--- /dev/null
+From 04bbb97d1b732b2d197f103c5818f5c214a4cf81 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Wed, 26 Feb 2020 16:21:22 +0300
+Subject: i2c: i801: Do not add ICH_RES_IO_SMI for the iTCO_wdt device
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 04bbb97d1b732b2d197f103c5818f5c214a4cf81 upstream.
+
+Martin noticed that nct6775 driver does not load properly on his system
+in v5.4+ kernels. The issue was bisected to commit b84398d6d7f9 ("i2c:
+i801: Use iTCO version 6 in Cannon Lake PCH and beyond") but it is
+likely not the culprit because the faulty code has been in the driver
+already since commit 9424693035a5 ("i2c: i801: Create iTCO device on
+newer Intel PCHs"). So more likely some commit that added PCI IDs of
+recent chipsets made the driver to create the iTCO_wdt device on Martins
+system.
+
+The issue was debugged to be PCI configuration access to the PMC device
+that is not present. This returns all 1's when read and this caused the
+iTCO_wdt driver to accidentally request resourses used by nct6775.
+
+It turns out that the SMI resource is only required for some ancient
+systems, not the ones supported by this driver. For this reason do not
+populate the SMI resource at all and drop all the related code. The
+driver now always populates the main I/O resource and only in case of SPT
+(Intel Sunrisepoint) compatible devices it adds another resource for the
+NO_REBOOT bit. These two resources are of different types so
+platform_get_resource() used by the iTCO_wdt driver continues to find
+the both resources at index 0.
+
+Link: https://lore.kernel.org/linux-hwmon/CAM1AHpQ4196tyD=HhBu-2donSsuogabkfP03v1YF26Q7_BgvgA@mail.gmail.com/
+Fixes: 9424693035a5 ("i2c: i801: Create iTCO device on newer Intel PCHs")
+[wsa: complete fix needs all of http://patchwork.ozlabs.org/project/linux-i2c/list/?series=160959&state=*]
+Reported-by: Martin Volf <martin.volf.42@gmail.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-i801.c | 45 +++++++++++-------------------------------
+ 1 file changed, 12 insertions(+), 33 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -129,11 +129,6 @@
+ #define TCOBASE 0x050
+ #define TCOCTL 0x054
+
+-#define ACPIBASE 0x040
+-#define ACPIBASE_SMI_OFF 0x030
+-#define ACPICTRL 0x044
+-#define ACPICTRL_EN 0x080
+-
+ #define SBREG_BAR 0x10
+ #define SBREG_SMBCTRL 0xc6000c
+ #define SBREG_SMBCTRL_DNV 0xcf000c
+@@ -1544,7 +1539,7 @@ i801_add_tco_spt(struct i801_priv *priv,
+ pci_bus_write_config_byte(pci_dev->bus, devfn, 0xe1, hidden);
+ spin_unlock(&p2sb_spinlock);
+
+- res = &tco_res[ICH_RES_MEM_OFF];
++ res = &tco_res[1];
+ if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS)
+ res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV;
+ else
+@@ -1554,7 +1549,7 @@ i801_add_tco_spt(struct i801_priv *priv,
+ res->flags = IORESOURCE_MEM;
+
+ return platform_device_register_resndata(&pci_dev->dev, "iTCO_wdt", -1,
+- tco_res, 3, &spt_tco_platform_data,
++ tco_res, 2, &spt_tco_platform_data,
+ sizeof(spt_tco_platform_data));
+ }
+
+@@ -1567,17 +1562,16 @@ static struct platform_device *
+ i801_add_tco_cnl(struct i801_priv *priv, struct pci_dev *pci_dev,
+ struct resource *tco_res)
+ {
+- return platform_device_register_resndata(&pci_dev->dev, "iTCO_wdt", -1,
+- tco_res, 2, &cnl_tco_platform_data,
+- sizeof(cnl_tco_platform_data));
++ return platform_device_register_resndata(&pci_dev->dev,
++ "iTCO_wdt", -1, tco_res, 1, &cnl_tco_platform_data,
++ sizeof(cnl_tco_platform_data));
+ }
+
+ static void i801_add_tco(struct i801_priv *priv)
+ {
+- u32 base_addr, tco_base, tco_ctl, ctrl_val;
+ struct pci_dev *pci_dev = priv->pci_dev;
+- struct resource tco_res[3], *res;
+- unsigned int devfn;
++ struct resource tco_res[2], *res;
++ u32 tco_base, tco_ctl;
+
+ /* If we have ACPI based watchdog use that instead */
+ if (acpi_has_watchdog())
+@@ -1592,30 +1586,15 @@ static void i801_add_tco(struct i801_pri
+ return;
+
+ memset(tco_res, 0, sizeof(tco_res));
+-
+- res = &tco_res[ICH_RES_IO_TCO];
+- res->start = tco_base & ~1;
+- res->end = res->start + 32 - 1;
+- res->flags = IORESOURCE_IO;
+-
+ /*
+- * Power Management registers.
