--- /dev/null
+From fcca6d05ef49d5650514ea1dcfd12e4ae3ff2be6 Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Fri, 30 Aug 2024 22:31:54 +0800
+Subject: ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit fcca6d05ef49d5650514ea1dcfd12e4ae3ff2be6 upstream.
+
+Return devm_of_clk_add_hw_provider() in order to transfer the error, if it
+fails due to resource allocation failure or device tree clock provider
+registration failure.
+
+Cc: stable@vger.kernel.org
+Fixes: ebbfabc16d23 ("ASoC: rt5682: Add CCF usage for providing I2S clks")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Link: https://patch.msgid.link/20240830143154.3448004-1-make24@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/rt5682.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/rt5682.c
++++ b/sound/soc/codecs/rt5682.c
+@@ -2903,8 +2903,10 @@ int rt5682_register_dai_clks(struct rt56
+ }
+
+ if (dev->of_node) {
+- devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get,
++ ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get,
+ dai_clk_hw);
++ if (ret)
++ return ret;
+ } else {
+ ret = devm_clk_hw_register_clkdev(dev, dai_clk_hw,
+ init.name,
--- /dev/null
+From 07bfa9cdbf3cd2daadfaaba0601f126f45951ffa Mon Sep 17 00:00:00 2001
+From: Leo Ma <hanghong.ma@amd.com>
+Date: Mon, 19 Aug 2024 13:25:27 -0400
+Subject: drm/amd/display: Add HDMI DSC native YCbCr422 support
+
+From: Leo Ma <hanghong.ma@amd.com>
+
+commit 07bfa9cdbf3cd2daadfaaba0601f126f45951ffa upstream.
+
+[WHY && HOW]
+For some HDMI OVT timing, YCbCr422 encoding fails at the DSC
+bandwidth check. The root cause is our DSC policy for timing
+doesn't account for HDMI YCbCr422 native support.
+
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Chris Park <chris.park@amd.com>
+Signed-off-by: Leo Ma <hanghong.ma@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 4 ++--
+ drivers/gpu/drm/amd/display/dc/dc_dsc.h | 3 ++-
+ drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c | 5 +++--
+ 3 files changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -1147,7 +1147,7 @@ static int compute_mst_dsc_configs_for_l
+ params[count].num_slices_v = aconnector->dsc_settings.dsc_num_slices_v;
+ params[count].bpp_overwrite = aconnector->dsc_settings.dsc_bits_per_pixel;
+ params[count].compression_possible = stream->sink->dsc_caps.dsc_dec_caps.is_dsc_supported;
+- dc_dsc_get_policy_for_timing(params[count].timing, 0, &dsc_policy);
++ dc_dsc_get_policy_for_timing(params[count].timing, 0, &dsc_policy, dc_link_get_highest_encoding_format(stream->link));
+ if (!dc_dsc_compute_bandwidth_range(
+ stream->sink->ctx->dc->res_pool->dscs[0],
+ stream->sink->ctx->dc->debug.dsc_min_slice_height_override,
+@@ -1684,7 +1684,7 @@ static bool is_dsc_common_config_possibl
+ {
+ struct dc_dsc_policy dsc_policy = {0};
+
+- dc_dsc_get_policy_for_timing(&stream->timing, 0, &dsc_policy);
++ dc_dsc_get_policy_for_timing(&stream->timing, 0, &dsc_policy, dc_link_get_highest_encoding_format(stream->link));
+ dc_dsc_compute_bandwidth_range(stream->sink->ctx->dc->res_pool->dscs[0],
+ stream->sink->ctx->dc->debug.dsc_min_slice_height_override,
+ dsc_policy.min_target_bpp * 16,
+--- a/drivers/gpu/drm/amd/display/dc/dc_dsc.h
++++ b/drivers/gpu/drm/amd/display/dc/dc_dsc.h
+@@ -100,7 +100,8 @@ uint32_t dc_dsc_stream_bandwidth_overhea
+ */
+ void dc_dsc_get_policy_for_timing(const struct dc_crtc_timing *timing,
+ uint32_t max_target_bpp_limit_override_x16,
+- struct dc_dsc_policy *policy);
++ struct dc_dsc_policy *policy,
++ const enum dc_link_encoding_format link_encoding);
+
+ void dc_dsc_policy_set_max_target_bpp_limit(uint32_t limit);
+
+--- a/drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c
++++ b/drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c
+@@ -882,7 +882,7 @@ static bool setup_dsc_config(
+
+ memset(dsc_cfg, 0, sizeof(struct dc_dsc_config));
+
+- dc_dsc_get_policy_for_timing(timing, options->max_target_bpp_limit_override_x16, &policy);
++ dc_dsc_get_policy_for_timing(timing, options->max_target_bpp_limit_override_x16, &policy, link_encoding);
+ pic_width = timing->h_addressable + timing->h_border_left + timing->h_border_right;
+ pic_height = timing->v_addressable + timing->v_border_top + timing->v_border_bottom;
+
+@@ -1171,7 +1171,8 @@ uint32_t dc_dsc_stream_bandwidth_overhea
+
+ void dc_dsc_get_policy_for_timing(const struct dc_crtc_timing *timing,
+ uint32_t max_target_bpp_limit_override_x16,
+- struct dc_dsc_policy *policy)
++ struct dc_dsc_policy *policy,
++ const enum dc_link_encoding_format link_encoding)
+ {
+ uint32_t bpc = 0;
+
--- /dev/null
+From 8151a6c13111b465dbabe07c19f572f7cbd16fef Mon Sep 17 00:00:00 2001
+From: Fangzhi Zuo <Jerry.Zuo@amd.com>
+Date: Fri, 12 Jul 2024 16:30:03 -0400
+Subject: drm/amd/display: Skip Recompute DSC Params if no Stream on Link
+
+From: Fangzhi Zuo <Jerry.Zuo@amd.com>
+
+commit 8151a6c13111b465dbabe07c19f572f7cbd16fef upstream.
+
+[why]
+Encounter NULL pointer dereference uner mst + dsc setup.
+
+BUG: kernel NULL pointer dereference, address: 0000000000000008
+ PGD 0 P4D 0
+ Oops: 0000 [#1] PREEMPT SMP NOPTI
+ CPU: 4 PID: 917 Comm: sway Not tainted 6.3.9-arch1-1 #1 124dc55df4f5272ccb409f39ef4872fc2b3376a2
+ Hardware name: LENOVO 20NKS01Y00/20NKS01Y00, BIOS R12ET61W(1.31 ) 07/28/2022
+ RIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper]
+ Code: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 <48> 8>
+ RSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293
+ RAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224
+ RDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280
+ RBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850
+ R10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000
+ R13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224
+ FS: 00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000008 CR3: 000000010ddc6000 CR4: 00000000003506e0
+ Call Trace:
+<TASK>
+ ? __die+0x23/0x70
+ ? page_fault_oops+0x171/0x4e0
+ ? plist_add+0xbe/0x100
+ ? exc_page_fault+0x7c/0x180
+ ? asm_exc_page_fault+0x26/0x30
+ ? drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]
+ ? drm_dp_atomic_find_time_slots+0x28/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]
+ compute_mst_dsc_configs_for_link+0x2ff/0xa40 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]
+ ? fill_plane_buffer_attributes+0x419/0x510 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]
+ compute_mst_dsc_configs_for_state+0x1e1/0x250 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]
+ amdgpu_dm_atomic_check+0xecd/0x1190 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]
+ drm_atomic_check_only+0x5c5/0xa40
+ drm_mode_atomic_ioctl+0x76e/0xbc0
+
+[how]
+dsc recompute should be skipped if no mode change detected on the new
+request. If detected, keep checking whether the stream is already on
+current state or not.
