From: Greg Kroah-Hartman Date: Thu, 16 Jan 2020 09:30:23 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.14.166~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4419e86933d09fabbdb49049aa9cbc407a40e92f;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: bpf-make-use-of-probe_user_write-in-probe-write-helper.patch bpf-skmsg-fix-potential-psock-null-pointer-dereference.patch bpf-support-pre-2.25-binutils-objcopy-for-vmlinux-btf.patch libbpf-fix-makefile-libbpf-symbol-mismatch-diagnostic.patch rdma-counter-prevent-qp-counter-manual-binding-in-auto-mode.patch rdma-hns-bugfix-for-qpc-cqc-timer-configuration.patch rdma-hns-fix-build-error-again.patch rdma-hns-fix-to-support-64k-page-for-srq.patch rdma-hns-modify-return-value-of-restrack-functions.patch rdma-hns-prevent-undefined-behavior-in-hns_roce_set_user_sq_size.patch rdma-hns-release-qp-resources-when-failed-to-destroy-qp.patch rdma-hns-remove-a-redundant-le16_to_cpu.patch rdma-mlx5-return-proper-error-value.patch rdma-remove-nes-abi-header.patch rdma-siw-fix-port-number-endianness-in-a-debug-message.patch rdma-srpt-report-the-scsi-residual-to-the-initiator.patch xprtrdma-add-unique-trace-points-for-posting-local-invalidate-wrs.patch xprtrdma-close-window-between-waking-rpc-senders-and-posting-receives.patch xprtrdma-connection-becomes-unstable-after-a-reconnect.patch xprtrdma-fix-mr-list-handling.patch --- diff --git a/queue-5.4/bpf-make-use-of-probe_user_write-in-probe-write-helper.patch b/queue-5.4/bpf-make-use-of-probe_user_write-in-probe-write-helper.patch new file mode 100644 index 00000000000..b8b92596e3f --- /dev/null +++ b/queue-5.4/bpf-make-use-of-probe_user_write-in-probe-write-helper.patch @@ -0,0 +1,49 @@ +From eb1b66887472eaa7342305b7890ae510dd9d1a79 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Sat, 2 Nov 2019 00:17:58 +0100 +Subject: bpf: Make use of probe_user_write in probe write helper + +From: Daniel Borkmann + +commit eb1b66887472eaa7342305b7890ae510dd9d1a79 upstream. + +Convert the bpf_probe_write_user() helper to probe_user_write() such that +writes are not attempted under KERNEL_DS anymore which is buggy as kernel +and user space pointers can have overlapping addresses. Also, given we have +the access_ok() check inside probe_user_write(), the helper doesn't need +to do it twice. + +Fixes: 96ae52279594 ("bpf: Add bpf_probe_write_user BPF helper to be called in tracers") +Signed-off-by: Daniel Borkmann +Signed-off-by: Alexei Starovoitov +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/841c461781874c07a0ee404a454c3bc0459eed30.1572649915.git.daniel@iogearbox.net +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/bpf_trace.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -163,7 +163,7 @@ static const struct bpf_func_proto bpf_p + .arg3_type = ARG_ANYTHING, + }; + +-BPF_CALL_3(bpf_probe_write_user, void *, unsafe_ptr, const void *, src, ++BPF_CALL_3(bpf_probe_write_user, void __user *, unsafe_ptr, const void *, src, + u32, size) + { + /* +@@ -186,10 +186,8 @@ BPF_CALL_3(bpf_probe_write_user, void *, + return -EPERM; + if (unlikely(!nmi_uaccess_okay())) + return -EPERM; +- if (!access_ok(unsafe_ptr, size)) +- return -EPERM; + +- return probe_kernel_write(unsafe_ptr, src, size); ++ return probe_user_write(unsafe_ptr, src, size); + } + + static const struct bpf_func_proto bpf_probe_write_user_proto = { diff --git a/queue-5.4/bpf-skmsg-fix-potential-psock-null-pointer-dereference.patch b/queue-5.4/bpf-skmsg-fix-potential-psock-null-pointer-dereference.patch new file mode 100644 index 00000000000..80b925ca500 --- /dev/null +++ b/queue-5.4/bpf-skmsg-fix-potential-psock-null-pointer-dereference.patch @@ -0,0 +1,62 @@ +From 8163999db445021f2651a8a47b5632483e8722ea Mon Sep 17 00:00:00 2001 +From: John Fastabend +Date: Thu, 21 Nov 2019 08:25:09 -0800 +Subject: bpf: skmsg, fix potential psock NULL pointer dereference + +From: John Fastabend + +commit 8163999db445021f2651a8a47b5632483e8722ea upstream. + +Report from Dan Carpenter, + + net/core/skmsg.c:792 sk_psock_write_space() + error: we previously assumed 'psock' could be null (see line 790) + + net/core/skmsg.c + 789 psock = sk_psock(sk); + 790 if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))) + Check for NULL + 791 schedule_work(&psock->work); + 792 write_space = psock->saved_write_space; + ^^^^^^^^^^^^^^^^^^^^^^^^ + 793 rcu_read_unlock(); + 794 write_space(sk); + +Ensure psock dereference on line 792 only occurs if psock is not null. + +Reported-by: Dan Carpenter +Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: John Fastabend +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/skmsg.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -793,15 +793,18 @@ static void sk_psock_strp_data_ready(str + static void sk_psock_write_space(struct sock *sk) + { + struct sk_psock *psock; +- void (*write_space)(struct sock *sk); ++ void (*write_space)(struct sock *sk) = NULL; + + rcu_read_lock(); + psock = sk_psock(sk); +- if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))) +- schedule_work(&psock->work); +- write_space = psock->saved_write_space; ++ if (likely(psock)) { ++ if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) ++ schedule_work(&psock->work); ++ write_space = psock->saved_write_space; ++ } + rcu_read_unlock(); +- write_space(sk); ++ if (write_space) ++ write_space(sk); + } + + int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock) diff --git a/queue-5.4/bpf-support-pre-2.25-binutils-objcopy-for-vmlinux-btf.patch b/queue-5.4/bpf-support-pre-2.25-binutils-objcopy-for-vmlinux-btf.patch new file mode 100644 index 00000000000..7c4a5ed5c6c --- /dev/null +++ b/queue-5.4/bpf-support-pre-2.25-binutils-objcopy-for-vmlinux-btf.patch @@ -0,0 +1,62 @@ +From da5fb18225b49b97bb37c51bcbbb2990a507c364 Mon Sep 17 00:00:00 2001 +From: Stanislav Fomichev +Date: Wed, 27 Nov 2019 08:14:10 -0800 +Subject: bpf: Support pre-2.25-binutils objcopy for vmlinux BTF + +From: Stanislav Fomichev + +commit da5fb18225b49b97bb37c51bcbbb2990a507c364 upstream. + +If vmlinux BTF generation fails, but CONFIG_DEBUG_INFO_BTF is set, +.BTF section of vmlinux is empty and kernel will prohibit +BPF loading and return "in-kernel BTF is malformed". + +--dump-section argument to binutils' objcopy was added in version 2.25. +When