From: Greg Kroah-Hartman Date: Sun, 30 Jan 2022 12:56:37 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v5.4.176~51 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=eceaad9c64fa5e2c633a3a77729cd872dabe5f6b;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: jbd2-export-jbd2_journal__journal_head.patch mm-kasan-use-compare-exchange-operation-to-set-kasan-page-tag.patch mt76-connac-introduce-mcu_ce_cmd-macro.patch ocfs2-fix-a-deadlock-when-commit-trans.patch pci-sysfs-find-shadow-rom-before-static-attribute-initialization.patch powerpc-32-fix-boot-failure-with-gcc-latent-entropy-plugin.patch powerpc-32s-allocate-one-256k-ibat-instead-of-two-consecutives-128k-ibats.patch powerpc-32s-fix-kasan_init_region-for-kasan.patch sched-membarrier-fix-membarrier-rseq-fence-command-missing-from-query-bitmask.patch x86-cpu-add-xeon-icelake-d-to-list-of-cpus-that-support-ppin.patch x86-mce-amd-allow-thresholding-interface-updates-after-init.patch --- diff --git a/queue-5.15/jbd2-export-jbd2_journal__journal_head.patch b/queue-5.15/jbd2-export-jbd2_journal__journal_head.patch new file mode 100644 index 00000000000..a23335b592a --- /dev/null +++ b/queue-5.15/jbd2-export-jbd2_journal__journal_head.patch @@ -0,0 +1,59 @@ +From 4cd1103d8c66b2cdb7e64385c274edb0ac5e8887 Mon Sep 17 00:00:00 2001 +From: Joseph Qi +Date: Sat, 29 Jan 2022 13:41:23 -0800 +Subject: jbd2: export jbd2_journal_[grab|put]_journal_head + +From: Joseph Qi + +commit 4cd1103d8c66b2cdb7e64385c274edb0ac5e8887 upstream. + +Patch series "ocfs2: fix a deadlock case". + +This fixes a deadlock case in ocfs2. We firstly export jbd2 symbols +jbd2_journal_[grab|put]_journal_head as preparation and later use them +in ocfs2 insread of jbd_[lock|unlock]_bh_journal_head to fix the +deadlock. + +This patch (of 2): + +This exports symbols jbd2_journal_[grab|put]_journal_head, which will be +used outside modules, e.g. ocfs2. + +Link: https://lkml.kernel.org/r/20220121071205.100648-2-joseph.qi@linux.alibaba.com +Signed-off-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Cc: Andreas Dilger +Cc: Gautham Ananthakrishna +Cc: Saeed Mirzamohammadi +Cc: "Theodore Ts'o" +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/jbd2/journal.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -2970,6 +2970,7 @@ struct journal_head *jbd2_journal_grab_j + jbd_unlock_bh_journal_head(bh); + return jh; + } ++EXPORT_SYMBOL(jbd2_journal_grab_journal_head); + + static void __journal_remove_journal_head(struct buffer_head *bh) + { +@@ -3022,6 +3023,7 @@ void jbd2_journal_put_journal_head(struc + jbd_unlock_bh_journal_head(bh); + } + } ++EXPORT_SYMBOL(jbd2_journal_put_journal_head); + + /* + * Initialize jbd inode head diff --git a/queue-5.15/mm-kasan-use-compare-exchange-operation-to-set-kasan-page-tag.patch b/queue-5.15/mm-kasan-use-compare-exchange-operation-to-set-kasan-page-tag.patch new file mode 100644 index 00000000000..b4d265fa09d --- /dev/null +++ b/queue-5.15/mm-kasan-use-compare-exchange-operation-to-set-kasan-page-tag.patch @@ -0,0 +1,56 @@ +From 27fe73394a1c6d0b07fa4d95f1bca116d1cc66e9 Mon Sep 17 00:00:00 2001 +From: Peter Collingbourne +Date: Sat, 29 Jan 2022 13:41:14 -0800 +Subject: mm, kasan: use compare-exchange operation to set KASAN page tag + +From: Peter Collingbourne + +commit 27fe73394a1c6d0b07fa4d95f1bca116d1cc66e9 upstream. + +It has been reported that the tag setting operation on newly-allocated +pages can cause the page flags to be corrupted when performed +concurrently with other flag updates as a result of the use of +non-atomic operations. + +Fix the problem by using a compare-exchange loop to update the tag. + +Link: https://lkml.kernel.org/r/20220120020148.1632253-1-pcc@google.com +Link: https://linux-review.googlesource.com/id/I456b24a2b9067d93968d43b4bb3351c0cec63101 +Fixes: 2813b9c02962 ("kasan, mm, arm64: tag non slab memory allocated via pagealloc") +Signed-off-by: Peter Collingbourne +Reviewed-by: Andrey Konovalov +Cc: Peter Zijlstra +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/mm.h | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -1511,11 +1511,18 @@ static inline u8 page_kasan_tag(const st + + static inline void page_kasan_tag_set(struct page *page, u8 tag) + { +- if (kasan_enabled()) { +- tag ^= 0xff; +- page->flags &= ~(KASAN_TAG_MASK << KASAN_TAG_PGSHIFT); +- page->flags |= (tag & KASAN_TAG_MASK) << KASAN_TAG_PGSHIFT; +- } ++ unsigned long old_flags, flags; ++ ++ if (!kasan_enabled()) ++ return; ++ ++ tag ^= 0xff; ++ old_flags = READ_ONCE(page->flags); ++ do { ++ flags = old_flags; ++ flags &= ~(KASAN_TAG_MASK << KASAN_TAG_PGSHIFT); ++ flags |= (tag & KASAN_TAG_MASK) << KASAN_TAG_PGSHIFT; ++ } while (unlikely(!try_cmpxchg(&page->flags, &old_flags, flags))); + } + + static inline void page_kasan_tag_reset(struct page *page) diff --git a/queue-5.15/mt76-connac-introduce-mcu_ce_cmd-macro.patch b/queue-5.15/mt76-connac-introduce-mcu_ce_cmd-macro.patch new file mode 100644 index 00000000000..bfc7cc0f855 --- /dev/null +++ b/queue-5.15/mt76-connac-introduce-mcu_ce_cmd-macro.patch @@ -0,0 +1,418 @@ +From 680a2ead741ad9b479a53adf154ed5eee74d2b9a Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Thu, 9 Dec 2021 14:06:27 +0100 +Subject: mt76: connac: introduce MCU_CE_CMD macro + +From: Lorenzo Bianconi + +commit 680a2ead741ad9b479a53adf154ed5eee74d2b9a upstream. + +Similar to MCU_EXT_CMD, introduce MCU_CE_CMD for CE commands + +Stable kernel notes: + +Upstream commit 547224024579 (mt76: connac: introduce MCU_UNI_CMD macro, +2021-12-09) introduced a bug by removing MCU_UNI_PREFIX, but not +updating MCU_CMD_MASK accordingly, so when commands are compared in +mt7921_mcu_parse_response() one has the extra bit __MCU_CMD_FIELD_UNI +set and the comparison fails: + + if (mcu_cmd != event->cid) + if (20001 != 1) + +The fix was