+
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
+Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -1344,6 +1344,9 @@ static bool is_dsc_need_re_compute(
+ DRM_DEBUG_DRIVER("%s: MST_DSC check on %d streams in current dc_state\n",
+ __func__, dc->current_state->stream_count);
+
++ if (new_stream_on_link_num == 0)
++ return false;
++
+ /* check current_state if there stream on link but it is not in
+ * new request state
+ */
--- /dev/null
+From d7d2688bf4ea58734d73e18edcbf4684b1496d30 Mon Sep 17 00:00:00 2001
+From: Kenneth Feng <kenneth.feng@amd.com>
+Date: Fri, 20 Sep 2024 19:05:37 +0800
+Subject: drm/amd/pm: update workload mask after the setting
+
+From: Kenneth Feng <kenneth.feng@amd.com>
+
+commit d7d2688bf4ea58734d73e18edcbf4684b1496d30 upstream.
+
+update workload mask after the setting.
+
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3625
+Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 6 +++++-
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 3 +++
+ drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 6 +++++-
+ 3 files changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
+@@ -2569,10 +2569,14 @@ static int smu_v13_0_0_set_power_profile
+ }
+ }
+
+- return smu_cmn_send_smc_msg_with_param(smu,
++ ret = smu_cmn_send_smc_msg_with_param(smu,
+ SMU_MSG_SetWorkloadMask,
+ workload_mask,
+ NULL);
++ if (!ret)
++ smu->workload_mask = workload_mask;
++
++ return ret;
+ }
+
+ static bool smu_v13_0_0_is_mode1_reset_supported(struct smu_context *smu)
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+@@ -2501,8 +2501,11 @@ static int smu_v13_0_7_set_power_profile
+ return -EINVAL;
+ ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_SetWorkloadMask,
+ 1 << workload_type, NULL);
++
+ if (ret)
+ dev_err(smu->adev->dev, "[%s] Failed to set work load mask!", __func__);
++ else
++ smu->workload_mask = (1 << workload_type);
+
+ return ret;
+ }
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
+@@ -1570,10 +1570,14 @@ static int smu_v14_0_2_set_power_profile
+ if (workload_type < 0)
+ return -EINVAL;
+
+- return smu_cmn_send_smc_msg_with_param(smu,
++ ret = smu_cmn_send_smc_msg_with_param(smu,
+ SMU_MSG_SetWorkloadMask,
+ 1 << workload_type,
+ NULL);
++ if (!ret)
++ smu->workload_mask = 1 << workload_type;
++
++ return ret;
+ }
+
+ static int smu_v14_0_2_baco_enter(struct smu_context *smu)
--- /dev/null
+From 34ad56a467c320d07db22146cfb99ee01704a5de Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 6 Sep 2024 13:51:06 -0400
+Subject: drm/amdgpu: bump driver version for cleared VRAM
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 34ad56a467c320d07db22146cfb99ee01704a5de upstream.
+
+Driver now clears VRAM on allocation. Bump the
+driver version so mesa knows when it will get
+cleared vram by default.
+
+Reviewed-by: Marek Olšák <marek.olsak@amd.com>
+Reviewed-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.11.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 86cff30d5c4e..db0763ffeff7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -117,9 +117,10 @@
+ * - 3.56.0 - Update IB start address and size alignment for decode and encode
+ * - 3.57.0 - Compute tunneling on GFX10+
+ * - 3.58.0 - Add GFX12 DCC support
++ * - 3.59.0 - Cleared VRAM
+ */
+ #define KMS_DRIVER_MAJOR 3
+-#define KMS_DRIVER_MINOR 58
++#define KMS_DRIVER_MINOR 59
+ #define KMS_DRIVER_PATCHLEVEL 0
+
+ /*
+--
+2.46.2
+
--- /dev/null
+From 3cb576bc6dfb8940228b8130638860b631dd428a Mon Sep 17 00:00:00 2001
+From: Frank Min <Frank.Min@amd.com>
+Date: Wed, 25 Sep 2024 11:39:06 +0800
+Subject: drm/amdgpu: fix PTE copy corruption for sdma 7
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Frank Min <Frank.Min@amd.com>
+
+commit 3cb576bc6dfb8940228b8130638860b631dd428a upstream.
+
+Without setting dcc bit, there is ramdon PTE copy corruption on sdma 7.
+
+so add this bit and update the packet format accordingly.
+
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Frank Min <Frank.Min@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.11.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c
+@@ -1022,13 +1022,16 @@ static void sdma_v7_0_vm_copy_pte(struct
+ unsigned bytes = count * 8;
+
+ ib->ptr[ib->length_dw++] = SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_COPY) |
+- SDMA_PKT_COPY_LINEAR_HEADER_SUB_OP(SDMA_SUBOP_COPY_LINEAR);
++ SDMA_PKT_COPY_LINEAR_HEADER_SUB_OP(SDMA_SUBOP_COPY_LINEAR) |
++ SDMA_PKT_COPY_LINEAR_HEADER_CPV(1);
++
+ ib->ptr[ib->length_dw++] = bytes - 1;
+ ib->ptr[ib->length_dw++] = 0; /* src/dst endian swap */
+ ib->ptr[ib->length_dw++] = lower_32_bits(src);
+ ib->ptr[ib->length_dw++] = upper_32_bits(src);
+ ib->ptr[ib->length_dw++] = lower_32_bits(pe);
+ ib->ptr[ib->length_dw++] = upper_32_bits(pe);
++ ib->ptr[ib->length_dw++] = 0;
+
+ }
+
+@@ -1631,7 +1634,7 @@ static void sdma_v7_0_set_buffer_funcs(s
+ }
+
+ static const struct amdgpu_vm_pte_funcs sdma_v7_0_vm_pte_funcs = {
+- .copy_pte_num_dw = 7,
++ .copy_pte_num_dw = 8,
+ .copy_pte = sdma_v7_0_vm_copy_pte,
+ .write_pte = sdma_v7_0_vm_write_pte,
+ .set_pte_pde = sdma_v7_0_vm_set_pte_pde,
--- /dev/null
+From 03b5038c0ad069380fab7e251d2bf3f1540d20f4 Mon Sep 17 00:00:00 2001
+From: David Belanger <david.belanger@amd.com>
+Date: Wed, 11 Sep 2024 11:16:50 -0400
+Subject: drm/amdgpu: Fix selfring initialization sequence on soc24
+
+From: David Belanger <david.belanger@amd.com>
+
+commit 03b5038c0ad069380fab7e251d2bf3f1540d20f4 upstream.
+
+Move enable_doorbell_selfring_aperture from common_hw_init
+to common_late_init in soc24, otherwise selfring aperture is
+initialized with an incorrect doorbell aperture base.
+
+Port changes from this commit from soc21 to soc24:
+commit 1c312e816c40 ("drm/amdgpu: Enable doorbell selfring after resize FB BAR")
+
+Signed-off-by: David Belanger <david.belanger@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.11.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc24.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc24.c b/drivers/gpu/drm/amd/amdgpu/soc24.c
+index b0c3678cfb31..fd4c3d4f8387 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc24.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc24.c
+@@ -250,13 +250,6 @@ static void soc24_program_aspm(struct amdgpu_device *adev)
+ adev->nbio.funcs->program_aspm(adev);
+ }
+
+-static void soc24_enable_doorbell_aperture(struct amdgpu_device *adev,
+- bool enable)
+-{
+- adev->nbio.funcs->enable_doorbell_aperture(adev, enable);
+- adev->nbio.funcs->enable_doorbell_selfring_aperture(adev, enable);
+-}
+-
+ const struct amdgpu_ip_block_version soc24_common_ip_block = {
+ .type = AMD_IP_BLOCK_TYPE_COMMON,
+ .major = 1,
+@@ -454,6 +447,11 @@ static int soc24_common_late_init(void *handle)
+ if (amdgpu_sriov_vf(adev))
+ xgpu_nv_mailbox_get_irq(adev);
+
++ /* Enable selfring doorbell aperture late because doorbell BAR
++ * aperture will change if resize BAR successfully in gmc sw_init.