++ * Always populate the main iTCO IO resource here. The second entry
++ * for NO_REBOOT MMIO is filled by the SPT specific function.
+ */
+- devfn = PCI_DEVFN(PCI_SLOT(pci_dev->devfn), 2);
+- pci_bus_read_config_dword(pci_dev->bus, devfn, ACPIBASE, &base_addr);
+-
+- res = &tco_res[ICH_RES_IO_SMI];
+- res->start = (base_addr & ~1) + ACPIBASE_SMI_OFF;
+- res->end = res->start + 3;
++ res = &tco_res[0];
++ res->start = tco_base & ~1;
++ res->end = res->start + 32 - 1;
+ res->flags = IORESOURCE_IO;
+
+- /*
+- * Enable the ACPI I/O space.
+- */
+- pci_bus_read_config_dword(pci_dev->bus, devfn, ACPICTRL, &ctrl_val);
+- ctrl_val |= ACPICTRL_EN;
+- pci_bus_write_config_dword(pci_dev->bus, devfn, ACPICTRL, ctrl_val);
+-
+ if (priv->features & FEATURE_TCO_CNL)
+ priv->tco_pdev = i801_add_tco_cnl(priv, pci_dev, tco_res);
+ else
--- /dev/null
+From 9a293d1e21a6461a11b4217b155bf445e57f4131 Mon Sep 17 00:00:00 2001
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Fri, 20 Mar 2020 16:02:10 -0400
+Subject: IB/hfi1: Ensure pq is not left on waitlist
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+commit 9a293d1e21a6461a11b4217b155bf445e57f4131 upstream.
+
+The following warning can occur when a pq is left on the dmawait list and
+the pq is then freed:
+
+ WARNING: CPU: 47 PID: 3546 at lib/list_debug.c:29 __list_add+0x65/0xc0
+ list_add corruption. next->prev should be prev (ffff939228da1880), but was ffff939cabb52230. (next=ffff939cabb52230).
