--- /dev/null
+From 4cd1103d8c66b2cdb7e64385c274edb0ac5e8887 Mon Sep 17 00:00:00 2001
+From: Joseph Qi <joseph.qi@linux.alibaba.com>
+Date: Sat, 29 Jan 2022 13:41:23 -0800
+Subject: jbd2: export jbd2_journal_[grab|put]_journal_head
+
+From: Joseph Qi <joseph.qi@linux.alibaba.com>
+
+commit 4cd1103d8c66b2cdb7e64385c274edb0ac5e8887 upstream.
+
+Patch series "ocfs2: fix a deadlock case".
+
+This fixes a deadlock case in ocfs2. We firstly export jbd2 symbols
+jbd2_journal_[grab|put]_journal_head as preparation and later use them
+in ocfs2 insread of jbd_[lock|unlock]_bh_journal_head to fix the
+deadlock.
+
+This patch (of 2):
+
+This exports symbols jbd2_journal_[grab|put]_journal_head, which will be
+used outside modules, e.g. ocfs2.
+
+Link: https://lkml.kernel.org/r/20220121071205.100648-2-joseph.qi@linux.alibaba.com
+Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Cc: Andreas Dilger <adilger.kernel@dilger.ca>
+Cc: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com>
+Cc: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com>
+Cc: "Theodore Ts'o" <tytso@mit.edu>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/jbd2/journal.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -2970,6 +2970,7 @@ struct journal_head *jbd2_journal_grab_j
+ jbd_unlock_bh_journal_head(bh);
+ return jh;
+ }
++EXPORT_SYMBOL(jbd2_journal_grab_journal_head);
+
+ static void __journal_remove_journal_head(struct buffer_head *bh)
+ {
+@@ -3022,6 +3023,7 @@ void jbd2_journal_put_journal_head(struc
+ jbd_unlock_bh_journal_head(bh);
+ }
+ }
++EXPORT_SYMBOL(jbd2_journal_put_journal_head);
+
+ /*
+ * Initialize jbd inode head
--- /dev/null
+From 27fe73394a1c6d0b07fa4d95f1bca116d1cc66e9 Mon Sep 17 00:00:00 2001
+From: Peter Collingbourne <pcc@google.com>
+Date: Sat, 29 Jan 2022 13:41:14 -0800
+Subject: mm, kasan: use compare-exchange operation to set KASAN page tag
+
+From: Peter Collingbourne <pcc@google.com>
+
+commit 27fe73394a1c6d0b07fa4d95f1bca116d1cc66e9 upstream.
+
+It has been reported that the tag setting operation on newly-allocated
+pages can cause the page flags to be corrupted when performed
+concurrently with other flag updates as a result of the use of
+non-atomic operations.
+
+Fix the problem by using a compare-exchange loop to update the tag.
+
+Link: https://lkml.kernel.org/r/20220120020148.1632253-1-pcc@google.com
+Link: https://linux-review.googlesource.com/id/I456b24a2b9067d93968d43b4bb3351c0cec63101
+Fixes: 2813b9c02962 ("kasan, mm, arm64: tag non slab memory allocated via pagealloc")
+Signed-off-by: Peter Collingbourne <pcc@google.com>
+Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/mm.h | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1524,11 +1524,18 @@ static inline u8 page_kasan_tag(const st
+
+ static inline void page_kasan_tag_set(struct page *page, u8 tag)
+ {
+- if (kasan_enabled()) {
+- tag ^= 0xff;
+- page->flags &= ~(KASAN_TAG_MASK << KASAN_TAG_PGSHIFT);
+- page->flags |= (tag & KASAN_TAG_MASK) << KASAN_TAG_PGSHIFT;
+- }
++ unsigned long old_flags, flags;
++
++ if (!kasan_enabled())
++ return;
++
++ tag ^= 0xff;
++ old_flags = READ_ONCE(page->flags);
++ do {
++ flags = old_flags;
++ flags &= ~(KASAN_TAG_MASK << KASAN_TAG_PGSHIFT);
++ flags |= (tag & KASAN_TAG_MASK) << KASAN_TAG_PGSHIFT;
++ } while (unlikely(!try_cmpxchg(&page->flags, &old_flags, flags)));
+ }
+
+ static inline void page_kasan_tag_reset(struct page *page)
--- /dev/null
+From 680a2ead741ad9b479a53adf154ed5eee74d2b9a Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 9 Dec 2021 14:06:27 +0100
+Subject: mt76: connac: introduce MCU_CE_CMD macro
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+commit 680a2ead741ad9b479a53adf154ed5eee74d2b9a upstream.
+
+Similar to MCU_EXT_CMD, introduce MCU_CE_CMD for CE commands
+
+Stable kernel notes:
+
+Upstream commit 547224024579 (mt76: connac: introduce MCU_UNI_CMD macro,
+2021-12-09) introduced a bug by removing MCU_UNI_PREFIX, but not
+updating MCU_CMD_MASK accordingly, so when commands are compared in
+mt7921_mcu_parse_response() one has the extra bit __MCU_CMD_FIELD_UNI
+set and the comparison fails:
+
+ if (mcu_cmd != event->cid)
+ if (20001 != 1)
+
+The fix was sneaked by in the next commit 680a2ead741a (mt76: connac:
+introduce MCU_CE_CMD macro, 2021-12-09):
+
+- int mcu_cmd = cmd & MCU_CMD_MASK;
++ int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
+
+But it was never merged into linux-stable.