++ */
++ adev->nbio.funcs->enable_doorbell_selfring_aperture(adev, true);
++
+ return 0;
+ }
+
+@@ -491,7 +489,7 @@ static int soc24_common_hw_init(void *handle)
+ adev->df.funcs->hw_init(adev);
+
+ /* enable the doorbell aperture */
+- soc24_enable_doorbell_aperture(adev, true);
++ adev->nbio.funcs->enable_doorbell_aperture(adev, true);
+
+ return 0;
+ }
+@@ -500,8 +498,13 @@ static int soc24_common_hw_fini(void *handle)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+- /* disable the doorbell aperture */
+- soc24_enable_doorbell_aperture(adev, false);
++ /* Disable the doorbell aperture and selfring doorbell aperture
++ * separately in hw_fini because soc21_enable_doorbell_aperture
++ * has been removed and there is no need to delay disabling
++ * selfring doorbell.
++ */
++ adev->nbio.funcs->enable_doorbell_aperture(adev, false);
++ adev->nbio.funcs->enable_doorbell_selfring_aperture(adev, false);
+
+ if (amdgpu_sriov_vf(adev))
+ xgpu_nv_mailbox_put_irq(adev);
+--
+2.46.2
+
--- /dev/null
+From 856265caa94a3c78feaa23ec1acd799fe1989201 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 16 Sep 2024 10:52:24 -0400
+Subject: drm/amdgpu/mes11: reduce timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 856265caa94a3c78feaa23ec1acd799fe1989201 upstream.
+
+The firmware timeout is 2s. Reduce the driver timeout to
+2.1 seconds to avoid back pressure on queue submissions.
+
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3627
+Fixes: f7c161a4c250 ("drm/amdgpu: increase mes submission timeout")
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c
+@@ -160,7 +160,7 @@ static int mes_v11_0_submit_pkt_and_poll
+ int api_status_off)
+ {
+ union MESAPI__QUERY_MES_STATUS mes_status_pkt;
+- signed long timeout = 3000000; /* 3000 ms */
++ signed long timeout = 2100000; /* 2100 ms */
+ struct amdgpu_device *adev = mes->adev;
+ struct amdgpu_ring *ring = &mes->ring[0];
+ struct MES_API_STATUS *api_status;
--- /dev/null
+From 84f76408abe989809de19d02e476b044fd985adc Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 18 Sep 2024 09:37:31 -0400
+Subject: drm/amdgpu/mes12: reduce timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 84f76408abe989809de19d02e476b044fd985adc upstream.
+
+The firmware timeout is 2s. Reduce the driver timeout to
+2.1 seconds to avoid back pressure on queue submissions.
+
+Fixes: 94b51a3d01ed ("drm/amdgpu/mes12: increase mes submission timeout")
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.11.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
+index ef05a4116230..186f77813397 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
+@@ -146,7 +146,7 @@ static int mes_v12_0_submit_pkt_and_poll_completion(struct amdgpu_mes *mes,
+ int api_status_off)
+ {
+ union MESAPI__QUERY_MES_STATUS mes_status_pkt;
+- signed long timeout = 3000000; /* 3000 ms */
++ signed long timeout = 2100000; /* 2100 ms */
+ struct amdgpu_device *adev = mes->adev;
+ struct amdgpu_ring *ring = &mes->ring[pipe];
+ spinlock_t *ring_lock = &mes->ring_lock[pipe];
+--
+2.46.2
+
--- /dev/null
+From 4771d2ecb7b9e4c2c73ede2908d7e7c989460981 Mon Sep 17 00:00:00 2001
+From: Jack Xiao <Jack.Xiao@amd.com>
+Date: Wed, 18 Sep 2024 17:07:13 +0800
+Subject: drm/amdgpu/mes12: set enable_level_process_quantum_check
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+commit 4771d2ecb7b9e4c2c73ede2908d7e7c989460981 upstream.
+
+enable_level_process_quantum_check is requried to enable process
+quantum based scheduling.
+
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.11.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
+@@ -582,6 +582,7 @@ static int mes_v12_0_set_hw_resources(st
+ mes_set_hw_res_pkt.disable_mes_log = 1;
+ mes_set_hw_res_pkt.use_different_vmid_compute = 1;
+ mes_set_hw_res_pkt.enable_reg_active_poll = 1;
++ mes_set_hw_res_pkt.enable_level_process_quantum_check = 1;
+
+ /*
+ * Keep oversubscribe timer for sdma . When we have unmapped doorbell
--- /dev/null
+From 3c75518cf27aa5a7e22e1f8f33339ded3779079b Mon Sep 17 00:00:00 2001
+From: Jack Xiao <Jack.Xiao@amd.com>
+Date: Wed, 11 Sep 2024 16:24:35 +0800
+Subject: drm/amdgpu/mes12: switch SET_SHADER_DEBUGGER pkt to mes schq pipe
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+commit 3c75518cf27aa5a7e22e1f8f33339ded3779079b upstream.
+
+The SET_SHADER_DEBUGGER packet must work with the added
+hardware queue, switch the packet submitting to mes schq pipe.
+
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.11.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c
+@@ -453,6 +453,11 @@ static int mes_v12_0_misc_op(struct amdg
+ union MESAPI__MISC misc_pkt;
+ int pipe;
+
++ if (mes->adev->enable_uni_mes)
++ pipe = AMDGPU_MES_KIQ_PIPE;
++ else
++ pipe = AMDGPU_MES_SCHED_PIPE;
++
+ memset(&misc_pkt, 0, sizeof(misc_pkt));
+
+ misc_pkt.header.type = MES_API_TYPE_SCHEDULER;
+@@ -487,6 +492,7 @@ static int mes_v12_0_misc_op(struct amdg
+ misc_pkt.wait_reg_mem.reg_offset2 = input->wrm_reg.reg1;
+ break;
+ case MES_MISC_OP_SET_SHADER_DEBUGGER:
++ pipe = AMDGPU_MES_SCHED_PIPE;
+ misc_pkt.opcode = MESAPI_MISC__SET_SHADER_DEBUGGER;
+ misc_pkt.set_shader_debugger.process_context_addr =
+ input->set_shader_debugger.process_context_addr;
+@@ -504,11 +510,6 @@ static int mes_v12_0_misc_op(struct amdg
+ return -EINVAL;
+ }
+
+- if (mes->adev->enable_uni_mes)
+- pipe = AMDGPU_MES_KIQ_PIPE;
+- else
+- pipe = AMDGPU_MES_SCHED_PIPE;
+-
+ return mes_v12_0_submit_pkt_and_poll_completion(mes, pipe,
+ &misc_pkt, sizeof(misc_pkt),
+ offsetof(union MESAPI__MISC, api_status));
--- /dev/null
+From 7b6df1d73290961ff0a00fd0022f28dd19e37181 Mon Sep 17 00:00:00 2001
+From: Frank Min <Frank.Min@amd.com>
+Date: Wed, 4 Sep 2024 10:50:33 +0800
+Subject: drm/amdgpu: update golden regs for gfx12
+
+From: Frank Min <Frank.Min@amd.com>
+
+commit 7b6df1d73290961ff0a00fd0022f28dd19e37181 upstream.