+ Modules linked in: mmfs26(OE) mmfslinux(OE) tracedev(OE) 8021q garp mrp ib_isert iscsi_target_mod target_core_mod crc_t10dif crct10dif_generic opa_vnic rpcrdma ib_iser libiscsi scsi_transport_iscsi ib_ipoib(OE) bridge stp llc iTCO_wdt iTCO_vendor_support intel_powerclamp coretemp intel_rapl iosf_mbi kvm_intel kvm irqbypass crct10dif_pclmul crct10dif_common crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd ast ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm pcspkr joydev drm_panel_orientation_quirks i2c_i801 mei_me lpc_ich mei wmi ipmi_si ipmi_devintf ipmi_msghandler nfit libnvdimm acpi_power_meter acpi_pad hfi1(OE) rdmavt(OE) rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_core binfmt_misc numatools(OE) xpmem(OE) ip_tables
+ nfsv3 nfs_acl nfs lockd grace sunrpc fscache igb ahci libahci i2c_algo_bit dca libata ptp pps_core crc32c_intel [last unloaded: i2c_algo_bit]
+ CPU: 47 PID: 3546 Comm: wrf.exe Kdump: loaded Tainted: G W OE ------------ 3.10.0-957.41.1.el7.x86_64 #1
+ Hardware name: HPE.COM HPE SGI 8600-XA730i Gen10/X11DPT-SB-SG007, BIOS SBED1229 01/22/2019
+ Call Trace:
+ [<ffffffff91f65ac0>] dump_stack+0x19/0x1b
+ [<ffffffff91898b78>] __warn+0xd8/0x100
+ [<ffffffff91898bff>] warn_slowpath_fmt+0x5f/0x80
+ [<ffffffff91a1dabe>] ? ___slab_alloc+0x24e/0x4f0
+ [<ffffffff91b97025>] __list_add+0x65/0xc0
+ [<ffffffffc03926a5>] defer_packet_queue+0x145/0x1a0 [hfi1]
+ [<ffffffffc0372987>] sdma_check_progress+0x67/0xa0 [hfi1]
+ [<ffffffffc03779d2>] sdma_send_txlist+0x432/0x550 [hfi1]
+ [<ffffffff91a20009>] ? kmem_cache_alloc+0x179/0x1f0
+ [<ffffffffc0392973>] ? user_sdma_send_pkts+0xc3/0x1990 [hfi1]
+ [<ffffffffc0393e3a>] user_sdma_send_pkts+0x158a/0x1990 [hfi1]
+ [<ffffffff918ab65e>] ? try_to_del_timer_sync+0x5e/0x90
+ [<ffffffff91a3fe1a>] ? __check_object_size+0x1ca/0x250
+ [<ffffffffc0395546>] hfi1_user_sdma_process_request+0xd66/0x1280 [hfi1]
+ [<ffffffffc034e0da>] hfi1_aio_write+0xca/0x120 [hfi1]
+ [<ffffffff91a4245b>] do_sync_readv_writev+0x7b/0xd0
+ [<ffffffff91a4409e>] do_readv_writev+0xce/0x260
+ [<ffffffff918df69f>] ? pick_next_task_fair+0x5f/0x1b0
+ [<ffffffff918db535>] ? sched_clock_cpu+0x85/0xc0
+ [<ffffffff91f6b16a>] ? __schedule+0x13a/0x860
+ [<ffffffff91a442c5>] vfs_writev+0x35/0x60
+ [<ffffffff91a4447f>] SyS_writev+0x7f/0x110
+ [<ffffffff91f78ddb>] system_call_fastpath+0x22/0x27
+
+The issue happens when wait_event_interruptible_timeout() returns a value
+<= 0.
+
+In that case, the pq is left on the list. The code continues sending
+packets and potentially can complete the current request with the pq still
+on the dmawait list provided no descriptor shortage is seen.
+
+If the pq is torn down in that state, the sdma interrupt handler could
+find the now freed pq on the list with list corruption or memory
+corruption resulting.
+
+Fix by adding a flush routine to ensure that the pq is never on a list
+after processing a request.
+
+A follow-up patch series will address issues with seqlock surfaced in:
+https://lore.kernel.org/r/20200320003129.GP20941@ziepe.ca
+
+The seqlock use for sdma will then be converted to a spin lock since the
+list_empty() doesn't need the protection afforded by the sequence lock
+currently in use.
