From: Greg Kroah-Hartman Date: Tue, 7 Apr 2020 09:12:41 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.4.31~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8af792420d90223eeda259858b1abcc79d2aa2fc;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: i2c-i801-do-not-add-ich_res_io_smi-for-the-itco_wdt-device.patch ib-hfi1-ensure-pq-is-not-left-on-waitlist.patch iwlwifi-consider-he-capability-when-setting-ldpc.patch iwlwifi-dbg-don-t-abort-if-sending-dbgc_suspend_resume-fails.patch iwlwifi-yoyo-don-t-add-tlv-offset-when-reading-fifos.patch net-fix-tx-hash-bound-checking.patch net-mlx5e-ktls-fix-wrong-value-in-record-tracker-enum.patch rxrpc-fix-sendmsg-msg_waitall-handling.patch soc-mediatek-knows_txdone-needs-to-be-set-in-mediatek-cmdq-helper.patch tcp-fix-tfo-synack-undo-to-avoid-double-timestamp-undo.patch --- diff --git a/queue-5.4/i2c-i801-do-not-add-ich_res_io_smi-for-the-itco_wdt-device.patch b/queue-5.4/i2c-i801-do-not-add-ich_res_io_smi-for-the-itco_wdt-device.patch new file mode 100644 index 00000000000..bff47cf2fdb --- /dev/null +++ b/queue-5.4/i2c-i801-do-not-add-ich_res_io_smi-for-the-itco_wdt-device.patch @@ -0,0 +1,135 @@ +From 04bbb97d1b732b2d197f103c5818f5c214a4cf81 Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Wed, 26 Feb 2020 16:21:22 +0300 +Subject: i2c: i801: Do not add ICH_RES_IO_SMI for the iTCO_wdt device + +From: Mika Westerberg + +commit 04bbb97d1b732b2d197f103c5818f5c214a4cf81 upstream. + +Martin noticed that nct6775 driver does not load properly on his system +in v5.4+ kernels. The issue was bisected to commit b84398d6d7f9 ("i2c: +i801: Use iTCO version 6 in Cannon Lake PCH and beyond") but it is +likely not the culprit because the faulty code has been in the driver +already since commit 9424693035a5 ("i2c: i801: Create iTCO device on +newer Intel PCHs"). So more likely some commit that added PCI IDs of +recent chipsets made the driver to create the iTCO_wdt device on Martins +system. + +The issue was debugged to be PCI configuration access to the PMC device +that is not present. This returns all 1's when read and this caused the +iTCO_wdt driver to accidentally request resourses used by nct6775. + +It turns out that the SMI resource is only required for some ancient +systems, not the ones supported by this driver. For this reason do not +populate the SMI resource at all and drop all the related code. The +driver now always populates the main I/O resource and only in case of SPT +(Intel Sunrisepoint) compatible devices it adds another resource for the +NO_REBOOT bit. These two resources are of different types so +platform_get_resource() used by the iTCO_wdt driver continues to find +the both resources at index 0. + +Link: https://lore.kernel.org/linux-hwmon/CAM1AHpQ4196tyD=HhBu-2donSsuogabkfP03v1YF26Q7_BgvgA@mail.gmail.com/ +Fixes: 9424693035a5 ("i2c: i801: Create iTCO device on newer Intel PCHs") +[wsa: complete fix needs all of http://patchwork.ozlabs.org/project/linux-i2c/list/?series=160959&state=*] +Reported-by: Martin Volf +Signed-off-by: Mika Westerberg +Reviewed-by: Guenter Roeck +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-i801.c | 45 +++++++++++------------------------------- + 1 file changed, 12 insertions(+), 33 deletions(-) + +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -129,11 +129,6 @@ + #define TCOBASE 0x050 + #define TCOCTL 0x054 + +-#define ACPIBASE 0x040 +-#define ACPIBASE_SMI_OFF 0x030 +-#define ACPICTRL 0x044 +-#define ACPICTRL_EN 0x080 +- + #define SBREG_BAR 0x10 + #define