+
+We need either both commits, or none.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 16 +++---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 47 ++++++++++--------
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h | 48 +++++++++----------
+ drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 24 ++++-----
+ drivers/net/wireless/mediatek/mt76/mt7921/testmode.c | 4 -
+ 5 files changed, 73 insertions(+), 66 deletions(-)
+
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
+@@ -145,7 +145,7 @@ void mt7615_mcu_fill_msg(struct mt7615_d
+ mcu_txd->cid = mcu_cmd;
+ mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
+
+- if (mcu_txd->ext_cid || (cmd & MCU_CE_PREFIX)) {
++ if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
+ if (cmd & __MCU_CMD_FIELD_QUERY)
+ mcu_txd->set_query = MCU_Q_QUERY;
+ else
+@@ -193,7 +193,7 @@ int mt7615_mcu_parse_response(struct mt7
+ skb_pull(skb, sizeof(*rxd));
+ event = (struct mt7615_mcu_uni_event *)skb->data;
+ ret = le32_to_cpu(event->status);
+- } else if (cmd == MCU_CMD_REG_READ) {
++ } else if (cmd == MCU_CE_QUERY(REG_READ)) {
+ struct mt7615_mcu_reg_event *event;
+
+ skb_pull(skb, sizeof(*rxd));
+@@ -2737,13 +2737,13 @@ int mt7615_mcu_set_bss_pm(struct mt7615_
+ if (vif->type != NL80211_IFTYPE_STATION)
+ return 0;
+
+- err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr,
+- sizeof(req_hdr), false);
++ err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT),
++ &req_hdr, sizeof(req_hdr), false);
+ if (err < 0 || !enable)
+ return err;
+
+- return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req,
+- sizeof(req), false);
++ return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED),
++ &req, sizeof(req), false);
+ }
+
+ int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif,
+@@ -2762,6 +2762,6 @@ int mt7615_mcu_set_roc(struct mt7615_phy
+
+ phy->roc_grant = false;
+
+- return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req,
+- sizeof(req), false);
++ return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_ROC),
++ &req, sizeof(req), false);
+ }
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+@@ -160,7 +160,8 @@ int mt76_connac_mcu_set_channel_domain(s
+
+ memcpy(__skb_push(skb, sizeof(hdr)), &hdr, sizeof(hdr));
+
+- return mt76_mcu_skb_send_msg(dev, skb, MCU_CMD_SET_CHAN_DOMAIN, false);
++ return mt76_mcu_skb_send_msg(dev, skb, MCU_CE_CMD(SET_CHAN_DOMAIN),
++ false);
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_channel_domain);
+
+@@ -198,8 +199,8 @@ int mt76_connac_mcu_set_vif_ps(struct mt
+ if (vif->type != NL80211_IFTYPE_STATION)
+ return -EOPNOTSUPP;
+
+- return mt76_mcu_send_msg(dev, MCU_CMD_SET_PS_PROFILE, &req,
+- sizeof(req), false);
++ return mt76_mcu_send_msg(dev, MCU_CE_CMD(SET_PS_PROFILE),
++ &req, sizeof(req), false);
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_vif_ps);
+
+@@ -1523,7 +1524,8 @@ int mt76_connac_mcu_hw_scan(struct mt76_
+ req->scan_func |= SCAN_FUNC_RANDOM_MAC;
+ }
+
+- err = mt76_mcu_skb_send_msg(mdev, skb, MCU_CMD_START_HW_SCAN, false);
++ err = mt76_mcu_skb_send_msg(mdev, skb, MCU_CE_CMD(START_HW_SCAN),
++ false);
+ if (err < 0)
+ clear_bit(MT76_HW_SCANNING, &phy->state);
+
+@@ -1551,8 +1553,8 @@ int mt76_connac_mcu_cancel_hw_scan(struc
+ ieee80211_scan_completed(phy->hw, &info);
+ }
+
+- return mt76_mcu_send_msg(phy->dev, MCU_CMD_CANCEL_HW_SCAN, &req,
+- sizeof(req), false);
++ return mt76_mcu_send_msg(phy->dev, MCU_CE_CMD(CANCEL_HW_SCAN),
++ &req, sizeof(req), false);
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_cancel_hw_scan);
+
+@@ -1638,7 +1640,8 @@ int mt76_connac_mcu_sched_scan_req(struc
+ memcpy(skb_put(skb, sreq->ie_len), sreq->ie, sreq->ie_len);
+ }
+
+- return mt76_mcu_skb_send_msg(mdev, skb, MCU_CMD_SCHED_SCAN_REQ, false);
++ return mt76_mcu_skb_send_msg(mdev, skb, MCU_CE_CMD(SCHED_SCAN_REQ),
++ false);
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_sched_scan_req);
+
+@@ -1658,8 +1661,8 @@ int mt76_connac_mcu_sched_scan_enable(st
+ else
+ clear_bit(MT76_HW_SCHED_SCANNING, &phy->state);
+
+- return mt76_mcu_send_msg(phy->dev, MCU_CMD_SCHED_SCAN_ENABLE, &req,
+- sizeof(req), false);
++ return mt76_mcu_send_msg(phy->dev, MCU_CE_CMD(SCHED_SCAN_ENABLE),
++ &req, sizeof(req), false);
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_sched_scan_enable);
+
+@@ -1671,8 +1674,8 @@ int mt76_connac_mcu_chip_config(struct m
+
+ memcpy(req.data, "assert", 7);
+
+- return mt76_mcu_send_msg(dev, MCU_CMD_CHIP_CONFIG, &req, sizeof(req),
+- false);
++ return mt76_mcu_send_msg(dev, MCU_CE_CMD(CHIP_CONFIG),
++ &req, sizeof(req), false);
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_chip_config);
+
+@@ -1684,8 +1687,8 @@ int mt76_connac_mcu_set_deep_sleep(struc
+
+ snprintf(req.data, sizeof(req.data), "KeepFullPwr %d", !enable);
+
+- return mt76_mcu_send_msg(dev, MCU_CMD_CHIP_CONFIG, &req, sizeof(req),
+- false);
++ return mt76_mcu_send_msg(dev, MCU_CE_CMD(CHIP_CONFIG),
++ &req, sizeof(req), false);
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_deep_sleep);
+
+@@ -1787,8 +1790,8 @@ int mt76_connac_mcu_get_nic_capability(s
+ struct sk_buff *skb;
+ int ret, i;
+
+- ret = mt76_mcu_send_and_get_msg(phy->dev, MCU_CMD_GET_NIC_CAPAB, NULL,
+- 0, true, &skb);
