--- /dev/null
+From 39d9b4b5e04d1213eccbb858fccd69bb3f6264e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2024 10:36:41 -0500
+Subject: ARM: dts: imxrt1050: Fix clocks for mmc
+
+From: Jesse Taube <Mr.Bossman075@gmail.com>
+
+[ Upstream commit 5f122030061db3e5d2bddd9cf5c583deaa6c54ff ]
+
+One of the usdhc1 controller's clocks should be IMXRT1050_CLK_AHB_PODF not
+IMXRT1050_CLK_OSC.
+
+Fixes: 1c4f01be3490 ("ARM: dts: imx: Add i.MXRT1050-EVK support")
+Signed-off-by: Jesse Taube <Mr.Bossman075@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi b/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi
+index dd714d235d5f..b0bad0d1ba36 100644
+--- a/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi
++++ b/arch/arm/boot/dts/nxp/imx/imxrt1050.dtsi
+@@ -87,7 +87,7 @@
+ reg = <0x402c0000 0x4000>;
+ interrupts = <110>;
+ clocks = <&clks IMXRT1050_CLK_IPG_PDOF>,
+- <&clks IMXRT1050_CLK_OSC>,
++ <&clks IMXRT1050_CLK_AHB_PODF>,
+ <&clks IMXRT1050_CLK_USDHC1>;
+ clock-names = "ipg", "ahb", "per";
+ bus-width = <4>;
+--
+2.39.5
+
--- /dev/null
+From ca353fd95df0fd91ddba267ed7f99e21994d5d31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2024 13:46:02 +0800
+Subject: arm64: dts: imx95: correct the address length of netcmix_blk_ctrl
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit c5b8d2c370842e3f9a15655893d8c597e2d981d9 ]
+
+The netc_blk_ctrl is controlled by the imx95-blk-ctl clock driver and
+provides relevant clock configurations for NETC, SAI and MQS. Its address
+length should be 8 bytes instead of 0x1000.
+
+Fixes: 7764fef26ea9 ("arm64: dts: imx95: Add NETCMIX block control support")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx95.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi
+index 03661e76550f..40cbb071f265 100644
+--- a/arch/arm64/boot/dts/freescale/imx95.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx95.dtsi
+@@ -1609,7 +1609,7 @@
+
+ netcmix_blk_ctrl: syscon@4c810000 {
+ compatible = "nxp,imx95-netcmix-blk-ctrl", "syscon";
+- reg = <0x0 0x4c810000 0x0 0x10000>;
++ reg = <0x0 0x4c810000 0x0 0x8>;
+ #clock-cells = <1>;
+ clocks = <&scmi_clk IMX95_CLK_BUSNETCMIX>;
+ assigned-clocks = <&scmi_clk IMX95_CLK_BUSNETCMIX>;
+--
+2.39.5
+
--- /dev/null
+From 0b658c68726b8a6e4afe2d44ddd6a326ec92f754 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2024 10:52:16 +0800
+Subject: arm64: dts: qcom: sa8775p: fix the secure device bootup issue
+
+From: Jie Gan <quic_jiegan@quicinc.com>
+
+[ Upstream commit 8a6442ec3437083348f32a6159b9a67bf66417bc ]
+
+The secure device(fused) cannot bootup with TPDM_DCC device. So
+disable it in DT.
+
+Fixes: 6596118ccdcd ("arm64: dts: qcom: Add coresight nodes for SA8775p")
+Signed-off-by: Jie Gan <quic_jiegan@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20241219025216.3463527-1-quic_jiegan@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sa8775p.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sa8775p.dtsi b/arch/arm64/boot/dts/qcom/sa8775p.dtsi
+index 320a94dcac5c..8a21448c0fa8 100644
+--- a/arch/arm64/boot/dts/qcom/sa8775p.dtsi
++++ b/arch/arm64/boot/dts/qcom/sa8775p.dtsi
+@@ -1940,6 +1940,7 @@
+
+ qcom,cmb-element-bits = <32>;
+ qcom,cmb-msrs-num = <32>;
++ status = "disabled";
+
+ out-ports {
+ port {
+--
+2.39.5
+
--- /dev/null
+From 7a0ddf413ae22e03f84734d03471ecce78436ee8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Dec 2024 22:43:39 +0000
+Subject: arm64: dts: rockchip: add hevc power domain clock to rk3328
+
+From: Peter Geis <pgwipeout@gmail.com>
+
+[ Upstream commit 3699f2c43ea9984e00d70463f8c29baaf260ea97 ]
+
+There is a race condition at startup between disabling power domains not
+used and disabling clocks not used on the rk3328. When the clocks are
+disabled first, the hevc power domain fails to shut off leading to a
+splat of failures. Add the hevc core clock to the rk3328 power domain
+node to prevent this condition.
+
+rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 3-.... }
+1087 jiffies s: 89 root: 0x8/.
+rcu: blocking rcu_node structures (internal RCU debug):
+Sending NMI from CPU 0 to CPUs 3:
+NMI backtrace for cpu 3
+CPU: 3 UID: 0 PID: 86 Comm: kworker/3:3 Not tainted 6.12.0-rc5+ #53
+Hardware name: Firefly ROC-RK3328-CC (DT)
+Workqueue: pm genpd_power_off_work_fn
+pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : regmap_unlock_spinlock+0x18/0x30
+lr : regmap_read+0x60/0x88
+sp : ffff800081123c00
+x29: ffff800081123c00 x28: ffff2fa4c62cad80 x27: 0000000000000000
+x26: ffffd74e6e660eb8 x25: ffff2fa4c62cae00 x24: 0000000000000040
+x23: ffffd74e6d2f3ab8 x22: 0000000000000001 x21: ffff800081123c74
+x20: 0000000000000000 x19: ffff2fa4c0412000 x18: 0000000000000000
+x17: 77202c31203d2065 x16: 6c6469203a72656c x15: 6c6f72746e6f632d
+x14: 7265776f703a6e6f x13: 2063766568206e69 x12: 616d6f64202c3431
+x11: 347830206f742030 x10: 3430303034783020 x9 : ffffd74e6c7369e0
+x8 : 3030316666206e69 x7 : 205d383738353733 x6 : 332e31202020205b
+x5 : ffffd74e6c73fc88 x4 : ffffd74e6c73fcd4 x3 : ffffd74e6c740b40
+x2 : ffff800080015484 x1 : 0000000000000000 x0 : ffff2fa4c0412000
+Call trace:
+regmap_unlock_spinlock+0x18/0x30
+rockchip_pmu_set_idle_request+0xac/0x2c0
+rockchip_pd_power+0x144/0x5f8
+rockchip_pd_power_off+0x1c/0x30
+_genpd_power_off+0x9c/0x180
+genpd_power_off.part.0.isra.0+0x130/0x2a8
+genpd_power_off_work_fn+0x6c/0x98
+process_one_work+0x170/0x3f0
+worker_thread+0x290/0x4a8
+kthread+0xec/0xf8
+ret_from_fork+0x10/0x20
+rockchip-pm-domain ff100000.syscon:power-controller: failed to get ack on domain 'hevc', val=0x88220
+
+Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs")
+Signed-off-by: Peter Geis <pgwipeout@gmail.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Link: https://lore.kernel.org/r/20241214224339.24674-1-pgwipeout@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+index c01a4cad48f3..d16a13d6442f 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+@@ -333,6 +333,7 @@
+
+ power-domain@RK3328_PD_HEVC {
+ reg = <RK3328_PD_HEVC>;
++ clocks = <&cru SCLK_VENC_CORE>;
+ #power-domain-cells = <0>;
+ };
+ power-domain@RK3328_PD_VIDEO {
+--
+2.39.5
+
--- /dev/null
+From bef7a18239dcf1350b3047e61810c423e099e1b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2025 16:41:48 +0800
+Subject: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit fcede1f0a043ccefe9bc6ad57f12718e42f63f1d ]
+
+Our syzkaller report a following UAF for v6.6:
+
+BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958
+Read of size 8 at addr ffff8881b57147d8 by task fsstress/232726
+
+CPU: 2 PID: 232726 Comm: fsstress Not tainted 6.6.0-g3629d1885222 #39
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106
+ print_address_description.constprop.0+0x66/0x300 mm/kasan/report.c:364
+ print_report+0x3e/0x70 mm/kasan/report.c:475
+ kasan_report+0xb8/0xf0 mm/kasan/report.c:588
+ hlist_add_head include/linux/list.h:1023 [inline]
+ bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958
+ bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271
+ bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323
+ blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660
+ blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143
+ __submit_bio+0xa0/0x6b0 block/blk-core.c:639
+ __submit_bio_noacct_mq block/blk-core.c:718 [inline]
+ submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747
+ submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847
+ __ext4_read_bh fs/ext4/super.c:205 [inline]
+ ext4_read_bh+0x15e/0x2e0 fs/ext4/super.c:230
+ __read_extent_tree_block+0x304/0x6f0 fs/ext4/extents.c:567
+ ext4_find_extent+0x479/0xd20 fs/ext4/extents.c:947
+ ext4_ext_map_blocks+0x1a3/0x2680 fs/ext4/extents.c:4182
+ ext4_map_blocks+0x929/0x15a0 fs/ext4/inode.c:660
+ ext4_iomap_begin_report+0x298/0x480 fs/ext4/inode.c:3569
+ iomap_iter+0x3dd/0x1010 fs/iomap/iter.c:91
+ iomap_fiemap+0x1f4/0x360 fs/iomap/fiemap.c:80
+ ext4_fiemap+0x181/0x210 fs/ext4/extents.c:5051
+ ioctl_fiemap.isra.0+0x1b4/0x290 fs/ioctl.c:220
+ do_vfs_ioctl+0x31c/0x11a0 fs/ioctl.c:811
+ __do_sys_ioctl fs/ioctl.c:869 [inline]
+ __se_sys_ioctl+0xae/0x190 fs/ioctl.c:857
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81
+ entry_SYSCALL_64_after_hwframe+0x78/0xe2
+
+Allocated by task 232719:
+ kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
+ kasan_set_track+0x25/0x30 mm/kasan/common.c:52
+ __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328
+ kasan_slab_alloc include/linux/kasan.h:188 [inline]
+ slab_post_alloc_hook mm/slab.h:768 [inline]
+ slab_alloc_node mm/slub.c:3492 [inline]
+ kmem_cache_alloc_node+0x1b8/0x6f0 mm/slub.c:3537
+ bfq_get_queue+0x215/0x1f00 block/bfq-iosched.c:5869
+ bfq_get_bfqq_handle_split+0x167/0x5f0 block/bfq-iosched.c:6776
+ bfq_init_rq+0x13a4/0x17a0 block/bfq-iosched.c:6938
+ bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271
+ bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323
+ blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660
+ blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143
+ __submit_bio+0xa0/0x6b0 block/blk-core.c:639
+ __submit_bio_noacct_mq block/blk-core.c:718 [inline]
+ submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747
+ submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847
+ __ext4_read_bh fs/ext4/super.c:205 [inline]
+ ext4_read_bh_nowait+0x15a/0x240 fs/ext4/super.c:217
+ ext4_read_bh_lock+0xac/0xd0 fs/ext4/super.c:242
+ ext4_bread_batch+0x268/0x500 fs/ext4/inode.c:958
+ __ext4_find_entry+0x448/0x10f0 fs/ext4/namei.c:1671
+ ext4_lookup_entry fs/ext4/namei.c:1774 [inline]
+ ext4_lookup.part.0+0x359/0x6f0 fs/ext4/namei.c:1842
+ ext4_lookup+0x72/0x90 fs/ext4/namei.c:1839
+ __lookup_slow+0x257/0x480 fs/namei.c:1696
+ lookup_slow fs/namei.c:1713 [inline]
+ walk_component+0x454/0x5c0 fs/namei.c:2004
+ link_path_walk.part.0+0x773/0xda0 fs/namei.c:2331
+ link_path_walk fs/namei.c:3826 [inline]
+ path_openat+0x1b9/0x520 fs/namei.c:3826
+ do_filp_open+0x1b7/0x400 fs/namei.c:3857
+ do_sys_openat2+0x5dc/0x6e0 fs/open.c:1428
+ do_sys_open fs/open.c:1443 [inline]
+ __do_sys_openat fs/open.c:1459 [inline]
+ __se_sys_openat fs/open.c:1454 [inline]
+ __x64_sys_openat+0x148/0x200 fs/open.c:1454
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81
+ entry_SYSCALL_64_after_hwframe+0x78/0xe2
+
+Freed by task 232726:
+ kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
+ kasan_set_track+0x25/0x30 mm/kasan/common.c:52
+ kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522
+ ____kasan_slab_free mm/kasan/common.c:236 [inline]
+ __kasan_slab_free+0x12a/0x1b0 mm/kasan/common.c:244
+ kasan_slab_free include/linux/kasan.h:164 [inline]
+ slab_free_hook mm/slub.c:1827 [inline]
+ slab_free_freelist_hook mm/slub.c:1853 [inline]
+ slab_free mm/slub.c:3820 [inline]
+ kmem_cache_free+0x110/0x760 mm/slub.c:3842
+ bfq_put_queue+0x6a7/0xfb0 block/bfq-iosched.c:5428
+ bfq_forget_entity block/bfq-wf2q.c:634 [inline]
+ bfq_put_idle_entity+0x142/0x240 block/bfq-wf2q.c:645
+ bfq_forget_idle+0x189/0x1e0 block/bfq-wf2q.c:671
+ bfq_update_vtime block/bfq-wf2q.c:1280 [inline]
+ __bfq_lookup_next_entity block/bfq-wf2q.c:1374 [inline]
+ bfq_lookup_next_entity+0x350/0x480 block/bfq-wf2q.c:1433
+ bfq_update_next_in_service+0x1c0/0x4f0 block/bfq-wf2q.c:128
+ bfq_deactivate_entity+0x10a/0x240 block/bfq-wf2q.c:1188
+ bfq_deactivate_bfqq block/bfq-wf2q.c:1592 [inline]
+ bfq_del_bfqq_busy+0x2e8/0xad0 block/bfq-wf2q.c:1659
+ bfq_release_process_ref+0x1cc/0x220 block/bfq-iosched.c:3139
+ bfq_split_bfqq+0x481/0xdf0 block/bfq-iosched.c:6754
+ bfq_init_rq+0xf29/0x17a0 block/bfq-iosched.c:6934
+ bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271
+ bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323
+ blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660
+ blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143
+ __submit_bio+0xa0/0x6b0 block/blk-core.c:639
+ __submit_bio_noacct_mq block/blk-core.c:718 [inline]
+ submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747
+ submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847
+ __ext4_read_bh fs/ext4/super.c:205 [inline]
+ ext4_read_bh+0x15e/0x2e0 fs/ext4/super.c:230
+ __read_extent_tree_block+0x304/0x6f0 fs/ext4/extents.c:567
+ ext4_find_extent+0x479/0xd20 fs/ext4/extents.c:947
+ ext4_ext_map_blocks+0x1a3/0x2680 fs/ext4/extents.c:4182
+ ext4_map_blocks+0x929/0x15a0 fs/ext4/inode.c:660
+ ext4_iomap_begin_report+0x298/0x480 fs/ext4/inode.c:3569
+ iomap_iter+0x3dd/0x1010 fs/iomap/iter.c:91
+ iomap_fiemap+0x1f4/0x360 fs/iomap/fiemap.c:80
+ ext4_fiemap+0x181/0x210 fs/ext4/extents.c:5051
+ ioctl_fiemap.isra.0+0x1b4/0x290 fs/ioctl.c:220
+ do_vfs_ioctl+0x31c/0x11a0 fs/ioctl.c:811
+ __do_sys_ioctl fs/ioctl.c:869 [inline]
+ __se_sys_ioctl+0xae/0x190 fs/ioctl.c:857
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81
+ entry_SYSCALL_64_after_hwframe+0x78/0xe2
+
+commit 1ba0403ac644 ("block, bfq: fix uaf for accessing waker_bfqq after
+splitting") fix the problem that if waker_bfqq is in the merge chain,
+and current is the only procress, waker_bfqq can be freed from
+bfq_split_bfqq(). However, the case that waker_bfqq is not in the merge
+chain is missed, and if the procress reference of waker_bfqq is 0,
+waker_bfqq can be freed as well.
+
+Fix the problem by checking procress reference if waker_bfqq is not in
+the merge_chain.
+
+Fixes: 1ba0403ac644 ("block, bfq: fix uaf for accessing waker_bfqq after splitting")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20250108084148.1549973-1-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 95dd7b795935..cad16c163611 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -6844,16 +6844,24 @@ static struct bfq_queue *bfq_waker_bfqq(struct bfq_queue *bfqq)
+ if (new_bfqq == waker_bfqq) {
+ /*
+ * If waker_bfqq is in the merge chain, and current
+- * is the only procress.
++ * is the only process, waker_bfqq can be freed.
+ */
+ if (bfqq_process_refs(waker_bfqq) == 1)
+ return NULL;
+- break;
++
++ return waker_bfqq;
+ }
+
+ new_bfqq = new_bfqq->new_bfqq;
+ }
+
++ /*
++ * If waker_bfqq is not in the merge chain, and it's procress reference
++ * is 0, waker_bfqq can be freed.
++ */
++ if (bfqq_process_refs(waker_bfqq) == 0)
++ return NULL;
++
+ return waker_bfqq;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 0e34f4c63f10f5d956f2ac0fc86751a5bbf3cb6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2024 01:18:01 +0000
+Subject: drm/mediatek: Only touch DISP_REG_OVL_PITCH_MSB if AFBC is supported
+
+From: Daniel Golle <daniel@makrotopia.org>
+
+[ Upstream commit f8d9b91739e1fb436447c437a346a36deb676a36 ]
+
+Touching DISP_REG_OVL_PITCH_MSB leads to video overlay on MT2701, MT7623N
+and probably other older SoCs being broken.