+
+update golden regs for gfx12
+
+Signed-off-by: Frank Min <Frank.Min@amd.com>
+Reviewed-by: Likun Gao <Likun.Gao@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.11.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
+@@ -202,12 +202,16 @@ static const struct amdgpu_hwip_reg_entr
+ SOC15_REG_ENTRY_STR(GC, 0, regCP_IB1_BUFSZ)
+ };
+
+-static const struct soc15_reg_golden golden_settings_gc_12_0[] = {
++static const struct soc15_reg_golden golden_settings_gc_12_0_rev0[] = {
+ SOC15_REG_GOLDEN_VALUE(GC, 0, regDB_MEM_CONFIG, 0x0000000f, 0x0000000f),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, regCB_HW_CONTROL_1, 0x03000000, 0x03000000),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, regGL2C_CTRL5, 0x00000070, 0x00000020)
+ };
+
++static const struct soc15_reg_golden golden_settings_gc_12_0[] = {
++ SOC15_REG_GOLDEN_VALUE(GC, 0, regDB_MEM_CONFIG, 0x00008000, 0x00008000),
++};
++
+ #define DEFAULT_SH_MEM_CONFIG \
+ ((SH_MEM_ADDRESS_MODE_64 << SH_MEM_CONFIG__ADDRESS_MODE__SHIFT) | \
+ (SH_MEM_ALIGNMENT_MODE_UNALIGNED << SH_MEM_CONFIG__ALIGNMENT_MODE__SHIFT) | \
+@@ -3446,10 +3450,14 @@ static void gfx_v12_0_init_golden_regist
+ switch (amdgpu_ip_version(adev, GC_HWIP, 0)) {
+ case IP_VERSION(12, 0, 0):
+ case IP_VERSION(12, 0, 1):
++ soc15_program_register_sequence(adev,
++ golden_settings_gc_12_0,
++ (const u32)ARRAY_SIZE(golden_settings_gc_12_0));
++
+ if (adev->rev_id == 0)
+ soc15_program_register_sequence(adev,
+- golden_settings_gc_12_0,
+- (const u32)ARRAY_SIZE(golden_settings_gc_12_0));
++ golden_settings_gc_12_0_rev0,
++ (const u32)ARRAY_SIZE(golden_settings_gc_12_0_rev0));
+ break;
+ default:
+ break;
--- /dev/null
+From 8048e5ade8224969023902b0b3f64470f9c250a7 Mon Sep 17 00:00:00 2001
+From: Saleemkhan Jamadar <saleemkhan.jamadar@amd.com>
+Date: Fri, 20 Sep 2024 18:40:18 +0530
+Subject: drm/amdgpu/vcn: enable AV1 on both instances
+
+From: Saleemkhan Jamadar <saleemkhan.jamadar@amd.com>
+
+commit 8048e5ade8224969023902b0b3f64470f9c250a7 upstream.
+
+v1 - remove cs parse code (Christian)
+
+On VCN v4_0_6 AV1 is supported on both the instances.
+Remove cs IB parse code since explict handling of AV1 schedule is
+not required.
+
+Signed-off-by: Saleemkhan Jamadar <saleemkhan.jamadar@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c | 165 --------------------------------
+ 1 file changed, 165 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
+@@ -1347,170 +1347,6 @@ static void vcn_v4_0_5_unified_ring_set_
+ }
+ }
+
+-static int vcn_v4_0_5_limit_sched(struct amdgpu_cs_parser *p,
+- struct amdgpu_job *job)
+-{
+- struct drm_gpu_scheduler **scheds;
+-
+- /* The create msg must be in the first IB submitted */
+- if (atomic_read(&job->base.entity->fence_seq))
+- return -EINVAL;
+-
+- /* if VCN0 is harvested, we can't support AV1 */
+- if (p->adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0)
+- return -EINVAL;
+-
+- scheds = p->adev->gpu_sched[AMDGPU_HW_IP_VCN_ENC]
+- [AMDGPU_RING_PRIO_0].sched;
+- drm_sched_entity_modify_sched(job->base.entity, scheds, 1);
+- return 0;
+-}
+-
+-static int vcn_v4_0_5_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job,
+- uint64_t addr)
+-{
+- struct ttm_operation_ctx ctx = { false, false };
+- struct amdgpu_bo_va_mapping *map;
+- uint32_t *msg, num_buffers;
+- struct amdgpu_bo *bo;
+- uint64_t start, end;
+- unsigned int i;
+- void *ptr;
+- int r;
+-
+- addr &= AMDGPU_GMC_HOLE_MASK;
+- r = amdgpu_cs_find_mapping(p, addr, &bo, &map);
+- if (r) {
+- DRM_ERROR("Can't find BO for addr 0x%08llx\n", addr);
+- return r;
+- }
+-
+- start = map->start * AMDGPU_GPU_PAGE_SIZE;
+- end = (map->last + 1) * AMDGPU_GPU_PAGE_SIZE;
+- if (addr & 0x7) {
+- DRM_ERROR("VCN messages must be 8 byte aligned!\n");
+- return -EINVAL;
+- }
+-
+- bo->flags |= AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED;
+- amdgpu_bo_placement_from_domain(bo, bo->allowed_domains);
+- r = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx);
+- if (r) {
+- DRM_ERROR("Failed validating the VCN message BO (%d)!\n", r);
+- return r;
+- }
+-
+- r = amdgpu_bo_kmap(bo, &ptr);
+- if (r) {
+- DRM_ERROR("Failed mapping the VCN message (%d)!\n", r);
+- return r;
+- }
+-
+- msg = ptr + addr - start;
+-
+- /* Check length */
+- if (msg[1] > end - addr) {
+- r = -EINVAL;
+- goto out;
+- }
+-
+- if (msg[3] != RDECODE_MSG_CREATE)
+- goto out;
+-
+- num_buffers = msg[2];
+- for (i = 0, msg = &msg[6]; i < num_buffers; ++i, msg += 4) {
+- uint32_t offset, size, *create;
+-
+- if (msg[0] != RDECODE_MESSAGE_CREATE)
+- continue;
+-
+- offset = msg[1];
+- size = msg[2];
+-
+- if (offset + size > end) {
+- r = -EINVAL;
+- goto out;
+- }
+-
+- create = ptr + addr + offset - start;
+-
+- /* H264, HEVC and VP9 can run on any instance */
+- if (create[0] == 0x7 || create[0] == 0x10 || create[0] == 0x11)
+- continue;
+-
+- r = vcn_v4_0_5_limit_sched(p, job);
+- if (r)
+- goto out;
+- }
+-
+-out:
+- amdgpu_bo_kunmap(bo);
+- return r;
+-}
+-
+-#define RADEON_VCN_ENGINE_TYPE_ENCODE (0x00000002)
+-#define RADEON_VCN_ENGINE_TYPE_DECODE (0x00000003)
+-
+-#define RADEON_VCN_ENGINE_INFO (0x30000001)
+-#define RADEON_VCN_ENGINE_INFO_MAX_OFFSET 16
+-
+-#define RENCODE_ENCODE_STANDARD_AV1 2
+-#define RENCODE_IB_PARAM_SESSION_INIT 0x00000003
+-#define RENCODE_IB_PARAM_SESSION_INIT_MAX_OFFSET 64
+-
+-/* return the offset in ib if id is found, -1 otherwise
+- * to speed up the searching we only search upto max_offset
+- */
+-static int vcn_v4_0_5_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int max_offset)
+-{
+- int i;
+-
+- for (i = 0; i < ib->length_dw && i < max_offset && ib->ptr[i] >= 8; i += ib->ptr[i]/4) {
+- if (ib->ptr[i + 1] == id)
+- return i;
+- }
+- return -1;
+-}
+-
+-static int vcn_v4_0_5_ring_patch_cs_in_place(struct amdgpu_cs_parser *p,
+- struct amdgpu_job *job,
+- struct amdgpu_ib *ib)
+-{
+- struct amdgpu_ring *ring = amdgpu_job_ring(job);