sneaked by in the next commit 680a2ead741a (mt76: connac: +introduce MCU_CE_CMD macro, 2021-12-09): + +- int mcu_cmd = cmd & MCU_CMD_MASK; ++ int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd); + +But it was never merged into linux-stable. + +We need either both commits, or none. + +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Felipe Contreras +Signed-off-by: Greg Kroah-Hartman +--- + .../net/wireless/mediatek/mt76/mt7615/mcu.c | 16 +++---- + .../wireless/mediatek/mt76/mt76_connac_mcu.c | 47 ++++++++++-------- + .../wireless/mediatek/mt76/mt76_connac_mcu.h | 48 ++++++++++--------- + .../net/wireless/mediatek/mt76/mt7921/mcu.c | 24 +++++----- + .../wireless/mediatek/mt76/mt7921/testmode.c | 4 +- + 5 files changed, 73 insertions(+), 66 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +index fcbcfc9f5a04..58be537adb1f 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +@@ -145,7 +145,7 @@ void mt7615_mcu_fill_msg(struct mt7615_dev *dev, struct sk_buff *skb, + mcu_txd->cid = mcu_cmd; + mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd); + +- if (mcu_txd->ext_cid || (cmd & MCU_CE_PREFIX)) { ++ if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) { + if (cmd & __MCU_CMD_FIELD_QUERY) + mcu_txd->set_query = MCU_Q_QUERY; + else +@@ -193,7 +193,7 @@ int mt7615_mcu_parse_response(struct mt76_dev *mdev, int cmd, + skb_pull(skb, sizeof(*rxd)); + event = (struct mt7615_mcu_uni_event *)skb->data; + ret = le32_to_cpu(event->status); +- } else if (cmd == MCU_CMD_REG_READ) { ++ } else if (cmd == MCU_CE_QUERY(REG_READ)) { + struct mt7615_mcu_reg_event *event; + + skb_pull(skb, sizeof(*rxd)); +@@ -2737,13 +2737,13 @@ int mt7615_mcu_set_bss_pm(struct mt7615_dev *dev, struct ieee80211_vif *vif, + if (vif->type != NL80211_IFTYPE_STATION) + return 0; + +- err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr, +- sizeof(req_hdr), false); ++ err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT), ++ &req_hdr, sizeof(req_hdr), false); + if (err < 0 || !enable) + return err; + +- return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req, +- sizeof(req), false); ++ return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED), ++ &req, sizeof(req), false); + } + + int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif, +@@ -2762,6 +2762,6 @@ int mt7615_mcu_set_roc(struct mt7615_phy *phy, struct ieee80211_vif *vif, + + phy->roc_grant = false; + +- return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_ROC, &req, +- sizeof(req), false); ++ return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_ROC), ++ &req, sizeof(req), false); + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +index 4a693368a4bf..71896e56256e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +@@ -160,7 +160,8 @@ int mt76_connac_mcu_set_channel_domain(struct mt76_phy *phy) + + memcpy(__skb_push(skb, sizeof(hdr)), &hdr, sizeof(hdr)); + +- return mt76_mcu_skb_send_msg(dev, skb, MCU_CMD_SET_CHAN_DOMAIN, false); ++ return mt76_mcu_skb_send_msg(dev, skb, MCU_CE_CMD(SET_CHAN_DOMAIN), ++ false); + } + EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_channel_domain); + +@@ -198,8 +199,8 @@ int mt76_connac_mcu_set_vif_ps(struct mt76_dev *dev, struct ieee80211_vif *vif) + if (vif->type != NL80211_IFTYPE_STATION) + return -EOPNOTSUPP; + +- return mt76_mcu_send_msg(dev, MCU_CMD_SET_PS_PROFILE, &req, +- sizeof(req), false); ++ return mt76_mcu_send_msg(dev, MCU_CE_CMD(SET_PS_PROFILE), ++ &req, sizeof(req), false); + } + EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_vif_ps); + +@@ -1519,7 +1520,8 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif, + req->scan_func |= SCAN_FUNC_RANDOM_MAC; + } + +- err = mt76_mcu_skb_send_msg(mdev, skb, MCU_CMD_START_HW_SCAN, false); ++ err = mt76_mcu_skb_send_msg(mdev, skb, MCU_CE_CMD(START_HW_SCAN), ++ false); + if (err < 0) + clear_bit(MT76_HW_SCANNING, &phy->state); + +@@ -1547,8 +1549,8 @@ int mt76_connac_mcu_cancel_hw_scan(struct mt76_phy *phy, + ieee80211_scan_completed(phy->hw, &info); + } + +- return mt76_mcu_send_msg(phy->dev, MCU_CMD_CANCEL_HW_SCAN, &req, +- sizeof(req), false); ++ return mt76_mcu_send_msg(phy->dev, MCU_CE_CMD(CANCEL_HW_SCAN), ++ &req, sizeof(req), false); + } + EXPORT_SYMBOL_GPL(mt76_connac_mcu_cancel_hw_scan); + +@@ -1634,7 +1636,8 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy, + memcpy(skb_put(skb, sreq->ie_len), sreq->ie, sreq->ie_len); + } + +- return mt76_mcu_skb_send_msg(mdev, skb, MCU_CMD_SCHED_SCAN_REQ, false); ++ return mt76_mcu_skb_send_msg(mdev, skb, MCU_CE_CMD(SCHED_SCAN_REQ), ++ false); + } + EXPORT_SYMBOL_GPL(mt76_connac_mcu_sched_scan_req); + +@@ -1654,8 +1657,8 @@ int mt76_connac_mcu_sched_scan_enable(struct mt76_phy *phy, + else + clear_bit(MT76_HW_SCHED_SCANNING, &phy->state); + +- return mt76_mcu_send_msg(phy->dev, MCU_CMD_SCHED_SCAN_ENABLE, &req, +- sizeof(req), false); ++ return mt76_mcu_send_msg(phy->dev, MCU_CE_CMD(SCHED_SCAN_ENABLE), ++ &req, sizeof(req), false); + } + EXPORT_SYMBOL_GPL(mt76_connac_mcu_sched_scan_enable); + +@@ -1667,8 +1670,8 @@ int mt76_connac_mcu_chip_config(struct mt76_dev *dev) + + memcpy(req.data, "assert", 7); + +- return mt76_mcu_send_msg(dev, MCU_CMD_CHIP_CONFIG, &req, sizeof(req), +- false); ++ return mt76_mcu_send_msg(dev, MCU_CE_CMD(CHIP_CONFIG), ++ &req, sizeof(req), false); + } + EXPORT_SYMBOL_GPL(mt76_connac_mcu_chip_config); + +@@ -1680,8 +1683,8 @@ int mt76_connac_mcu_set_deep_sleep(struct mt76_dev *dev, bool enable) + + snprintf(req.data, sizeof(req.data), "KeepFullPwr %d", !enable); + +- return mt76_mcu_send_msg(dev, MCU_CMD_CHIP_CONFIG, &req, sizeof(req), +- false); ++ return mt76_mcu_send_msg(dev, MCU_CE_CMD(CHIP_CONFIG), ++ &req, sizeof(req), false); + } + EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_deep_sleep); + +@@ -1783,8 +1786,8 @@ int