++ ret = mt76_mcu_send_and_get_msg(phy->dev, MCU_CE_CMD(GET_NIC_CAPAB),
++ NULL, 0, true, &skb);
+ if (ret)
+ return ret;
+
+@@ -2071,7 +2074,8 @@ mt76_connac_mcu_rate_txpower_band(struct
+ memcpy(skb->data, &tx_power_tlv, sizeof(tx_power_tlv));
+
+ err = mt76_mcu_skb_send_msg(dev, skb,
+- MCU_CMD_SET_RATE_TX_POWER, false);
++ MCU_CE_CMD(SET_RATE_TX_POWER),
++ false);
+ if (err < 0)
+ return err;
+ }
+@@ -2163,8 +2167,8 @@ int mt76_connac_mcu_set_p2p_oppps(struct
+ .bss_idx = mvif->idx,
+ };
+
+- return mt76_mcu_send_msg(phy->dev, MCU_CMD_SET_P2P_OPPPS, &req,
+- sizeof(req), false);
++ return mt76_mcu_send_msg(phy->dev, MCU_CE_CMD(SET_P2P_OPPPS),
++ &req, sizeof(req), false);
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_p2p_oppps);
+
+@@ -2490,8 +2494,8 @@ u32 mt76_connac_mcu_reg_rr(struct mt76_d
+ .addr = cpu_to_le32(offset),
+ };
+
+- return mt76_mcu_send_msg(dev, MCU_CMD_REG_READ, &req, sizeof(req),
+- true);
++ return mt76_mcu_send_msg(dev, MCU_CE_QUERY(REG_READ), &req,
++ sizeof(req), true);
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_reg_rr);
+
+@@ -2505,7 +2509,8 @@ void mt76_connac_mcu_reg_wr(struct mt76_
+ .val = cpu_to_le32(val),
+ };
+
+- mt76_mcu_send_msg(dev, MCU_CMD_REG_WRITE, &req, sizeof(req), false);
++ mt76_mcu_send_msg(dev, MCU_CE_CMD(REG_WRITE), &req,
++ sizeof(req), false);
+ }
+ EXPORT_SYMBOL_GPL(mt76_connac_mcu_reg_wr);
+
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+@@ -496,13 +496,11 @@ enum {
+ #define MCU_CMD_UNI_EXT_ACK (MCU_CMD_ACK | MCU_CMD_UNI | \
+ MCU_CMD_QUERY)
+
+-#define MCU_CE_PREFIX BIT(29)
+-#define MCU_CMD_MASK ~(MCU_CE_PREFIX)
+-
+ #define __MCU_CMD_FIELD_ID GENMASK(7, 0)
+ #define __MCU_CMD_FIELD_EXT_ID GENMASK(15, 8)
+ #define __MCU_CMD_FIELD_QUERY BIT(16)
+ #define __MCU_CMD_FIELD_UNI BIT(17)
++#define __MCU_CMD_FIELD_CE BIT(18)
+
+ #define MCU_CMD(_t) FIELD_PREP(__MCU_CMD_FIELD_ID, \
+ MCU_CMD_##_t)
+@@ -513,6 +511,10 @@ enum {
+ #define MCU_UNI_CMD(_t) (__MCU_CMD_FIELD_UNI | \
+ FIELD_PREP(__MCU_CMD_FIELD_ID, \
+ MCU_UNI_CMD_##_t))
++#define MCU_CE_CMD(_t) (__MCU_CMD_FIELD_CE | \
++ FIELD_PREP(__MCU_CMD_FIELD_ID, \
++ MCU_CE_CMD_##_t))
++#define MCU_CE_QUERY(_t) (MCU_CE_CMD(_t) | __MCU_CMD_FIELD_QUERY)
+
+ enum {
+ MCU_EXT_CMD_EFUSE_ACCESS = 0x01,
+@@ -589,26 +591,26 @@ enum {
+
+ /* offload mcu commands */
+ enum {
+- MCU_CMD_TEST_CTRL = MCU_CE_PREFIX | 0x01,
+- MCU_CMD_START_HW_SCAN = MCU_CE_PREFIX | 0x03,
+- MCU_CMD_SET_PS_PROFILE = MCU_CE_PREFIX | 0x05,
+- MCU_CMD_SET_CHAN_DOMAIN = MCU_CE_PREFIX | 0x0f,
+- MCU_CMD_SET_BSS_CONNECTED = MCU_CE_PREFIX | 0x16,
+- MCU_CMD_SET_BSS_ABORT = MCU_CE_PREFIX | 0x17,
+- MCU_CMD_CANCEL_HW_SCAN = MCU_CE_PREFIX | 0x1b,
+- MCU_CMD_SET_ROC = MCU_CE_PREFIX | 0x1d,
+- MCU_CMD_SET_P2P_OPPPS = MCU_CE_PREFIX | 0x33,
+- MCU_CMD_SET_RATE_TX_POWER = MCU_CE_PREFIX | 0x5d,
+- MCU_CMD_SCHED_SCAN_ENABLE = MCU_CE_PREFIX | 0x61,
+- MCU_CMD_SCHED_SCAN_REQ = MCU_CE_PREFIX | 0x62,
+- MCU_CMD_GET_NIC_CAPAB = MCU_CE_PREFIX | 0x8a,
+- MCU_CMD_SET_MU_EDCA_PARMS = MCU_CE_PREFIX | 0xb0,
+- MCU_CMD_REG_WRITE = MCU_CE_PREFIX | 0xc0,
+- MCU_CMD_REG_READ = MCU_CE_PREFIX | __MCU_CMD_FIELD_QUERY | 0xc0,
+- MCU_CMD_CHIP_CONFIG = MCU_CE_PREFIX | 0xca,
+- MCU_CMD_FWLOG_2_HOST = MCU_CE_PREFIX | 0xc5,
+- MCU_CMD_GET_WTBL = MCU_CE_PREFIX | 0xcd,
+- MCU_CMD_GET_TXPWR = MCU_CE_PREFIX | 0xd0,
++ MCU_CE_CMD_TEST_CTRL = 0x01,
++ MCU_CE_CMD_START_HW_SCAN = 0x03,
++ MCU_CE_CMD_SET_PS_PROFILE = 0x05,
++ MCU_CE_CMD_SET_CHAN_DOMAIN = 0x0f,
++ MCU_CE_CMD_SET_BSS_CONNECTED = 0x16,
++ MCU_CE_CMD_SET_BSS_ABORT = 0x17,
++ MCU_CE_CMD_CANCEL_HW_SCAN = 0x1b,
++ MCU_CE_CMD_SET_ROC = 0x1d,
++ MCU_CE_CMD_SET_P2P_OPPPS = 0x33,
++ MCU_CE_CMD_SET_RATE_TX_POWER = 0x5d,
++ MCU_CE_CMD_SCHED_SCAN_ENABLE = 0x61,
++ MCU_CE_CMD_SCHED_SCAN_REQ = 0x62,
++ MCU_CE_CMD_GET_NIC_CAPAB = 0x8a,
++ MCU_CE_CMD_SET_MU_EDCA_PARMS = 0xb0,
++ MCU_CE_CMD_REG_WRITE = 0xc0,
++ MCU_CE_CMD_REG_READ = 0xc0,
++ MCU_CE_CMD_CHIP_CONFIG = 0xca,
++ MCU_CE_CMD_FWLOG_2_HOST = 0xc5,
++ MCU_CE_CMD_GET_WTBL = 0xcd,
++ MCU_CE_CMD_GET_TXPWR = 0xd0,
+ };
+
+ enum {
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+@@ -163,8 +163,8 @@ mt7921_mcu_parse_eeprom(struct mt76_dev
+ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd,
+ struct sk_buff *skb, int seq)
+ {
++ int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd);
+ struct mt7921_mcu_rxd *rxd;
+- int mcu_cmd = cmd & MCU_CMD_MASK;
+ int ret = 0;
+
+ if (!skb) {
+@@ -201,7 +201,7 @@ int mt7921_mcu_parse_response(struct mt7
+ /* skip invalid event */
+ if (mcu_cmd != event->cid)
+ ret = -EAGAIN;
+- } else if (cmd == MCU_CMD_REG_READ) {
++ } else if (cmd == MCU_CE_QUERY(REG_READ)) {
+ struct mt7921_mcu_reg_event *event;
+
+ skb_pull(skb, sizeof(*rxd));
+@@ -274,7 +274,7 @@ int mt7921_mcu_fill_message(struct mt76_
+ mcu_txd->s2d_index = MCU_S2D_H2N;
+ mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd);
+
+- if (mcu_txd->ext_cid || (cmd & MCU_CE_PREFIX)) {
++ if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) {
+ if (cmd & __MCU_CMD_FIELD_QUERY)
+ mcu_txd->set_query = MCU_Q_QUERY;
+ else
+@@ -883,8 +883,8 @@ int mt7921_mcu_fw_log_2_host(struct mt79
+ .ctrl_val = ctrl
+ };
+
+- return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FWLOG_2_HOST, &data,
+- sizeof(data), false);