SBREG_SMBCTRL 0xc6000c + #define SBREG_SMBCTRL_DNV 0xcf000c +@@ -1544,7 +1539,7 @@ i801_add_tco_spt(struct i801_priv *priv, + pci_bus_write_config_byte(pci_dev->bus, devfn, 0xe1, hidden); + spin_unlock(&p2sb_spinlock); + +- res = &tco_res[ICH_RES_MEM_OFF]; ++ res = &tco_res[1]; + if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS) + res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV; + else +@@ -1554,7 +1549,7 @@ i801_add_tco_spt(struct i801_priv *priv, + res->flags = IORESOURCE_MEM; + + return platform_device_register_resndata(&pci_dev->dev, "iTCO_wdt", -1, +- tco_res, 3, &spt_tco_platform_data, ++ tco_res, 2, &spt_tco_platform_data, + sizeof(spt_tco_platform_data)); + } + +@@ -1567,17 +1562,16 @@ static struct platform_device * + i801_add_tco_cnl(struct i801_priv *priv, struct pci_dev *pci_dev, + struct resource *tco_res) + { +- return platform_device_register_resndata(&pci_dev->dev, "iTCO_wdt", -1, +- tco_res, 2, &cnl_tco_platform_data, +- sizeof(cnl_tco_platform_data)); ++ return platform_device_register_resndata(&pci_dev->dev, ++ "iTCO_wdt", -1, tco_res, 1, &cnl_tco_platform_data, ++ sizeof(cnl_tco_platform_data)); + } + + static void i801_add_tco(struct i801_priv *priv) + { +- u32 base_addr, tco_base, tco_ctl, ctrl_val; + struct pci_dev *pci_dev = priv->pci_dev; +- struct resource tco_res[3], *res; +- unsigned int devfn; ++ struct resource tco_res[2], *res; ++ u32 tco_base, tco_ctl; + + /* If we have ACPI based watchdog use that instead */ + if (acpi_has_watchdog()) +@@ -1592,30 +1586,15 @@ static void i801_add_tco(struct i801_pri + return; + + memset(tco_res, 0, sizeof(tco_res)); +- +- res = &tco_res[ICH_RES_IO_TCO]; +- res->start = tco_base & ~1; +- res->end = res->start + 32 - 1; +- res->flags = IORESOURCE_IO; +- + /* +- * Power Management registers. ++ * Always populate the main iTCO IO resource here. The second entry ++ * for NO_REBOOT MMIO is filled by the SPT specific function. + */ +- devfn = PCI_DEVFN(PCI_SLOT(pci_dev->devfn), 2); +- pci_bus_read_config_dword(pci_dev->bus, devfn, ACPIBASE, &base_addr); +- +- res = &tco_res[ICH_RES_IO_SMI]; +- res->start = (base_addr & ~1) + ACPIBASE_SMI_OFF; +- res->end = res->start + 3; ++ res = &tco_res[0]; ++ res->start = tco_base & ~1; ++ res->end = res->start + 32 - 1; + res->flags = IORESOURCE_IO; + +- /* +- * Enable the ACPI I/O space. +- */ +- pci_bus_read_config_dword(pci_dev->bus, devfn, ACPICTRL, &ctrl_val); +- ctrl_val |= ACPICTRL_EN; +- pci_bus_write_config_dword(pci_dev->bus, devfn, ACPICTRL, ctrl_val); +- + if (priv->features & FEATURE_TCO_CNL) + priv->tco_pdev = i801_add_tco_cnl(priv, pci_dev, tco_res); + else diff --git a/queue-5.4/ib-hfi1-ensure-pq-is-not-left-on-waitlist.patch b/queue-5.4/ib-hfi1-ensure-pq-is-not-left-on-waitlist.patch new file mode 100644 index 00000000000..e668d56e2a0 --- /dev/null +++ b/queue-5.4/ib-hfi1-ensure-pq-is-not-left-on-waitlist.patch @@ -0,0 +1,140 @@ +From 9a293d1e21a6461a11b4217b155bf445e57f4131 Mon Sep 17 00:00:00 2001 +From: Mike Marciniszyn +Date: Fri, 20 Mar 2020 16:02:10 -0400 +Subject: IB/hfi1: Ensure pq is not left on waitlist + +From: Mike Marciniszyn + +commit 9a293d1e21a6461a11b4217b155bf445e57f4131 upstream. + +The following warning can occur when a pq is left on the dmawait list and +the pq is then freed: + + WARNING: CPU: 47 PID: 3546 at lib/list_debug.c:29 __list_add+0x65/0xc0 + list_add corruption. next->prev should be prev (ffff939228da1880), but was ffff939cabb52230. (next=ffff939cabb52230). + Modules linked in: mmfs26(OE) mmfslinux(OE) tracedev(OE) 