+
+Move setting up AFBC layer configuration into a separate function only
+being called on hardware which actually supports AFBC which restores the
+behavior as it was before commit c410fa9b07c3 ("drm/mediatek: Add AFBC
+support to Mediatek DRM driver") on non-AFBC hardware.
+
+Fixes: c410fa9b07c3 ("drm/mediatek: Add AFBC support to Mediatek DRM driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/c7fbd3c3e633c0b7dd6d1cd78ccbdded31e1ca0f.1734397800.git.daniel@makrotopia.org/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 57 +++++++++++++------------
+ 1 file changed, 29 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+index a3091bfcbd43..19b0d5083981 100644
+--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
++++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+@@ -460,6 +460,29 @@ static unsigned int mtk_ovl_fmt_convert(struct mtk_disp_ovl *ovl,
+ }
+ }
+
++static void mtk_ovl_afbc_layer_config(struct mtk_disp_ovl *ovl,
++ unsigned int idx,
++ struct mtk_plane_pending_state *pending,
++ struct cmdq_pkt *cmdq_pkt)
++{
++ unsigned int pitch_msb = pending->pitch >> 16;
++ unsigned int hdr_pitch = pending->hdr_pitch;
++ unsigned int hdr_addr = pending->hdr_addr;
++
++ if (pending->modifier != DRM_FORMAT_MOD_LINEAR) {
++ mtk_ddp_write_relaxed(cmdq_pkt, hdr_addr, &ovl->cmdq_reg, ovl->regs,
++ DISP_REG_OVL_HDR_ADDR(ovl, idx));
++ mtk_ddp_write_relaxed(cmdq_pkt,
++ OVL_PITCH_MSB_2ND_SUBBUF | pitch_msb,
++ &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx));
++ mtk_ddp_write_relaxed(cmdq_pkt, hdr_pitch, &ovl->cmdq_reg, ovl->regs,
++ DISP_REG_OVL_HDR_PITCH(ovl, idx));
++ } else {
++ mtk_ddp_write_relaxed(cmdq_pkt, pitch_msb,
++ &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx));
++ }
++}
++
+ void mtk_ovl_layer_config(struct device *dev, unsigned int idx,
+ struct mtk_plane_state *state,
+ struct cmdq_pkt *cmdq_pkt)
+@@ -467,9 +490,7 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx,
+ struct mtk_disp_ovl *ovl = dev_get_drvdata(dev);
+ struct mtk_plane_pending_state *pending = &state->pending;
+ unsigned int addr = pending->addr;
+- unsigned int hdr_addr = pending->hdr_addr;
+- unsigned int pitch = pending->pitch;
+- unsigned int hdr_pitch = pending->hdr_pitch;
++ unsigned int pitch_lsb = pending->pitch & GENMASK(15, 0);
+ unsigned int fmt = pending->format;
+ unsigned int rotation = pending->rotation;
+ unsigned int offset = (pending->y << 16) | pending->x;
+@@ -477,16 +498,6 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx,
+ unsigned int blend_mode = state->base.pixel_blend_mode;
+ unsigned int ignore_pixel_alpha = 0;
+ unsigned int con;
+- bool is_afbc = pending->modifier != DRM_FORMAT_MOD_LINEAR;
+- union overlay_pitch {
+- struct split_pitch {
+- u16 lsb;
+- u16 msb;
+- } split_pitch;
+- u32 pitch;
+- } overlay_pitch;
+-
+- overlay_pitch.pitch = pitch;
+
+ if (!pending->enable) {
+ mtk_ovl_layer_off(dev, idx, cmdq_pkt);
+@@ -532,11 +543,12 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx,
+ }
+
+ if (ovl->data->supports_afbc)
+- mtk_ovl_set_afbc(ovl, cmdq_pkt, idx, is_afbc);
++ mtk_ovl_set_afbc(ovl, cmdq_pkt, idx,
++ pending->modifier != DRM_FORMAT_MOD_LINEAR);
+
+ mtk_ddp_write_relaxed(cmdq_pkt, con, &ovl->cmdq_reg, ovl->regs,
+ DISP_REG_OVL_CON(idx));
+- mtk_ddp_write_relaxed(cmdq_pkt, overlay_pitch.split_pitch.lsb | ignore_pixel_alpha,
++ mtk_ddp_write_relaxed(cmdq_pkt, pitch_lsb | ignore_pixel_alpha,
+ &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH(idx));
+ mtk_ddp_write_relaxed(cmdq_pkt, src_size, &ovl->cmdq_reg, ovl->regs,
+ DISP_REG_OVL_SRC_SIZE(idx));
+@@ -545,19 +557,8 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx,
+ mtk_ddp_write_relaxed(cmdq_pkt, addr, &ovl->cmdq_reg, ovl->regs,
+ DISP_REG_OVL_ADDR(ovl, idx));
+
+- if (is_afbc) {
+- mtk_ddp_write_relaxed(cmdq_pkt, hdr_addr, &ovl->cmdq_reg, ovl->regs,
+- DISP_REG_OVL_HDR_ADDR(ovl, idx));
+- mtk_ddp_write_relaxed(cmdq_pkt,
+- OVL_PITCH_MSB_2ND_SUBBUF | overlay_pitch.split_pitch.msb,
+- &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx));
+- mtk_ddp_write_relaxed(cmdq_pkt, hdr_pitch, &ovl->cmdq_reg, ovl->regs,
+- DISP_REG_OVL_HDR_PITCH(ovl, idx));
+- } else {
+- mtk_ddp_write_relaxed(cmdq_pkt,
+- overlay_pitch.split_pitch.msb,
+- &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH_MSB(idx));
+- }
++ if (ovl->data->supports_afbc)
++ mtk_ovl_afbc_layer_config(ovl, idx, pending, cmdq_pkt);
+
+ mtk_ovl_set_bit_depth(dev, idx, fmt, cmdq_pkt);
+ mtk_ovl_layer_on(dev, idx, cmdq_pkt);
+--
+2.39.5
+
--- /dev/null
+From 1cbfdf7ff79d7d72299f37f928d319e8b081e99b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2024 13:03:48 -0700
+Subject: drm/xe/oa: Add input fence dependencies
+
+From: Ashutosh Dixit <ashutosh.dixit@intel.com>
+
+[ Upstream commit 2fb4350a283af03a5ee34ba765783a941f942b82 ]
+
+Add input fence dependencies which will make OA configuration wait till
+these dependencies are met (till input fences signal).
+
+v2: Change add_deps arg to xe_oa_submit_bb from bool to enum (Matt Brost)
+
+Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241022200352.1192560-4-ashutosh.dixit@intel.com
+Stable-dep-of: f0ed39830e60 ("xe/oa: Fix query mode of operation for OAR/OAC")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_oa.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c
+index 94c558d949e1..fd14d62bfb54 100644
+--- a/drivers/gpu/drm/xe/xe_oa.c
++++ b/drivers/gpu/drm/xe/xe_oa.c
+@@ -42,6 +42,11 @@
+ #define DEFAULT_POLL_PERIOD_NS (NSEC_PER_SEC / DEFAULT_POLL_FREQUENCY_HZ)
+ #define XE_OA_UNIT_INVALID U32_MAX
+
++enum xe_oa_submit_deps {
++ XE_OA_SUBMIT_NO_DEPS,
++ XE_OA_SUBMIT_ADD_DEPS,
++};
++
+ struct xe_oa_reg {
+ struct xe_reg addr;
+ u32 value;
+@@ -572,7 +577,8 @@ static __poll_t xe_oa_poll(struct file *file, poll_table *wait)
+ return ret;
+ }
+
+-static struct dma_fence *xe_oa_submit_bb(struct xe_oa_stream *stream, struct xe_bb *bb)
++static struct dma_fence *xe_oa_submit_bb(struct xe_oa_stream *stream, enum xe_oa_submit_deps deps,
++ struct xe_bb *bb)
+ {
+ struct xe_sched_job *job;
+ struct dma_fence *fence;
+@@ -585,11 +591,22 @@ static struct dma_fence *xe_oa_submit_bb(struct xe_oa_stream *stream, struct xe_
+ goto exit;
+ }
+
++ if (deps == XE_OA_SUBMIT_ADD_DEPS) {
++ for (int i = 0; i < stream->num_syncs && !err; i++)
++ err = xe_sync_entry_add_deps(&stream->syncs[i], job);
++ if (err) {
++ drm_dbg(&stream->oa->xe->drm, "xe_sync_entry_add_deps err %d\n", err);
++ goto err_put_job;
++ }
++ }
++
+ xe_sched_job_arm(job);
+ fence = dma_fence_get(&job->drm.s_fence->finished);
+ xe_sched_job_push(job);
+
+ return fence;
++err_put_job:
++ xe_sched_job_put(job);
+ exit:
+ return ERR_PTR(err);
+ }
+@@ -667,7 +684,7 @@ static int xe_oa_modify_ctx_image(struct xe_oa_stream *stream, struct xe_lrc *lr
+
+ xe_oa_store_flex(stream, lrc, bb, flex, count);
+
+- fence = xe_oa_submit_bb(stream, bb);
++ fence = xe_oa_submit_bb(stream, XE_OA_SUBMIT_NO_DEPS, bb);
+ if (IS_ERR(fence)) {
+ err = PTR_ERR(fence);
+ goto free_bb;
+@@ -696,7 +713,7 @@ static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *re
+
+ write_cs_mi_lri(bb, reg_lri, 1);
+
+- fence = xe_oa_submit_bb(stream, bb);
++ fence = xe_oa_submit_bb(stream, XE_OA_SUBMIT_NO_DEPS, bb);
+ if (IS_ERR(fence)) {
+ err = PTR_ERR(fence);
+ goto free_bb;
+@@ -944,7 +961,7 @@ static int xe_oa_emit_oa_config(struct xe_oa_stream *stream, struct xe_oa_config
+ goto exit;
+ }
+
+- fence = xe_oa_submit_bb(stream, oa_bo->bb);
++ fence = xe_oa_submit_bb(stream, XE_OA_SUBMIT_ADD_DEPS, oa_bo->bb);
+ if (IS_ERR(fence)) {
+ err = PTR_ERR(fence);
+ goto exit;
+--
+2.39.5
+
--- /dev/null
+From 9aeced687e728b9de067a502a0780f8029e61763 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2024 13:03:46 -0700
+Subject: drm/xe/oa: Separate batch submission from waiting for completion
+
+From: Ashutosh Dixit <ashutosh.dixit@intel.com>
+
+[ Upstream commit dddcb19ad4d4bbe943a72a1fb3266c6e8aa8d541 ]
+
+When we introduce xe_syncs, we don't wait for internal OA programming
+batches to complete. That is, xe_syncs are signaled asynchronously. In
+anticipation for this, separate out batch submission from waiting for
+completion of those batches.