+- struct amdgpu_vcn_decode_buffer *decode_buffer;
+- uint64_t addr;
+- uint32_t val;
+- int idx;
+-
+- /* The first instance can decode anything */
+- if (!ring->me)
+- return 0;
+-
+- /* RADEON_VCN_ENGINE_INFO is at the top of ib block */
+- idx = vcn_v4_0_5_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO,
+- RADEON_VCN_ENGINE_INFO_MAX_OFFSET);
+- if (idx < 0) /* engine info is missing */
+- return 0;
+-
+- val = amdgpu_ib_get_value(ib, idx + 2); /* RADEON_VCN_ENGINE_TYPE */
+- if (val == RADEON_VCN_ENGINE_TYPE_DECODE) {
+- decode_buffer = (struct amdgpu_vcn_decode_buffer *)&ib->ptr[idx + 6];
+-
+- if (!(decode_buffer->valid_buf_flag & 0x1))
+- return 0;
+-
+- addr = ((u64)decode_buffer->msg_buffer_address_hi) << 32 |
+- decode_buffer->msg_buffer_address_lo;
+- return vcn_v4_0_5_dec_msg(p, job, addr);
+- } else if (val == RADEON_VCN_ENGINE_TYPE_ENCODE) {
+- idx = vcn_v4_0_5_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT,
+- RENCODE_IB_PARAM_SESSION_INIT_MAX_OFFSET);
+- if (idx >= 0 && ib->ptr[idx + 2] == RENCODE_ENCODE_STANDARD_AV1)
+- return vcn_v4_0_5_limit_sched(p, job);
+- }
+- return 0;
+-}
+-
+ static const struct amdgpu_ring_funcs vcn_v4_0_5_unified_ring_vm_funcs = {
+ .type = AMDGPU_RING_TYPE_VCN_ENC,
+ .align_mask = 0x3f,
+@@ -1518,7 +1354,6 @@ static const struct amdgpu_ring_funcs vc
+ .get_rptr = vcn_v4_0_5_unified_ring_get_rptr,
+ .get_wptr = vcn_v4_0_5_unified_ring_get_wptr,
+ .set_wptr = vcn_v4_0_5_unified_ring_set_wptr,
+- .patch_cs_in_place = vcn_v4_0_5_ring_patch_cs_in_place,
+ .emit_frame_size =
+ SOC15_FLUSH_GPU_TLB_NUM_WREG * 3 +
+ SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 4 +
--- /dev/null
+From d52ac79053a2f3eba04c1e7b56334df84d1d289f Mon Sep 17 00:00:00 2001
+From: Sreekant Somasekharan <sreekant.somasekharan@amd.com>
+Date: Fri, 20 Sep 2024 01:53:17 -0400
+Subject: drm/amdkfd: Add SDMA queue quantum support for GFX12
+
+From: Sreekant Somasekharan <sreekant.somasekharan@amd.com>
+
+commit d52ac79053a2f3eba04c1e7b56334df84d1d289f upstream.
+
+program SDMAx_QUEUEx_SCHEDULE_CNTL for context switch due to
+quantum in KFD for GFX12.
+
+Signed-off-by: Sreekant Somasekharan <sreekant.somasekharan@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.11.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c
+@@ -341,6 +341,10 @@ static void update_mqd_sdma(struct mqd_m
+ m->sdmax_rlcx_doorbell_offset =
+ q->doorbell_off << SDMA0_QUEUE0_DOORBELL_OFFSET__OFFSET__SHIFT;
+
++ m->sdmax_rlcx_sched_cntl = (amdgpu_sdma_phase_quantum
++ << SDMA0_QUEUE0_SCHEDULE_CNTL__CONTEXT_QUANTUM__SHIFT)
++ & SDMA0_QUEUE0_SCHEDULE_CNTL__CONTEXT_QUANTUM_MASK;
++
+ m->sdma_engine_id = q->sdma_engine_id;
+ m->sdma_queue_id = q->sdma_queue_id;
+
--- /dev/null
+From eb017f4ea13b1a5ad7f4332279f2e4c67b44bdea Mon Sep 17 00:00:00 2001
+From: Nuno Sa <nuno.sa@analog.com>
+Date: Fri, 20 Sep 2024 09:22:52 +0200
+Subject: Input: adp5588-keys - fix check on return code
+
+From: Nuno Sa <nuno.sa@analog.com>
+
+commit eb017f4ea13b1a5ad7f4332279f2e4c67b44bdea upstream.
+
+During adp5588_setup(), we read all the events to clear the event FIFO.
+However, adp5588_read() just calls i2c_smbus_read_byte_data() which
+returns the byte read in case everything goes well. Hence, we need to
+explicitly check for a negative error code instead of checking for
+something different than 0.
+
+Fixes: e960309ce318 ("Input: adp5588-keys - bail out on returned error")
+Cc: stable@vger.kernel.org
+Signed-off-by: Nuno Sa <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20240920-fix-adp5588-err-check-v1-1-81f6e957ef24@analog.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/keyboard/adp5588-keys.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/keyboard/adp5588-keys.c
++++ b/drivers/input/keyboard/adp5588-keys.c
+@@ -627,7 +627,7 @@ static int adp5588_setup(struct adp5588_
+
+ for (i = 0; i < KEYP_MAX_EVENT; i++) {
+ ret = adp5588_read(client, KEY_EVENTA);
+- if (ret)
++ if (ret < 0)
+ return ret;
+ }
+
--- /dev/null
+From 01eed86d50af9fab27d876fd677b86259ebe9de3 Mon Sep 17 00:00:00 2001
+From: Werner Sembach <wse@tuxedocomputers.com>
+Date: Tue, 10 Sep 2024 11:40:07 +0200
+Subject: Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line
+
+From: Werner Sembach <wse@tuxedocomputers.com>
+
+commit 01eed86d50af9fab27d876fd677b86259ebe9de3 upstream.
+
+There might be devices out in the wild where the board name is GMxXGxx
+instead of GMxXGxX.
+
+Adding both to be on the safe side.
+
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240910094008.1601230-2-wse@tuxedocomputers.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/serio/i8042-acpipnpio.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/input/serio/i8042-acpipnpio.h
++++ b/drivers/input/serio/i8042-acpipnpio.h
+@@ -1138,6 +1138,13 @@ static const struct dmi_system_id i8042_
+ },
+ {
+ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "GMxXGxx"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ },
++ {
++ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "GMxXGxX"),
+ },
+ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
--- /dev/null
+From 3870e2850b56306d1d1e435c5a1ccbccd7c59291 Mon Sep 17 00:00:00 2001
+From: Werner Sembach <wse@tuxedocomputers.com>
+Date: Tue, 10 Sep 2024 11:40:08 +0200
+Subject: Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table
+
+From: Werner Sembach <wse@tuxedocomputers.com>
+
+commit 3870e2850b56306d1d1e435c5a1ccbccd7c59291 upstream.
+
+The Gen6 devices have the same problem and the same Solution as the Gen5
+ones.
+
+Some TongFang barebones have touchpad and/or keyboard issues after
+suspend, fixable with nomux + reset + noloop + nopnp. Luckily, none of
+them have an external PS/2 port so this can safely be set for all of
+them.
+
+I'm not entirely sure if every device listed really needs all four quirks,
+but after testing and production use, no negative effects could be
+observed when setting all four.