mt76_connac_mcu_get_nic_capability(struct mt76_phy *phy) + struct sk_buff *skb; + int ret, i; + +- ret = mt76_mcu_send_and_get_msg(phy->dev, MCU_CMD_GET_NIC_CAPAB, NULL, +- 0, true, &skb); ++ ret = mt76_mcu_send_and_get_msg(phy->dev, MCU_CE_CMD(GET_NIC_CAPAB), ++ NULL, 0, true, &skb); + if (ret) + return ret; + +@@ -2042,7 +2045,8 @@ mt76_connac_mcu_rate_txpower_band(struct mt76_phy *phy, + memcpy(skb->data, &tx_power_tlv, sizeof(tx_power_tlv)); + + err = mt76_mcu_skb_send_msg(dev, skb, +- MCU_CMD_SET_RATE_TX_POWER, false); ++ MCU_CE_CMD(SET_RATE_TX_POWER), ++ false); + if (err < 0) + return err; + } +@@ -2134,8 +2138,8 @@ int mt76_connac_mcu_set_p2p_oppps(struct ieee80211_hw *hw, + .bss_idx = mvif->idx, + }; + +- return mt76_mcu_send_msg(phy->dev, MCU_CMD_SET_P2P_OPPPS, &req, +- sizeof(req), false); ++ return mt76_mcu_send_msg(phy->dev, MCU_CE_CMD(SET_P2P_OPPPS), ++ &req, sizeof(req), false); + } + EXPORT_SYMBOL_GPL(mt76_connac_mcu_set_p2p_oppps); + +@@ -2461,8 +2465,8 @@ u32 mt76_connac_mcu_reg_rr(struct mt76_dev *dev, u32 offset) + .addr = cpu_to_le32(offset), + }; + +- return mt76_mcu_send_msg(dev, MCU_CMD_REG_READ, &req, sizeof(req), +- true); ++ return mt76_mcu_send_msg(dev, MCU_CE_QUERY(REG_READ), &req, ++ sizeof(req), true); + } + EXPORT_SYMBOL_GPL(mt76_connac_mcu_reg_rr); + +@@ -2476,7 +2480,8 @@ void mt76_connac_mcu_reg_wr(struct mt76_dev *dev, u32 offset, u32 val) + .val = cpu_to_le32(val), + }; + +- mt76_mcu_send_msg(dev, MCU_CMD_REG_WRITE, &req, sizeof(req), false); ++ mt76_mcu_send_msg(dev, MCU_CE_CMD(REG_WRITE), &req, ++ sizeof(req), false); + } + EXPORT_SYMBOL_GPL(mt76_connac_mcu_reg_wr); + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h +index 655dfd955310..039e228e0435 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h +@@ -497,13 +497,11 @@ enum { + #define MCU_CMD_UNI_EXT_ACK (MCU_CMD_ACK | MCU_CMD_UNI | \ + MCU_CMD_QUERY) + +-#define MCU_CE_PREFIX BIT(29) +-#define MCU_CMD_MASK ~(MCU_CE_PREFIX) +- + #define __MCU_CMD_FIELD_ID GENMASK(7, 0) + #define __MCU_CMD_FIELD_EXT_ID GENMASK(15, 8) + #define __MCU_CMD_FIELD_QUERY BIT(16) + #define __MCU_CMD_FIELD_UNI BIT(17) ++#define __MCU_CMD_FIELD_CE BIT(18) + + #define MCU_CMD(_t) FIELD_PREP(__MCU_CMD_FIELD_ID, \ + MCU_CMD_##_t) +@@ -514,6 +512,10 @@ enum { + #define MCU_UNI_CMD(_t) (__MCU_CMD_FIELD_UNI | \ + FIELD_PREP(__MCU_CMD_FIELD_ID, \ + MCU_UNI_CMD_##_t)) ++#define MCU_CE_CMD(_t) (__MCU_CMD_FIELD_CE | \ ++ FIELD_PREP(__MCU_CMD_FIELD_ID, \ ++ MCU_CE_CMD_##_t)) ++#define MCU_CE_QUERY(_t) (MCU_CE_CMD(_t) | __MCU_CMD_FIELD_QUERY) + + enum { + MCU_EXT_CMD_EFUSE_ACCESS = 0x01, +@@ -590,26 +592,26 @@ enum { + + /* offload mcu commands */ + enum { +- MCU_CMD_TEST_CTRL = MCU_CE_PREFIX | 0x01, +- MCU_CMD_START_HW_SCAN = MCU_CE_PREFIX | 0x03, +- MCU_CMD_SET_PS_PROFILE = MCU_CE_PREFIX | 0x05, +- MCU_CMD_SET_CHAN_DOMAIN = MCU_CE_PREFIX | 0x0f, +- MCU_CMD_SET_BSS_CONNECTED = MCU_CE_PREFIX | 0x16, +- MCU_CMD_SET_BSS_ABORT = MCU_CE_PREFIX | 0x17, +- MCU_CMD_CANCEL_HW_SCAN = MCU_CE_PREFIX | 0x1b, +- MCU_CMD_SET_ROC = MCU_CE_PREFIX | 0x1d, +- MCU_CMD_SET_P2P_OPPPS = MCU_CE_PREFIX | 0x33, +- MCU_CMD_SET_RATE_TX_POWER = MCU_CE_PREFIX | 0x5d, +- MCU_CMD_SCHED_SCAN_ENABLE = MCU_CE_PREFIX | 0x61, +- MCU_CMD_SCHED_SCAN_REQ = MCU_CE_PREFIX | 0x62, +- MCU_CMD_GET_NIC_CAPAB = MCU_CE_PREFIX | 0x8a, +- MCU_CMD_SET_MU_EDCA_PARMS = MCU_CE_PREFIX | 0xb0, +- MCU_CMD_REG_WRITE = MCU_CE_PREFIX | 0xc0, +- MCU_CMD_REG_READ = MCU_CE_PREFIX | __MCU_CMD_FIELD_QUERY | 0xc0, +- MCU_CMD_CHIP_CONFIG = MCU_CE_PREFIX | 0xca, +- MCU_CMD_FWLOG_2_HOST = MCU_CE_PREFIX | 0xc5, +- MCU_CMD_GET_WTBL = MCU_CE_PREFIX | 0xcd, +- MCU_CMD_GET_TXPWR = MCU_CE_PREFIX | 0xd0, ++ MCU_CE_CMD_TEST_CTRL = 0x01, ++ MCU_CE_CMD_START_HW_SCAN = 0x03, ++ MCU_CE_CMD_SET_PS_PROFILE = 0x05, ++ MCU_CE_CMD_SET_CHAN_DOMAIN = 0x0f, ++ MCU_CE_CMD_SET_BSS_CONNECTED = 0x16, ++ MCU_CE_CMD_SET_BSS_ABORT = 0x17, ++ MCU_CE_CMD_CANCEL_HW_SCAN = 0x1b, ++ MCU_CE_CMD_SET_ROC = 0x1d, ++ MCU_CE_CMD_SET_P2P_OPPPS = 0x33, ++ MCU_CE_CMD_SET_RATE_TX_POWER = 0x5d, ++ MCU_CE_CMD_SCHED_SCAN_ENABLE = 0x61, ++ MCU_CE_CMD_SCHED_SCAN_REQ = 0x62, ++ MCU_CE_CMD_GET_NIC_CAPAB = 0x8a, ++ MCU_CE_CMD_SET_MU_EDCA_PARMS = 0xb0, ++ MCU_CE_CMD_REG_WRITE = 0xc0, ++ MCU_CE_CMD_REG_READ = 0xc0, ++ MCU_CE_CMD_CHIP_CONFIG = 0xca, ++ MCU_CE_CMD_FWLOG_2_HOST = 0xc5, ++ MCU_CE_CMD_GET_WTBL = 0xcd, ++ MCU_CE_CMD_GET_TXPWR = 0xd0, + }; + + enum { +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +index bbb53b4507e8..7f04af865046 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +@@ -163,8 +163,8 @@ mt7921_mcu_parse_eeprom(struct mt76_dev *dev, struct sk_buff *skb) + int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd, + struct sk_buff *skb, int seq) + { ++ int mcu_cmd = FIELD_GET(__MCU_CMD_FIELD_ID, cmd); + struct mt7921_mcu_rxd *rxd; +- int mcu_cmd = cmd & MCU_CMD_MASK; + int ret = 0; + + if (!skb) { +@@ -201,7 +201,7 @@ int mt7921_mcu_parse_response(struct mt76_dev *mdev, int cmd, + /* skip invalid event */ + if (mcu_cmd != event->cid) + ret = -EAGAIN; +- } else if (cmd == MCU_CMD_REG_READ) { ++ } else if (cmd == MCU_CE_QUERY(REG_READ)) { + struct mt7921_mcu_reg_event *event; + + skb_pull(skb, sizeof(*rxd)); +@@ -274,7 +274,7 @@ int mt7921_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb, + mcu_txd->s2d_index = MCU_S2D_H2N; + mcu_txd->ext_cid = FIELD_GET(__MCU_CMD_FIELD_EXT_ID, cmd); + +- if (mcu_txd->ext_cid || (cmd & MCU_CE_PREFIX)) { ++ if (mcu_txd->ext_cid || (cmd & __MCU_CMD_FIELD_CE)) { + if (cmd & __MCU_CMD_FIELD_QUERY) + mcu_txd->set_query = MCU_Q_QUERY; + else +@@ -894,8 +894,8 @@ int mt7921_mcu_fw_log_2_host(struct mt7921_dev *dev, u8 ctrl) + .ctrl_val = ctrl + }; + +- return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_FWLOG_2_HOST, &data, +- sizeof(data), false); ++ return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(FWLOG_2_HOST), ++ &data, sizeof(data), false); + } + + int mt7921_run_firmware(struct mt7921_dev *dev) +@@ -1020,8 +1020,8 @@ int mt7921_mcu_set_tx(struct mt7921_dev *dev, struct ieee80211_vif *vif) + e->timer = q->mu_edca_timer; + } + +- return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_MU_EDCA_PARMS, &req_mu, +- sizeof(req_mu), false); ++ return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_MU_EDCA_PARMS), ++ &req_mu, sizeof(req_mu), false); + } + + int mt7921_mcu_set_chan_info(struct mt7921_phy *phy, int cmd) +@@ -1225,13 +1225,13 @@ mt7921_mcu_set_bss_pm(struct mt7921_dev *dev, struct ieee80211_vif *vif, + if (vif->type != NL80211_IFTYPE_STATION) + return 0; + +- err = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_ABORT, &req_hdr, +- sizeof(req_hdr), false); ++ err = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_ABORT), ++ &req_hdr, sizeof(req_hdr), false); + if (err < 0 || !enable) + return err; + +- return mt76_mcu_send_msg(&dev->mt76, MCU_CMD_SET_BSS_CONNECTED, &req, +- sizeof(req), false); ++ return mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_BSS_CONNECTED), ++ &req, sizeof(req), false); + } + + int mt7921_mcu_sta_update(struct mt7921_dev *dev, struct ieee80211_sta *sta, +@@ -1341,7 +1341,7 @@ int mt7921_get_txpwr_info(struct mt7921_dev *dev, struct mt7921_txpwr *txpwr) + struct sk_buff *skb; + int ret; + +- ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CMD_GET_TXPWR, ++ ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CE_CMD(GET_TXPWR), + &req, sizeof(req), true, &skb); + if (ret) + return ret; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c b/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c +index 8bd43879dd6f..bdec8684ce94 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/testmode.c +@@ -66,7 +66,7 @@ mt7921_tm_set(struct mt7921_dev *dev, struct mt7921_tm_cmd *req) + if (!mt76_testmode_enabled(phy)) + goto out; + +- ret = mt76_mcu_send_msg(&dev->mt76, MCU_CMD_TEST_CTRL, &cmd, ++ ret = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(TEST_CTRL), &cmd, + sizeof(cmd), false); + if (ret) + goto out; +@@ -95,7 +95,7 @@ mt7921_tm_query(struct mt7921_dev *dev, struct mt7921_tm_cmd *req, + struct sk_buff *skb; + int ret; + +- ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CMD_TEST_CTRL, ++ ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_CE_CMD(TEST_CTRL), + &cmd, sizeof(cmd), true, &skb); + if (ret) + goto out; +-- +2.35.1 + diff --git a/queue-5.15/ocfs2-fix-a-deadlock-when-commit-trans.patch b/queue-5.15/ocfs2-fix-a-deadlock-when-commit-trans.patch new file mode 100644 index 00000000000..dc31a45b76b --- /dev/null +++ b/queue-5.15/ocfs2-fix-a-deadlock-when-commit-trans.patch @@ -0,0 +1,87 @@ +From ddf4b773aa40790dfa936bd845c18e735a49c61c Mon Sep 17 00:00:00 2001 +From: Joseph Qi +Date: Sat, 29 Jan 2022 13:41:27 -0800 +Subject: ocfs2: fix a deadlock when commit trans + +From: Joseph Qi + +commit ddf4b773aa40790dfa936bd845c18e735a49c61c upstream. + +commit 6f1b228529ae introduces a regression which can deadlock as +follows: + + Task1: Task2: + jbd2_journal_commit_transaction ocfs2_test_bg_bit_allocatable + spin_lock(&jh->b_state_lock) jbd_lock_bh_journal_head + __jbd2_journal_remove_checkpoint spin_lock(&jh->b_state_lock) + jbd2_journal_put_journal_head + jbd_lock_bh_journal_head + +Task1 and Task2 lock bh->b_state and jh->b_state_lock in different +order, which finally result in a deadlock. + +So use jbd2_journal_[grab|put]_journal_head instead in +ocfs2_test_bg_bit_allocatable() to fix it. + +Link: https://lkml.kernel.org/r/20220121071205.100648-3-joseph.qi@linux.alibaba.com +Fixes: 6f1b228529ae ("ocfs2: fix race between searching chunks and release journal_head from buffer_head") +Signed-off-by: Joseph Qi +Reported-by: Gautham Ananthakrishna +Tested-by: Gautham Ananthakrishna +Reported-by: Saeed Mirzamohammadi +Cc: "Theodore Ts'o" +Cc: Andreas Dilger +Cc: Changwei Ge +Cc: Gang He +Cc: Joel Becker +Cc: Jun Piao +Cc: Junxiao Bi +Cc: Mark Fasheh +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/ocfs2/suballoc.c | 25 +++++++++++-------------- + 1 file changed, 11 insertions(+), 14 deletions(-) + +--- a/fs/ocfs2/suballoc.c ++++ b/fs/ocfs2/suballoc.c +@@ -1251,26 +1251,23 @@ static int ocfs2_test_bg_bit_allocatable + { + struct ocfs2_group_desc *bg = (struct ocfs2_group_desc *) bg_bh->b_data; + struct journal_head *jh; +- int ret = 1; ++ int ret; + + if (ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap)) + return 0; + +- if (!buffer_jbd(bg_bh)) ++ jh = jbd2_journal_grab_journal_head(bg_bh); ++ if (!jh) + return 1; + +- jbd_lock_bh_journal_head(bg_bh); +- if (buffer_jbd(bg_bh)) { +- jh = bh2jh(bg_bh); +- spin_lock(&jh->b_state_lock); +- bg = (struct ocfs2_group_desc *) jh->b_committed_data; +- if (bg) +- ret = !ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap); +- else +- ret = 1; +- spin_unlock(&jh->b_state_lock); +- } +- jbd_unlock_bh_journal_head(bg_bh); ++ spin_lock(&jh->b_state_lock); ++ bg = (struct ocfs2_group_desc *) jh->b_committed_data; ++ if (bg) ++ ret = !ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap); ++ else ++ ret = 1; ++ spin_unlock(&jh->b_state_lock); ++ jbd2_journal_put_journal_head(jh); + + return ret; + } diff --git a/queue-5.15/pci-sysfs-find-shadow-rom-before-static-attribute-initialization.patch b/queue-5.15/pci-sysfs-find-shadow-rom-before-static-attribute-initialization.patch new file mode 100644 index 00000000000..6ad02d5dcc5 --- /dev/null +++ b/queue-5.15/pci-sysfs-find-shadow-rom-before-static-attribute-initialization.patch @@ -0,0 +1,113 @@ +From 66d28b21fe6b3da8d1e9f0a7ba38bc61b6c547e1 Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Wed, 26 Jan 2022 09:40:01 -0600 +Subject: PCI/sysfs: Find shadow ROM before static attribute initialization +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjorn Helgaas + +commit 66d28b21fe6b3da8d1e9f0a7ba38bc61b6c547e1 upstream. + +Ville reported that the sysfs "rom" file for VGA devices disappeared after +527139d738d7 ("PCI/sysfs: Convert "rom" to static attribute"). + +Prior to 527139d738d7, FINAL fixups, including pci_fixup_video() where we +find shadow ROMs, were run before pci_create_sysfs_dev_files() created the +sysfs "rom" file. + +After 527139d738d7, "rom" is a static attribute and is created before FINAL +fixups are run, so we didn't create "rom" files for shadow ROMs: + + acpi_pci_root_add + ... + pci_scan_single_device + pci_device_add + pci_fixup_video # <-- new HEADER fixup + device_add + ... + if (grp->is_visible()) + pci_dev_rom_attr_is_visible # after 527139d738d7 + pci_bus_add_devices + pci_bus_add_device + pci_fixup_device(pci_fixup_final) + pci_fixup_video # <-- previous FINAL fixup + pci_create_sysfs_dev_files + if (pci_resource_len(pdev, PCI_ROM_RESOURCE)) + sysfs_create_bin_file("rom") # before 527139d738d7 + +Change pci_fixup_video() to be a HEADER fixup so it runs before sysfs +static attributes are initialized. + +Rename the Loongson pci_fixup_radeon() to pci_fixup_video() and make its +dmesg logging identical to the others since it is doing the same job. + +Link: https://lore.kernel.org/r/YbxqIyrkv3GhZVxx@intel.com +Fixes: 527139d738d7 ("PCI/sysfs: Convert "rom" to static attribute") +Link: https://lore.kernel.org/r/20220126154001.16895-1-helgaas@kernel.org +Reported-by: Ville Syrjälä +Tested-by: Ville Syrjälä +Signed-off-by: Bjorn Helgaas +Cc: stable@vger.kernel.org # v5.13+ +Cc: Huacai Chen +Cc: Jiaxun Yang +Cc: Thomas Bogendoerfer +Cc: Thomas Gleixner +Cc: Ingo Molnar +Cc: Borislav Petkov +Cc: Dave Hansen +Cc: Krzysztof Wilczyński +Signed-off-by: Greg Kroah-Hartman +--- + arch/ia64/pci/fixup.c | 4 ++-- + arch/mips/loongson64/vbios_quirk.c | 9 ++++----- + arch/x86/pci/fixup.c | 4 ++-- + 3 files changed, 8 insertions(+), 9 deletions(-) + +--- a/arch/ia64/pci/fixup.c ++++ b/arch/ia64/pci/fixup.c +@@ -76,5 +76,5 @@ static void pci_fixup_video(struct pci_d + } + } + } +-DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_ANY_ID, PCI_ANY_ID, +- PCI_CLASS_DISPLAY_VGA, 8, pci_fixup_video); ++DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_ANY_ID, PCI_ANY_ID, ++ PCI_CLASS_DISPLAY_VGA, 8, pci_fixup_video); +--- a/arch/mips/loongson64/vbios_quirk.c ++++ b/arch/mips/loongson64/vbios_quirk.c +@@ -3,7 +3,7 @@ + #include + #include + +-static void pci_fixup_radeon(struct pci_dev *pdev) ++static void pci_fixup_video(struct pci_dev *pdev) + { + struct resource *res = &pdev->resource[PCI_ROM_RESOURCE]; + +@@ -22,8 +22,7 @@ static void pci_fixup_radeon(struct pci_ + res->flags = IORESOURCE_MEM | IORESOURCE_ROM_SHADOW | + IORESOURCE_PCI_FIXED; + +- dev_info(&pdev->dev, "BAR %d: assigned %pR for Radeon ROM\n", +- PCI_ROM_RESOURCE, res); ++ dev_info(&pdev->dev, "Video device with shadowed ROM at %pR\n", res); + } +-DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_ATI, 0x9615, +- PCI_CLASS_DISPLAY_VGA, 8, pci_fixup_radeon); ++DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_ATI, 0x9615, ++ PCI_CLASS_DISPLAY_VGA, 8, pci_fixup_video); +--- a/arch/x86/pci/fixup.c ++++ b/arch/x86/pci/fixup.c +@@ -353,8 +353,8 @@ static void pci_fixup_video(struct pci_d + } + } + } +-DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_ANY_ID, PCI_ANY_ID, +- PCI_CLASS_DISPLAY_VGA, 8, pci_fixup_video); ++DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_ANY_ID, PCI_ANY_ID, ++ PCI_CLASS_DISPLAY_VGA, 8, pci_fixup_video); + + + static const struct dmi_system_id msi_k8t_dmi_table[] = { diff --git a/queue-5.15/powerpc-32-fix-boot-failure-with-gcc-latent-entropy-plugin.patch b/queue-5.15/powerpc-32-fix-boot-failure-with-gcc-latent-entropy-plugin.patch new file mode 100644 index 00000000000..62abcd2f9c9 --- /dev/null +++ b/queue-5.15/powerpc-32-fix-boot-failure-with-gcc-latent-entropy-plugin.patch @@ -0,0 +1,54 @@ +From bba496656a73fc1d1330b49c7f82843836e9feb1 Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Wed, 22 Dec 2021 13:07:31 +0000 +Subject: powerpc/32: Fix boot failure with GCC latent entropy plugin + +From: Christophe Leroy + +commit bba496656a73fc1d1330b49c7f82843836e9feb1 upstream. + +Boot fails with GCC latent entropy plugin enabled. + +This is due to early boot functions trying to access 'latent_entropy' +global data while the kernel is not relocated at its final +destination yet. + +As there is no way to tell GCC to use PTRRELOC() to access it, +disable latent entropy plugin in early_32.o and feature-fixups.o and +code-patching.o + +Fixes: 38addce8b600 ("gcc-plugins: Add latent_entropy plugin") +Cc: stable@vger.kernel.org # v4.9+ +Reported-by: Erhard Furtner +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215217 +Link: https://lore.kernel.org/r/2bac55483b8daf5b1caa163a45fa5f9cdbe18be4.1640178426.git.christophe.leroy@csgroup.eu +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/Makefile | 1 + + arch/powerpc/lib/Makefile | 3 +++ + 2 files changed, 4 insertions(+) + +--- a/arch/powerpc/kernel/Makefile ++++ b/arch/powerpc/kernel/Makefile +@@ -11,6 +11,7 @@ CFLAGS_prom_init.o += -fPIC + CFLAGS_btext.o += -fPIC + endif + ++CFLAGS_early_32.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) + CFLAGS_cputable.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) + CFLAGS_prom_init.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) + CFLAGS_btext.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) +--- a/arch/powerpc/lib/Makefile ++++ b/arch/powerpc/lib/Makefile +@@ -19,6 +19,9 @@ CFLAGS_code-patching.o += -DDISABLE_BRAN + CFLAGS_feature-fixups.o += -DDISABLE_BRANCH_PROFILING + endif + ++CFLAGS_code-patching.