+
+v2: Change return type of xe_oa_submit_bb to "struct dma_fence *" (Matt B)
+v3: Retain init "int err = 0;" in xe_oa_submit_bb (Jose)
+
+Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241022200352.1192560-2-ashutosh.dixit@intel.com
+Stable-dep-of: f0ed39830e60 ("xe/oa: Fix query mode of operation for OAR/OAC")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_oa.c | 57 +++++++++++++++++++++++++++++---------
+ 1 file changed, 44 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c
+index 78823f53d290..4962c9eb9a81 100644
+--- a/drivers/gpu/drm/xe/xe_oa.c
++++ b/drivers/gpu/drm/xe/xe_oa.c
+@@ -567,11 +567,10 @@ static __poll_t xe_oa_poll(struct file *file, poll_table *wait)
+ return ret;
+ }
+
+-static int xe_oa_submit_bb(struct xe_oa_stream *stream, struct xe_bb *bb)
++static struct dma_fence *xe_oa_submit_bb(struct xe_oa_stream *stream, struct xe_bb *bb)
+ {
+ struct xe_sched_job *job;
+ struct dma_fence *fence;
+- long timeout;
+ int err = 0;
+
+ /* Kernel configuration is issued on stream->k_exec_q, not stream->exec_q */
+@@ -585,14 +584,9 @@ static int xe_oa_submit_bb(struct xe_oa_stream *stream, struct xe_bb *bb)
+ fence = dma_fence_get(&job->drm.s_fence->finished);
+ xe_sched_job_push(job);
+
+- timeout = dma_fence_wait_timeout(fence, false, HZ);
+- dma_fence_put(fence);
+- if (timeout < 0)
+- err = timeout;
+- else if (!timeout)
+- err = -ETIME;
++ return fence;
+ exit:
+- return err;
++ return ERR_PTR(err);
+ }
+
+ static void write_cs_mi_lri(struct xe_bb *bb, const struct xe_oa_reg *reg_data, u32 n_regs)
+@@ -656,6 +650,7 @@ static void xe_oa_store_flex(struct xe_oa_stream *stream, struct xe_lrc *lrc,
+ static int xe_oa_modify_ctx_image(struct xe_oa_stream *stream, struct xe_lrc *lrc,
+ const struct flex *flex, u32 count)
+ {
++ struct dma_fence *fence;
+ struct xe_bb *bb;
+ int err;
+
+@@ -667,7 +662,16 @@ static int xe_oa_modify_ctx_image(struct xe_oa_stream *stream, struct xe_lrc *lr
+
+ xe_oa_store_flex(stream, lrc, bb, flex, count);
+
+- err = xe_oa_submit_bb(stream, bb);
++ fence = xe_oa_submit_bb(stream, bb);
++ if (IS_ERR(fence)) {
++ err = PTR_ERR(fence);
++ goto free_bb;
++ }
++ xe_bb_free(bb, fence);
++ dma_fence_put(fence);
++
++ return 0;
++free_bb:
+ xe_bb_free(bb, NULL);
+ exit:
+ return err;
+@@ -675,6 +679,7 @@ static int xe_oa_modify_ctx_image(struct xe_oa_stream *stream, struct xe_lrc *lr
+
+ static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *reg_lri)
+ {
++ struct dma_fence *fence;
+ struct xe_bb *bb;
+ int err;
+
+@@ -686,7 +691,16 @@ static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *re
+
+ write_cs_mi_lri(bb, reg_lri, 1);
+
+- err = xe_oa_submit_bb(stream, bb);
++ fence = xe_oa_submit_bb(stream, bb);
++ if (IS_ERR(fence)) {
++ err = PTR_ERR(fence);
++ goto free_bb;
++ }
++ xe_bb_free(bb, fence);
++ dma_fence_put(fence);
++
++ return 0;
++free_bb:
+ xe_bb_free(bb, NULL);
+ exit:
+ return err;
+@@ -914,15 +928,32 @@ static int xe_oa_emit_oa_config(struct xe_oa_stream *stream, struct xe_oa_config
+ {
+ #define NOA_PROGRAM_ADDITIONAL_DELAY_US 500
+ struct xe_oa_config_bo *oa_bo;
+- int err, us = NOA_PROGRAM_ADDITIONAL_DELAY_US;
++ int err = 0, us = NOA_PROGRAM_ADDITIONAL_DELAY_US;
++ struct dma_fence *fence;
++ long timeout;
+
++ /* Emit OA configuration batch */
+ oa_bo = xe_oa_alloc_config_buffer(stream, config);
+ if (IS_ERR(oa_bo)) {
+ err = PTR_ERR(oa_bo);
+ goto exit;
+ }
+
+- err = xe_oa_submit_bb(stream, oa_bo->bb);
++ fence = xe_oa_submit_bb(stream, oa_bo->bb);
++ if (IS_ERR(fence)) {
++ err = PTR_ERR(fence);
++ goto exit;
++ }
++
++ /* Wait till all previous batches have executed */
++ timeout = dma_fence_wait_timeout(fence, false, 5 * HZ);
++ dma_fence_put(fence);
++ if (timeout < 0)
++ err = timeout;
++ else if (!timeout)
++ err = -ETIME;
++ if (err)
++ drm_dbg(&stream->oa->xe->drm, "dma_fence_wait_timeout err %d\n", err);
+
+ /* Additional empirical delay needed for NOA programming after registers are written */
+ usleep_range(us, 2 * us);
+--
+2.39.5
+
--- /dev/null
+From 756233c8ca6cada8855f9f98aeadce3a60799ab3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2024 13:03:47 -0700
+Subject: drm/xe/oa/uapi: Define and parse OA sync properties
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ashutosh Dixit <ashutosh.dixit@intel.com>
+
+[ Upstream commit c8507a25cebd179db935dd266a33c51bef1b1e80 ]
+
+Now that we have laid the groundwork, introduce OA sync properties in the
+uapi and parse the input xe_sync array as is done elsewhere in the
+driver. Also add DRM_XE_OA_CAPS_SYNCS bit in OA capabilities for userspace.