+
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240910094008.1601230-3-wse@tuxedocomputers.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/serio/i8042-acpipnpio.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/input/serio/i8042-acpipnpio.h
++++ b/drivers/input/serio/i8042-acpipnpio.h
+@@ -1143,6 +1143,13 @@ static const struct dmi_system_id i8042_
+ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ },
+ /*
+ * A lot of modern Clevo barebones have touchpad and/or keyboard issues
+ * after suspend fixable with nomux + reset + noloop + nopnp. Luckily,
--- /dev/null
+From e06edf96dea065dd1d9df695bf8b92784992333e Mon Sep 17 00:00:00 2001
+From: Werner Sembach <wse@tuxedocomputers.com>
+Date: Thu, 5 Sep 2024 18:48:51 +0200
+Subject: Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table
+
+From: Werner Sembach <wse@tuxedocomputers.com>
+
+commit e06edf96dea065dd1d9df695bf8b92784992333e upstream.
+
+Some TongFang barebones have touchpad and/or keyboard issues after
+suspend, fixable with nomux + reset + noloop + nopnp. Luckily, none of
+them have an external PS/2 port so this can safely be set for all of
+them.
+
+I'm not entirely sure if every device listed really needs all four quirks,
+but after testing and production use, no negative effects could be
+observed when setting all four.
+
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240905164851.771578-1-wse@tuxedocomputers.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/serio/i8042-acpipnpio.h | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/drivers/input/serio/i8042-acpipnpio.h
++++ b/drivers/input/serio/i8042-acpipnpio.h
+@@ -1121,6 +1121,29 @@ static const struct dmi_system_id i8042_
+ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ /*
++ * Some TongFang barebones have touchpad and/or keyboard issues after
++ * suspend fixable with nomux + reset + noloop + nopnp. Luckily, none of
++ * them have an external PS/2 port so this can safely be set for all of
++ * them.
++ * TongFang barebones come with board_vendor and/or system_vendor set to
++ * a different value for each individual reseller. The only somewhat
++ * universal way to identify them is by board_name.
++ */
++ {
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "GM6XGxX"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "GMxXGxX"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ },
++ /*
+ * A lot of modern Clevo barebones have touchpad and/or keyboard issues
+ * after suspend fixable with nomux + reset + noloop + nopnp. Luckily,
+ * none of them have an external PS/2 port so this can safely be set for
--- /dev/null
+From 8386207f37e98453e1de3f51e50eeeea089103f9 Mon Sep 17 00:00:00 2001
+From: Eliav Bar-ilan <eliavb@nvidia.com>
+Date: Tue, 10 Sep 2024 16:44:16 -0300
+Subject: iommu/amd: Fix argument order in amd_iommu_dev_flush_pasid_all()
+
+From: Eliav Bar-ilan <eliavb@nvidia.com>
+
+commit 8386207f37e98453e1de3f51e50eeeea089103f9 upstream.
+
+An incorrect argument order calling amd_iommu_dev_flush_pasid_pages()
+causes improper flushing of the IOMMU, leaving the old value of GCR3 from
+a previous process attached to the same PASID.
+
+The function has the signature:
+
+void amd_iommu_dev_flush_pasid_pages(struct iommu_dev_data *dev_data,
+ ioasid_t pasid, u64 address, size_t size)
+
+Correct the argument order.
+
+Cc: stable@vger.kernel.org
+Fixes: 474bf01ed9f0 ("iommu/amd: Add support for device based TLB invalidation")
+Signed-off-by: Eliav Bar-ilan <eliavb@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Link: https://lore.kernel.org/r/0-v1-fc6bc37d8208+250b-amd_pasid_flush_jgg@nvidia.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/amd/iommu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -1550,8 +1550,8 @@ void amd_iommu_dev_flush_pasid_pages(str
+ void amd_iommu_dev_flush_pasid_all(struct iommu_dev_data *dev_data,
+ ioasid_t pasid)
+ {
+- amd_iommu_dev_flush_pasid_pages(dev_data, 0,
+- CMD_INV_IOMMU_ALL_PAGES_ADDRESS, pasid);
++ amd_iommu_dev_flush_pasid_pages(dev_data, pasid, 0,
++ CMD_INV_IOMMU_ALL_PAGES_ADDRESS);
+ }
+
+ void amd_iommu_domain_flush_complete(struct protection_domain *domain)
--- /dev/null
+From 8f6887349b2f829a4121c518aeb064fc922714e4 Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgg@nvidia.com>
+Date: Tue, 27 Aug 2024 13:46:45 -0300
+Subject: iommufd: Protect against overflow of ALIGN() during iova allocation
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+commit 8f6887349b2f829a4121c518aeb064fc922714e4 upstream.
+
+Userspace can supply an iova and uptr such that the target iova alignment
+becomes really big and ALIGN() overflows which corrupts the selected area
+range during allocation. CONFIG_IOMMUFD_TEST can detect this:
+
+ WARNING: CPU: 1 PID: 5092 at drivers/iommu/iommufd/io_pagetable.c:268 iopt_alloc_area_pages drivers/iommu/iommufd/io_pagetable.c:268 [inline]
+ WARNING: CPU: 1 PID: 5092 at drivers/iommu/iommufd/io_pagetable.c:268 iopt_map_pages+0xf95/0x1050 drivers/iommu/iommufd/io_pagetable.c:352
+ Modules linked in:
+ CPU: 1 PID: 5092 Comm: syz-executor294 Not tainted 6.10.0-rc5-syzkaller-00294-g3ffea9a7a6f7 #0
+ Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
+ RIP: 0010:iopt_alloc_area_pages drivers/iommu/iommufd/io_pagetable.c:268 [inline]
+ RIP: 0010:iopt_map_pages+0xf95/0x1050 drivers/iommu/iommufd/io_pagetable.c:352
+ Code: fc e9 a4 f3 ff ff e8 1a 8b 4c fc 41 be e4 ff ff ff e9 8a f3 ff ff e8 0a 8b 4c fc 90 0f 0b 90 e9 37 f5 ff ff e8 fc 8a 4c fc 90 <0f> 0b 90 e9 68 f3 ff ff 48 c7 c1 ec 82 ad 8f 80 e1 07 80 c1 03 38
+ RSP: 0018:ffffc90003ebf9e0 EFLAGS: 00010293
+ RAX: ffffffff85499fa4 RBX: 00000000ffffffef RCX: ffff888079b49e00
+ RDX: 0000000000000000 RSI: 00000000ffffffef RDI: 0000000000000000
+ RBP: ffffc90003ebfc50 R08: ffffffff85499b30 R09: ffffffff85499942
+ R10: 0000000000000002 R11: ffff888079b49e00 R12: ffff8880228e0010
+ R13: 0000000000000000 R14: 1ffff920007d7f68 R15: ffffc90003ebfd00
+ FS: 000055557d760380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00000000005fdeb8 CR3: 000000007404a000 CR4: 00000000003506f0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ <TASK>
+ iommufd_ioas_copy+0x610/0x7b0 drivers/iommu/iommufd/ioas.c:274
+ iommufd_fops_ioctl+0x4d9/0x5a0 drivers/iommu/iommufd/main.c:421
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:907 [inline]
+ __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Cap the automatic alignment to the huge page size, which is probably a
+better idea overall. Huge automatic alignments can fragment and chew up
+the available IOVA space without any reason.