using pre-2.25 binutils, BTF generation silently fails. Convert +to --only-section which is present on pre-2.25 binutils. + +Documentation/process/changes.rst states that binutils 2.21+ +is supported, not sure those standards apply to BPF subsystem. + +v2: +* exit and print an error if gen_btf fails (John Fastabend) + +v3: +* resend with Andrii's Acked-by/Tested-by tags + +Fixes: 341dfcf8d78ea ("btf: expose BTF info through sysfs") +Signed-off-by: Stanislav Fomichev +Signed-off-by: Alexei Starovoitov +Tested-by: Andrii Nakryiko +Acked-by: Andrii Nakryiko +Cc: John Fastabend +Link: https://lore.kernel.org/bpf/20191127161410.57327-1-sdf@google.com +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/link-vmlinux.sh | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/scripts/link-vmlinux.sh ++++ b/scripts/link-vmlinux.sh +@@ -127,7 +127,8 @@ gen_btf() + cut -d, -f1 | cut -d' ' -f2) + bin_format=$(LANG=C ${OBJDUMP} -f ${1} | grep 'file format' | \ + awk '{print $4}') +- ${OBJCOPY} --dump-section .BTF=.btf.vmlinux.bin ${1} 2>/dev/null ++ ${OBJCOPY} --set-section-flags .BTF=alloc -O binary \ ++ --only-section=.BTF ${1} .btf.vmlinux.bin 2>/dev/null + ${OBJCOPY} -I binary -O ${bin_format} -B ${bin_arch} \ + --rename-section .data=.BTF .btf.vmlinux.bin ${2} + } +@@ -253,6 +254,10 @@ btf_vmlinux_bin_o="" + if [ -n "${CONFIG_DEBUG_INFO_BTF}" ]; then + if gen_btf .tmp_vmlinux.btf .btf.vmlinux.bin.o ; then + btf_vmlinux_bin_o=.btf.vmlinux.bin.o ++ else ++ echo >&2 "Failed to generate BTF for vmlinux" ++ echo >&2 "Try to disable CONFIG_DEBUG_INFO_BTF" ++ exit 1 + fi + fi + diff --git a/queue-5.4/libbpf-fix-makefile-libbpf-symbol-mismatch-diagnostic.patch b/queue-5.4/libbpf-fix-makefile-libbpf-symbol-mismatch-diagnostic.patch new file mode 100644 index 00000000000..501ffaaf950 --- /dev/null +++ b/queue-5.4/libbpf-fix-makefile-libbpf-symbol-mismatch-diagnostic.patch @@ -0,0 +1,34 @@ +From b568405856906ee4d9ba6284fd36f2928653a623 Mon Sep 17 00:00:00 2001 +From: Andrii Nakryiko +Date: Wed, 27 Nov 2019 12:01:34 -0800 +Subject: libbpf: Fix Makefile' libbpf symbol mismatch diagnostic + +From: Andrii Nakryiko + +commit b568405856906ee4d9ba6284fd36f2928653a623 upstream. + +Fix Makefile's diagnostic diff output when there is LIBBPF_API-versioned +symbols mismatch. + +Fixes: 1bd63524593b ("libbpf: handle symbol versioning properly for libbpf.a") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20191127200134.1360660-1-andriin@fb.com +Signed-off-by: Greg Kroah-Hartman + +--- + tools/lib/bpf/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/lib/bpf/Makefile ++++ b/tools/lib/bpf/Makefile +@@ -215,7 +215,7 @@ check_abi: $(OUTPUT)libbpf.so + "versioned symbols in $^ ($(VERSIONED_SYM_COUNT))." \ + "Please make sure all LIBBPF_API symbols are" \ + "versioned in $(VERSION_SCRIPT)." >&2; \ +- readelf -s --wide $(OUTPUT)libbpf-in.o | \ ++ readelf -s --wide $(BPF_IN_SHARED) | \ + cut -d "@" -f1 | sed 's/_v[0-9]_[0-9]_[0-9].*//' | \ + awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$8}'| \ + sort -u > $(OUTPUT)libbpf_global_syms.tmp; \ diff --git a/queue-5.4/rdma-counter-prevent-qp-counter-manual-binding-in-auto-mode.patch b/queue-5.4/rdma-counter-prevent-qp-counter-manual-binding-in-auto-mode.patch new file mode 100644 index 00000000000..dc76ec4aba2 --- /dev/null +++ b/queue-5.4/rdma-counter-prevent-qp-counter-manual-binding-in-auto-mode.patch @@ -0,0 +1,64 @@ +From 663912a6378a34fd4f43b8d873f0c6c6322d9d0e Mon Sep 17 00:00:00 2001 +From: Mark Zhang +Date: Mon, 16 Sep 2019 10:11:52 +0300 +Subject: RDMA/counter: Prevent QP counter manual binding in auto mode + +From: Mark Zhang + +commit 663912a6378a34fd4f43b8d873f0c6c6322d9d0e upstream. + +If auto mode is configured, manual counter allocation and QP bind is not +allowed. + +Fixes: 1bd8e0a9d0fd ("RDMA/counter: Allow manual mode configuration support") +Link: https://lore.kernel.org/r/20190916071154.20383-3-leon@kernel.org +Signed-off-by: Mark Zhang +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/counters.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/core/counters.c ++++ b/drivers/infiniband/core/counters.c +@@ -466,10 +466,15 @@ static struct rdma_counter *rdma_get_cou + int rdma_counter_bind_qpn(struct ib_device *dev, u8 port, + u32 qp_num, u32 counter_id) + { ++ struct rdma_port_counter *port_counter; + struct rdma_counter *counter; + struct ib_qp *qp; + int ret; + ++ port_counter = &dev->port_data[port].port_counter; ++ if (port_counter->mode.mode == RDMA_COUNTER_MODE_AUTO) ++ return -EINVAL; ++ + qp = rdma_counter_get_qp(dev, qp_num); + if (!qp) + return -ENOENT; +@@ -506,6 +511,7 @@ err: + int rdma_counter_bind_qpn_alloc(struct ib_device *dev, u8 port, + u32 qp_num, u32 *counter_id) + { ++ struct rdma_port_counter *port_counter; + struct rdma_counter *counter; + struct ib_qp *qp; + int ret; +@@ -513,9 +519,13 @@ int rdma_counter_bind_qpn_alloc(struct i + if (!rdma_is_port_valid(dev, port)) + return -EINVAL; + +- if (!dev->port_data[port].port_counter.hstats) ++ port_counter = &dev->port_data[port].port_counter; ++ if (!port_counter->hstats) + return -EOPNOTSUPP; + ++ if (port_counter->mode.mode == RDMA_COUNTER_MODE_AUTO) ++ return -EINVAL; ++ + qp = rdma_counter_get_qp(dev, qp_num); + if (!qp) + return -ENOENT; diff --git a/queue-5.4/rdma-hns-bugfix-for-qpc-cqc-timer-configuration.patch b/queue-5.4/rdma-hns-bugfix-for-qpc-cqc-timer-configuration.patch new file mode 100644 index 00000000000..fe37a1651c4 --- /dev/null +++ b/queue-5.4/rdma-hns-bugfix-for-qpc-cqc-timer-configuration.patch @@ -0,0 +1,37 @@ +From 887803db866a7a4e1817a3cb8a3eee4e9879fed2 Mon Sep 17 00:00:00 2001 +From: Yangyang Li +Date: Thu, 24 Oct 2019 17:21:57 +0800 +Subject: RDMA/hns: Bugfix for qpc/cqc timer configuration + +From: Yangyang Li + +commit 887803db866a7a4e1817a3cb8a3eee4e9879fed2 upstream. + +qpc/cqc timer entry size needs one page, but currently they are fixedly +configured to 4096, which is not appropriate in 64K page scenarios. So +they should be modified to PAGE_SIZE. + +Fixes: 0e40dc2f70cd ("RDMA/hns: Add timer allocation support for hip08") +Link: https://lore.kernel.org/r/1571908917-16220-3-git-send-email-liweihang@hisilicon.com +Signed-off-by: Yangyang Li +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +@@ -87,8 +87,8 @@ + #define HNS_ROCE_V2_MTT_ENTRY_SZ 64 + #define HNS_ROCE_V2_CQE_ENTRY_SIZE 32 + #define HNS_ROCE_V2_SCCC_ENTRY_SZ 32 +-#define HNS_ROCE_V2_QPC_TIMER_ENTRY_SZ 4096 +-#define HNS_ROCE_V2_CQC_TIMER_ENTRY_SZ 4096 ++#define HNS_ROCE_V2_QPC_TIMER_ENTRY_SZ PAGE_SIZE ++#define HNS_ROCE_V2_CQC_TIMER_ENTRY_SZ PAGE_SIZE + #define HNS_ROCE_V2_PAGE_SIZE_SUPPORTED 0xFFFFF000 + #define HNS_ROCE_V2_MAX_INNER_MTPT_NUM 2 + #define HNS_ROCE_INVALID_LKEY 0x100 diff --git a/queue-5.4/rdma-hns-fix-build-error-again.patch b/queue-5.4/rdma-hns-fix-build-error-again.patch new file mode 100644 index 00000000000..3968c1e99b2 --- /dev/null +++ b/queue-5.4/rdma-hns-fix-build-error-again.patch @@ -0,0 +1,94 @@ +From d5b60e26e86a463ca83bb5ec502dda6ea685159e Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 7 Oct 2019 23:18:08 +0200 +Subject: RDMA/hns: Fix build error again + +From: Arnd Bergmann + +commit d5b60e26e86a463ca83bb5ec502dda6ea685159e upstream. + +This is not the first attempt to fix building random configurations, +unfortunately the attempt in commit a07fc0bb483e ("RDMA/hns: Fix build +error") caused a new problem when CONFIG_INFINIBAND_HNS_HIP06=m and +CONFIG_INFINIBAND_HNS_HIP08=y: + +drivers/infiniband/hw/hns/hns_roce_main.o:(.rodata+0xe60): undefined reference to `__this_module' + +Revert commits a07fc0bb483e ("RDMA/hns: Fix build error") and +a3e2d4c7e766 ("RDMA/hns: remove obsolete Kconfig comment") to get back to +the previous state, then fix the issues described there differently, by +adding more specific dependencies: INFINIBAND_HNS can now only be built-in +if at least one of HNS or HNS3 are built-in, and the individual back-ends +are only available if that code is reachable from the main driver. + +Fixes: a07fc0bb483e ("RDMA/hns: Fix build error") +Fixes: a3e2d4c7e766 ("RDMA/hns: remove obsolete Kconfig comment") +Fixes: dd74282df573 ("RDMA/hns: Initialize the PCI device for hip08 RoCE") +Fixes: 08805fdbeb2d ("RDMA/hns: Split hw v1 driver from hns roce driver") +Link: https://lore.kernel.org/r/20191007211826.3361202-1-arnd@arndb.de +Signed-off-by: Arnd Bergmann +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hns/Kconfig | 17 ++++++++++++++--- + drivers/infiniband/hw/hns/Makefile | 8 ++++++-- + 2 files changed, 20 insertions(+), 5 deletions(-) + +--- a/drivers/infiniband/hw/hns/Kconfig ++++ b/drivers/infiniband/hw/hns/Kconfig +@@ -1,23 +1,34 @@ + # SPDX-License-Identifier: GPL-2.0-only + config INFINIBAND_HNS +- bool "HNS RoCE Driver" ++ tristate "HNS RoCE Driver" + depends on NET_VENDOR_HISILICON + depends on ARM64 || (COMPILE_TEST && 64BIT) ++ depends on (HNS_DSAF && HNS_ENET) || HNS3 + ---help--- + This is a RoCE/RDMA driver for the Hisilicon RoCE engine. The engine + is used in Hisilicon Hip06 and more further ICT SoC based on + platform device. + ++ To compile HIP06 or HIP08 driver as module, choose M here. ++ + config INFINIBAND_HNS_HIP06 +- tristate "Hisilicon Hip06 Family RoCE support" ++ bool "Hisilicon Hip06 Family RoCE support" + depends on INFINIBAND_HNS && HNS && HNS_DSAF && HNS_ENET ++ depends on INFINIBAND_HNS=m || (HNS_DSAF=y && HNS_ENET=y) + ---help--- + RoCE driver support for Hisilicon RoCE engine in Hisilicon Hip06 and + Hip07 SoC. These RoCE engines are platform devices. + ++ To compile this driver, choose Y here: if INFINIBAND_HNS is m, this ++ module will be called hns-roce-hw-v1 ++ + config INFINIBAND_HNS_HIP08 +- tristate "Hisilicon Hip08 Family RoCE support" ++ bool "Hisilicon Hip08 Family RoCE support" + depends on INFINIBAND_HNS && PCI && HNS3 ++ depends on INFINIBAND_HNS=m || HNS3=y + ---help--- + RoCE driver support for Hisilicon RoCE engine in Hisilicon Hip08 SoC. + The RoCE engine is a PCI device. ++ ++ To compile this driver, choose Y here: if INFINIBAND_HNS is m, this ++ module will be called hns-roce-hw-v2. +--- a/drivers/infiniband/hw/hns/Makefile ++++ b/drivers/infiniband/hw/hns/Makefile +@@ -9,8 +9,12 @@ hns-roce-objs := hns_roce_main.o hns_roc + hns_roce_ah.o hns_roce_hem.o hns_roce_mr.o hns_roce_qp.o \ + hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o + ++ifdef CONFIG_INFINIBAND_HNS_HIP06 + hns-roce-hw-v1-objs := hns_roce_hw_v1.o $(hns-roce-objs) +-obj-$(CONFIG_INFINIBAND_HNS_HIP06) += hns-roce-hw-v1.o ++obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v1.o ++endif + ++ifdef CONFIG_INFINIBAND_HNS_HIP08 + hns-roce-hw-v2-objs := hns_roce_hw_v2.o hns_roce_hw_v2_dfx.o $(hns-roce-objs) +-obj-$(CONFIG_INFINIBAND_HNS_HIP08) += hns-roce-hw-v2.o ++obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v2.o ++endif diff --git a/queue-5.4/rdma-hns-fix-to-support-64k-page-for-srq.patch b/queue-5.4/rdma-hns-fix-to-support-64k-page-for-srq.patch new file mode 100644 index 00000000000..91ec669ec80 --- /dev/null +++ b/queue-5.4/rdma-hns-fix-to-support-64k-page-for-srq.patch @@ -0,0 +1,39 @@ +From 5c7e76fb7cb5071be800c938ebf2c475e140d3f0 Mon Sep 17 00:00:00 2001 +From: Lijun Ou +Date: Thu, 24 Oct 2019 17:21:56 +0800 +Subject: RDMA/hns: Fix to support 64K page for srq + +From: Lijun Ou + +commit 5c7e76fb7cb5071be800c938ebf2c475e140d3f0 upstream. + +SRQ's page size configuration of BA and buffer should depend on current +PAGE_SHIFT, or it can't work in scenario of 64K page. + +Fixes: c7bcb13442e1 ("RDMA/hns: Add SRQ support for hip08 kernel mode") +Link: https://lore.kernel.org/r/1571908917-16220-2-git-send-email-liweihang@hisilicon.com +Signed-off-by: Lijun Ou +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -6088,11 +6088,11 @@ static void hns_roce_v2_write_srqc(struc + roce_set_field(srq_context->byte_44_idxbufpgsz_addr, + SRQC_BYTE_44_SRQ_IDX_BA_PG_SZ_M, + SRQC_BYTE_44_SRQ_IDX_BA_PG_SZ_S, +- hr_dev->caps.idx_ba_pg_sz); ++ hr_dev->caps.idx_ba_pg_sz + PG_SHIFT_OFFSET); + roce_set_field(srq_context->byte_44_idxbufpgsz_addr, + SRQC_BYTE_44_SRQ_IDX_BUF_PG_SZ_M, + SRQC_BYTE_44_SRQ_IDX_BUF_PG_SZ_S, +- hr_dev->caps.idx_buf_pg_sz); ++ hr_dev->caps.idx_buf_pg_sz + PG_SHIFT_OFFSET); + + srq_context->idx_nxt_blk_addr = + cpu_to_le32(mtts_idx[1] >> PAGE_ADDR_SHIFT); diff --git a/queue-5.4/rdma-hns-modify-return-value-of-restrack-functions.patch b/queue-5.4/rdma-hns-modify-return-value-of-restrack-functions.patch new file mode 100644 index 00000000000..f6a87a6dc06 --- /dev/null +++ b/queue-5.4/rdma-hns-modify-return-value-of-restrack-functions.patch @@ -0,0 +1,34 @@ +From cfd82da4e741c16d71a12123bf0cb585af2b8796 Mon Sep 17 00:00:00 2001 +From: Lang Cheng +Date: Wed, 4 Sep 2019 11:14:44 +0800 +Subject: RDMA/hns: Modify return value of restrack functions + +From: Lang Cheng + +commit cfd82da4e741c16d71a12123bf0cb585af2b8796 upstream. + +The restrack function return EINVAL instead of EMSGSIZE when the driver +operation fails. + +Fixes: 4b42d05d0b2c ("RDMA/hns: Remove unnecessary kzalloc") +Signed-off-by: Lang Cheng +Signed-off-by: Weihang Li +Link: https://lore.kernel.org/r/1567566885-23088-5-git-send-email-liweihang@hisilicon.com +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hns/hns_roce_restrack.