++ return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(FWLOG_2_HOST),
++ &data, sizeof(data), false);
+ }
+
+ int mt7921_run_firmware(struct mt7921_dev *dev)
+@@ -1009,8 +1009,8 @@ int mt7921_mcu_set_tx(struct mt7921_dev
+ e->timer = q->mu_edca_timer;
+ }
+
+- return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_MU_EDCA_PARMS, &req_mu,
+- sizeof(req_mu), false);
++ return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_MU_EDCA_PARMS),
++ &req_mu, sizeof(req_mu), false);
+ }
+
+ int mt7921_mcu_set_chan_info(struct mt7921_phy *phy, int cmd)
+@@ -1214,13 +1214,13 @@ mt7921_mcu_set_bss_pm(struct mt7921_dev
+ if (vif->type != NL80211_IFTYPE_STATION)
+ return 0;
+
+- err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr,
+- sizeof(req_hdr), false);
++ err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT),
++ &req_hdr, sizeof(req_hdr), false);
+ if (err < 0 || !enable)
+ return err;
+
+- return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req,
+- sizeof(req), false);
++ return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED),
++ &req, sizeof(req), false);
+ }
+
+ int mt7921_mcu_sta_update(struct mt7921_dev *dev, struct ieee80211_sta *sta,
+@@ -1330,7 +1330,7 @@ int mt7921_get_txpwr_info(struct mt7921_
+ struct sk_buff *skb;
+ int ret;
+
+- ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CMD_GET_TXPWR,
++ ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CE_CMD(GET_TXPWR),
+ &req, sizeof(req), true, &skb);
+ if (ret)
+ return ret;
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c
+@@ -66,7 +66,7 @@ mt7921_tm_set(struct mt7921_dev *dev, st
+ if (!mt76_testmode_enabled(phy))
+ goto out;
+
+- ret = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_TEST_CTRL, &cmd,
++ ret = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(TEST_CTRL), &cmd,
+ sizeof(cmd), false);
+ if (ret)
+ goto out;
+@@ -95,7 +95,7 @@ mt7921_tm_query(struct mt7921_dev *dev,
+ struct sk_buff *skb;
+ int ret;
+
+- ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CMD_TEST_CTRL,
++ ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CE_CMD(TEST_CTRL),
+ &cmd, sizeof(cmd), true, &skb);
+ if (ret)
+ goto out;
--- /dev/null
+From ddf4b773aa40790dfa936bd845c18e735a49c61c Mon Sep 17 00:00:00 2001
+From: Joseph Qi <joseph.qi@linux.alibaba.com>
+Date: Sat, 29 Jan 2022 13:41:27 -0800
+Subject: ocfs2: fix a deadlock when commit trans
+
+From: Joseph Qi <joseph.qi@linux.alibaba.com>
+
+commit ddf4b773aa40790dfa936bd845c18e735a49c61c upstream.
+
+commit 6f1b228529ae introduces a regression which can deadlock as
+follows:
+
+ Task1: Task2:
+ jbd2_journal_commit_transaction ocfs2_test_bg_bit_allocatable
+ spin_lock(&jh->b_state_lock) jbd_lock_bh_journal_head
+ __jbd2_journal_remove_checkpoint spin_lock(&jh->b_state_lock)
+ jbd2_journal_put_journal_head
+ jbd_lock_bh_journal_head
+
+Task1 and Task2 lock bh->b_state and jh->b_state_lock in different
+order, which finally result in a deadlock.
+
+So use jbd2_journal_[grab|put]_journal_head instead in
+ocfs2_test_bg_bit_allocatable() to fix it.
+
+Link: https://lkml.kernel.org/r/20220121071205.100648-3-joseph.qi@linux.alibaba.com
+Fixes: 6f1b228529ae ("ocfs2: fix race between searching chunks and release journal_head from buffer_head")
+Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Reported-by: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com>
+Tested-by: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com>
+Reported-by: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com>
+Cc: "Theodore Ts'o" <tytso@mit.edu>
+Cc: Andreas Dilger <adilger.kernel@dilger.ca>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Jun Piao <piaojun@huawei.com>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ocfs2/suballoc.c | 25 +++++++++++--------------
+ 1 file changed, 11 insertions(+), 14 deletions(-)
+
+--- a/fs/ocfs2/suballoc.c
++++ b/fs/ocfs2/suballoc.c
+@@ -1251,26 +1251,23 @@ static int ocfs2_test_bg_bit_allocatable
+ {
+ struct ocfs2_group_desc *bg = (struct ocfs2_group_desc *) bg_bh->b_data;
+ struct journal_head *jh;
+- int ret = 1;
++ int ret;
+
+ if (ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap))
+ return 0;
+
+- if (!buffer_jbd(bg_bh))
++ jh = jbd2_journal_grab_journal_head(bg_bh);
++ if (!jh)
+ return 1;
+
+- jbd_lock_bh_journal_head(bg_bh);
+- if (buffer_jbd(bg_bh)) {
+- jh = bh2jh(bg_bh);
+- spin_lock(&jh->b_state_lock);
+- bg = (struct ocfs2_group_desc *) jh->b_committed_data;
+- if (bg)
+- ret = !ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap);
+- else
+- ret = 1;
+- spin_unlock(&jh->b_state_lock);
+- }
+- jbd_unlock_bh_journal_head(bg_bh);
++ spin_lock(&jh->b_state_lock);
++ bg = (struct ocfs2_group_desc *) jh->b_committed_data;
++ if (bg)
++ ret = !ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap);
++ else
++ ret = 1;
++ spin_unlock(&jh->b_state_lock);
++ jbd2_journal_put_journal_head(jh);
+
+ return ret;
+ }
--- /dev/null
+From 66d28b21fe6b3da8d1e9f0a7ba38bc61b6c547e1 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Wed, 26 Jan 2022 09:40:01 -0600
+Subject: PCI/sysfs: Find shadow ROM before static attribute initialization
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit 66d28b21fe6b3da8d1e9f0a7ba38bc61b6c547e1 upstream.