+
+Link: https://patch.msgid.link/r/0-v1-8009738b9891+1f7-iommufd_align_overflow_jgg@nvidia.com
+Cc: stable@vger.kernel.org
+Fixes: 51fe6141f0f6 ("iommufd: Data structure to provide IOVA to PFN mapping")
+Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
+Reported-by: syzbot+16073ebbc4c64b819b47@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/r/000000000000388410061a74f014@google.com
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/iommufd/io_pagetable.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/iommu/iommufd/io_pagetable.c
++++ b/drivers/iommu/iommufd/io_pagetable.c
+@@ -112,6 +112,7 @@ static int iopt_alloc_iova(struct io_pag
+ unsigned long page_offset = uptr % PAGE_SIZE;
+ struct interval_tree_double_span_iter used_span;
+ struct interval_tree_span_iter allowed_span;
++ unsigned long max_alignment = PAGE_SIZE;
+ unsigned long iova_alignment;
+
+ lockdep_assert_held(&iopt->iova_rwsem);
+@@ -131,6 +132,13 @@ static int iopt_alloc_iova(struct io_pag
+ roundup_pow_of_two(length),
+ 1UL << __ffs64(uptr));
+
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
++ max_alignment = HPAGE_SIZE;
++#endif
++ /* Protect against ALIGN() overflow */
++ if (iova_alignment >= max_alignment)
++ iova_alignment = max_alignment;
++
+ if (iova_alignment < iopt->iova_alignment)
+ return -EINVAL;
+
--- /dev/null
+From f26a525b77e040d584e967369af1e018d2d59112 Mon Sep 17 00:00:00 2001
+From: Snehal Koukuntla <snehalreddy@google.com>
+Date: Mon, 9 Sep 2024 18:01:54 +0000
+Subject: KVM: arm64: Add memory length checks and remove inline in do_ffa_mem_xfer
+
+From: Snehal Koukuntla <snehalreddy@google.com>
+
+commit f26a525b77e040d584e967369af1e018d2d59112 upstream.
+
+When we share memory through FF-A and the description of the buffers
+exceeds the size of the mapped buffer, the fragmentation API is used.
+The fragmentation API allows specifying chunks of descriptors in subsequent
+FF-A fragment calls and no upper limit has been established for this.
+The entire memory region transferred is identified by a handle which can be
+used to reclaim the transferred memory.
+To be able to reclaim the memory, the description of the buffers has to fit
+in the ffa_desc_buf.
+Add a bounds check on the FF-A sharing path to prevent the memory reclaim
+from failing.
+
+Also do_ffa_mem_xfer() does not need __always_inline, except for the
+BUILD_BUG_ON() aspect, which gets moved to a macro.
+
+[maz: fixed the BUILD_BUG_ON() breakage with LLVM, thanks to Wei-Lin Chang
+ for the timely report]
+
+Fixes: 634d90cf0ac65 ("KVM: arm64: Handle FFA_MEM_LEND calls from the host")
+Cc: stable@vger.kernel.org
+Reviewed-by: Sebastian Ene <sebastianene@google.com>
+Signed-off-by: Snehal Koukuntla <snehalreddy@google.com>
+Reviewed-by: Oliver Upton <oliver.upton@linux.dev>
+Link: https://lore.kernel.org/r/20240909180154.3267939-1-snehalreddy@google.com
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/hyp/nvhe/ffa.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/arch/arm64/kvm/hyp/nvhe/ffa.c
++++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
+@@ -426,9 +426,9 @@ out:
+ return;
+ }
+
+-static __always_inline void do_ffa_mem_xfer(const u64 func_id,
+- struct arm_smccc_res *res,
+- struct kvm_cpu_context *ctxt)
++static void __do_ffa_mem_xfer(const u64 func_id,
++ struct arm_smccc_res *res,
++ struct kvm_cpu_context *ctxt)
+ {
+ DECLARE_REG(u32, len, ctxt, 1);
+ DECLARE_REG(u32, fraglen, ctxt, 2);
+@@ -440,9 +440,6 @@ static __always_inline void do_ffa_mem_x
+ u32 offset, nr_ranges;
+ int ret = 0;
+
+- BUILD_BUG_ON(func_id != FFA_FN64_MEM_SHARE &&
+- func_id != FFA_FN64_MEM_LEND);
+-
+ if (addr_mbz || npages_mbz || fraglen > len ||
+ fraglen > KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE) {
+ ret = FFA_RET_INVALID_PARAMETERS;
+@@ -461,6 +458,11 @@ static __always_inline void do_ffa_mem_x
+ goto out_unlock;
+ }
+
++ if (len > ffa_desc_buf.len) {
++ ret = FFA_RET_NO_MEMORY;
++ goto out_unlock;
++ }
++
+ buf = hyp_buffers.tx;
+ memcpy(buf, host_buffers.tx, fraglen);
+
+@@ -512,6 +514,13 @@ err_unshare:
+ goto out_unlock;
+ }
+
++#define do_ffa_mem_xfer(fid, res, ctxt) \
++ do { \
++ BUILD_BUG_ON((fid) != FFA_FN64_MEM_SHARE && \
++ (fid) != FFA_FN64_MEM_LEND); \
++ __do_ffa_mem_xfer((fid), (res), (ctxt)); \
++ } while (0);
++
+ static void do_ffa_mem_reclaim(struct arm_smccc_res *res,
+ struct kvm_cpu_context *ctxt)
+ {
--- /dev/null
+From 44d17459626052a2390457e550a12cb973506b2f Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Thu, 29 Aug 2024 21:35:51 -0700
+Subject: KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit 44d17459626052a2390457e550a12cb973506b2f upstream.
+
+Use a dedicated mutex to guard kvm_usage_count to fix a potential deadlock
+on x86 due to a chain of locks and SRCU synchronizations. Translating the
+below lockdep splat, CPU1 #6 will wait on CPU0 #1, CPU0 #8 will wait on
+CPU2 #3, and CPU2 #7 will wait on CPU1 #4 (if there's a writer, due to the
+fairness of r/w semaphores).
+
+ CPU0 CPU1 CPU2
+1 lock(&kvm->slots_lock);
+2 lock(&vcpu->mutex);
+3 lock(&kvm->srcu);
+4 lock(cpu_hotplug_lock);
+5 lock(kvm_lock);
+6 lock(&kvm->slots_lock);
+7 lock(cpu_hotplug_lock);
+8 sync(&kvm->srcu);
+
+Note, there are likely more potential deadlocks in KVM x86, e.g. the same
+pattern of taking cpu_hotplug_lock outside of kvm_lock likely exists with
+__kvmclock_cpufreq_notifier():
+
+ cpuhp_cpufreq_online()
+ |
+ -> cpufreq_online()
+ |
+ -> cpufreq_gov_performance_limits()
+ |
+ -> __cpufreq_driver_target()
+ |
+ -> __target_index()
+ |
+ -> cpufreq_freq_transition_begin()
+ |
+ -> cpufreq_notify_transition()
+ |
+ -> ... __kvmclock_cpufreq_notifier()
+
+But, actually triggering such deadlocks is beyond rare due to the
+combination of dependencies and timings involved. E.g. the cpufreq
+notifier is only used on older CPUs without a constant TSC, mucking with
+the NX hugepage mitigation while VMs are running is very uncommon, and
+doing so while also onlining/offlining a CPU (necessary to generate
+contention on cpu_hotplug_lock) would be even more unusual.
+
+The most robust solution to the general cpu_hotplug_lock issue is likely
+to switch vm_list to be an RCU-protected list, e.g. so that x86's cpufreq
+notifier doesn't to take kvm_lock. For now, settle for fixing the most
+blatant deadlock, as switching to an RCU-protected list is a much more
+involved change, but add a comment in locking.rst to call out that care
+needs to be taken when walking holding kvm_lock and walking vm_list.