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) ++CFLAGS_feature-fixups.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) ++ + obj-y += alloc.o code-patching.o feature-fixups.o pmem.o test_code-patching.o + + ifndef CONFIG_KASAN diff --git a/queue-5.15/powerpc-32s-allocate-one-256k-ibat-instead-of-two-consecutives-128k-ibats.patch b/queue-5.15/powerpc-32s-allocate-one-256k-ibat-instead-of-two-consecutives-128k-ibats.patch new file mode 100644 index 00000000000..28be2513a2e --- /dev/null +++ b/queue-5.15/powerpc-32s-allocate-one-256k-ibat-instead-of-two-consecutives-128k-ibats.patch @@ -0,0 +1,71 @@ +From 37eb7ca91b692e8e49e7dd50158349a6c8fb5b09 Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Fri, 26 Nov 2021 13:40:35 +0100 +Subject: powerpc/32s: Allocate one 256k IBAT instead of two consecutives 128k IBATs + +From: Christophe Leroy + +commit 37eb7ca91b692e8e49e7dd50158349a6c8fb5b09 upstream. + +Today we have the following IBATs allocated: + + ---[ Instruction Block Address Translation ]--- + 0: 0xc0000000-0xc03fffff 0x00000000 4M Kernel x m + 1: 0xc0400000-0xc05fffff 0x00400000 2M Kernel x m + 2: 0xc0600000-0xc06fffff 0x00600000 1M Kernel x m + 3: 0xc0700000-0xc077ffff 0x00700000 512K Kernel x m + 4: 0xc0780000-0xc079ffff 0x00780000 128K Kernel x m + 5: 0xc07a0000-0xc07bffff 0x007a0000 128K Kernel x m + 6: - + 7: - + +The two 128K should be a single 256K instead. + +When _etext is not aligned to 128Kbytes, the system will allocate +all necessary BATs to the lower 128Kbytes boundary, then allocate +an additional 128Kbytes BAT for the remaining block. + +Instead, align the top to 128Kbytes so that the function directly +allocates a 256Kbytes last block: + + ---[ Instruction Block Address Translation ]--- + 0: 0xc0000000-0xc03fffff 0x00000000 4M Kernel x m + 1: 0xc0400000-0xc05fffff 0x00400000 2M Kernel x m + 2: 0xc0600000-0xc06fffff 0x00600000 1M Kernel x m + 3: 0xc0700000-0xc077ffff 0x00700000 512K Kernel x m + 4: 0xc0780000-0xc07bffff 0x00780000 256K Kernel x m + 5: - + 6: - + 7: - + +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/ab58b296832b0ec650e2203200e060adbcb2677d.1637930421.git.christophe.leroy@csgroup.eu +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/mm/book3s32/mmu.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/arch/powerpc/mm/book3s32/mmu.c ++++ b/arch/powerpc/mm/book3s32/mmu.c +@@ -196,18 +196,17 @@ void mmu_mark_initmem_nx(void) + int nb = mmu_has_feature(MMU_FTR_USE_HIGH_BATS) ? 8 : 4; + int i; + unsigned long base = (unsigned long)_stext - PAGE_OFFSET; +- unsigned long top = (unsigned long)_etext - PAGE_OFFSET; ++ unsigned long top = ALIGN((unsigned long)_etext - PAGE_OFFSET, SZ_128K); + unsigned long border = (unsigned long)__init_begin - PAGE_OFFSET; + unsigned long size; + +- for (i = 0; i < nb - 1 && base < top && top - base > (128 << 10);) { ++ for (i = 0; i < nb - 1 && base < top;) { + size = block_size(base, top); + setibat(i++, PAGE_OFFSET + base, base, size, PAGE_KERNEL_TEXT); + base += size; + } + if (base < top) { + size = block_size(base, top); +- size = max(size, 128UL << 10); + if ((top - base) > size) { + size <<= 1; + if (strict_kernel_rwx_enabled() && base + size > border) diff --git a/queue-5.15/powerpc-32s-fix-kasan_init_region-for-kasan.patch b/queue-5.15/powerpc-32s-fix-kasan_init_region-for-kasan.patch new file mode 100644 index 00000000000..50930e807ae --- /dev/null +++ b/queue-5.15/powerpc-32s-fix-kasan_init_region-for-kasan.patch @@ -0,0 +1,195 @@ +From d37823c3528e5e0705fc7746bcbc2afffb619259 Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Mon, 10 Jan 2022 15:29:25 +0000 +Subject: powerpc/32s: Fix kasan_init_region() for KASAN + +From: Christophe Leroy + +commit d37823c3528e5e0705fc7746bcbc2afffb619259 upstream. + +It has been reported some configuration where the kernel doesn't +boot with KASAN enabled. + +This is due to wrong BAT allocation for the KASAN area: + + ---[ Data Block Address Translation ]--- + 0: 0xc0000000-0xcfffffff 0x00000000 256M Kernel rw m + 1: 0xd0000000-0xdfffffff 0x10000000 256M Kernel rw m + 2: 0xe0000000-0xefffffff 0x20000000 256M Kernel rw m + 3: 0xf8000000-0xf9ffffff 0x2a000000 32M Kernel rw m + 4: 0xfa000000-0xfdffffff 0x2c000000 64M Kernel rw m + +A BAT must have both virtual and physical addresses alignment matching +the size of the BAT. This is not the case for BAT 4 above. + +Fix kasan_init_region() by using block_size() function that is in +book3s32/mmu.c. To be able to reuse it here, make it non static and +change its name to bat_block_size() in order to avoid name conflict +with block_size() defined in + +Also reuse find_free_bat() to avoid an error message from setbat() +when no BAT is available. + +And allocate memory outside of linear memory mapping to avoid +wasting that precious space. + +With this change we get correct alignment for BATs and KASAN shadow +memory is allocated outside the linear memory space. + + ---[ Data Block Address Translation ]--- + 0: 0xc0000000-0xcfffffff 0x00000000 256M Kernel rw + 1: 0xd0000000-0xdfffffff 0x10000000 256M Kernel rw + 2: 0xe0000000-0xefffffff 0x20000000 256M Kernel rw + 3: 0xf8000000-0xfbffffff 0x7c000000 64M Kernel rw + 4: 0xfc000000-0xfdffffff 0x7a000000 32M Kernel rw + +Fixes: 7974c4732642 ("powerpc/32s: Implement dedicated kasan_init_region()") +Cc: stable@vger.kernel.org +Reported-by: Maxime Bizon +Signed-off-by: Christophe Leroy +Tested-by: Maxime Bizon +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/7a50ef902494d1325227d47d33dada01e52e5518.1641818726.git.christophe.leroy@csgroup.eu +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/asm/book3s/32/mmu-hash.h | 2 + arch/powerpc/mm/book3s32/mmu.c | 10 ++-- + arch/powerpc/mm/kasan/book3s_32.c | 57 +++++++++++++------------- + 3 files changed, 37 insertions(+), 32 deletions(-) + +--- a/arch/powerpc/include/asm/book3s/32/mmu-hash.h ++++ b/arch/powerpc/include/asm/book3s/32/mmu-hash.h +@@ -143,6 +143,8 @@ static __always_inline void update_user_ + update_user_segment(15, val); + } + ++int __init find_free_bat(void); ++unsigned int bat_block_size(unsigned long base, unsigned long top); + #endif /* !