+
+Fixes: a0d406934a46 ("staging/rdma/hfi1: Add page lock limit check for SDMA requests")
+Link: https://lore.kernel.org/r/20200320200200.23203.37777.stgit@awfm-01.aw.intel.com
+Reviewed-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/hfi1/user_sdma.c | 25 ++++++++++++++++++++++---
+ 1 file changed, 22 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -141,6 +141,7 @@ static int defer_packet_queue(
+ */
+ xchg(&pq->state, SDMA_PKT_Q_DEFERRED);
+ if (list_empty(&pq->busy.list)) {
++ pq->busy.lock = &sde->waitlock;
+ iowait_get_priority(&pq->busy);
+ iowait_queue(pkts_sent, &pq->busy, &sde->dmawait);
+ }
+@@ -155,6 +156,7 @@ static void activate_packet_queue(struct
+ {
+ struct hfi1_user_sdma_pkt_q *pq =
+ container_of(wait, struct hfi1_user_sdma_pkt_q, busy);
++ pq->busy.lock = NULL;
+ xchg(&pq->state, SDMA_PKT_Q_ACTIVE);
+ wake_up(&wait->wait_dma);
+ };
+@@ -256,6 +258,21 @@ pq_reqs_nomem:
+ return ret;
+ }
+
++static void flush_pq_iowait(struct hfi1_user_sdma_pkt_q *pq)
++{
++ unsigned long flags;
++ seqlock_t *lock = pq->busy.lock;
++
++ if (!lock)
++ return;
++ write_seqlock_irqsave(lock, flags);
++ if (!list_empty(&pq->busy.list)) {
++ list_del_init(&pq->busy.list);
++ pq->busy.lock = NULL;
++ }
++ write_sequnlock_irqrestore(lock, flags);
++}
++
+ int hfi1_user_sdma_free_queues(struct hfi1_filedata *fd,
+ struct hfi1_ctxtdata *uctxt)
+ {
+@@ -281,6 +298,7 @@ int hfi1_user_sdma_free_queues(struct hf
+ kfree(pq->reqs);
+ kfree(pq->req_in_use);
+ kmem_cache_destroy(pq->txreq_cache);
++ flush_pq_iowait(pq);
+ kfree(pq);
+ } else {
+ spin_unlock(&fd->pq_rcu_lock);
+@@ -587,11 +605,12 @@ int hfi1_user_sdma_process_request(struc
+ if (ret < 0) {
+ if (ret != -EBUSY)
+ goto free_req;
+- wait_event_interruptible_timeout(
++ if (wait_event_interruptible_timeout(
+ pq->busy.wait_dma,
+- (pq->state == SDMA_PKT_Q_ACTIVE),
++ pq->state == SDMA_PKT_Q_ACTIVE,
+ msecs_to_jiffies(
+- SDMA_IOWAIT_TIMEOUT));
++ SDMA_IOWAIT_TIMEOUT)) <= 0)
++ flush_pq_iowait(pq);
+ }
+ }
+ *count += idx;
--- /dev/null
+From cb377dfda1755b3bc01436755d866c8e5336a762 Mon Sep 17 00:00:00 2001
+From: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Date: Fri, 6 Mar 2020 15:16:22 +0200
+Subject: iwlwifi: consider HE capability when setting LDPC
+
+From: Mordechay Goodstein <mordechay.goodstein@intel.com>
+
+commit cb377dfda1755b3bc01436755d866c8e5336a762 upstream.
+
+The AP may set the LDPC capability only in HE (IEEE80211_HE_PHY_CAP1),
+but we were checking it only in the HT capabilities.
+
+If we don't use this capability when required, the DSP gets the wrong
+configuration in HE and doesn't work properly.