8021q garp mrp ib_isert iscsi_target_mod target_core_mod crc_t10dif crct10dif_generic opa_vnic rpcrdma ib_iser libiscsi scsi_transport_iscsi ib_ipoib(OE) bridge stp llc iTCO_wdt iTCO_vendor_support intel_powerclamp coretemp intel_rapl iosf_mbi kvm_intel kvm irqbypass crct10dif_pclmul crct10dif_common crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd ast ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm pcspkr joydev drm_panel_orientation_quirks i2c_i801 mei_me lpc_ich mei wmi ipmi_si ipmi_devintf ipmi_msghandler nfit libnvdimm acpi_power_meter acpi_pad hfi1(OE) rdmavt(OE) rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_core binfmt_misc numatools(OE) xpmem(OE) ip_tables + nfsv3 nfs_acl nfs lockd grace sunrpc fscache igb ahci libahci i2c_algo_bit dca libata ptp pps_core crc32c_intel [last unloaded: i2c_algo_bit] + CPU: 47 PID: 3546 Comm: wrf.exe Kdump: loaded Tainted: G W OE ------------ 3.10.0-957.41.1.el7.x86_64 #1 + Hardware name: HPE.COM HPE SGI 8600-XA730i Gen10/X11DPT-SB-SG007, BIOS SBED1229 01/22/2019 + Call Trace: + [] dump_stack+0x19/0x1b + [] __warn+0xd8/0x100 + [] warn_slowpath_fmt+0x5f/0x80 + [] ? ___slab_alloc+0x24e/0x4f0 + [] __list_add+0x65/0xc0 + [] defer_packet_queue+0x145/0x1a0 [hfi1] + [] sdma_check_progress+0x67/0xa0 [hfi1] + [] sdma_send_txlist+0x432/0x550 [hfi1] + [] ? kmem_cache_alloc+0x179/0x1f0 + [] ? user_sdma_send_pkts+0xc3/0x1990 [hfi1] + [] user_sdma_send_pkts+0x158a/0x1990 [hfi1] + [] ? try_to_del_timer_sync+0x5e/0x90 + [] ? __check_object_size+0x1ca/0x250 + [] hfi1_user_sdma_process_request+0xd66/0x1280 [hfi1] + [] hfi1_aio_write+0xca/0x120 [hfi1] + [] do_sync_readv_writev+0x7b/0xd0 + [] do_readv_writev+0xce/0x260 + [] ? pick_next_task_fair+0x5f/0x1b0 + [] ? sched_clock_cpu+0x85/0xc0 + [] ? __schedule+0x13a/0x860 + [] vfs_writev+0x35/0x60 + [] SyS_writev+0x7f/0x110 + [] system_call_fastpath+0x22/0x27 + +The issue happens when wait_event_interruptible_timeout() returns a value +<= 0. + +In that case, the pq is left on the list. The code continues sending +packets and potentially can complete the current request with the pq still +on the dmawait list provided no descriptor shortage is seen. + +If the pq is torn down in that state, the sdma interrupt handler could +find the now freed pq on the list with list corruption or memory +corruption resulting. + +Fix by adding a flush routine to ensure that the pq is never on a list +after processing a request. + +A follow-up patch series will address issues with seqlock surfaced in: +https://lore.kernel.org/r/20200320003129.GP20941@ziepe.ca + +The seqlock use for sdma will then be converted to a spin lock since the +list_empty() doesn't need the protection afforded by the sequence lock +currently in use. + +Fixes: a0d406934a46 ("staging/rdma/hfi1: Add page lock limit check for SDMA requests") +Link: https://lore.kernel.org/r/20200320200200.23203.37777.stgit@awfm-01.aw.intel.com +Reviewed-by: Kaike Wan +Signed-off-by: Mike Marciniszyn +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hfi1/user_sdma.c | 25 ++++++++++++++++++++++--- + 1 file changed, 22 insertions(+), 3 deletions(-) + +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -141,6 +141,7 @@ static int defer_packet_queue( + */ + xchg(&pq->state, SDMA_PKT_Q_DEFERRED); + if (list_empty(&pq->busy.list)) { ++ pq->busy.lock = &sde->waitlock; + iowait_get_priority(&pq->busy); + iowait_queue(pkts_sent, &pq->busy, &sde->dmawait); + } +@@ -155,6 +156,7 @@ static void activate_packet_queue(struct + { + struct