__ASSEMBLY__ */ + + /* We happily ignore the smaller BATs on 601, we don't actually use +--- a/arch/powerpc/mm/book3s32/mmu.c ++++ b/arch/powerpc/mm/book3s32/mmu.c +@@ -76,7 +76,7 @@ unsigned long p_block_mapped(phys_addr_t + return 0; + } + +-static int find_free_bat(void) ++int __init find_free_bat(void) + { + int b; + int n = mmu_has_feature(MMU_FTR_USE_HIGH_BATS) ? 8 : 4; +@@ -100,7 +100,7 @@ static int find_free_bat(void) + * - block size has to be a power of two. This is calculated by finding the + * highest bit set to 1. + */ +-static unsigned int block_size(unsigned long base, unsigned long top) ++unsigned int bat_block_size(unsigned long base, unsigned long top) + { + unsigned int max_size = SZ_256M; + unsigned int base_shift = (ffs(base) - 1) & 31; +@@ -145,7 +145,7 @@ static unsigned long __init __mmu_mapin_ + int idx; + + while ((idx = find_free_bat()) != -1 && base != top) { +- unsigned int size = block_size(base, top); ++ unsigned int size = bat_block_size(base, top); + + if (size < 128 << 10) + break; +@@ -201,12 +201,12 @@ void mmu_mark_initmem_nx(void) + unsigned long size; + + for (i = 0; i < nb - 1 && base < top;) { +- size = block_size(base, top); ++ size = bat_block_size(base, top); + setibat(i++, PAGE_OFFSET + base, base, size, PAGE_KERNEL_TEXT); + base += size; + } + if (base < top) { +- size = block_size(base, top); ++ size = bat_block_size(base, top); + if ((top - base) > size) { + size <<= 1; + if (strict_kernel_rwx_enabled() && base + size > border) +--- a/arch/powerpc/mm/kasan/book3s_32.c ++++ b/arch/powerpc/mm/kasan/book3s_32.c +@@ -10,48 +10,51 @@ int __init kasan_init_region(void *start + { + unsigned long k_start = (unsigned long)kasan_mem_to_shadow(start); + unsigned long k_end = (unsigned long)kasan_mem_to_shadow(start + size); +- unsigned long k_cur = k_start; +- int k_size = k_end - k_start; +- int k_size_base = 1 << (ffs(k_size) - 1); ++ unsigned long k_nobat = k_start; ++ unsigned long k_cur; ++ phys_addr_t phys; + int ret; +- void *block; + +- block = memblock_alloc(k_size, k_size_base); ++ while (k_nobat < k_end) { ++ unsigned int k_size = bat_block_size(k_nobat, k_end); ++ int idx = find_free_bat(); ++ ++ if (idx == -1) ++ break; ++ if (k_size < SZ_128K) ++ break; ++ phys = memblock_phys_alloc_range(k_size, k_size, 0, ++ MEMBLOCK_ALLOC_ANYWHERE); ++ if (!phys) ++ break; + +- if (block && k_size_base >= SZ_128K && k_start == ALIGN(k_start, k_size_base)) { +- int shift = ffs(k_size - k_size_base); +- int k_size_more = shift ? 1 << (shift - 1) : 0; +- +- setbat(-1, k_start, __pa(block), k_size_base, PAGE_KERNEL); +- if (k_size_more >= SZ_128K) +- setbat(-1, k_start + k_size_base, __pa(block) + k_size_base, +- k_size_more, PAGE_KERNEL); +- if (v_block_mapped(k_start)) +- k_cur = k_start + k_size_base; +- if (v_block_mapped(k_start + k_size_base)) +- k_cur = k_start + k_size_base + k_size_more; +- +- update_bats(); ++ setbat(idx, k_nobat, phys, k_size, PAGE_KERNEL); ++ k_nobat += k_size; + } ++ if (k_nobat != k_start) ++ update_bats(); + +- if (!block) +- block = memblock_alloc(k_size, PAGE_SIZE); +- if (!block) +- return -ENOMEM; ++ if (k_nobat < k_end) { ++ phys = memblock_phys_alloc_range(k_end - k_nobat, PAGE_SIZE, 0, ++ MEMBLOCK_ALLOC_ANYWHERE); ++ if (!phys) ++ return -ENOMEM; ++ } + + ret = kasan_init_shadow_page_tables(k_start, k_end); + if (ret) + return ret; + +- kasan_update_early_region(k_start, k_cur, __pte(0)); ++ kasan_update_early_region(k_start, k_nobat, __pte(0)); + +- for (; k_cur < k_end; k_cur += PAGE_SIZE) { ++ for (k_cur = k_nobat; k_cur < k_end; k_cur += PAGE_SIZE) { + pmd_t *pmd = pmd_off_k(k_cur); +- void *va = block + k_cur - k_start; +- pte_t pte = pfn_pte(PHYS_PFN(__pa(va)), PAGE_KERNEL); ++ pte_t pte = pfn_pte(PHYS_PFN(phys + k_cur - k_nobat), PAGE_KERNEL); + + __set_pte_at(&init_mm, k_cur, pte_offset_kernel(pmd, k_cur), pte, 0); + } + flush_tlb_kernel_range(k_start, k_end); ++ memset(kasan_mem_to_shadow(start), 0, k_end - k_start); ++ + return 0; + } diff --git a/queue-5.15/sched-membarrier-fix-membarrier-rseq-fence-command-missing-from-query-bitmask.patch b/queue-5.15/sched-membarrier-fix-membarrier-rseq-fence-command-missing-from-query-bitmask.patch new file mode 100644 index 00000000000..2c5bc4104b5 --- /dev/null +++ b/queue-5.15/sched-membarrier-fix-membarrier-rseq-fence-command-missing-from-query-bitmask.patch @@ -0,0 +1,65 @@ +From 809232619f5b15e31fb3563985e705454f32621f Mon Sep 17 00:00:00 2001 +From: Mathieu Desnoyers +Date: Mon, 17 Jan 2022 15:30:10 -0500 +Subject: sched/membarrier: Fix membarrier-rseq fence command missing from query bitmask + +From: Mathieu Desnoyers + +commit 809232619f5b15e31fb3563985e705454f32621f upstream. + +The membarrier command MEMBARRIER_CMD_QUERY allows querying the +available membarrier commands. When the membarrier-rseq fence commands +were added, a new MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ_BITMASK was +introduced with the intent to expose them with the MEMBARRIER_CMD_QUERY +command, the but it was never added to MEMBARRIER_CMD_BITMASK. + +The membarrier-rseq fence commands are therefore not wired up with the +query command. + +Rename MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ_BITMASK to +MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK (the bitmask is not a command +per-se), and change the erroneous +MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_RSEQ_BITMASK (which does not +actually exist) to MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_RSEQ. + +Wire up MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK in +MEMBARRIER_CMD_BITMASK. Fixing this allows discovering availability of +the membarrier-rseq fence feature. + +Fixes: 2a36ab717e8f ("rseq/membarrier: Add MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ") +Signed-off-by: Mathieu Desnoyers +Signed-off-by: Peter Zijlstra (Intel) +Cc: # 5.10+ +Link: https://lkml.kernel.org/r/20220117203010.30129-1-mathieu.desnoyers@efficios.