+
+Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Fixes: befebbb30af0 ("iwlwifi: rs: consider LDPC capability in case of HE")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20200306151128.492d167c1a25.I1ad1353dbbf6c99ae57814be750f41a1c9f7f4ac@changeid
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
+@@ -147,7 +147,11 @@ static u16 rs_fw_get_config_flags(struct
+ (vht_ena && (vht_cap->cap & IEEE80211_VHT_CAP_RXLDPC))))
+ flags |= IWL_TLC_MNG_CFG_FLAGS_LDPC_MSK;
+
+- /* consider our LDPC support in case of HE */
++ /* consider LDPC support in case of HE */
++ if (he_cap->has_he && (he_cap->he_cap_elem.phy_cap_info[1] &
++ IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
++ flags |= IWL_TLC_MNG_CFG_FLAGS_LDPC_MSK;
++
+ if (sband->iftype_data && sband->iftype_data->he_cap.has_he &&
+ !(sband->iftype_data->he_cap.he_cap_elem.phy_cap_info[1] &
+ IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD))
--- /dev/null
+From 699b760bd29edba736590fffef7654cb079c753e Mon Sep 17 00:00:00 2001
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Fri, 6 Mar 2020 15:16:25 +0200
+Subject: iwlwifi: dbg: don't abort if sending DBGC_SUSPEND_RESUME fails
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+commit 699b760bd29edba736590fffef7654cb079c753e upstream.
+
+If the firmware is in a bad state or not initialized fully, sending
+the DBGC_SUSPEND_RESUME command fails but we can still collect logs.
+
+Instead of aborting the entire dump process, simply ignore the error.
+By removing the last callpoint that was checking the return value, we
+can also convert the function to return void.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Fixes: 576058330f2d ("iwlwifi: dbg: support debug recording suspend resume command")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20200306151129.dcec37b2efd4.I8dcd190431d110a6a0e88095ce93591ccfb3d78d@changeid
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 15 +++++----------
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.h | 6 +++---
+ 2 files changed, 8 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -2311,10 +2311,7 @@ static void iwl_fw_dbg_collect_sync(stru
+ goto out;
+ }
+
+- if (iwl_fw_dbg_stop_restart_recording(fwrt, ¶ms, true)) {
+- IWL_ERR(fwrt, "Failed to stop DBGC recording, aborting dump\n");
+- goto out;
+- }
++ iwl_fw_dbg_stop_restart_recording(fwrt, ¶ms, true);
+
+ IWL_DEBUG_FW_INFO(fwrt, "WRT: Data collection start\n");
+ if (iwl_trans_dbg_ini_valid(fwrt->trans))
+@@ -2480,14 +2477,14 @@ static int iwl_fw_dbg_restart_recording(
+ return 0;
+ }
+
+-int iwl_fw_dbg_stop_restart_recording(struct iwl_fw_runtime *fwrt,
+- struct iwl_fw_dbg_params *params,
+- bool stop)
++void iwl_fw_dbg_stop_restart_recording(struct iwl_fw_runtime *fwrt,
++ struct iwl_fw_dbg_params *params,
++ bool stop)
+ {
+ int ret = 0;
+
+ if (test_bit(STATUS_FW_ERROR, &fwrt->trans->status))
+- return 0;
++ return;
+
+ if (fw_has_capa(&fwrt->fw->ucode_capa,
+ IWL_UCODE_TLV_CAPA_DBG_SUSPEND_RESUME_CMD_SUPP))
+@@ -2504,7 +2501,5 @@ int iwl_fw_dbg_stop_restart_recording(st
+ iwl_fw_set_dbg_rec_on(fwrt);
+ }
+ #endif
+-
+- return ret;
+ }
+ IWL_EXPORT_SYMBOL(iwl_fw_dbg_stop_restart_recording);
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
+@@ -263,9 +263,9 @@ _iwl_fw_dbg_trigger_simple_stop(struct i
+ _iwl_fw_dbg_trigger_simple_stop((fwrt), (wdev), \
+ iwl_fw_dbg_get_trigger((fwrt)->fw,\
+ (trig)))
+-int iwl_fw_dbg_stop_restart_recording(struct iwl_fw_runtime *fwrt,
+- struct iwl_fw_dbg_params *params,
+- bool stop);
++void iwl_fw_dbg_stop_restart_recording(struct iwl_fw_runtime *fwrt,
++ struct iwl_fw_dbg_params *params,
++ bool stop);
+
+ #ifdef CONFIG_IWLWIFI_DEBUGFS
+ static inline void iwl_fw_set_dbg_rec_on(struct iwl_fw_runtime *fwrt)
--- /dev/null
+From a5688e600e78f9fc68102bf0fe5c797fc2826abe Mon Sep 17 00:00:00 2001
+From: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Date: Fri, 6 Mar 2020 15:16:24 +0200
+Subject: iwlwifi: yoyo: don't add TLV offset when reading FIFOs
+
+From: Mordechay Goodstein <mordechay.goodstein@intel.com>
+
+commit a5688e600e78f9fc68102bf0fe5c797fc2826abe upstream.