+
+v2: Fix and document DRM_XE_SYNC_TYPE_USER_FENCE for OA (Matt B)
+ Add DRM_XE_OA_CAPS_SYNCS bit to OA capabilities (Jose)
+
+Acked-by: José Roberto de Souza <jose.souza@intel.com>
+Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241022200352.1192560-3-ashutosh.dixit@intel.com
+Stable-dep-of: f0ed39830e60 ("xe/oa: Fix query mode of operation for OAR/OAC")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_oa.c | 83 +++++++++++++++++++++++++++++++-
+ drivers/gpu/drm/xe/xe_oa_types.h | 6 +++
+ drivers/gpu/drm/xe/xe_query.c | 2 +-
+ include/uapi/drm/xe_drm.h | 17 +++++++
+ 4 files changed, 106 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c
+index 4962c9eb9a81..94c558d949e1 100644
+--- a/drivers/gpu/drm/xe/xe_oa.c
++++ b/drivers/gpu/drm/xe/xe_oa.c
+@@ -36,6 +36,7 @@
+ #include "xe_pm.h"
+ #include "xe_sched_job.h"
+ #include "xe_sriov.h"
++#include "xe_sync.h"
+
+ #define DEFAULT_POLL_FREQUENCY_HZ 200
+ #define DEFAULT_POLL_PERIOD_NS (NSEC_PER_SEC / DEFAULT_POLL_FREQUENCY_HZ)
+@@ -70,6 +71,7 @@ struct flex {
+ };
+
+ struct xe_oa_open_param {
++ struct xe_file *xef;
+ u32 oa_unit_id;
+ bool sample;
+ u32 metric_set;
+@@ -81,6 +83,9 @@ struct xe_oa_open_param {
+ struct xe_exec_queue *exec_q;
+ struct xe_hw_engine *hwe;
+ bool no_preempt;
++ struct drm_xe_sync __user *syncs_user;
++ int num_syncs;
++ struct xe_sync_entry *syncs;
+ };
+
+ struct xe_oa_config_bo {
+@@ -1393,6 +1398,9 @@ static int xe_oa_stream_init(struct xe_oa_stream *stream,
+ stream->period_exponent = param->period_exponent;
+ stream->no_preempt = param->no_preempt;
+
++ stream->num_syncs = param->num_syncs;
++ stream->syncs = param->syncs;
++
+ /*
+ * For Xe2+, when overrun mode is enabled, there are no partial reports at the end
+ * of buffer, making the OA buffer effectively a non-power-of-2 size circular
+@@ -1743,6 +1751,20 @@ static int xe_oa_set_no_preempt(struct xe_oa *oa, u64 value,
+ return 0;
+ }
+
++static int xe_oa_set_prop_num_syncs(struct xe_oa *oa, u64 value,
++ struct xe_oa_open_param *param)
++{
++ param->num_syncs = value;
++ return 0;
++}
++
++static int xe_oa_set_prop_syncs_user(struct xe_oa *oa, u64 value,
++ struct xe_oa_open_param *param)
++{
++ param->syncs_user = u64_to_user_ptr(value);
++ return 0;
++}
++
+ typedef int (*xe_oa_set_property_fn)(struct xe_oa *oa, u64 value,
+ struct xe_oa_open_param *param);
+ static const xe_oa_set_property_fn xe_oa_set_property_funcs[] = {
+@@ -1755,6 +1777,8 @@ static const xe_oa_set_property_fn xe_oa_set_property_funcs[] = {
+ [DRM_XE_OA_PROPERTY_EXEC_QUEUE_ID] = xe_oa_set_prop_exec_queue_id,
+ [DRM_XE_OA_PROPERTY_OA_ENGINE_INSTANCE] = xe_oa_set_prop_engine_instance,
+ [DRM_XE_OA_PROPERTY_NO_PREEMPT] = xe_oa_set_no_preempt,
++ [DRM_XE_OA_PROPERTY_NUM_SYNCS] = xe_oa_set_prop_num_syncs,
++ [DRM_XE_OA_PROPERTY_SYNCS] = xe_oa_set_prop_syncs_user,
+ };
+
+ static int xe_oa_user_ext_set_property(struct xe_oa *oa, u64 extension,
+@@ -1814,6 +1838,49 @@ static int xe_oa_user_extensions(struct xe_oa *oa, u64 extension, int ext_number
+ return 0;
+ }
+
++static int xe_oa_parse_syncs(struct xe_oa *oa, struct xe_oa_open_param *param)
++{
++ int ret, num_syncs, num_ufence = 0;
++
++ if (param->num_syncs && !param->syncs_user) {
++ drm_dbg(&oa->xe->drm, "num_syncs specified without sync array\n");
++ ret = -EINVAL;
++ goto exit;
++ }
++
++ if (param->num_syncs) {
++ param->syncs = kcalloc(param->num_syncs, sizeof(*param->syncs), GFP_KERNEL);
++ if (!param->syncs) {
++ ret = -ENOMEM;
++ goto exit;
++ }
++ }
++
++ for (num_syncs = 0; num_syncs < param->num_syncs; num_syncs++) {
++ ret = xe_sync_entry_parse(oa->xe, param->xef, ¶m->syncs[num_syncs],
++ ¶m->syncs_user[num_syncs], 0);
++ if (ret)
++ goto err_syncs;
++
++ if (xe_sync_is_ufence(¶m->syncs[num_syncs]))
++ num_ufence++;
++ }
++
++ if (XE_IOCTL_DBG(oa->xe, num_ufence > 1)) {
++ ret = -EINVAL;
++ goto err_syncs;
++ }
++
++ return 0;
++
++err_syncs:
++ while (num_syncs--)
++ xe_sync_entry_cleanup(¶m->syncs[num_syncs]);
++ kfree(param->syncs);
++exit:
++ return ret;
++}
++
+ /**
+ * xe_oa_stream_open_ioctl - Opens an OA stream
+ * @dev: @drm_device
+@@ -1839,6 +1906,7 @@ int xe_oa_stream_open_ioctl(struct drm_device *dev, u64 data, struct drm_file *f
+ return -ENODEV;
+ }
+
++ param.xef = xef;
+ ret = xe_oa_user_extensions(oa, data, 0, ¶m);
+ if (ret)
+ return ret;
+@@ -1907,11 +1975,24 @@ int xe_oa_stream_open_ioctl(struct drm_device *dev, u64 data, struct drm_file *f
+ drm_dbg(&oa->xe->drm, "Using periodic sampling freq %lld Hz\n", oa_freq_hz);
+ }
+
++ ret = xe_oa_parse_syncs(oa, ¶m);
++ if (ret)
++ goto err_exec_q;
++
+ mutex_lock(¶m.hwe->gt->oa.gt_lock);
+ ret = xe_oa_stream_open_ioctl_locked(oa, ¶m);
+ mutex_unlock(¶m.hwe->gt->oa.gt_lock);
++ if (ret < 0)
++ goto err_sync_cleanup;
++
++ return ret;
++
++err_sync_cleanup:
++ while (param.num_syncs--)
++ xe_sync_entry_cleanup(¶m.syncs[param.num_syncs]);
++ kfree(param.syncs);
+ err_exec_q:
+- if (ret < 0 && param.exec_q)
++ if (param.exec_q)
+ xe_exec_queue_put(param.exec_q);
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/xe/xe_oa_types.h b/drivers/gpu/drm/xe/xe_oa_types.h
+index 8862eca73fbe..99f4b2d4bdcf 100644
+--- a/drivers/gpu/drm/xe/xe_oa_types.h
++++ b/drivers/gpu/drm/xe/xe_oa_types.h
+@@ -238,5 +238,11 @@ struct xe_oa_stream {
+
+ /** @no_preempt: Whether preemption and timeslicing is disabled for stream exec_q */
+ u32 no_preempt;
++
++ /** @num_syncs: size of @syncs array */
++ u32 num_syncs;
++
++ /** @syncs: syncs to wait on and to signal */
++ struct xe_sync_entry *syncs;
+ };
+ #endif
+diff --git a/drivers/gpu/drm/xe/xe_query.c b/drivers/gpu/drm/xe/xe_query.c
+index 1c96375bd7df..6fec5d1a1eb4 100644
+--- a/drivers/gpu/drm/xe/xe_query.c
++++ b/drivers/gpu/drm/xe/xe_query.c
+@@ -679,7 +679,7 @@ static int query_oa_units(struct xe_device *xe,
+ du->oa_unit_id = u->oa_unit_id;
+ du->oa_unit_type = u->type;
+ du->oa_timestamp_freq = xe_oa_timestamp_frequency(gt);
+- du->capabilities = DRM_XE_OA_CAPS_BASE;
++ du->capabilities = DRM_XE_OA_CAPS_BASE | DRM_XE_OA_CAPS_SYNCS;
+
+ j = 0;
+ for_each_hw_engine(hwe, gt, hwe_id) {
+diff --git a/include/uapi/drm/xe_drm.h b/include/uapi/drm/xe_drm.h
+index c4182e95a619..4a8a4a63e99c 100644
+--- a/include/uapi/drm/xe_drm.h
++++ b/include/uapi/drm/xe_drm.h
+@@ -1485,6 +1485,7 @@ struct drm_xe_oa_unit {
+ /** @capabilities: OA capabilities bit-mask */
+ __u64 capabilities;
+ #define DRM_XE_OA_CAPS_BASE (1 << 0)
++#define DRM_XE_OA_CAPS_SYNCS (1 << 1)
+
+ /** @oa_timestamp_freq: OA timestamp freq */
+ __u64 oa_timestamp_freq;
+@@ -1634,6 +1635,22 @@ enum drm_xe_oa_property_id {
+ * to be disabled for the stream exec queue.