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/hns/hns_roce_restrack.c ++++ b/drivers/infiniband/hw/hns/hns_roce_restrack.c +@@ -95,7 +95,7 @@ static int hns_roce_fill_res_cq_entry(st + + ret = hr_dev->dfx->query_cqc_info(hr_dev, hr_cq->cqn, (int *)context); + if (ret) +- goto err; ++ return -EINVAL; + + table_attr = nla_nest_start(msg, RDMA_NLDEV_ATTR_DRIVER); + if (!table_attr) { diff --git a/queue-5.4/rdma-hns-prevent-undefined-behavior-in-hns_roce_set_user_sq_size.patch b/queue-5.4/rdma-hns-prevent-undefined-behavior-in-hns_roce_set_user_sq_size.patch new file mode 100644 index 00000000000..1aaf6f90e9d --- /dev/null +++ b/queue-5.4/rdma-hns-prevent-undefined-behavior-in-hns_roce_set_user_sq_size.patch @@ -0,0 +1,57 @@ +From 515f60004ed985d2b2f03659365752e0b6142986 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Sat, 8 Jun 2019 12:25:14 +0300 +Subject: RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size() + +From: Jason Gunthorpe + +commit 515f60004ed985d2b2f03659365752e0b6142986 upstream. + +The "ucmd->log_sq_bb_count" variable is a user controlled variable in the +0-255 range. If we shift more than then number of bits in an int then +it's undefined behavior (it shift wraps), and potentially the int could +become negative. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Link: https://lore.kernel.org/r/20190608092514.GC28890@mwanda +Reported-by: Dan Carpenter +Signed-off-by: Jason Gunthorpe +Reviewed-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hns/hns_roce_qp.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -332,9 +332,8 @@ static int check_sq_size_with_integrity( + u8 max_sq_stride = ilog2(roundup_sq_stride); + + /* Sanity check SQ size before proceeding */ +- if ((u32)(1 << ucmd->log_sq_bb_count) > hr_dev->caps.max_wqes || +- ucmd->log_sq_stride > max_sq_stride || +- ucmd->log_sq_stride < HNS_ROCE_IB_MIN_SQ_STRIDE) { ++ if (ucmd->log_sq_stride > max_sq_stride || ++ ucmd->log_sq_stride < HNS_ROCE_IB_MIN_SQ_STRIDE) { + ibdev_err(&hr_dev->ib_dev, "check SQ size error!\n"); + return -EINVAL; + } +@@ -358,13 +357,16 @@ static int hns_roce_set_user_sq_size(str + u32 max_cnt; + int ret; + ++ if (check_shl_overflow(1, ucmd->log_sq_bb_count, &hr_qp->sq.wqe_cnt) || ++ hr_qp->sq.wqe_cnt > hr_dev->caps.max_wqes) ++ return -EINVAL; ++ + ret = check_sq_size_with_integrity(hr_dev, cap, ucmd); + if (ret) { + ibdev_err(&hr_dev->ib_dev, "Sanity check sq size failed\n"); + return ret; + } + +- hr_qp->sq.wqe_cnt = 1 << ucmd->log_sq_bb_count; + hr_qp->sq.wqe_shift = ucmd->log_sq_stride; + + max_cnt = max(1U, cap->max_send_sge); diff --git a/queue-5.4/rdma-hns-release-qp-resources-when-failed-to-destroy-qp.patch b/queue-5.4/rdma-hns-release-qp-resources-when-failed-to-destroy-qp.patch new file mode 100644 index 00000000000..ffb63ea6e7d --- /dev/null +++ b/queue-5.4/rdma-hns-release-qp-resources-when-failed-to-destroy-qp.patch @@ -0,0 +1,66 @@ +From d302c6e3a6895608a5856bc708c47bda1770b24d Mon Sep 17 00:00:00 2001 +From: Yangyang Li +Date: Wed, 9 Oct 2019 09:21:50 +0800 +Subject: RDMA/hns: Release qp resources when failed to destroy qp + +From: Yangyang Li + +commit d302c6e3a6895608a5856bc708c47bda1770b24d upstream. + +Even if no response from hardware, we should make sure that qp related +resources are released to avoid memory leaks. + +Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC") +Signed-off-by: Yangyang Li +Signed-off-by: Weihang Li +Link: https://lore.kernel.org/r/1570584110-3659-1-git-send-email-liweihang@hisilicon.com +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -4650,16 +4650,14 @@ static int hns_roce_v2_destroy_qp_common + { + struct hns_roce_cq *send_cq, *recv_cq; + struct ib_device *ibdev = &hr_dev->ib_dev; +- int ret; ++ int ret = 0; + + if (hr_qp->ibqp.qp_type == IB_QPT_RC && hr_qp->state != IB_QPS_RESET) { + /* Modify qp to reset before destroying qp */ + ret = hns_roce_v2_modify_qp(&hr_qp->ibqp, NULL, 0, + hr_qp->state, IB_QPS_RESET); +- if (ret) { ++ if (ret) + ibdev_err(ibdev, "modify QP to Reset failed.\n"); +- return ret; +- } + } + + send_cq = to_hr_cq(hr_qp->ibqp.send_cq); +@@ -4715,7 +4713,7 @@ static int hns_roce_v2_destroy_qp_common + kfree(hr_qp->rq_inl_buf.wqe_list); + } + +- return 0; ++ return ret; + } + + static int hns_roce_v2_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) +@@ -4725,11 +4723,9 @@ static int hns_roce_v2_destroy_qp(struct + int ret; + + ret = hns_roce_v2_destroy_qp_common(hr_dev, hr_qp, udata); +- if (ret) { ++ if (ret) + ibdev_err(&hr_dev->ib_dev, "Destroy qp 0x%06lx failed(%d)\n", + hr_qp->qpn, ret); +- return ret; +- } + + if (hr_qp->ibqp.qp_type == IB_QPT_GSI) + kfree(hr_to_hr_sqp(hr_qp)); diff --git a/queue-5.4/rdma-hns-remove-a-redundant-le16_to_cpu.patch b/queue-5.4/rdma-hns-remove-a-redundant-le16_to_cpu.patch new file mode 100644 index 00000000000..f46089d4b10 --- /dev/null +++ b/queue-5.4/rdma-hns-remove-a-redundant-le16_to_cpu.patch @@ -0,0 +1,33 @@ +From 9f7d7064009c37cb26eee4a83302cf077fe180d6 Mon Sep 17 00:00:00 2001 +From: Weihang Li +Date: Wed, 4 Sep 2019 11:14:41 +0800 +Subject: RDMA/hns: remove a redundant le16_to_cpu + +From: Weihang Li + +commit 9f7d7064009c37cb26eee4a83302cf077fe180d6 upstream. + +Type of ah->av.vlan is u16, there will be a problem using le16_to_cpu +on it. + +Fixes: 82e620d9c3a0 ("RDMA/hns: Modify the data structure of hns_roce_av") +Signed-off-by: Weihang Li +Link: https://lore.kernel.org/r/1567566885-23088-2-git-send-email-liweihang@hisilicon.com +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -389,7 +389,7 @@ static int hns_roce_v2_post_send(struct + roce_set_field(ud_sq_wqe->byte_36, + V2_UD_SEND_WQE_BYTE_36_VLAN_M, + V2_UD_SEND_WQE_BYTE_36_VLAN_S, +- le16_to_cpu(ah->av.vlan)); ++ ah->av.vlan); + roce_set_field(ud_sq_wqe->byte_36, + V2_UD_SEND_WQE_BYTE_36_HOPLIMIT_M, + V2_UD_SEND_WQE_BYTE_36_HOPLIMIT_S, diff --git a/queue-5.4/rdma-mlx5-return-proper-error-value.patch b/queue-5.4/rdma-mlx5-return-proper-error-value.patch new file mode 100644 index 00000000000..60cc8401361 --- /dev/null +++ b/queue-5.4/rdma-mlx5-return-proper-error-value.patch @@ -0,0 +1,35 @@ +From 546d30099ed204792083f043cd7e016de86016a3 Mon Sep 17 00:00:00 2001 +From: Leon Romanovsky +Date: Tue, 29 Oct 2019 07:57:21 +0200 +Subject: RDMA/mlx5: Return proper error value + +From: Leon Romanovsky + +commit 546d30099ed204792083f043cd7e016de86016a3 upstream. + +Returned value from mlx5_mr_cache_alloc() is checked to be error or real +pointer. Return proper error code instead of NULL which is not checked +later. + +Fixes: 81713d3788d2 ("IB/mlx5: Add implicit MR support") +Link: https://lore.kernel.org/r/20191029055721.7192-1-leon@kernel.org +Signed-off-by: Leon Romanovsky +Reviewed-by: Jason Gunthorpe +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/mr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -428,7 +428,7 @@ struct mlx5_ib_mr *mlx5_mr_cache_alloc(s + + if (entry < 0 || entry >= MAX_MR_CACHE_ENTRIES) { + mlx5_ib_err(dev, "cache entry %d is out of range\n", entry); +- return NULL; ++ return ERR_PTR(-EINVAL); + } + + ent = &cache->ent[entry]; diff --git a/queue-5.4/rdma-remove-nes-abi-header.patch b/queue-5.4/rdma-remove-nes-abi-header.patch new file mode 100644 index 00000000000..5bc1ff854ff --- /dev/null +++ b/queue-5.4/rdma-remove-nes-abi-header.patch @@ -0,0 +1,138 @@ +From 949b452f9cfef17e78055239f978d95ba729eee1 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Thu, 24 Oct 2019 13:51:03 +0000 +Subject: rdma: Remove nes ABI header + +From: Jason Gunthorpe + +commit 949b452f9cfef17e78055239f978d95ba729eee1 upstream. + +This was missed when nes was removed. + +Fixes: 2d3c72ed5041 ("rdma: Remove nes") +Link: https://lore.kernel.org/r/20191024135059.GA20084@ziepe.ca +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + include/uapi/rdma/nes-abi.h | 115 -------------------------------------------- + 1 file changed, 115 deletions(-) + +--- a/include/uapi/rdma/nes-abi.h ++++ /dev/null +@@ -1,115 +0,0 @@ +-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */ +-/* +- * Copyright (c) 2006 - 2011 Intel Corporation. All rights reserved. +- * Copyright (c) 2005 Topspin Communications. All rights reserved. +- * Copyright (c) 2005 Cisco Systems. All rights reserved. +- * Copyright (c) 2005 Open Grid Computing, Inc. All rights reserved. +- * +- * This software is available to you under a choice of one of two +- * licenses. You may choose to be licensed under the terms of the GNU +- * General Public License (GPL) Version 2, available from the file +- * COPYING in the main directory of this source tree, or the +- * OpenIB.org BSD license below: +- * +- * Redistribution and use in source and binary forms, with or +- * without modification, are permitted provided that the following +- * conditions are met: +- * +- * - Redistributions of source code must retain the above +- * copyright notice, this list of conditions and the following +- * disclaimer. +- * +- * - Redistributions in binary form must reproduce the above +- * copyright notice, this list of conditions and the following +- * disclaimer in the documentation and/or other materials +- * provided with the distribution. +- * +- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS +- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN +- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +- * SOFTWARE. +- * +- */ +- +-#ifndef NES_ABI_USER_H +-#define NES_ABI_USER_H +- +-#include +- +-#define NES_ABI_USERSPACE_VER 2 +-#define NES_ABI_KERNEL_VER 2 +- +-/* +- * Make sure that all structs defined in this file remain laid out so +- * that they pack the same way on 32-bit and 64-bit architectures (to +- * avoid incompatibility between 32-bit userspace and 64-bit kernels). +- * In particular do not use pointer types -- pass pointers in __u64 +- * instead. +- */ +- +-struct nes_alloc_ucontext_req { +- __u32 reserved32; +- __u8 userspace_ver; +- __u8 reserved8[3]; +-}; +- +-struct nes_alloc_ucontext_resp { +- __u32 max_pds; /* maximum pds allowed for this user process */ +- __u32 max_qps; /* maximum qps allowed for this user process */ +- __u32 wq_size; /* size of the WQs (sq+rq) allocated to the mmaped area */ +- __u8 virtwq; /* flag to indicate if virtual WQ are to be used or not */ +- __u8 kernel_ver; +- __u8 reserved[2]; +-}; +- +-struct nes_alloc_pd_resp { +- __u32 pd_id; +- __u32 mmap_db_index; +-}; +- +-struct nes_create_cq_req { +- __aligned_u64 user_cq_buffer; +- __u32 mcrqf; +- __u8 reserved[4]; +-}; +- +-struct nes_create_qp_req { +- __aligned_u64 user_wqe_buffers; +- __aligned_u64 user_qp_buffer; +-}; +- +-enum iwnes_memreg_type { +- IWNES_MEMREG_TYPE_MEM = 0x0000, +- IWNES_MEMREG_TYPE_QP = 0x0001, +- IWNES_MEMREG_TYPE_CQ = 0x0002, +- IWNES_MEMREG_TYPE_MW = 0x0003, +- IWNES_MEMREG_TYPE_FMR = 0x0004, +- IWNES_MEMREG_TYPE_FMEM = 0x0005, +-}; +- +-struct nes_mem_reg_req { +- __u32 reg_type; /* indicates if id is memory, QP or CQ */ +- __u32 reserved; +-}; +- +-struct nes_create_cq_resp { +- __u32 cq_id; +- __u32 cq_size; +- __u32 mmap_db_index; +- __u32 reserved; +-}; +- +-struct nes_create_qp_resp { +- __u32 qp_id; +- __u32 actual_sq_size; +- __u32 actual_rq_size; +- __u32 mmap_sq_db_index; +- __u32 mmap_rq_db_index; +- __u32 nes_drv_opt; +-}; +- +-#endif /* NES_ABI_USER_H */ diff --git a/queue-5.4/rdma-siw-fix-port-number-endianness-in-a-debug-message.patch b/queue-5.4/rdma-siw-fix-port-number-endianness-in-a-debug-message.patch new file mode 100644 index 00000000000..275de4f0b4b --- /dev/null +++ b/queue-5.4/rdma-siw-fix-port-number-endianness-in-a-debug-message.patch @@ -0,0 +1,41 @@ +From 050dbddf249eee3e936b5734c30b2e1b427efdc3 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Mon, 30 Sep 2019 16:16:56 -0700 +Subject: RDMA/siw: Fix port number endianness in a debug message + +From: Bart Van Assche + +commit 050dbddf249eee3e936b5734c30b2e1b427efdc3 upstream. + +sin_port and sin6_port are big endian member variables. Convert these port +numbers into CPU endianness before printing. + +Link: https://lore.kernel.org/r/20190930231707.48259-5-bvanassche@acm.org +Fixes: 6c52fdc244b5 ("rdma/siw: connection management") +Signed-off-by: Bart Van Assche +Reviewed-by: Bernard Metzler +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/sw/siw/siw_cm.