+
+The TLV offset is only used to read registers, while the offset used for
+the FIFO addresses are hard coded in the driver and not given by the
+TLV.
+
+If we try to apply the TLV offset when reading the FIFOs, we'll read
+from invalid addresses, causing the driver to hang.
+
+Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Fixes: 8d7dea25ada7 ("iwlwifi: dbg_ini: implement Rx fifos dump")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20200306151129.fbab869c26fa.I4ddac20d02f9bce41855a816aa6855c89bc3874e@changeid
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -8,7 +8,7 @@
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 - 2019 Intel Corporation
++ * Copyright(c) 2018 - 2020 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -31,7 +31,7 @@
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 - 2019 Intel Corporation
++ * Copyright(c) 2018 - 2020 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -1373,11 +1373,7 @@ static int iwl_dump_ini_rxf_iter(struct
+ goto out;
+ }
+
+- /*
+- * region register have absolute value so apply rxf offset after
+- * reading the registers
+- */
+- offs += rxf_data.offset;
++ offs = rxf_data.offset;
+
+ /* Lock fence */
+ iwl_write_prph_no_grab(fwrt->trans, RXF_SET_FENCE_MODE + offs, 0x1);
--- /dev/null
+From 6e11d1578fba8d09d03a286740ffcf336d53928c Mon Sep 17 00:00:00 2001
+From: Amritha Nambiar <amritha.nambiar@intel.com>
+Date: Mon, 24 Feb 2020 10:56:00 -0800
+Subject: net: Fix Tx hash bound checking
+
+From: Amritha Nambiar <amritha.nambiar@intel.com>
+
+commit 6e11d1578fba8d09d03a286740ffcf336d53928c upstream.
+
+Fixes the lower and upper bounds when there are multiple TCs and
+traffic is on the the same TC on the same device.
+
+The lower bound is represented by 'qoffset' and the upper limit for
+hash value is 'qcount + qoffset'. This gives a clean Rx to Tx queue
+mapping when there are multiple TCs, as the queue indices for upper TCs
+will be offset by 'qoffset'.
+
+v2: Fixed commit description based on comments.
+
+Fixes: 1b837d489e06 ("net: Revoke export for __skb_tx_hash, update it to just be static skb_tx_hash")
+Fixes: eadec877ce9c ("net: Add support for subordinate traffic classes to netdev_pick_tx")
+Signed-off-by: Amritha Nambiar <amritha.nambiar@intel.com>
+Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/core/dev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2795,6 +2795,8 @@ static u16 skb_tx_hash(const struct net_
+
+ if (skb_rx_queue_recorded(skb)) {
+ hash = skb_get_rx_queue(skb);
++ if (hash >= qoffset)
++ hash -= qoffset;
+ while (unlikely(hash >= qcount))
+ hash -= qcount;
+ return hash + qoffset;
--- /dev/null
+From f28ca65efa87b3fb8da3d69ca7cb1ebc0448de66 Mon Sep 17 00:00:00 2001
+From: Tariq Toukan <tariqt@mellanox.com>
+Date: Mon, 24 Feb 2020 13:56:53 +0200
+Subject: net/mlx5e: kTLS, Fix wrong value in record tracker enum
+
+From: Tariq Toukan <tariqt@mellanox.com>
+
+commit f28ca65efa87b3fb8da3d69ca7cb1ebc0448de66 upstream.