+
+Ville reported that the sysfs "rom" file for VGA devices disappeared after
+527139d738d7 ("PCI/sysfs: Convert "rom" to static attribute").
+
+Prior to 527139d738d7, FINAL fixups, including pci_fixup_video() where we
+find shadow ROMs, were run before pci_create_sysfs_dev_files() created the
+sysfs "rom" file.
+
+After 527139d738d7, "rom" is a static attribute and is created before FINAL
+fixups are run, so we didn't create "rom" files for shadow ROMs:
+
+ acpi_pci_root_add
+ ...
+ pci_scan_single_device
+ pci_device_add
+ pci_fixup_video # <-- new HEADER fixup
+ device_add
+ ...
+ if (grp->is_visible())
+ pci_dev_rom_attr_is_visible # after 527139d738d7
+ pci_bus_add_devices
+ pci_bus_add_device
+ pci_fixup_device(pci_fixup_final)
+ pci_fixup_video # <-- previous FINAL fixup
+ pci_create_sysfs_dev_files
+ if (pci_resource_len(pdev, PCI_ROM_RESOURCE))
+ sysfs_create_bin_file("rom") # before 527139d738d7
+
+Change pci_fixup_video() to be a HEADER fixup so it runs before sysfs
+static attributes are initialized.
+
+Rename the Loongson pci_fixup_radeon() to pci_fixup_video() and make its
+dmesg logging identical to the others since it is doing the same job.
+
+Link: https://lore.kernel.org/r/YbxqIyrkv3GhZVxx@intel.com
+Fixes: 527139d738d7 ("PCI/sysfs: Convert "rom" to static attribute")
+Link: https://lore.kernel.org/r/20220126154001.16895-1-helgaas@kernel.org
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: stable@vger.kernel.org # v5.13+
+Cc: Huacai Chen <chenhuacai@kernel.org>
+Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Krzysztof Wilczyński <kw@linux.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/ia64/pci/fixup.c | 4 ++--
+ arch/mips/loongson64/vbios_quirk.c | 9 ++++-----
+ arch/x86/pci/fixup.c | 4 ++--
+ 3 files changed, 8 insertions(+), 9 deletions(-)
+
+--- a/arch/ia64/pci/fixup.c
++++ b/arch/ia64/pci/fixup.c
+@@ -76,5 +76,5 @@ static void pci_fixup_video(struct pci_d
+ }
+ }
+ }
+-DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_ANY_ID, PCI_ANY_ID,
+- PCI_CLASS_DISPLAY_VGA, 8, pci_fixup_video);
++DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_ANY_ID, PCI_ANY_ID,
++ PCI_CLASS_DISPLAY_VGA, 8, pci_fixup_video);
+--- a/arch/mips/loongson64/vbios_quirk.c
++++ b/arch/mips/loongson64/vbios_quirk.c
+@@ -3,7 +3,7 @@
+ #include <linux/pci.h>
+ #include <loongson.h>
+
+-static void pci_fixup_radeon(struct pci_dev *pdev)
++static void pci_fixup_video(struct pci_dev *pdev)
+ {
+ struct resource *res = &pdev->resource[PCI_ROM_RESOURCE];
+
+@@ -22,8 +22,7 @@ static void pci_fixup_radeon(struct pci_
+ res->flags = IORESOURCE_MEM | IORESOURCE_ROM_SHADOW |
+ IORESOURCE_PCI_FIXED;
+
+- dev_info(&pdev->dev, "BAR %d: assigned %pR for Radeon ROM\n",
+- PCI_ROM_RESOURCE, res);
++ dev_info(&pdev->dev, "Video device with shadowed ROM at %pR\n", res);
+ }
+-DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_ATI, 0x9615,
+- PCI_CLASS_DISPLAY_VGA, 8, pci_fixup_radeon);
++DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_ATI, 0x9615,
++ PCI_CLASS_DISPLAY_VGA, 8, pci_fixup_video);
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -353,8 +353,8 @@ static void pci_fixup_video(struct pci_d
+ }
+ }
+ }
+-DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_ANY_ID, PCI_ANY_ID,
+- PCI_CLASS_DISPLAY_VGA, 8, pci_fixup_video);
++DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_ANY_ID, PCI_ANY_ID,
++ PCI_CLASS_DISPLAY_VGA, 8, pci_fixup_video);
+
+
+ static const struct dmi_system_id msi_k8t_dmi_table[] = {
--- /dev/null
+From bba496656a73fc1d1330b49c7f82843836e9feb1 Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+Date: Wed, 22 Dec 2021 13:07:31 +0000
+Subject: powerpc/32: Fix boot failure with GCC latent entropy plugin
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+commit bba496656a73fc1d1330b49c7f82843836e9feb1 upstream.
+
+Boot fails with GCC latent entropy plugin enabled.
+
+This is due to early boot functions trying to access 'latent_entropy'
+global data while the kernel is not relocated at its final
+destination yet.