hfi1_user_sdma_pkt_q *pq = + container_of(wait, struct hfi1_user_sdma_pkt_q, busy); ++ pq->busy.lock = NULL; + xchg(&pq->state, SDMA_PKT_Q_ACTIVE); + wake_up(&wait->wait_dma); + }; +@@ -256,6 +258,21 @@ pq_reqs_nomem: + return ret; + } + ++static void flush_pq_iowait(struct hfi1_user_sdma_pkt_q *pq) ++{ ++ unsigned long flags; ++ seqlock_t *lock = pq->busy.lock; ++ ++ if (!lock) ++ return; ++ write_seqlock_irqsave(lock, flags); ++ if (!list_empty(&pq->busy.list)) { ++ list_del_init(&pq->busy.list); ++ pq->busy.lock = NULL; ++ } ++ write_sequnlock_irqrestore(lock, flags); ++} ++ + int hfi1_user_sdma_free_queues(struct hfi1_filedata *fd, + struct hfi1_ctxtdata *uctxt) + { +@@ -281,6 +298,7 @@ int hfi1_user_sdma_free_queues(struct hf + kfree(pq->reqs); + kfree(pq->req_in_use); + kmem_cache_destroy(pq->txreq_cache); ++ flush_pq_iowait(pq); + kfree(pq); + } else { + spin_unlock(&fd->pq_rcu_lock); +@@ -587,11 +605,12 @@ int hfi1_user_sdma_process_request(struc + if (ret < 0) { + if (ret != -EBUSY) + goto free_req; +- wait_event_interruptible_timeout( ++ if (wait_event_interruptible_timeout( + pq->busy.wait_dma, +- (pq->state == SDMA_PKT_Q_ACTIVE), ++ pq->state == SDMA_PKT_Q_ACTIVE, + msecs_to_jiffies( +- SDMA_IOWAIT_TIMEOUT)); ++ SDMA_IOWAIT_TIMEOUT)) <= 0) ++ flush_pq_iowait(pq); + } + } + *count += idx; diff --git a/queue-5.4/iwlwifi-consider-he-capability-when-setting-ldpc.patch b/queue-5.4/iwlwifi-consider-he-capability-when-setting-ldpc.patch new file mode 100644 index 00000000000..74955655838 --- /dev/null +++ b/queue-5.4/iwlwifi-consider-he-capability-when-setting-ldpc.patch @@ -0,0 +1,40 @@ +From cb377dfda1755b3bc01436755d866c8e5336a762 Mon Sep 17 00:00:00 2001 +From: Mordechay Goodstein +Date: Fri, 6 Mar 2020 15:16:22 +0200 +Subject: iwlwifi: consider HE capability when setting LDPC + +From: Mordechay Goodstein + +commit cb377dfda1755b3bc01436755d866c8e5336a762 upstream. + +The AP may set the LDPC capability only in HE (IEEE80211_HE_PHY_CAP1), +but we were checking it only in the HT capabilities. + +If we don't use this capability when required, the DSP gets the wrong +configuration in HE and doesn't work properly. + +Signed-off-by: Mordechay Goodstein +Fixes: befebbb30af0 ("iwlwifi: rs: consider LDPC capability in case of HE") +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20200306151128.492d167c1a25.I1ad1353dbbf6c99ae57814be750f41a1c9f7f4ac@changeid +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c +@@ -147,7 +147,11 @@ static u16 rs_fw_get_config_flags(struct + (vht_ena && (vht_cap->cap & IEEE80211_VHT_CAP_RXLDPC)))) + flags |= IWL_TLC_MNG_CFG_FLAGS_LDPC_MSK; + +- /* consider our LDPC support in case of HE */ ++ /* consider LDPC support in case of HE */ ++ if (he_cap->has_he && (he_cap->he_cap_elem.phy_cap_info[1] & ++ IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)) ++ flags |= IWL_TLC_MNG_CFG_FLAGS_LDPC_MSK; ++ + if (sband->iftype_data && sband->iftype_data->he_cap.has_he && + !(sband->iftype_data->he_cap.he_cap_elem.phy_cap_info[1] & + IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD)) diff --git a/queue-5.4/iwlwifi-dbg-don-t-abort-if-sending-dbgc_suspend_resume-fails.patch b/queue-5.4/iwlwifi-dbg-don-t-abort-if-sending-dbgc_suspend_resume-fails.patch new file mode 100644 index 00000000000..b3979e68b5a --- /dev/null +++ b/queue-5.4/iwlwifi-dbg-don-t-abort-if-sending-dbgc_suspend_resume-fails.patch @@ -0,0 +1,83 @@ +From 699b760bd29edba736590fffef7654cb079c753e Mon Sep 17 00:00:00 2001 +From: Luca Coelho +Date: Fri, 6 Mar 2020 