+ */
+ DRM_XE_OA_PROPERTY_NO_PREEMPT,
++
++ /**
++ * @DRM_XE_OA_PROPERTY_NUM_SYNCS: Number of syncs in the sync array
++ * specified in @DRM_XE_OA_PROPERTY_SYNCS
++ */
++ DRM_XE_OA_PROPERTY_NUM_SYNCS,
++
++ /**
++ * @DRM_XE_OA_PROPERTY_SYNCS: Pointer to struct @drm_xe_sync array
++ * with array size specified via @DRM_XE_OA_PROPERTY_NUM_SYNCS. OA
++ * configuration will wait till input fences signal. Output fences
++ * will signal after the new OA configuration takes effect. For
++ * @DRM_XE_SYNC_TYPE_USER_FENCE, @addr is a user pointer, similar
++ * to the VM bind case.
++ */
++ DRM_XE_OA_PROPERTY_SYNCS,
+ };
+
+ /**
+--
+2.39.5
+
--- /dev/null
+From 708ed3fb70c6b41e5f64076dac7e3db75e7e68de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2024 09:33:35 +0100
+Subject: firewall: remove misplaced semicolon from stm32_firewall_get_firewall
+
+From: guanjing <guanjing@cmss.chinamobile.com>
+
+[ Upstream commit 155c5bf26f983e9988333eeb0ef217138304d13b ]
+
+Remove misplaced colon in stm32_firewall_get_firewall()
+which results in a syntax error when the code is compiled
+without CONFIG_STM32_FIREWALL.
+
+Fixes: 5c9668cfc6d7 ("firewall: introduce stm32_firewall framework")
+Signed-off-by: guanjing <guanjing@cmss.chinamobile.com>
+Reviewed-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bus/stm32_firewall_device.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/bus/stm32_firewall_device.h b/include/linux/bus/stm32_firewall_device.h
+index 18e0a2fc3816..5178b72bc920 100644
+--- a/include/linux/bus/stm32_firewall_device.h
++++ b/include/linux/bus/stm32_firewall_device.h
+@@ -115,7 +115,7 @@ void stm32_firewall_release_access_by_id(struct stm32_firewall *firewall, u32 su
+ #else /* CONFIG_STM32_FIREWALL */
+
+ int stm32_firewall_get_firewall(struct device_node *np, struct stm32_firewall *firewall,
+- unsigned int nb_firewall);
++ unsigned int nb_firewall)
+ {
+ return -ENODEV;
+ }
+--
+2.39.5
+
--- /dev/null
+From c556c4148cfcffdc1f4061241f208c28155c2f04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jan 2025 21:36:18 +0000
+Subject: hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors
+ occur
+
+From: Daniil Stas <daniil.stas@posteo.net>
+
+[ Upstream commit 82163d63ae7a4c36142cd252388737205bb7e4b9 ]
+
+scsi_execute_cmd() function can return both negative (linux codes) and
+positive (scsi_cmnd result field) error codes.
+
+Currently the driver just passes error codes of scsi_execute_cmd() to
+hwmon core, which is incorrect because hwmon only checks for negative
+error codes. This leads to hwmon reporting uninitialized data to
+userspace in case of SCSI errors (for example if the disk drive was
+disconnected).
+
+This patch checks scsi_execute_cmd() output and returns -EIO if it's
+error code is positive.
+
+Fixes: 5b46903d8bf37 ("hwmon: Driver for disk and solid state drives with temperature sensors")
+Signed-off-by: Daniil Stas <daniil.stas@posteo.net>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Cc: Chris Healy <cphealy@gmail.com>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: Bart Van Assche <bvanassche@acm.org>
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-scsi@vger.kernel.org
+Cc: linux-ide@vger.kernel.org
+Cc: linux-hwmon@vger.kernel.org
+Link: https://lore.kernel.org/r/20250105213618.531691-1-daniil.stas@posteo.net
+[groeck: Avoid inline variable declaration for portability]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/drivetemp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/drivetemp.c b/drivers/hwmon/drivetemp.c
+index 6bdd21aa005a..2a4ec55ddb47 100644
+--- a/drivers/hwmon/drivetemp.c
++++ b/drivers/hwmon/drivetemp.c
+@@ -165,6 +165,7 @@ static int drivetemp_scsi_command(struct drivetemp_data *st,
+ {
+ u8 scsi_cmd[MAX_COMMAND_SIZE];
+ enum req_op op;
++ int err;
+
+ memset(scsi_cmd, 0, sizeof(scsi_cmd));
+ scsi_cmd[0] = ATA_16;
+@@ -192,8 +193,11 @@ static int drivetemp_scsi_command(struct drivetemp_data *st,
+ scsi_cmd[12] = lba_high;
+ scsi_cmd[14] = ata_command;
+
+- return scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata,
+- ATA_SECT_SIZE, HZ, 5, NULL);
++ err = scsi_execute_cmd(st->sdev, scsi_cmd, op, st->smartdata,
++ ATA_SECT_SIZE, HZ, 5, NULL);
++ if (err > 0)
++ err = -EIO;
++ return err;
+ }
+
+ static int drivetemp_ata_command(struct drivetemp_data *st, u8 feature,
+--
+2.39.5
+
--- /dev/null
+From c56e79d453ef5b5fc6ded252bc6ba461f12946ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2024 21:24:37 +0000
+Subject: mm: zswap: fix race between [de]compression and CPU hotunplug
+
+From: Yosry Ahmed <yosryahmed@google.com>
+
+[ Upstream commit eaebeb93922ca6ab0dd92027b73d0112701706ef ]
+
+In zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of the
+current CPU at the beginning of the operation is retrieved and used
+throughout. However, since neither preemption nor migration are disabled,
+it is possible that the operation continues on a different CPU.
+
+If the original CPU is hotunplugged while the acomp_ctx is still in use,
+we run into a UAF bug as the resources attached to the acomp_ctx are freed
+during hotunplug in zswap_cpu_comp_dead().
+
+The problem was introduced in commit 1ec3b5fe6eec ("mm/zswap: move to use
+crypto_acomp API for hardware acceleration") when the switch to the
+crypto_acomp API was made. Prior to that, the per-CPU crypto_comp was
+retrieved using get_cpu_ptr() which disables preemption and makes sure the
+CPU cannot go away from under us. Preemption cannot be disabled with the
+crypto_acomp API as a sleepable context is needed.
+
+Commit 8ba2f844f050 ("mm/zswap: change per-cpu mutex and buffer to
+per-acomp_ctx") increased the UAF surface area by making the per-CPU
+buffers dynamic, adding yet another resource that can be freed from under
+zswap compression/decompression by CPU hotunplug.
+
+There are a few ways to fix this:
+(a) Add a refcount for acomp_ctx.
+(b) Disable migration while using the per-CPU acomp_ctx.
+(c) Disable CPU hotunplug while using the per-CPU acomp_ctx by holding
+the CPUs read lock.
+
+Implement (c) since it's simpler than (a), and (b) involves using
+migrate_disable() which is apparently undesired (see huge comment in
+include/linux/preempt.h).