+
+As there is no way to tell GCC to use PTRRELOC() to access it,
+disable latent entropy plugin in early_32.o and feature-fixups.o and
+code-patching.o
+
+Fixes: 38addce8b600 ("gcc-plugins: Add latent_entropy plugin")
+Cc: stable@vger.kernel.org # v4.9+
+Reported-by: Erhard Furtner <erhard_f@mailbox.org>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=215217
+Link: https://lore.kernel.org/r/2bac55483b8daf5b1caa163a45fa5f9cdbe18be4.1640178426.git.christophe.leroy@csgroup.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/Makefile | 1 +
+ arch/powerpc/lib/Makefile | 3 +++
+ 2 files changed, 4 insertions(+)
+
+--- a/arch/powerpc/kernel/Makefile
++++ b/arch/powerpc/kernel/Makefile
+@@ -11,6 +11,7 @@ CFLAGS_prom_init.o += -fPIC
+ CFLAGS_btext.o += -fPIC
+ endif
+
++CFLAGS_early_32.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
+ CFLAGS_cputable.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
+ CFLAGS_prom_init.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
+ CFLAGS_btext.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
+--- a/arch/powerpc/lib/Makefile
++++ b/arch/powerpc/lib/Makefile
+@@ -19,6 +19,9 @@ CFLAGS_code-patching.o += -DDISABLE_BRAN
+ CFLAGS_feature-fixups.o += -DDISABLE_BRANCH_PROFILING
+ endif
+
++CFLAGS_code-patching.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
++CFLAGS_feature-fixups.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
++
+ obj-y += alloc.o code-patching.o feature-fixups.o pmem.o test_code-patching.o
+
+ ifndef CONFIG_KASAN
--- /dev/null
+From 37eb7ca91b692e8e49e7dd50158349a6c8fb5b09 Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+Date: Fri, 26 Nov 2021 13:40:35 +0100
+Subject: powerpc/32s: Allocate one 256k IBAT instead of two consecutives 128k IBATs
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+commit 37eb7ca91b692e8e49e7dd50158349a6c8fb5b09 upstream.
+
+Today we have the following IBATs allocated:
+
+ ---[ Instruction Block Address Translation ]---
+ 0: 0xc0000000-0xc03fffff 0x00000000 4M Kernel x m
+ 1: 0xc0400000-0xc05fffff 0x00400000 2M Kernel x m
+ 2: 0xc0600000-0xc06fffff 0x00600000 1M Kernel x m
+ 3: 0xc0700000-0xc077ffff 0x00700000 512K Kernel x m
+ 4: 0xc0780000-0xc079ffff 0x00780000 128K Kernel x m
+ 5: 0xc07a0000-0xc07bffff 0x007a0000 128K Kernel x m
+ 6: -
+ 7: -
+
+The two 128K should be a single 256K instead.
+
+When _etext is not aligned to 128Kbytes, the system will allocate
+all necessary BATs to the lower 128Kbytes boundary, then allocate
+an additional 128Kbytes BAT for the remaining block.
+
+Instead, align the top to 128Kbytes so that the function directly
+allocates a 256Kbytes last block:
+
+ ---[ Instruction Block Address Translation ]---
+ 0: 0xc0000000-0xc03fffff 0x00000000 4M Kernel x m
+ 1: 0xc0400000-0xc05fffff 0x00400000 2M Kernel x m
+ 2: 0xc0600000-0xc06fffff 0x00600000 1M Kernel x m
+ 3: 0xc0700000-0xc077ffff 0x00700000 512K Kernel x m
+ 4: 0xc0780000-0xc07bffff 0x00780000 256K Kernel x m
+ 5: -
+ 6: -
+ 7: -
+
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/ab58b296832b0ec650e2203200e060adbcb2677d.1637930421.git.christophe.leroy@csgroup.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/book3s32/mmu.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/arch/powerpc/mm/book3s32/mmu.c
++++ b/arch/powerpc/mm/book3s32/mmu.c
+@@ -196,18 +196,17 @@ void mmu_mark_initmem_nx(void)
+ int nb = mmu_has_feature(MMU_FTR_USE_HIGH_BATS) ? 8 : 4;
+ int i;
+ unsigned long base = (unsigned long)_stext - PAGE_OFFSET;
+- unsigned long top = (unsigned long)_etext - PAGE_OFFSET;
++ unsigned long top = ALIGN((unsigned long)_etext - PAGE_OFFSET, SZ_128K);
+ unsigned long border = (unsigned long)__init_begin - PAGE_OFFSET;
+ unsigned long size;
+
+- for (i = 0; i < nb - 1 && base < top && top - base > (128 << 10);) {
++ for (i = 0; i < nb - 1 && base < top;) {
+ size = block_size(base, top);
+ setibat(i++, PAGE_OFFSET + base, base, size, PAGE_KERNEL_TEXT);
+ base += size;
+ }
+ if (base < top) {
+ size = block_size(base, top);
+- size = max(size, 128UL << 10);
+ if ((top - base) > size) {
+ size <<= 1;
+ if (strict_kernel_rwx_enabled() && base + size > border)
--- /dev/null
+From d37823c3528e5e0705fc7746bcbc2afffb619259 Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+Date: Mon, 10 Jan 2022 15:29:25 +0000
+Subject: powerpc/32s: Fix kasan_init_region() for KASAN
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+commit d37823c3528e5e0705fc7746bcbc2afffb619259 upstream.
+
+It has been reported some configuration where the kernel doesn't
+boot with KASAN enabled.
+
+This is due to wrong BAT allocation for the KASAN area:
+
+ ---[ Data Block Address Translation ]---
+ 0: 0xc0000000-0xcfffffff 0x00000000 256M Kernel rw m
+ 1: 0xd0000000-0xdfffffff 0x10000000 256M Kernel rw m
+ 2: 0xe0000000-0xefffffff 0x20000000 256M Kernel rw m
+ 3: 0xf8000000-0xf9ffffff 0x2a000000 32M Kernel rw m
+ 4: 0xfa000000-0xfdffffff 0x2c000000 64M Kernel rw m
+
+A BAT must have both virtual and physical addresses alignment matching
+the size of the BAT. This is not the case for BAT 4 above.
+
+Fix kasan_init_region() by using block_size() function that is in
+book3s32/mmu.c. To be able to reuse it here, make it non static and
+change its name to bat_block_size() in order to avoid name conflict
+with block_size() defined in <linux/blkdev.h>
+
+Also reuse find_free_bat() to avoid an error message from setbat()
+when no BAT is available.
+
+And allocate memory outside of linear memory mapping to avoid
+wasting that precious space.
+
+With this change we get correct alignment for BATs and KASAN shadow
+memory is allocated outside the linear memory space.