15:16:25 +0200 +Subject: iwlwifi: dbg: don't abort if sending DBGC_SUSPEND_RESUME fails + +From: Luca Coelho + +commit 699b760bd29edba736590fffef7654cb079c753e upstream. + +If the firmware is in a bad state or not initialized fully, sending +the DBGC_SUSPEND_RESUME command fails but we can still collect logs. + +Instead of aborting the entire dump process, simply ignore the error. +By removing the last callpoint that was checking the return value, we +can also convert the function to return void. + +Signed-off-by: Luca Coelho +Fixes: 576058330f2d ("iwlwifi: dbg: support debug recording suspend resume command") +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20200306151129.dcec37b2efd4.I8dcd190431d110a6a0e88095ce93591ccfb3d78d@changeid +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 15 +++++---------- + drivers/net/wireless/intel/iwlwifi/fw/dbg.h | 6 +++--- + 2 files changed, 8 insertions(+), 13 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +@@ -2311,10 +2311,7 @@ static void iwl_fw_dbg_collect_sync(stru + goto out; + } + +- if (iwl_fw_dbg_stop_restart_recording(fwrt, ¶ms, true)) { +- IWL_ERR(fwrt, "Failed to stop DBGC recording, aborting dump\n"); +- goto out; +- } ++ iwl_fw_dbg_stop_restart_recording(fwrt, ¶ms, true); + + IWL_DEBUG_FW_INFO(fwrt, "WRT: Data collection start\n"); + if (iwl_trans_dbg_ini_valid(fwrt->trans)) +@@ -2480,14 +2477,14 @@ static int iwl_fw_dbg_restart_recording( + return 0; + } + +-int iwl_fw_dbg_stop_restart_recording(struct iwl_fw_runtime *fwrt, +- struct iwl_fw_dbg_params *params, +- bool stop) ++void iwl_fw_dbg_stop_restart_recording(struct iwl_fw_runtime *fwrt, ++ struct iwl_fw_dbg_params *params, ++ bool stop) + { + int ret = 0; + + if (test_bit(STATUS_FW_ERROR, &fwrt->trans->status)) +- return 0; ++ return; + + if (fw_has_capa(&fwrt->fw->ucode_capa, + IWL_UCODE_TLV_CAPA_DBG_SUSPEND_RESUME_CMD_SUPP)) +@@ -2504,7 +2501,5 @@ int iwl_fw_dbg_stop_restart_recording(st + iwl_fw_set_dbg_rec_on(fwrt); + } + #endif +- +- return ret; + } + IWL_EXPORT_SYMBOL(iwl_fw_dbg_stop_restart_recording); +--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h +@@ -263,9 +263,9 @@ _iwl_fw_dbg_trigger_simple_stop(struct i + _iwl_fw_dbg_trigger_simple_stop((fwrt), (wdev), \ + iwl_fw_dbg_get_trigger((fwrt)->fw,\ + (trig))) +-int iwl_fw_dbg_stop_restart_recording(struct iwl_fw_runtime *fwrt, +- struct iwl_fw_dbg_params *params, +- bool stop); ++void iwl_fw_dbg_stop_restart_recording(struct iwl_fw_runtime *fwrt, ++ struct iwl_fw_dbg_params *params, ++ bool stop); + + #ifdef CONFIG_IWLWIFI_DEBUGFS + static inline void iwl_fw_set_dbg_rec_on(struct iwl_fw_runtime *fwrt) diff --git a/queue-5.4/iwlwifi-yoyo-don-t-add-tlv-offset-when-reading-fifos.patch b/queue-5.4/iwlwifi-yoyo-don-t-add-tlv-offset-when-reading-fifos.patch new file mode 100644 index 00000000000..aaf9c1b3fc1 --- /dev/null +++ b/queue-5.4/iwlwifi-yoyo-don-t-add-tlv-offset-when-reading-fifos.patch @@ -0,0 +1,59 @@ +From a5688e600e78f9fc68102bf0fe5c797fc2826abe Mon Sep 17 00:00:00 2001 +From: Mordechay Goodstein +Date: Fri, 6 Mar 2020 15:16:24 +0200 +Subject: iwlwifi: yoyo: don't add TLV offset when reading FIFOs + +From: Mordechay Goodstein + +commit a5688e600e78f9fc68102bf0fe5c797fc2826abe upstream. + +The TLV offset is only used to read registers, while the offset used for +the FIFO addresses are hard coded in the driver and not given by the +TLV. + +If we try to apply the TLV offset when reading the FIFOs, we'll read +from invalid addresses, causing the driver to hang. + +Signed-off-by: Mordechay Goodstein +Fixes: 8d7dea25ada7 ("iwlwifi: dbg_ini: implement Rx fifos dump") +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20200306151129.fbab869c26fa.I4ddac20d02f9bce41855a816aa6855c89bc3874e@changeid +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +@@ -8,7 +8,7 @@ + * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2015 - 2017 Intel Deutschland GmbH +- * Copyright(c) 2018 - 2019 Intel Corporation ++ * Copyright(c) 2018 - 2020 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -31,7 +31,7 @@ + * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2015 - 2017 Intel Deutschland GmbH +- * Copyright(c) 2018 - 2019 Intel Corporation ++ * Copyright(c) 2018 - 2020 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -1373,11 +1373,7 @@ static int iwl_dump_ini_rxf_iter(struct + goto out; + } + +- /* +- * region register have absolute value so apply rxf offset after +- * reading the registers +- */ +- offs += rxf_data.offset; ++ offs = rxf_data.offset; + + /* Lock fence */ + iwl_write_prph_no_grab(fwrt->trans, RXF_SET_FENCE_MODE + offs, 0x1); diff --git a/queue-5.4/net-fix-tx-hash-bound-checking.patch b/queue-5.4/net-fix-tx-hash-bound-checking.patch new file mode 100644 index 00000000000..3ec59673ec6 --- /dev/null +++ b/queue-5.4/net-fix-tx-hash-bound-checking.patch @@ -0,0 +1,42 @@ +From 6e11d1578fba8d09d03a286740ffcf336d53928c Mon Sep 17 00:00:00 2001 +From: Amritha Nambiar +Date: Mon, 24 Feb 2020 10:56:00 -0800 +Subject: net: Fix Tx hash bound checking + +From: Amritha Nambiar + +commit 6e11d1578fba8d09d03a286740ffcf336d53928c upstream. + +Fixes the lower and upper bounds when there are multiple TCs and +traffic is on the the same TC on the same device. + +The lower bound is represented by 'qoffset' and the upper limit for +hash value is 'qcount + qoffset'. This gives a clean Rx to Tx queue +mapping when there are multiple TCs, as the queue indices for upper TCs +will be offset by 'qoffset'. + +v2: Fixed commit description based on comments. + +Fixes: 1b837d489e06 ("net: Revoke export for __skb_tx_hash, update it to just be static skb_tx_hash") +Fixes: eadec877ce9c ("net: Add support for subordinate traffic classes to netdev_pick_tx") +Signed-off-by: Amritha Nambiar +Reviewed-by: Alexander Duyck +Reviewed-by: Sridhar Samudrala +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/dev.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2795,6 +2795,8 @@ static u16 skb_tx_hash(const struct net_ + + if (skb_rx_queue_recorded(skb)) { + hash = skb_get_rx_queue(skb); ++ if (hash >= qoffset) ++ hash -= qoffset; + while (unlikely(hash >= qcount)) + hash -= qcount; + return hash + qoffset; diff --git a/queue-5.4/net-mlx5e-ktls-fix-wrong-value-in-record-tracker-enum.patch b/queue-5.4/net-mlx5e-ktls-fix-wrong-value-in-record-tracker-enum.patch new file mode 100644 index 00000000000..5620dc5e1e8 --- /dev/null +++ b/queue-5.4/net-mlx5e-ktls-fix-wrong-value-in-record-tracker-enum.patch @@ -0,0 +1,35 @@ +From f28ca65efa87b3fb8da3d69ca7cb1ebc0448de66 Mon Sep 17 00:00:00 2001 +From: Tariq Toukan +Date: Mon, 24 Feb 2020 13:56:53 +0200 +Subject: net/mlx5e: kTLS, Fix wrong value in record tracker enum + +From: Tariq Toukan + +commit f28ca65efa87b3fb8da3d69ca7cb1ebc0448de66 upstream. + +Fix to match the HW spec: TRACKING state is 1, SEARCHING is 2. +No real issue for now, as these values are not currently used. + +Fixes: d2ead1f360e8 ("net/mlx5e: Add kTLS TX HW offload support") +Signed-off-by: Tariq Toukan +Reviewed-by: Boris Pismenny +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h +@@ -38,8 +38,8 @@ enum { + + enum { + MLX5E_TLS_PROGRESS_PARAMS_RECORD_TRACKER_STATE_START = 0, +- MLX5E_TLS_PROGRESS_PARAMS_RECORD_TRACKER_STATE_SEARCHING = 1, +- MLX5E_TLS_PROGRESS_PARAMS_RECORD_TRACKER_STATE_TRACKING = 2, ++ MLX5E_TLS_PROGRESS_PARAMS_RECORD_TRACKER_STATE_TRACKING = 1, ++ MLX5E_TLS_PROGRESS_PARAMS_RECORD_TRACKER_STATE_SEARCHING = 2, + }; + + struct mlx5e_ktls_offload_context_tx { diff --git a/queue-5.4/rxrpc-fix-sendmsg-msg_waitall-handling.patch b/queue-5.4/rxrpc-fix-sendmsg-msg_waitall-handling.patch new file mode 100644 index 00000000000..40e7fd1395a --- /dev/null +++ b/queue-5.4/rxrpc-fix-sendmsg-msg_waitall-handling.patch @@ -0,0 +1,34 @@ +From 498b577660f08cef5d9e78e0ed6dcd4c0939e98c Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Fri, 13 Mar 2020 17:30:27 +0000 +Subject: rxrpc: Fix sendmsg(MSG_WAITALL) handling + +From: David Howells + +commit 498b577660f08cef5d9e78e0ed6dcd4c0939e98c upstream. + +Fix the handling of sendmsg() with MSG_WAITALL for userspace to round the +timeout for when a signal occurs up to at least two jiffies as a 1 jiffy +timeout may end up being effectively 0 if jiffies wraps at the wrong time. + +Fixes: bc5e3a546d55 ("rxrpc: Use MSG_WAITALL to tell sendmsg() to temporarily ignore signals") +Signed-off-by: David Howells +Signed-off-by: Greg Kroah-Hartman + +--- + net/rxrpc/sendmsg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/rxrpc/sendmsg.c ++++ b/net/rxrpc/sendmsg.c +@@ -58,8 +58,8 @@ static int rxrpc_wait_for_tx_window_wait + + rtt = READ_ONCE(call->peer->rtt); + rtt2 = nsecs_to_jiffies64(rtt) * 2; +- if (rtt2 < 1) +- rtt2 = 1; ++ if (rtt2 < 2) ++ rtt2 = 2; + + timeout = rtt2; + tx_start = READ_ONCE(call->tx_hard_ack); diff --git a/queue-5.4/series b/queue-5.4/series index 5d950358c5f..66ac0355f2b 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -23,3 +23,13 @@ extcon-axp288-add-wakeup-support.patch power-supply-axp288_charger-add-special-handling-for-hp-pavilion-x2-10.patch revert-dm-always-call-blk_queue_split-in-dm_process_bio.patch alsa-hda-ca0132-add-recon3di-quirk-to-handle-integrated-sound-on-evga-x99-classified-motherboard.patch +soc-mediatek-knows_txdone-needs-to-be-set-in-mediatek-cmdq-helper.patch +net-mlx5e-ktls-fix-wrong-value-in-record-tracker-enum.patch +iwlwifi-consider-he-capability-when-setting-ldpc.patch +iwlwifi-yoyo-don-t-add-tlv-offset-when-reading-fifos.patch +iwlwifi-dbg-don-t-abort-if-sending-dbgc_suspend_resume-fails.patch +rxrpc-fix-sendmsg-msg_waitall-handling.patch +ib-hfi1-ensure-pq-is-not-left-on-waitlist.patch +tcp-fix-tfo-synack-undo-to-avoid-double-timestamp-undo.patch +i2c-i801-do-not-add-ich_res_io_smi-for-the-itco_wdt-device.patch +net-fix-tx-hash-bound-checking.patch diff --git a/queue-5.4/soc-mediatek-knows_txdone-needs-to-be-set-in-mediatek-cmdq-helper.patch b/queue-5.4/soc-mediatek-knows_txdone-needs-to-be-set-in-mediatek-cmdq-helper.patch new file mode 100644 index 00000000000..a55e07139eb --- /dev/null +++ b/queue-5.4/soc-mediatek-knows_txdone-needs-to-be-set-in-mediatek-cmdq-helper.patch @@ -0,0 +1,34 @@ +From ce35e21d82bcac8b3fd5128888f9e233f8444293 Mon Sep 17 00:00:00 2001 +From: Bibby Hsieh +Date: Fri, 14 Feb 2020 12:35:45 +0800 +Subject: soc: mediatek: knows_txdone needs to be set in Mediatek CMDQ helper + +From: Bibby Hsieh + +commit ce35e21d82bcac8b3fd5128888f9e233f8444293 upstream. + +Mediatek CMDQ driver have a mechanism to do TXDONE_BY_ACK, +so we should set knows_txdone. + +Fixes:576f1b4bc802 ("soc: mediatek: Add Mediatek CMDQ helper") + +Cc: stable@vger.kernel.org # v5.0+ +Signed-off-by: Bibby Hsieh +Reviewed-by: CK Hu +Signed-off-by: Matthias Brugger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/soc/mediatek/mtk-cmdq-helper.