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +--- a/drivers/infiniband/sw/siw/siw_cm.c ++++ b/drivers/infiniband/sw/siw/siw_cm.c +@@ -1867,14 +1867,7 @@ static int siw_listen_address(struct iw_ + list_add_tail(&cep->listenq, (struct list_head *)id->provider_data); + cep->state = SIW_EPSTATE_LISTENING; + +- if (addr_family == AF_INET) +- siw_dbg(id->device, "Listen at laddr %pI4 %u\n", +- &(((struct sockaddr_in *)laddr)->sin_addr), +- ((struct sockaddr_in *)laddr)->sin_port); +- else +- siw_dbg(id->device, "Listen at laddr %pI6 %u\n", +- &(((struct sockaddr_in6 *)laddr)->sin6_addr), +- ((struct sockaddr_in6 *)laddr)->sin6_port); ++ siw_dbg(id->device, "Listen at laddr %pISp\n", laddr); + + return 0; + diff --git a/queue-5.4/rdma-srpt-report-the-scsi-residual-to-the-initiator.patch b/queue-5.4/rdma-srpt-report-the-scsi-residual-to-the-initiator.patch new file mode 100644 index 00000000000..e3135e68127 --- /dev/null +++ b/queue-5.4/rdma-srpt-report-the-scsi-residual-to-the-initiator.patch @@ -0,0 +1,70 @@ +From e88982ad1bb12db699de96fbc07096359ef6176c Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Tue, 5 Nov 2019 13:46:32 -0800 +Subject: RDMA/srpt: Report the SCSI residual to the initiator + +From: Bart Van Assche + +commit e88982ad1bb12db699de96fbc07096359ef6176c upstream. + +The code added by this patch is similar to the code that already exists in +ibmvscsis_determine_resid(). This patch has been tested by running the +following command: + +strace sg_raw -r 1k /dev/sdb 12 00 00 00 60 00 -o inquiry.bin |& + grep resid= + +Link: https://lore.kernel.org/r/20191105214632.183302-1-bvanassche@acm.org +Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") +Signed-off-by: Bart Van Assche +Acked-by: Honggang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -1364,9 +1364,11 @@ static int srpt_build_cmd_rsp(struct srp + struct srpt_send_ioctx *ioctx, u64 tag, + int status) + { ++ struct se_cmd *cmd = &ioctx->cmd; + struct srp_rsp *srp_rsp; + const u8 *sense_data; + int sense_data_len, max_sense_len; ++ u32 resid = cmd->residual_count; + + /* + * The lowest bit of all SAM-3 status codes is zero (see also +@@ -1388,6 +1390,28 @@ static int srpt_build_cmd_rsp(struct srp + srp_rsp->tag = tag; + srp_rsp->status = status; + ++ if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) { ++ if (cmd->data_direction == DMA_TO_DEVICE) { ++ /* residual data from an underflow write */ ++ srp_rsp->flags = SRP_RSP_FLAG_DOUNDER; ++ srp_rsp->data_out_res_cnt = cpu_to_be32(resid); ++ } else if (cmd->data_direction == DMA_FROM_DEVICE) { ++ /* residual data from an underflow read */ ++ srp_rsp->flags = SRP_RSP_FLAG_DIUNDER; ++ srp_rsp->data_in_res_cnt = cpu_to_be32(resid); ++ } ++ } else if (cmd->se_cmd_flags & SCF_OVERFLOW_BIT) { ++ if (cmd->data_direction == DMA_TO_DEVICE) { ++ /* residual data from an overflow write */ ++ srp_rsp->flags = SRP_RSP_FLAG_DOOVER; ++ srp_rsp->data_out_res_cnt = cpu_to_be32(resid); ++ } else if (cmd->data_direction == DMA_FROM_DEVICE) { ++ /* residual data from an overflow read */ ++ srp_rsp->flags = SRP_RSP_FLAG_DIOVER; ++ srp_rsp->data_in_res_cnt = cpu_to_be32(resid); ++ } ++ } ++ + if (sense_data_len) { + BUILD_BUG_ON(MIN_MAX_RSP_SIZE <= sizeof(*srp_rsp)); + max_sense_len = ch->max_ti_iu_len - sizeof(*srp_rsp); diff --git a/queue-5.4/series b/queue-5.4/series index 8b7b1195f46..a5fe92de6b1 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -58,3 +58,23 @@ asoc-fsl_esai-add-spin-lock-to-protect-reset-stop-and-start.patch asoc-sof-intel-broadwell-clarify-mutual-exclusion-with-legacy-driver.patch asoc-core-fix-compile-warning-with-config_debug_fs-n.patch asoc-rsnd-fix-dalign-register-for-ssiu.patch +rdma-hns-prevent-undefined-behavior-in-hns_roce_set_user_sq_size.patch +rdma-hns-remove-a-redundant-le16_to_cpu.patch +rdma-hns-modify-return-value-of-restrack-functions.patch +rdma-counter-prevent-qp-counter-manual-binding-in-auto-mode.patch +rdma-siw-fix-port-number-endianness-in-a-debug-message.patch +rdma-hns-fix-build-error-again.patch +rdma-hns-release-qp-resources-when-failed-to-destroy-qp.patch +xprtrdma-add-unique-trace-points-for-posting-local-invalidate-wrs.patch +xprtrdma-connection-becomes-unstable-after-a-reconnect.patch +xprtrdma-fix-mr-list-handling.patch +xprtrdma-close-window-between-waking-rpc-senders-and-posting-receives.patch +rdma-hns-fix-to-support-64k-page-for-srq.patch +rdma-hns-bugfix-for-qpc-cqc-timer-configuration.patch +rdma-remove-nes-abi-header.patch +rdma-mlx5-return-proper-error-value.patch +rdma-srpt-report-the-scsi-residual-to-the-initiator.patch +bpf-make-use-of-probe_user_write-in-probe-write-helper.patch +bpf-skmsg-fix-potential-psock-null-pointer-dereference.patch +bpf-support-pre-2.25-binutils-objcopy-for-vmlinux-btf.patch +libbpf-fix-makefile-libbpf-symbol-mismatch-diagnostic.patch diff --git a/queue-5.4/xprtrdma-add-unique-trace-points-for-posting-local-invalidate-wrs.patch b/queue-5.4/xprtrdma-add-unique-trace-points-for-posting-local-invalidate-wrs.patch new file mode 100644 index 00000000000..f33ba441c7f --- /dev/null +++ b/queue-5.4/xprtrdma-add-unique-trace-points-for-posting-local-invalidate-wrs.patch @@ -0,0 +1,96 @@ +From 4b93dab36f28e673725e5e6123ebfccf7697f96a Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Wed, 9 Oct 2019 13:07:21 -0400 +Subject: xprtrdma: Add unique trace points for posting Local Invalidate WRs + +From: Chuck Lever + +commit 4b93dab36f28e673725e5e6123ebfccf7697f96a upstream. + +When adding frwr_unmap_async way back when, I re-used the existing +trace_xprtrdma_post_send() trace point to record the return code +of ib_post_send. + +Unfortunately there are some cases where re-using that trace point +causes a crash. Instead, construct a trace point specific to posting +Local Invalidate WRs that will always be safe to use in that context, +and will act as a trace log eye-catcher for Local Invalidation. + +Fixes: 847568942f93 ("xprtrdma: Remove fr_state") +Fixes: d8099feda483 ("xprtrdma: Reduce context switching due ... ") +Signed-off-by: Chuck Lever +Tested-by: Bill Baker +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + include/trace/events/rpcrdma.h | 25 +++++++++++++++++++++++++ + net/sunrpc/xprtrdma/frwr_ops.c | 4 ++-- + 2 files changed, 27 insertions(+), 2 deletions(-) + +--- a/include/trace/events/rpcrdma.h ++++ b/include/trace/events/rpcrdma.h +@@ -735,6 +735,31 @@ TRACE_EVENT(xprtrdma_post_recvs, + ) + ); + ++TRACE_EVENT(xprtrdma_post_linv, ++ TP_PROTO( ++ const struct rpcrdma_req *req, ++ int status ++ ), ++ ++ TP_ARGS(req, status), ++ ++ TP_STRUCT__entry( ++ __field(const void *, req) ++ __field(int, status) ++ __field(u32, xid) ++ ), ++ ++ TP_fast_assign( ++ __entry->req = req; ++ __entry->status = status; ++ __entry->xid = be32_to_cpu(req->rl_slot.rq_xid); ++ ), ++ ++ TP_printk("req=%p xid=0x%08x status=%d", ++ __entry->req, __entry->xid, __entry->status ++ ) ++); ++ + /** + ** Completion events + **/ +--- a/net/sunrpc/xprtrdma/frwr_ops.c ++++ b/net/sunrpc/xprtrdma/frwr_ops.c +@@ -570,7 +570,6 @@ void frwr_unmap_sync(struct rpcrdma_xprt + */ + bad_wr = NULL; + rc = ib_post_send(r_xprt->rx_ia.ri_id->qp, first, &bad_wr); +- trace_xprtrdma_post_send(req, rc); + + /* The final LOCAL_INV WR in the chain is supposed to + * do the wake. If it was never posted, the wake will +@@ -583,6 +582,7 @@ void frwr_unmap_sync(struct rpcrdma_xprt + + /* Recycle MRs in the LOCAL_INV chain that did not get posted. + */ ++ trace_xprtrdma_post_linv(req, rc); + while (bad_wr) { + frwr = container_of(bad_wr, struct rpcrdma_frwr, + fr_invwr); +@@ -673,12 +673,12 @@ void frwr_unmap_async(struct rpcrdma_xpr + */ + bad_wr = NULL; + rc = ib_post_send(r_xprt->rx_ia.ri_id->qp, first, &bad_wr); +- trace_xprtrdma_post_send(req, rc); + if (!rc) + return; + + /* Recycle MRs in the LOCAL_INV chain that did not get posted. + */ ++ trace_xprtrdma_post_linv(req, rc); + while (bad_wr) { + frwr = container_of(bad_wr, struct rpcrdma_frwr, fr_invwr); + mr = container_of(frwr, struct rpcrdma_mr, frwr); diff --git a/queue-5.4/xprtrdma-close-window-between-waking-rpc-senders-and-posting-receives.patch b/queue-5.4/xprtrdma-close-window-between-waking-rpc-senders-and-posting-receives.patch new file mode 100644 index 00000000000..e20ca733347 --- /dev/null +++ b/queue-5.4/xprtrdma-close-window-between-waking-rpc-senders-and-posting-receives.patch @@ -0,0 +1,90 @@ +From 2ae50ad68cd79224198b525f7bd645c9da98b6ff Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Wed, 9 Oct 2019 13:07:38 -0400 +Subject: xprtrdma: Close window between waking RPC senders and posting Receives + +From: Chuck Lever + +commit 2ae50ad68cd79224198b525f7bd645c9da98b6ff upstream. + +A recent clean up attempted to separate Receive handling and RPC +Reply processing, in the name of clean layering. + +Unfortunately, we can't do this because the Receive Queue has to be +refilled _after_ the most recent credit update from the responder +is parsed from the transport header, but _before_ we wake up the +next RPC sender. That is right in the middle of +rpcrdma_reply_handler(). + +Usually this isn't a problem because current responder +implementations don't vary their credit grant. The one exception is +when a connection is established: the grant goes from one to a much +larger number on the first Receive. The requester MUST post enough +Receives right then so that any outstanding requests can be sent +without risking RNR and connection loss. + +Fixes: 6ceea36890a0 ("xprtrdma: Refactor Receive accounting") +Signed-off-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtrdma/rpc_rdma.c | 1 + + net/sunrpc/xprtrdma/verbs.c | 11 +++++++---- + net/sunrpc/xprtrdma/xprt_rdma.h | 1 + + 3 files changed, 9 insertions(+), 4 deletions(-) + +--- a/net/sunrpc/xprtrdma/rpc_rdma.c ++++ b/net/sunrpc/xprtrdma/rpc_rdma.c +@@ -1362,6 +1362,7 @@ void rpcrdma_reply_handler(struct rpcrdm + xprt->cwnd = credits << RPC_CWNDSHIFT; + spin_unlock(&xprt->transport_lock); + } ++ rpcrdma_post_recvs(r_xprt, false); + + req = rpcr_to_rdmar(rqst); + if (req->rl_reply) { +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -84,7 +84,6 @@ rpcrdma_regbuf_alloc(size_t size, enum d + gfp_t flags); + static void rpcrdma_regbuf_dma_unmap(struct rpcrdma_regbuf *rb); + static void rpcrdma_regbuf_free(struct rpcrdma_regbuf *rb); +-static void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp); + + /* Wait for outstanding transport work to finish. ib_drain_qp + * handles the drains in the wrong order for us, so open code +@@ -170,7 +169,6 @@ rpcrdma_wc_receive(struct ib_cq *cq, str + rdmab_addr(rep->rr_rdmabuf), + wc->byte_len, DMA_FROM_DEVICE); + +- rpcrdma_post_recvs(r_xprt, false); + rpcrdma_reply_handler(rep); + return; + +@@ -1478,8 +1476,13 @@ rpcrdma_ep_post(struct rpcrdma_ia *ia, + return 0; + } + +-static void +-rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp) ++/** ++ * rpcrdma_post_recvs - Refill the Receive Queue ++ * @r_xprt: controlling transport instance ++ * @temp: mark Receive buffers to be deleted after use ++ * ++ */ ++void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp) + { + struct rpcrdma_buffer *buf = &r_xprt->rx_buf; + struct rpcrdma_ep *ep = &r_xprt->rx_ep; +--- a/net/sunrpc/xprtrdma/xprt_rdma.h ++++ b/net/sunrpc/xprtrdma/xprt_rdma.h +@@ -474,6 +474,7 @@ void rpcrdma_ep_disconnect(struct rpcrdm + + int rpcrdma_ep_post(struct rpcrdma_ia *, struct rpcrdma_ep *, + struct rpcrdma_req *); ++void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp); + + /* + * Buffer calls - xprtrdma/verbs.c diff --git a/queue-5.4/xprtrdma-connection-becomes-unstable-after-a-reconnect.patch b/queue-5.4/xprtrdma-connection-becomes-unstable-after-a-reconnect.patch new file mode 100644 index 00000000000..36719c90995 --- /dev/null +++ b/queue-5.4/xprtrdma-connection-becomes-unstable-after-a-reconnect.patch @@ -0,0 +1,89 @@ +From a31b2f939219dd9bffdf01a45bd91f209f8cc369 Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Wed, 9 Oct 2019 13:07:27 -0400 +Subject: xprtrdma: Connection becomes unstable after a reconnect + +From: Chuck Lever + +commit a31b2f939219dd9bffdf01a45bd91f209f8cc369 upstream. + +This is because xprt_request_get_cong() is allowing more than one +RPC Call to be