+
+Link: https://lkml.kernel.org/r/20241219212437.2714151-1-yosryahmed@google.com
+Fixes: 1ec3b5fe6eec ("mm/zswap: move to use crypto_acomp API for hardware acceleration")
+Signed-off-by: Yosry Ahmed <yosryahmed@google.com>
+Reported-by: Johannes Weiner <hannes@cmpxchg.org>
+Closes: https://lore.kernel.org/lkml/20241113213007.GB1564047@cmpxchg.org/
+Reported-by: Sam Sun <samsun1006219@gmail.com>
+Closes: https://lore.kernel.org/lkml/CAEkJfYMtSdM5HceNsXUDf5haghD5+o2e7Qv4OcuruL4tPg6OaQ@mail.gmail.com/
+Reviewed-by: Chengming Zhou <chengming.zhou@linux.dev>
+Acked-by: Barry Song <baohua@kernel.org>
+Reviewed-by: Nhat Pham <nphamcs@gmail.com>
+Cc: Vitaly Wool <vitalywool@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/zswap.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/mm/zswap.c b/mm/zswap.c
+index 0030ce8fecfc..c86d4bcbb447 100644
+--- a/mm/zswap.c
++++ b/mm/zswap.c
+@@ -875,6 +875,18 @@ static int zswap_cpu_comp_dead(unsigned int cpu, struct hlist_node *node)
+ return 0;
+ }
+
++/* Prevent CPU hotplug from freeing up the per-CPU acomp_ctx resources */
++static struct crypto_acomp_ctx *acomp_ctx_get_cpu(struct crypto_acomp_ctx __percpu *acomp_ctx)
++{
++ cpus_read_lock();
++ return raw_cpu_ptr(acomp_ctx);
++}
++
++static void acomp_ctx_put_cpu(void)
++{
++ cpus_read_unlock();
++}
++
+ static bool zswap_compress(struct folio *folio, struct zswap_entry *entry)
+ {
+ struct crypto_acomp_ctx *acomp_ctx;
+@@ -887,8 +899,7 @@ static bool zswap_compress(struct folio *folio, struct zswap_entry *entry)
+ gfp_t gfp;
+ u8 *dst;
+
+- acomp_ctx = raw_cpu_ptr(entry->pool->acomp_ctx);
+-
++ acomp_ctx = acomp_ctx_get_cpu(entry->pool->acomp_ctx);
+ mutex_lock(&acomp_ctx->mutex);
+
+ dst = acomp_ctx->buffer;
+@@ -944,6 +955,7 @@ static bool zswap_compress(struct folio *folio, struct zswap_entry *entry)
+ zswap_reject_alloc_fail++;
+
+ mutex_unlock(&acomp_ctx->mutex);
++ acomp_ctx_put_cpu();
+ return comp_ret == 0 && alloc_ret == 0;
+ }
+
+@@ -954,7 +966,7 @@ static void zswap_decompress(struct zswap_entry *entry, struct folio *folio)
+ struct crypto_acomp_ctx *acomp_ctx;
+ u8 *src;
+
+- acomp_ctx = raw_cpu_ptr(entry->pool->acomp_ctx);
++ acomp_ctx = acomp_ctx_get_cpu(entry->pool->acomp_ctx);
+ mutex_lock(&acomp_ctx->mutex);
+
+ src = zpool_map_handle(zpool, entry->handle, ZPOOL_MM_RO);
+@@ -984,6 +996,7 @@ static void zswap_decompress(struct zswap_entry *entry, struct folio *folio)
+
+ if (src != acomp_ctx->buffer)
+ zpool_unmap_handle(zpool, entry->handle);
++ acomp_ctx_put_cpu();
+ }
+
+ /*********************************
+--
+2.39.5
+
iio-adc-ad7173-fix-using-shared-static-info-struct.patch
iio-adc-ad7124-disable-all-channels-at-probe-time.patch
io_uring-eventfd-ensure-io_eventfd_signal-defers-another-rcu-period.patch
+arm64-dts-imx95-correct-the-address-length-of-netcmi.patch
+arm-dts-imxrt1050-fix-clocks-for-mmc.patch
+arm64-dts-qcom-sa8775p-fix-the-secure-device-bootup-.patch
+hwmon-drivetemp-fix-driver-producing-garbage-data-wh.patch
+block-bfq-fix-waker_bfqq-uaf-after-bfq_split_bfqq.patch
+arm64-dts-rockchip-add-hevc-power-domain-clock-to-rk.patch
+firewall-remove-misplaced-semicolon-from-stm32_firew.patch
+drm-xe-oa-separate-batch-submission-from-waiting-for.patch
+drm-xe-oa-uapi-define-and-parse-oa-sync-properties.patch
+drm-xe-oa-add-input-fence-dependencies.patch
+xe-oa-fix-query-mode-of-operation-for-oar-oac.patch
+mm-zswap-fix-race-between-de-compression-and-cpu-hot.patch
+drm-mediatek-only-touch-disp_reg_ovl_pitch_msb-if-af.patch
--- /dev/null
+From a65d438e587efaac9af626908a555e536361984b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2024 09:19:18 -0800
+Subject: xe/oa: Fix query mode of operation for OAR/OAC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+
+[ Upstream commit f0ed39830e6064d62f9c5393505677a26569bb56 ]
+
+This is a set of squashed commits to facilitate smooth applying to
+stable. Each commit message is retained for reference.
+
+1) Allow a GGTT mapped batch to be submitted to user exec queue
+
+For a OA use case, one of the HW registers needs to be modified by
+submitting an MI_LOAD_REGISTER_IMM command to the users exec queue, so
+that the register is modified in the user's hardware context. In order
+to do this a batch that is mapped in GGTT, needs to be submitted to the
+user exec queue. Since all user submissions use q->vm and hence PPGTT,
+add some plumbing to enable submission of batches mapped in GGTT.
+
+v2: ggtt is zero-initialized, so no need to set it false (Matt Brost)
+
+2) xe/oa: Use MI_LOAD_REGISTER_IMMEDIATE to enable OAR/OAC
+
+To enable OAR/OAC, a bit in RING_CONTEXT_CONTROL needs to be set.
+Setting this bit cause the context image size to change and if not done
+correct, can cause undesired hangs.
+
+Current code uses a separate exec_queue to modify this bit and is
+error-prone. As per HW recommendation, submit MI_LOAD_REGISTER_IMM to
+the target hardware context to modify the relevant bit.
+
+In v2 version, an attempt to submit everything to the user-queue was
+made, but it failed the unprivileged-single-ctx-counters test. It
+appears that the OACTXCONTROL must be modified from a remote context.
+
+In v3 version, all context specific register configurations were moved
+to use LOAD_REGISTER_IMMEDIATE and that seems to work well. This is a
+cleaner way, since we can now submit all configuration to user
+exec_queue and the fence handling is simplified.
+
+v2:
+(Matt)
+- set job->ggtt to true if create job is successful
+- unlock vm on job error
+
+(Ashutosh)
+- don't wait on job submission
+- use kernel exec queue where possible
+
+v3:
+(Ashutosh)
+- Fix checkpatch issues
+- Remove extra spaces/new-lines
+- Add Fixes: and Cc: tags
+- Reset context control bit when OA stream is closed
+- Submit all config via MI_LOAD_REGISTER_IMMEDIATE
+
+(Umesh)
+- Update commit message for v3 experiment
+- Squash patches for easier port to stable
+
+v4:
+(Ashutosh)
+- No need to pass q to xe_oa_submit_bb
+- Do not support exec queues with width > 1
+- Fix disabling of CTX_CTRL_OAC_CONTEXT_ENABLE
+
+v5:
+(Ashutosh)
+- Drop reg_lri related comments
+- Use XE_OA_SUBMIT_NO_DEPS in xe_oa_load_with_lri
+
+Fixes: 8135f1c09dd2 ("drm/xe/oa: Don't reset OAC_CONTEXT_ENABLE on OA stream close")
+Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com> # commit 1
+Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241220171919.571528-2-umesh.nerlige.ramappa@intel.com
+(cherry picked from commit 55039832f98c7e05f1cf9e0d8c12b2490abd0f16)
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_oa.c | 134 ++++++++----------------
+ drivers/gpu/drm/xe/xe_ring_ops.c | 5 +-
+ drivers/gpu/drm/xe/xe_sched_job_types.h | 2 +
+ 3 files changed, 51 insertions(+), 90 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c
+index fd14d62bfb54..d81f0b05b2df 100644
+--- a/drivers/gpu/drm/xe/xe_oa.c
++++ b/drivers/gpu/drm/xe/xe_oa.c
+@@ -69,12 +69,6 @@ struct xe_oa_config {
+ struct rcu_head rcu;
+ };
+
+-struct flex {
+- struct xe_reg reg;
+- u32 offset;
+- u32 value;
+-};
+-
+ struct xe_oa_open_param {
+ struct xe_file *xef;
+ u32 oa_unit_id;
+@@ -577,19 +571,38 @@ static __poll_t xe_oa_poll(struct file *file, poll_table *wait)
+ return ret;
+ }
+
++static void xe_oa_lock_vma(struct xe_exec_queue *q)
++{
++ if (q->vm) {
++ down_read(&q->vm->lock);
++ xe_vm_lock(q->vm, false);