+
+Fix to match the HW spec: TRACKING state is 1, SEARCHING is 2.
+No real issue for now, as these values are not currently used.
+
+Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support")
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Reviewed-by: Boris Pismenny <borisp@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
+@@ -38,8 +38,8 @@ enum {
+
+ enum {
+ MLX5E_TLS_PROGRESS_PARAMS_RECORD_TRACKER_STATE_START = 0,
+- MLX5E_TLS_PROGRESS_PARAMS_RECORD_TRACKER_STATE_SEARCHING = 1,
+- MLX5E_TLS_PROGRESS_PARAMS_RECORD_TRACKER_STATE_TRACKING = 2,
++ MLX5E_TLS_PROGRESS_PARAMS_RECORD_TRACKER_STATE_TRACKING = 1,
++ MLX5E_TLS_PROGRESS_PARAMS_RECORD_TRACKER_STATE_SEARCHING = 2,
+ };
+
+ struct mlx5e_ktls_offload_context_tx {
--- /dev/null
+From 498b577660f08cef5d9e78e0ed6dcd4c0939e98c Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Fri, 13 Mar 2020 17:30:27 +0000
+Subject: rxrpc: Fix sendmsg(MSG_WAITALL) handling
+
+From: David Howells <dhowells@redhat.com>
+
+commit 498b577660f08cef5d9e78e0ed6dcd4c0939e98c upstream.
+
+Fix the handling of sendmsg() with MSG_WAITALL for userspace to round the
+timeout for when a signal occurs up to at least two jiffies as a 1 jiffy
+timeout may end up being effectively 0 if jiffies wraps at the wrong time.
+
+Fixes: bc5e3a546d55 ("rxrpc: Use MSG_WAITALL to tell sendmsg() to temporarily ignore signals")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/rxrpc/sendmsg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -58,8 +58,8 @@ static int rxrpc_wait_for_tx_window_wait
+
+ rtt = READ_ONCE(call->peer->rtt);
+ rtt2 = nsecs_to_jiffies64(rtt) * 2;
+- if (rtt2 < 1)
+- rtt2 = 1;
++ if (rtt2 < 2)
++ rtt2 = 2;
+
+ timeout = rtt2;
+ tx_start = READ_ONCE(call->tx_hard_ack);
power-supply-axp288_charger-add-special-handling-for-hp-pavilion-x2-10.patch
revert-dm-always-call-blk_queue_split-in-dm_process_bio.patch
alsa-hda-ca0132-add-recon3di-quirk-to-handle-integrated-sound-on-evga-x99-classified-motherboard.patch
+soc-mediatek-knows_txdone-needs-to-be-set-in-mediatek-cmdq-helper.patch
+net-mlx5e-ktls-fix-wrong-value-in-record-tracker-enum.patch
+iwlwifi-consider-he-capability-when-setting-ldpc.patch
+iwlwifi-yoyo-don-t-add-tlv-offset-when-reading-fifos.patch
+iwlwifi-dbg-don-t-abort-if-sending-dbgc_suspend_resume-fails.patch
+rxrpc-fix-sendmsg-msg_waitall-handling.patch
+ib-hfi1-ensure-pq-is-not-left-on-waitlist.patch
+tcp-fix-tfo-synack-undo-to-avoid-double-timestamp-undo.patch
+i2c-i801-do-not-add-ich_res_io_smi-for-the-itco_wdt-device.patch
+net-fix-tx-hash-bound-checking.patch
--- /dev/null
+From ce35e21d82bcac8b3fd5128888f9e233f8444293 Mon Sep 17 00:00:00 2001
+From: Bibby Hsieh <bibby.hsieh@mediatek.com>
+Date: Fri, 14 Feb 2020 12:35:45 +0800
+Subject: soc: mediatek: knows_txdone needs to be set in Mediatek CMDQ helper
+
+From: Bibby Hsieh <bibby.hsieh@mediatek.com>
+
+commit ce35e21d82bcac8b3fd5128888f9e233f8444293 upstream.