transmitted before the first Receive on the new +connection. The first Receive fills the Receive Queue based on the +server's credit grant. Before that Receive, there is only a single +Receive WR posted because the client doesn't know the server's +credit grant. + +Solution is to clear rq_cong on all outstanding rpc_rqsts when the +the cwnd is reset. This is because an RPC/RDMA credit is good for +one connection instance only. + +Fixes: 75891f502f5f ("SUNRPC: Support for congestion control ... ") +Signed-off-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtrdma/transport.c | 3 +++ + net/sunrpc/xprtrdma/verbs.c | 22 ++++++++++++++++++++++ + 2 files changed, 25 insertions(+) + +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -428,8 +428,11 @@ void xprt_rdma_close(struct rpc_xprt *xp + /* Prepare @xprt for the next connection by reinitializing + * its credit grant to one (see RFC 8166, Section 3.3.3). + */ ++ spin_lock(&xprt->transport_lock); + r_xprt->rx_buf.rb_credits = 1; ++ xprt->cong = 0; + xprt->cwnd = RPC_CWNDSHIFT; ++ spin_unlock(&xprt->transport_lock); + + out: + xprt->reestablish_timeout = 0; +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -75,6 +75,7 @@ + * internal functions + */ + static void rpcrdma_sendctx_put_locked(struct rpcrdma_sendctx *sc); ++static void rpcrdma_reqs_reset(struct rpcrdma_xprt *r_xprt); + static void rpcrdma_reps_destroy(struct rpcrdma_buffer *buf); + static void rpcrdma_mrs_create(struct rpcrdma_xprt *r_xprt); + static void rpcrdma_mrs_destroy(struct rpcrdma_buffer *buf); +@@ -780,6 +781,7 @@ rpcrdma_ep_disconnect(struct rpcrdma_ep + trace_xprtrdma_disconnect(r_xprt, rc); + + rpcrdma_xprt_drain(r_xprt); ++ rpcrdma_reqs_reset(r_xprt); + } + + /* Fixed-size circular FIFO queue. This implementation is wait-free and +@@ -1042,6 +1044,26 @@ out1: + return NULL; + } + ++/** ++ * rpcrdma_reqs_reset - Reset all reqs owned by a transport ++ * @r_xprt: controlling transport instance ++ * ++ * ASSUMPTION: the rb_allreqs list is stable for the duration, ++ * and thus can be walked without holding rb_lock. Eg. the ++ * caller is holding the transport send lock to exclude ++ * device removal or disconnection. ++ */ ++static void rpcrdma_reqs_reset(struct rpcrdma_xprt *r_xprt) ++{ ++ struct rpcrdma_buffer *buf = &r_xprt->rx_buf; ++ struct rpcrdma_req *req; ++ ++ list_for_each_entry(req, &buf->rb_allreqs, rl_all) { ++ /* Credits are valid only for one connection */ ++ req->rl_slot.rq_cong = 0; ++ } ++} ++ + static struct rpcrdma_rep *rpcrdma_rep_create(struct rpcrdma_xprt *r_xprt, + bool temp) + { diff --git a/queue-5.4/xprtrdma-fix-mr-list-handling.patch b/queue-5.4/xprtrdma-fix-mr-list-handling.patch new file mode 100644 index 00000000000..dd798087b37 --- /dev/null +++ b/queue-5.4/xprtrdma-fix-mr-list-handling.patch @@ -0,0 +1,117 @@ +From c3700780a096fc66467c81076ddf7f3f11d639b5 Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Wed, 9 Oct 2019 13:07:43 -0400 +Subject: xprtrdma: Fix MR list handling + +From: Chuck Lever + +commit c3700780a096fc66467c81076ddf7f3f11d639b5 upstream. + +Close some holes introduced by commit 6dc6ec9e04c4 ("xprtrdma: Cache +free MRs in each rpcrdma_req") that could result in list corruption. + +In addition, the result that is tabulated in @count is no longer +used, so @count is removed. + +Fixes: 6dc6ec9e04c4 ("xprtrdma: Cache free MRs in each rpcrdma_req") +Signed-off-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtrdma/verbs.c | 41 +++++++++++++++++++++-------------------- + 1 file changed, 21 insertions(+), 20 deletions(-) + +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -79,7 +79,6 @@ static void rpcrdma_reqs_reset(struct rp + static void rpcrdma_reps_destroy(struct rpcrdma_buffer *buf); + static void rpcrdma_mrs_create(struct rpcrdma_xprt *r_xprt); + static void rpcrdma_mrs_destroy(struct rpcrdma_buffer *buf); +-static void rpcrdma_mr_free(struct rpcrdma_mr *mr); + static struct rpcrdma_regbuf * + rpcrdma_regbuf_alloc(size_t size, enum dma_data_direction direction, + gfp_t flags); +@@ -967,7 +966,7 @@ rpcrdma_mrs_create(struct rpcrdma_xprt * + mr->mr_xprt = r_xprt; + + spin_lock(&buf->rb_lock); +- list_add(&mr->mr_list, &buf->rb_mrs); ++ rpcrdma_mr_push(mr, &buf->rb_mrs); + list_add(&mr->mr_all, &buf->rb_all_mrs); + spin_unlock(&buf->rb_lock); + } +@@ -1185,10 +1184,19 @@ out: + */ + void rpcrdma_req_destroy(struct rpcrdma_req *req) + { ++ struct rpcrdma_mr *mr; ++ + list_del(&req->rl_all); + +- while (!list_empty(&req->rl_free_mrs)) +- rpcrdma_mr_free(rpcrdma_mr_pop(&req->rl_free_mrs)); ++ while ((mr = rpcrdma_mr_pop(&req->rl_free_mrs))) { ++ struct rpcrdma_buffer *buf = &mr->mr_xprt->rx_buf; ++ ++ spin_lock(&buf->rb_lock); ++ list_del(&mr->mr_all); ++ spin_unlock(&buf->rb_lock); ++ ++ frwr_release_mr(mr); ++ } + + rpcrdma_regbuf_free(req->rl_recvbuf); + rpcrdma_regbuf_free(req->rl_sendbuf); +@@ -1196,24 +1204,28 @@ void rpcrdma_req_destroy(struct rpcrdma_ + kfree(req); + } + +-static void +-rpcrdma_mrs_destroy(struct rpcrdma_buffer *buf) ++/** ++ * rpcrdma_mrs_destroy - Release all of a transport's MRs ++ * @buf: controlling buffer instance ++ * ++ * Relies on caller holding the transport send lock to protect ++ * removing mr->mr_list from req->rl_free_mrs safely. ++ */ ++static void rpcrdma_mrs_destroy(struct rpcrdma_buffer *buf) + { + struct rpcrdma_xprt *r_xprt = container_of(buf, struct rpcrdma_xprt, + rx_buf); + struct rpcrdma_mr *mr; +- unsigned int count; + +- count = 0; + spin_lock(&buf->rb_lock); + while ((mr = list_first_entry_or_null(&buf->rb_all_mrs, + struct rpcrdma_mr, + mr_all)) != NULL) { ++ list_del(&mr->mr_list); + list_del(&mr->mr_all); + spin_unlock(&buf->rb_lock); + + frwr_release_mr(mr); +- count++; + spin_lock(&buf->rb_lock); + } + spin_unlock(&buf->rb_lock); +@@ -1286,17 +1298,6 @@ void rpcrdma_mr_put(struct rpcrdma_mr *m + rpcrdma_mr_push(mr, &mr->mr_req->rl_free_mrs); + } + +-static void rpcrdma_mr_free(struct rpcrdma_mr *mr) +-{ +- struct rpcrdma_xprt *r_xprt = mr->mr_xprt; +- struct rpcrdma_buffer *buf = &r_xprt->rx_buf; +- +- mr->mr_req = NULL; +- spin_lock(&buf->rb_lock); +- rpcrdma_mr_push(mr, &buf->rb_mrs); +- spin_unlock(&buf->rb_lock); +-} +- + /** + * rpcrdma_buffer_get - Get a request buffer + * @buffers: Buffer pool from which to obtain a buffer