++ }
++}
++
++static void xe_oa_unlock_vma(struct xe_exec_queue *q)
++{
++ if (q->vm) {
++ xe_vm_unlock(q->vm);
++ up_read(&q->vm->lock);
++ }
++}
++
+ static struct dma_fence *xe_oa_submit_bb(struct xe_oa_stream *stream, enum xe_oa_submit_deps deps,
+ struct xe_bb *bb)
+ {
++ struct xe_exec_queue *q = stream->exec_q ?: stream->k_exec_q;
+ struct xe_sched_job *job;
+ struct dma_fence *fence;
+ int err = 0;
+
+- /* Kernel configuration is issued on stream->k_exec_q, not stream->exec_q */
+- job = xe_bb_create_job(stream->k_exec_q, bb);
++ xe_oa_lock_vma(q);
++
++ job = xe_bb_create_job(q, bb);
+ if (IS_ERR(job)) {
+ err = PTR_ERR(job);
+ goto exit;
+ }
++ job->ggtt = true;
+
+ if (deps == XE_OA_SUBMIT_ADD_DEPS) {
+ for (int i = 0; i < stream->num_syncs && !err; i++)
+@@ -604,10 +617,13 @@ static struct dma_fence *xe_oa_submit_bb(struct xe_oa_stream *stream, enum xe_oa
+ fence = dma_fence_get(&job->drm.s_fence->finished);
+ xe_sched_job_push(job);
+
++ xe_oa_unlock_vma(q);
++
+ return fence;
+ err_put_job:
+ xe_sched_job_put(job);
+ exit:
++ xe_oa_unlock_vma(q);
+ return ERR_PTR(err);
+ }
+
+@@ -655,63 +671,19 @@ static void xe_oa_free_configs(struct xe_oa_stream *stream)
+ free_oa_config_bo(oa_bo);
+ }
+
+-static void xe_oa_store_flex(struct xe_oa_stream *stream, struct xe_lrc *lrc,
+- struct xe_bb *bb, const struct flex *flex, u32 count)
+-{
+- u32 offset = xe_bo_ggtt_addr(lrc->bo);
+-
+- do {
+- bb->cs[bb->len++] = MI_STORE_DATA_IMM | MI_SDI_GGTT | MI_SDI_NUM_DW(1);
+- bb->cs[bb->len++] = offset + flex->offset * sizeof(u32);
+- bb->cs[bb->len++] = 0;
+- bb->cs[bb->len++] = flex->value;
+-
+- } while (flex++, --count);
+-}
+-
+-static int xe_oa_modify_ctx_image(struct xe_oa_stream *stream, struct xe_lrc *lrc,
+- const struct flex *flex, u32 count)
+-{
+- struct dma_fence *fence;
+- struct xe_bb *bb;
+- int err;
+-
+- bb = xe_bb_new(stream->gt, 4 * count, false);
+- if (IS_ERR(bb)) {
+- err = PTR_ERR(bb);
+- goto exit;
+- }
+-
+- xe_oa_store_flex(stream, lrc, bb, flex, count);
+-
+- fence = xe_oa_submit_bb(stream, XE_OA_SUBMIT_NO_DEPS, bb);
+- if (IS_ERR(fence)) {
+- err = PTR_ERR(fence);
+- goto free_bb;
+- }
+- xe_bb_free(bb, fence);
+- dma_fence_put(fence);
+-
+- return 0;
+-free_bb:
+- xe_bb_free(bb, NULL);
+-exit:
+- return err;
+-}
+-
+-static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *reg_lri)
++static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *reg_lri, u32 count)
+ {
+ struct dma_fence *fence;
+ struct xe_bb *bb;
+ int err;
+
+- bb = xe_bb_new(stream->gt, 3, false);
++ bb = xe_bb_new(stream->gt, 2 * count + 1, false);
+ if (IS_ERR(bb)) {
+ err = PTR_ERR(bb);
+ goto exit;
+ }
+
+- write_cs_mi_lri(bb, reg_lri, 1);
++ write_cs_mi_lri(bb, reg_lri, count);
+
+ fence = xe_oa_submit_bb(stream, XE_OA_SUBMIT_NO_DEPS, bb);
+ if (IS_ERR(fence)) {
+@@ -731,70 +703,54 @@ static int xe_oa_load_with_lri(struct xe_oa_stream *stream, struct xe_oa_reg *re
+ static int xe_oa_configure_oar_context(struct xe_oa_stream *stream, bool enable)
+ {
+ const struct xe_oa_format *format = stream->oa_buffer.format;
+- struct xe_lrc *lrc = stream->exec_q->lrc[0];
+- u32 regs_offset = xe_lrc_regs_offset(lrc) / sizeof(u32);
+ u32 oacontrol = __format_to_oactrl(format, OAR_OACONTROL_COUNTER_SEL_MASK) |
+ (enable ? OAR_OACONTROL_COUNTER_ENABLE : 0);
+
+- struct flex regs_context[] = {
++ struct xe_oa_reg reg_lri[] = {
+ {
+ OACTXCONTROL(stream->hwe->mmio_base),
+- stream->oa->ctx_oactxctrl_offset[stream->hwe->class] + 1,
+ enable ? OA_COUNTER_RESUME : 0,
+ },
++ {
++ OAR_OACONTROL,
++ oacontrol,
++ },
+ {
+ RING_CONTEXT_CONTROL(stream->hwe->mmio_base),
+- regs_offset + CTX_CONTEXT_CONTROL,
+- _MASKED_BIT_ENABLE(CTX_CTRL_OAC_CONTEXT_ENABLE),
++ _MASKED_FIELD(CTX_CTRL_OAC_CONTEXT_ENABLE,
++ enable ? CTX_CTRL_OAC_CONTEXT_ENABLE : 0)
+ },
+ };
+- struct xe_oa_reg reg_lri = { OAR_OACONTROL, oacontrol };
+- int err;
+-
+- /* Modify stream hwe context image with regs_context */
+- err = xe_oa_modify_ctx_image(stream, stream->exec_q->lrc[0],
+- regs_context, ARRAY_SIZE(regs_context));
+- if (err)
+- return err;
+
+- /* Apply reg_lri using LRI */
+- return xe_oa_load_with_lri(stream, ®_lri);
++ return xe_oa_load_with_lri(stream, reg_lri, ARRAY_SIZE(reg_lri));
+ }
+
+ static int xe_oa_configure_oac_context(struct xe_oa_stream *stream, bool enable)
+ {
+ const struct xe_oa_format *format = stream->oa_buffer.format;
+- struct xe_lrc *lrc = stream->exec_q->lrc[0];
+- u32 regs_offset = xe_lrc_regs_offset(lrc) / sizeof(u32);
+ u32 oacontrol = __format_to_oactrl(format, OAR_OACONTROL_COUNTER_SEL_MASK) |
+ (enable ? OAR_OACONTROL_COUNTER_ENABLE : 0);
+- struct flex regs_context[] = {
++ struct xe_oa_reg reg_lri[] = {
+ {
+ OACTXCONTROL(stream->hwe->mmio_base),
+- stream->oa->ctx_oactxctrl_offset[stream->hwe->class] + 1,
+ enable ? OA_COUNTER_RESUME : 0,
+ },
++ {
++ OAC_OACONTROL,
++ oacontrol
++ },
+ {
+ RING_CONTEXT_CONTROL(stream->hwe->mmio_base),
+- regs_offset + CTX_CONTEXT_CONTROL,
+- _MASKED_BIT_ENABLE(CTX_CTRL_OAC_CONTEXT_ENABLE) |
++ _MASKED_FIELD(CTX_CTRL_OAC_CONTEXT_ENABLE,
++ enable ? CTX_CTRL_OAC_CONTEXT_ENABLE : 0) |
+ _MASKED_FIELD(CTX_CTRL_RUN_ALONE, enable ? CTX_CTRL_RUN_ALONE : 0),
+ },
+ };
+- struct xe_oa_reg reg_lri = { OAC_OACONTROL, oacontrol };
+- int err;
+
+ /* Set ccs select to enable programming of OAC_OACONTROL */
+ xe_mmio_write32(stream->gt, __oa_regs(stream)->oa_ctrl, __oa_ccs_select(stream));
+
+- /* Modify stream hwe context image with regs_context */
+- err = xe_oa_modify_ctx_image(stream, stream->exec_q->lrc[0],
+- regs_context, ARRAY_SIZE(regs_context));
+- if (err)
+- return err;
+-
+- /* Apply reg_lri using LRI */
+- return xe_oa_load_with_lri(stream, ®_lri);
++ return xe_oa_load_with_lri(stream, reg_lri, ARRAY_SIZE(reg_lri));
+ }
+
+ static int xe_oa_configure_oa_context(struct xe_oa_stream *stream, bool enable)
+@@ -1933,8 +1889,8 @@ int xe_oa_stream_open_ioctl(struct drm_device *dev, u64 data, struct drm_file *f
+ if (XE_IOCTL_DBG(oa->xe, !param.exec_q))
+ return -ENOENT;
+
+- if (param.exec_q->width > 1)
+- drm_dbg(&oa->xe->drm, "exec_q->width > 1, programming only exec_q->lrc[0]\n");
++ if (XE_IOCTL_DBG(oa->xe, param.exec_q->width > 1))
++ return -EOPNOTSUPP;
+ }
+
+ /*
+diff --git a/drivers/gpu/drm/xe/xe_ring_ops.c b/drivers/gpu/drm/xe/xe_ring_ops.c
+index 0be4f489d3e1..9f327f27c072 100644
+--- a/drivers/gpu/drm/xe/xe_ring_ops.c
++++ b/drivers/gpu/drm/xe/xe_ring_ops.c
+@@ -221,7 +221,10 @@ static int emit_pipe_imm_ggtt(u32 addr, u32 value, bool stall_only, u32 *dw,
+
+ static u32 get_ppgtt_flag(struct xe_sched_job *job)
+ {
+- return job->q->vm ? BIT(8) : 0;
++ if (job->q->vm && !job->ggtt)
++ return BIT(8);
++
++ return 0;
+ }
+
+ static int emit_copy_timestamp(struct xe_lrc *lrc, u32 *dw, int i)
+diff --git a/drivers/gpu/drm/xe/xe_sched_job_types.h b/drivers/gpu/drm/xe/xe_sched_job_types.h
+index 0d3f76fb05ce..c207361bf43e 100644
+--- a/drivers/gpu/drm/xe/xe_sched_job_types.h
++++ b/drivers/gpu/drm/xe/xe_sched_job_types.h
+@@ -57,6 +57,8 @@ struct xe_sched_job {
+ u32 migrate_flush_flags;
+ /** @ring_ops_flush_tlb: The ring ops need to flush TLB before payload. */
+ bool ring_ops_flush_tlb;
++ /** @ggtt: mapped in ggtt. */
++ bool ggtt;
+ /** @ptrs: per instance pointers. */
+ struct xe_job_ptrs ptrs[];
+ };
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