+
+ ---[ Data Block Address Translation ]---
+ 0: 0xc0000000-0xcfffffff 0x00000000 256M Kernel rw
+ 1: 0xd0000000-0xdfffffff 0x10000000 256M Kernel rw
+ 2: 0xe0000000-0xefffffff 0x20000000 256M Kernel rw
+ 3: 0xf8000000-0xfbffffff 0x7c000000 64M Kernel rw
+ 4: 0xfc000000-0xfdffffff 0x7a000000 32M Kernel rw
+
+Fixes: 7974c4732642 ("powerpc/32s: Implement dedicated kasan_init_region()")
+Cc: stable@vger.kernel.org
+Reported-by: Maxime Bizon <mbizon@freebox.fr>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Tested-by: Maxime Bizon <mbizon@freebox.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/7a50ef902494d1325227d47d33dada01e52e5518.1641818726.git.christophe.leroy@csgroup.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/include/asm/book3s/32/mmu-hash.h | 2
+ arch/powerpc/mm/book3s32/mmu.c | 10 ++--
+ arch/powerpc/mm/kasan/book3s_32.c | 57 +++++++++++++-------------
+ 3 files changed, 37 insertions(+), 32 deletions(-)
+
+--- a/arch/powerpc/include/asm/book3s/32/mmu-hash.h
++++ b/arch/powerpc/include/asm/book3s/32/mmu-hash.h
+@@ -143,6 +143,8 @@ static __always_inline void update_user_
+ update_user_segment(15, val);
+ }
+
++int __init find_free_bat(void);
++unsigned int bat_block_size(unsigned long base, unsigned long top);
+ #endif /* !__ASSEMBLY__ */
+
+ /* We happily ignore the smaller BATs on 601, we don't actually use
+--- a/arch/powerpc/mm/book3s32/mmu.c
++++ b/arch/powerpc/mm/book3s32/mmu.c
+@@ -76,7 +76,7 @@ unsigned long p_block_mapped(phys_addr_t
+ return 0;
+ }
+
+-static int find_free_bat(void)
++int __init find_free_bat(void)
+ {
+ int b;
+ int n = mmu_has_feature(MMU_FTR_USE_HIGH_BATS) ? 8 : 4;
+@@ -100,7 +100,7 @@ static int find_free_bat(void)
+ * - block size has to be a power of two. This is calculated by finding the
+ * highest bit set to 1.
+ */
+-static unsigned int block_size(unsigned long base, unsigned long top)
++unsigned int bat_block_size(unsigned long base, unsigned long top)
+ {
+ unsigned int max_size = SZ_256M;
+ unsigned int base_shift = (ffs(base) - 1) & 31;
+@@ -145,7 +145,7 @@ static unsigned long __init __mmu_mapin_
+ int idx;
+
+ while ((idx = find_free_bat()) != -1 && base != top) {
+- unsigned int size = block_size(base, top);
++ unsigned int size = bat_block_size(base, top);
+
+ if (size < 128 << 10)
+ break;
+@@ -201,12 +201,12 @@ void mmu_mark_initmem_nx(void)
+ unsigned long size;
+
+ for (i = 0; i < nb - 1 && base < top;) {
+- size = block_size(base, top);
++ size = bat_block_size(base, top);
+ setibat(i++, PAGE_OFFSET + base, base, size, PAGE_KERNEL_TEXT);
+ base += size;
+ }
+ if (base < top) {
+- size = block_size(base, top);
++ size = bat_block_size(base, top);
+ if ((top - base) > size) {
+ size <<= 1;
+ if (strict_kernel_rwx_enabled() && base + size > border)
+--- a/arch/powerpc/mm/kasan/book3s_32.c
++++ b/arch/powerpc/mm/kasan/book3s_32.c
+@@ -10,48 +10,51 @@ int __init kasan_init_region(void *start
+ {
+ unsigned long k_start = (unsigned long)kasan_mem_to_shadow(start);
+ unsigned long k_end = (unsigned long)kasan_mem_to_shadow(start + size);
+- unsigned long k_cur = k_start;
+- int k_size = k_end - k_start;
+- int k_size_base = 1 << (ffs(k_size) - 1);
++ unsigned long k_nobat = k_start;
++ unsigned long k_cur;
++ phys_addr_t phys;
+ int ret;
+- void *block;
+
+- block = memblock_alloc(k_size, k_size_base);
++ while (k_nobat < k_end) {
++ unsigned int k_size = bat_block_size(k_nobat, k_end);
++ int idx = find_free_bat();
++
++ if (idx == -1)
++ break;
++ if (k_size < SZ_128K)
++ break;
++ phys = memblock_phys_alloc_range(k_size, k_size, 0,
++ MEMBLOCK_ALLOC_ANYWHERE);
++ if (!phys)
++ break;
+
+- if (block && k_size_base >= SZ_128K && k_start == ALIGN(k_start, k_size_base)) {
+- int shift = ffs(k_size - k_size_base);
+- int k_size_more = shift ? 1 << (shift - 1) : 0;
+-
+- setbat(-1, k_start, __pa(block), k_size_base, PAGE_KERNEL);
+- if (k_size_more >= SZ_128K)
+- setbat(-1, k_start + k_size_base, __pa(block) + k_size_base,
+- k_size_more, PAGE_KERNEL);
+- if (v_block_mapped(k_start))
+- k_cur = k_start + k_size_base;
+- if (v_block_mapped(k_start + k_size_base))
+- k_cur = k_start + k_size_base + k_size_more;
+-
+- update_bats();
++ setbat(idx, k_nobat, phys, k_size, PAGE_KERNEL);
++ k_nobat += k_size;
+ }
++ if (k_nobat != k_start)
++ update_bats();
+
+- if (!block)
+- block = memblock_alloc(k_size, PAGE_SIZE);
+- if (!block)
+- return -ENOMEM;
++ if (k_nobat < k_end) {
++ phys = memblock_phys_alloc_range(k_end - k_nobat, PAGE_SIZE, 0,
++ MEMBLOCK_ALLOC_ANYWHERE);
++ if (!phys)
++ return -ENOMEM;
++ }
+
+ ret = kasan_init_shadow_page_tables(k_start, k_end);
+ if (ret)
+ return ret;
+
+- kasan_update_early_region(k_start, k_cur, __pte(0));
++ kasan_update_early_region(k_start, k_nobat, __pte(0));
+
+- for (; k_cur < k_end; k_cur += PAGE_SIZE) {
++ for (k_cur = k_nobat; k_cur < k_end; k_cur += PAGE_SIZE) {
+ pmd_t *pmd = pmd_off_k(k_cur);
+- void *va = block + k_cur - k_start;
+- pte_t pte = pfn_pte(PHYS_PFN(__pa(va)), PAGE_KERNEL);
++ pte_t pte = pfn_pte(PHYS_PFN(phys + k_cur - k_nobat), PAGE_KERNEL);
+
+ __set_pte_at(&init_mm, k_cur, pte_offset_kernel(pmd, k_cur), pte, 0);
+ }
+ flush_tlb_kernel_range(k_start, k_end);
++ memset(kasan_mem_to_shadow(start), 0, k_end - k_start);
++
+ return 0;
+ }
--- /dev/null
+From 809232619f5b15e31fb3563985e705454f32621f Mon Sep 17 00:00:00 2001
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Date: Mon, 17 Jan 2022 15:30:10 -0500
+Subject: sched/membarrier: Fix membarrier-rseq fence command missing from query bitmask
+
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+
+commit 809232619f5b15e31fb3563985e705454f32621f upstream.