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/membarrier.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/kernel/sched/membarrier.c ++++ b/kernel/sched/membarrier.c +@@ -147,11 +147,11 @@ + #endif + + #ifdef CONFIG_RSEQ +-#define MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ_BITMASK \ ++#define MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK \ + (MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ \ +- | MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_RSEQ_BITMASK) ++ | MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_RSEQ) + #else +-#define MEMBARRIER_CMD_PRIVATE_EXPEDITED_RSEQ_BITMASK 0 ++#define MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK 0 + #endif + + #define MEMBARRIER_CMD_BITMASK \ +@@ -159,7 +159,8 @@ + | MEMBARRIER_CMD_REGISTER_GLOBAL_EXPEDITED \ + | MEMBARRIER_CMD_PRIVATE_EXPEDITED \ + | MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED \ +- | MEMBARRIER_PRIVATE_EXPEDITED_SYNC_CORE_BITMASK) ++ | MEMBARRIER_PRIVATE_EXPEDITED_SYNC_CORE_BITMASK \ ++ | MEMBARRIER_PRIVATE_EXPEDITED_RSEQ_BITMASK) + + static void ipi_mb(void *info) + { diff --git a/queue-5.15/series b/queue-5.15/series index 67d71dbfa5e..1bcf2b4566d 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -63,3 +63,14 @@ usb-typec-tcpci-don-t-touch-cc-line-if-it-s-vconn-source.patch usb-typec-tcpm-do-not-disconnect-while-receiving-vbus-off.patch usb-typec-tcpm-do-not-disconnect-when-receiving-vsafe0v.patch ucsi_ccg-check-dev_int-bit-only-when-starting-ccg4.patch +mm-kasan-use-compare-exchange-operation-to-set-kasan-page-tag.patch +jbd2-export-jbd2_journal__journal_head.patch +ocfs2-fix-a-deadlock-when-commit-trans.patch +sched-membarrier-fix-membarrier-rseq-fence-command-missing-from-query-bitmask.patch +pci-sysfs-find-shadow-rom-before-static-attribute-initialization.patch +x86-mce-amd-allow-thresholding-interface-updates-after-init.patch +x86-cpu-add-xeon-icelake-d-to-list-of-cpus-that-support-ppin.patch +powerpc-32s-allocate-one-256k-ibat-instead-of-two-consecutives-128k-ibats.patch +powerpc-32s-fix-kasan_init_region-for-kasan.patch +powerpc-32-fix-boot-failure-with-gcc-latent-entropy-plugin.patch +mt76-connac-introduce-mcu_ce_cmd-macro.patch diff --git a/queue-5.15/x86-cpu-add-xeon-icelake-d-to-list-of-cpus-that-support-ppin.patch b/queue-5.15/x86-cpu-add-xeon-icelake-d-to-list-of-cpus-that-support-ppin.patch new file mode 100644 index 00000000000..96b6959beac --- /dev/null +++ b/queue-5.15/x86-cpu-add-xeon-icelake-d-to-list-of-cpus-that-support-ppin.patch @@ -0,0 +1,33 @@ +From e464121f2d40eabc7d11823fb26db807ce945df4 Mon Sep 17 00:00:00 2001 +From: Tony Luck +Date: Fri, 21 Jan 2022 09:47:38 -0800 +Subject: x86/cpu: Add Xeon Icelake-D to list of CPUs that support PPIN + +From: Tony Luck + +commit e464121f2d40eabc7d11823fb26db807ce945df4 upstream. + +Missed adding the Icelake-D CPU to the list. It uses the same MSRs +to control and read the inventory number as all the other models. + +Fixes: dc6b025de95b ("x86/mce: Add Xeon Icelake to list of CPUs that support PPIN") +Reported-by: Ailin Xu +Signed-off-by: Tony Luck +Signed-off-by: Borislav Petkov +Cc: +Link: https://lore.kernel.org/r/20220121174743.1875294-2-tony.luck@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/mce/intel.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/kernel/cpu/mce/intel.c ++++ b/arch/x86/kernel/cpu/mce/intel.c +@@ -486,6 +486,7 @@ static void intel_ppin_init(struct cpuin + case INTEL_FAM6_BROADWELL_X: + case INTEL_FAM6_SKYLAKE_X: + case INTEL_FAM6_ICELAKE_X: ++ case INTEL_FAM6_ICELAKE_D: + case INTEL_FAM6_SAPPHIRERAPIDS_X: + case INTEL_FAM6_XEON_PHI_KNL: + case INTEL_FAM6_XEON_PHI_KNM: diff --git a/queue-5.15/x86-mce-amd-allow-thresholding-interface-updates-after-init.patch b/queue-5.15/x86-mce-amd-allow-thresholding-interface-updates-after-init.patch new file mode 100644 index 00000000000..ebeaf95c946 --- /dev/null +++ b/queue-5.15/x86-mce-amd-allow-thresholding-interface-updates-after-init.patch @@ -0,0 +1,39 @@ +From 1f52b0aba6fd37653416375cb8a1ca673acf8d5f Mon Sep 17 00:00:00 2001 +From: Yazen Ghannam +Date: Mon, 17 Jan 2022 16:13:28 +0000 +Subject: x86/MCE/AMD: Allow thresholding interface updates after init + +From: Yazen Ghannam + +commit 1f52b0aba6fd37653416375cb8a1ca673acf8d5f upstream. + +Changes to the AMD Thresholding sysfs code prevents sysfs writes from +updating the underlying registers once CPU init is completed, i.e. +"threshold_banks" is set. + +Allow the registers to be updated if the thresholding interface is +already initialized or if in the init path. Use the "set_lvt_off" value +to indicate if running in the init path, since this value is only set +during init. + +Fixes: a037f3ca0ea0 ("x86/mce/amd: Make threshold bank setting hotplug robust") +Signed-off-by: Yazen Ghannam +Signed-off-by: Borislav Petkov +Cc: +Link: https://lore.kernel.org/r/20220117161328.19148-1-yazen.ghannam@amd.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/mce/amd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/mce/amd.c ++++ b/arch/x86/kernel/cpu/mce/amd.c +@@ -400,7 +400,7 @@ static void threshold_restart_bank(void + u32 hi, lo; + + /* sysfs write might race against an offline operation */ +- if (this_cpu_read(threshold_banks)) ++ if (!this_cpu_read(threshold_banks) && !tr->set_lvt_off) + return; + + rdmsr(tr->b->address, lo, hi);