+
+Mediatek CMDQ driver have a mechanism to do TXDONE_BY_ACK,
+so we should set knows_txdone.
+
+Fixes:576f1b4bc802 ("soc: mediatek: Add Mediatek CMDQ helper")
+
+Cc: stable@vger.kernel.org # v5.0+
+Signed-off-by: Bibby Hsieh <bibby.hsieh@mediatek.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/soc/mediatek/mtk-cmdq-helper.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/soc/mediatek/mtk-cmdq-helper.c
++++ b/drivers/soc/mediatek/mtk-cmdq-helper.c
+@@ -38,6 +38,7 @@ struct cmdq_client *cmdq_mbox_create(str
+ client->pkt_cnt = 0;
+ client->client.dev = dev;
+ client->client.tx_block = false;
++ client->client.knows_txdone = true;
+ client->chan = mbox_request_channel(&client->client, index);
+
+ if (IS_ERR(client->chan)) {
--- /dev/null
+From dad8cea7add96a353fa1898b5ccefbb72da66f29 Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Sat, 22 Feb 2020 11:21:15 -0500
+Subject: tcp: fix TFO SYNACK undo to avoid double-timestamp-undo
+
+From: Neal Cardwell <ncardwell@google.com>
+
+commit dad8cea7add96a353fa1898b5ccefbb72da66f29 upstream.
+
+In a rare corner case the new logic for undo of SYNACK RTO could
+result in triggering the warning in tcp_fastretrans_alert() that says:
+ WARN_ON(tp->retrans_out != 0);
+
+The warning looked like:
+
+WARNING: CPU: 1 PID: 1 at net/ipv4/tcp_input.c:2818 tcp_ack+0x13e0/0x3270
+
+The sequence that tickles this bug is:
+ - Fast Open server receives TFO SYN with data, sends SYNACK
+ - (client receives SYNACK and sends ACK, but ACK is lost)
+ - server app sends some data packets
+ - (N of the first data packets are lost)
+ - server receives client ACK that has a TS ECR matching first SYNACK,
+ and also SACKs suggesting the first N data packets were lost
+ - server performs TS undo of SYNACK RTO, then immediately
+ enters recovery
+ - buggy behavior then performed a *second* undo that caused
+ the connection to be in CA_Open with retrans_out != 0
+
+Basically, the incoming ACK packet with SACK blocks causes us to first
+undo the cwnd reduction from the SYNACK RTO, but then immediately
+enters fast recovery, which then makes us eligible for undo again. And
+then tcp_rcv_synrecv_state_fastopen() accidentally performs an undo
+using a "mash-up" of state from two different loss recovery phases: it
+uses the timestamp info from the ACK of the original SYNACK, and the
+undo_marker from the fast recovery.
+
+This fix refines the logic to only invoke the tcp_try_undo_loss()
+inside tcp_rcv_synrecv_state_fastopen() if the connection is still in
+CA_Loss. If peer SACKs triggered fast recovery, then
+tcp_rcv_synrecv_state_fastopen() can't safely undo.
+
+Fixes: 794200d66273 ("tcp: undo cwnd on Fast Open spurious SYNACK retransmit")
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/tcp_input.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -6096,7 +6096,11 @@ static void tcp_rcv_synrecv_state_fastop
+ {
+ struct request_sock *req;
+
+- tcp_try_undo_loss(sk, false);
++ /* If we are still handling the SYNACK RTO, see if timestamp ECR allows
++ * undo. If peer SACKs triggered fast recovery, we can't undo here.
++ */
++ if (inet_csk(sk)->icsk_ca_state == TCP_CA_Loss)
++ tcp_try_undo_loss(sk, false);
+
+ /* Reset rtx states to prevent spurious retransmits_timed_out() */
+ tcp_sk(sk)->retrans_stamp = 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