+
+The membarrier command MEMBARRIER_CMD_QUERY allows querying the
+available membarrier commands. When the membarrier-rseq fence commands
+were added, a new MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ_BITMASK was
+introduced with the intent to expose them with the MEMBARRIER_CMD_QUERY
+command, the but it was never added to MEMBARRIER_CMD_BITMASK.
+
+The membarrier-rseq fence commands are therefore not wired up with the
+query command.
+
+Rename MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ_BITMASK to
+MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK (the bitmask is not a command
+per-se), and change the erroneous
+MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_RSEQ_BITMASK (which does not
+actually exist) to MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_RSEQ.
+
+Wire up MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK in
+MEMBARRIER_CMD_BITMASK. Fixing this allows discovering availability of
+the membarrier-rseq fence feature.
+
+Fixes: 2a36ab717e8f ("rseq/membarrier: Add MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ")
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: <stable@vger.kernel.org> # 5.10+
+Link: https://lkml.kernel.org/r/20220117203010.30129-1-mathieu.desnoyers@efficios.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/membarrier.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/kernel/sched/membarrier.c
++++ b/kernel/sched/membarrier.c
+@@ -147,11 +147,11 @@
+ #endif
+
+ #ifdef CONFIG_RSEQ
+-#define MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ_BITMASK \
++#define MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK \
+ (MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ \
+- | MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_RSEQ_BITMASK)
++ | MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_RSEQ)
+ #else
+-#define MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ_BITMASK 0
++#define MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK 0
+ #endif
+
+ #define MEMBARRIER_CMD_BITMASK \
+@@ -159,7 +159,8 @@
+ | MEMBARRIER_CMD_REGISTER_GLOBAL_EXPEDITED \
+ | MEMBARRIER_CMD_PRIVATE_EXPEDITED \
+ | MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED \
+- | MEMBARRIER_PRIVATE_EXPEDITED_SYNC_CORE_BITMASK)
++ | MEMBARRIER_PRIVATE_EXPEDITED_SYNC_CORE_BITMASK \
++ | MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK)
+
+ static void ipi_mb(void *info)
+ {
usb-typec-tcpm-do-not-disconnect-while-receiving-vbus-off.patch
usb-typec-tcpm-do-not-disconnect-when-receiving-vsafe0v.patch
ucsi_ccg-check-dev_int-bit-only-when-starting-ccg4.patch
+mt76-connac-introduce-mcu_ce_cmd-macro.patch
+mm-kasan-use-compare-exchange-operation-to-set-kasan-page-tag.patch
+jbd2-export-jbd2_journal__journal_head.patch
+ocfs2-fix-a-deadlock-when-commit-trans.patch
+sched-membarrier-fix-membarrier-rseq-fence-command-missing-from-query-bitmask.patch
+pci-sysfs-find-shadow-rom-before-static-attribute-initialization.patch
+x86-mce-amd-allow-thresholding-interface-updates-after-init.patch
+x86-cpu-add-xeon-icelake-d-to-list-of-cpus-that-support-ppin.patch
+powerpc-32s-allocate-one-256k-ibat-instead-of-two-consecutives-128k-ibats.patch
+powerpc-32s-fix-kasan_init_region-for-kasan.patch
+powerpc-32-fix-boot-failure-with-gcc-latent-entropy-plugin.patch
--- /dev/null
+From e464121f2d40eabc7d11823fb26db807ce945df4 Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Fri, 21 Jan 2022 09:47:38 -0800
+Subject: x86/cpu: Add Xeon Icelake-D to list of CPUs that support PPIN
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit e464121f2d40eabc7d11823fb26db807ce945df4 upstream.
+
+Missed adding the Icelake-D CPU to the list. It uses the same MSRs
+to control and read the inventory number as all the other models.
+
+Fixes: dc6b025de95b ("x86/mce: Add Xeon Icelake to list of CPUs that support PPIN")
+Reported-by: Ailin Xu <ailin.xu@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20220121174743.1875294-2-tony.luck@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/mce/intel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kernel/cpu/mce/intel.c
++++ b/arch/x86/kernel/cpu/mce/intel.c
+@@ -486,6 +486,7 @@ static void intel_ppin_init(struct cpuin
+ case INTEL_FAM6_BROADWELL_X:
+ case INTEL_FAM6_SKYLAKE_X:
+ case INTEL_FAM6_ICELAKE_X:
++ case INTEL_FAM6_ICELAKE_D:
+ case INTEL_FAM6_SAPPHIRERAPIDS_X:
+ case INTEL_FAM6_XEON_PHI_KNL:
+ case INTEL_FAM6_XEON_PHI_KNM:
--- /dev/null
+From 1f52b0aba6fd37653416375cb8a1ca673acf8d5f Mon Sep 17 00:00:00 2001
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+Date: Mon, 17 Jan 2022 16:13:28 +0000
+Subject: x86/MCE/AMD: Allow thresholding interface updates after init
+
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+
+commit 1f52b0aba6fd37653416375cb8a1ca673acf8d5f upstream.
+
+Changes to the AMD Thresholding sysfs code prevents sysfs writes from
+updating the underlying registers once CPU init is completed, i.e.
+"threshold_banks" is set.
+
+Allow the registers to be updated if the thresholding interface is
+already initialized or if in the init path. Use the "set_lvt_off" value
+to indicate if running in the init path, since this value is only set
+during init.
+
+Fixes: a037f3ca0ea0 ("x86/mce/amd: Make threshold bank setting hotplug robust")
+Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20220117161328.19148-1-yazen.ghannam@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/mce/amd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/mce/amd.c
++++ b/arch/x86/kernel/cpu/mce/amd.c
+@@ -401,7 +401,7 @@ static void threshold_restart_bank(void
+ u32 hi, lo;
+
+ /* sysfs write might race against an offline operation */
+- if (this_cpu_read(threshold_banks))
++ if (!this_cpu_read(threshold_banks) && !tr->set_lvt_off)
+ return;
+
+ rdmsr(tr->b->address, lo, hi);
projects / thirdparty / kernel / stable-queue.git / commitdiff