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/soc/mediatek/mtk-cmdq-helper.c ++++ b/drivers/soc/mediatek/mtk-cmdq-helper.c +@@ -38,6 +38,7 @@ struct cmdq_client *cmdq_mbox_create(str + client->pkt_cnt = 0; + client->client.dev = dev; + client->client.tx_block = false; ++ client->client.knows_txdone = true; + client->chan = mbox_request_channel(&client->client, index); + + if (IS_ERR(client->chan)) { diff --git a/queue-5.4/tcp-fix-tfo-synack-undo-to-avoid-double-timestamp-undo.patch b/queue-5.4/tcp-fix-tfo-synack-undo-to-avoid-double-timestamp-undo.patch new file mode 100644 index 00000000000..a86be6fa68f --- /dev/null +++ b/queue-5.4/tcp-fix-tfo-synack-undo-to-avoid-double-timestamp-undo.patch @@ -0,0 +1,68 @@ +From dad8cea7add96a353fa1898b5ccefbb72da66f29 Mon Sep 17 00:00:00 2001 +From: Neal Cardwell +Date: Sat, 22 Feb 2020 11:21:15 -0500 +Subject: tcp: fix TFO SYNACK undo to avoid double-timestamp-undo + +From: Neal Cardwell + +commit dad8cea7add96a353fa1898b5ccefbb72da66f29 upstream. + +In a rare corner case the new logic for undo of SYNACK RTO could +result in triggering the warning in tcp_fastretrans_alert() that says: + WARN_ON(tp->retrans_out != 0); + +The warning looked like: + +WARNING: CPU: 1 PID: 1 at net/ipv4/tcp_input.c:2818 tcp_ack+0x13e0/0x3270 + +The sequence that tickles this bug is: + - Fast Open server receives TFO SYN with data, sends SYNACK + - (client receives SYNACK and sends ACK, but ACK is lost) + - server app sends some data packets + - (N of the first data packets are lost) + - server receives client ACK that has a TS ECR matching first SYNACK, + and also SACKs suggesting the first N data packets were lost + - server performs TS undo of SYNACK RTO, then immediately + enters recovery + - buggy behavior then performed a *second* undo that caused + the connection to be in CA_Open with retrans_out != 0 + +Basically, the incoming ACK packet with SACK blocks causes us to first +undo the cwnd reduction from the SYNACK RTO, but then immediately +enters fast recovery, which then makes us eligible for undo again. And +then tcp_rcv_synrecv_state_fastopen() accidentally performs an undo +using a "mash-up" of state from two different loss recovery phases: it +uses the timestamp info from the ACK of the original SYNACK, and the +undo_marker from the fast recovery. + +This fix refines the logic to only invoke the tcp_try_undo_loss() +inside tcp_rcv_synrecv_state_fastopen() if the connection is still in +CA_Loss. If peer SACKs triggered fast recovery, then +tcp_rcv_synrecv_state_fastopen() can't safely undo. + +Fixes: 794200d66273 ("tcp: undo cwnd on Fast Open spurious SYNACK retransmit") +Signed-off-by: Neal Cardwell +Signed-off-by: Yuchung Cheng +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp_input.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -6096,7 +6096,11 @@ static void tcp_rcv_synrecv_state_fastop + { + struct request_sock *req; + +- tcp_try_undo_loss(sk, false); ++ /* If we are still handling the SYNACK RTO, see if timestamp ECR allows ++ * undo. If peer SACKs triggered fast recovery, we can't undo here. ++ */ ++ if (inet_csk(sk)->icsk_ca_state == TCP_CA_Loss) ++ tcp_try_undo_loss(sk, false); + + /* Reset rtx states to prevent spurious retransmits_timed_out() */ + tcp_sk(sk)->retrans_stamp = 0;