+
+ ======================================================
+ WARNING: possible circular locking dependency detected
+ 6.10.0-smp--c257535a0c9d-pip #330 Tainted: G S O
+ ------------------------------------------------------
+ tee/35048 is trying to acquire lock:
+ ff6a80eced71e0a8 (&kvm->slots_lock){+.+.}-{3:3}, at: set_nx_huge_pages+0x179/0x1e0 [kvm]
+
+ but task is already holding lock:
+ ffffffffc07abb08 (kvm_lock){+.+.}-{3:3}, at: set_nx_huge_pages+0x14a/0x1e0 [kvm]
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #3 (kvm_lock){+.+.}-{3:3}:
+ __mutex_lock+0x6a/0xb40
+ mutex_lock_nested+0x1f/0x30
+ kvm_dev_ioctl+0x4fb/0xe50 [kvm]
+ __se_sys_ioctl+0x7b/0xd0
+ __x64_sys_ioctl+0x21/0x30
+ x64_sys_call+0x15d0/0x2e60
+ do_syscall_64+0x83/0x160
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+ -> #2 (cpu_hotplug_lock){++++}-{0:0}:
+ cpus_read_lock+0x2e/0xb0
+ static_key_slow_inc+0x16/0x30
+ kvm_lapic_set_base+0x6a/0x1c0 [kvm]
+ kvm_set_apic_base+0x8f/0xe0 [kvm]
+ kvm_set_msr_common+0x9ae/0xf80 [kvm]
+ vmx_set_msr+0xa54/0xbe0 [kvm_intel]
+ __kvm_set_msr+0xb6/0x1a0 [kvm]
+ kvm_arch_vcpu_ioctl+0xeca/0x10c0 [kvm]
+ kvm_vcpu_ioctl+0x485/0x5b0 [kvm]
+ __se_sys_ioctl+0x7b/0xd0
+ __x64_sys_ioctl+0x21/0x30
+ x64_sys_call+0x15d0/0x2e60
+ do_syscall_64+0x83/0x160
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+ -> #1 (&kvm->srcu){.+.+}-{0:0}:
+ __synchronize_srcu+0x44/0x1a0
+ synchronize_srcu_expedited+0x21/0x30
+ kvm_swap_active_memslots+0x110/0x1c0 [kvm]
+ kvm_set_memslot+0x360/0x620 [kvm]
+ __kvm_set_memory_region+0x27b/0x300 [kvm]
+ kvm_vm_ioctl_set_memory_region+0x43/0x60 [kvm]
+ kvm_vm_ioctl+0x295/0x650 [kvm]
+ __se_sys_ioctl+0x7b/0xd0
+ __x64_sys_ioctl+0x21/0x30
+ x64_sys_call+0x15d0/0x2e60
+ do_syscall_64+0x83/0x160
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+ -> #0 (&kvm->slots_lock){+.+.}-{3:3}:
+ __lock_acquire+0x15ef/0x2e30
+ lock_acquire+0xe0/0x260
+ __mutex_lock+0x6a/0xb40
+ mutex_lock_nested+0x1f/0x30
+ set_nx_huge_pages+0x179/0x1e0 [kvm]
+ param_attr_store+0x93/0x100
+ module_attr_store+0x22/0x40
+ sysfs_kf_write+0x81/0xb0
+ kernfs_fop_write_iter+0x133/0x1d0
+ vfs_write+0x28d/0x380
+ ksys_write+0x70/0xe0
+ __x64_sys_write+0x1f/0x30
+ x64_sys_call+0x281b/0x2e60
+ do_syscall_64+0x83/0x160
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Cc: Chao Gao <chao.gao@intel.com>
+Fixes: 0bf50497f03b ("KVM: Drop kvm_count_lock and instead protect kvm_usage_count with kvm_lock")
+Cc: stable@vger.kernel.org
+Reviewed-by: Kai Huang <kai.huang@intel.com>
+Acked-by: Kai Huang <kai.huang@intel.com>
+Tested-by: Farrah Chen <farrah.chen@intel.com>
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-ID: <20240830043600.127750-2-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/virt/kvm/locking.rst | 32 +++++++++++++++++++++++---------
+ virt/kvm/kvm_main.c | 31 ++++++++++++++++---------------
+ 2 files changed, 39 insertions(+), 24 deletions(-)
+
+--- a/Documentation/virt/kvm/locking.rst
++++ b/Documentation/virt/kvm/locking.rst
+@@ -9,7 +9,7 @@ KVM Lock Overview
+
+ The acquisition orders for mutexes are as follows:
+
+-- cpus_read_lock() is taken outside kvm_lock
++- cpus_read_lock() is taken outside kvm_lock and kvm_usage_lock
+
+ - kvm->lock is taken outside vcpu->mutex
+
+@@ -24,6 +24,12 @@ The acquisition orders for mutexes are a
+ are taken on the waiting side when modifying memslots, so MMU notifiers
+ must not take either kvm->slots_lock or kvm->slots_arch_lock.
+
++cpus_read_lock() vs kvm_lock:
++- Taking cpus_read_lock() outside of kvm_lock is problematic, despite that
++ being the official ordering, as it is quite easy to unknowingly trigger
++ cpus_read_lock() while holding kvm_lock. Use caution when walking vm_list,
++ e.g. avoid complex operations when possible.
++
+ For SRCU:
+
+ - ``synchronize_srcu(&kvm->srcu)`` is called inside critical sections
+@@ -227,10 +233,17 @@ time it will be set using the Dirty trac
+ :Type: mutex
+ :Arch: any
+ :Protects: - vm_list
+- - kvm_usage_count
++
++``kvm_usage_lock``
++^^^^^^^^^^^^^^^^^^
++
++:Type: mutex
++:Arch: any
++:Protects: - kvm_usage_count
+ - hardware virtualization enable/disable
+-:Comment: KVM also disables CPU hotplug via cpus_read_lock() during
+- enable/disable.
++:Comment: Exists because using kvm_lock leads to deadlock (see earlier comment
++ on cpus_read_lock() vs kvm_lock). Note, KVM also disables CPU hotplug via
++ cpus_read_lock() when enabling/disabling virtualization.
+
+ ``kvm->mn_invalidate_lock``
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^
+@@ -290,11 +303,12 @@ time it will be set using the Dirty trac
+ wakeup.
+
+ ``vendor_module_lock``
+-^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++^^^^^^^^^^^^^^^^^^^^^^
+ :Type: mutex
+ :Arch: x86
+ :Protects: loading a vendor module (kvm_amd or kvm_intel)
+-:Comment: Exists because using kvm_lock leads to deadlock. cpu_hotplug_lock is
+- taken outside of kvm_lock, e.g. in KVM's CPU online/offline callbacks, and
+- many operations need to take cpu_hotplug_lock when loading a vendor module,
+- e.g. updating static calls.
++:Comment: Exists because using kvm_lock leads to deadlock. kvm_lock is taken
++ in notifiers, e.g. __kvmclock_cpufreq_notifier(), that may be invoked while
++ cpu_hotplug_lock is held, e.g. from cpufreq_boost_trigger_state(), and many
++ operations need to take cpu_hotplug_lock when loading a vendor module, e.g.
++ updating static calls.
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -5575,6 +5575,7 @@ __visible bool kvm_rebooting;
+ EXPORT_SYMBOL_GPL(kvm_rebooting);
+
+ static DEFINE_PER_CPU(bool, hardware_enabled);
++static DEFINE_MUTEX(kvm_usage_lock);
+ static int kvm_usage_count;
+
+ static int __hardware_enable_nolock(void)
+@@ -5607,10 +5608,10 @@ static int kvm_online_cpu(unsigned int c
+ * be enabled. Otherwise running VMs would encounter unrecoverable
+ * errors when scheduled to this CPU.
+ */
+- mutex_lock(&kvm_lock);
++ mutex_lock(&kvm_usage_lock);
+ if (kvm_usage_count)
+ ret = __hardware_enable_nolock();
+- mutex_unlock(&kvm_lock);
++ mutex_unlock(&kvm_usage_lock);
+ return ret;
+ }
+
+@@ -5630,10 +5631,10 @@ static void hardware_disable_nolock(void
+
+ static int kvm_offline_cpu(unsigned int cpu)
+ {
+- mutex_lock(&kvm_lock);
++ mutex_lock(&kvm_usage_lock);
+ if (kvm_usage_count)
+ hardware_disable_nolock(NULL);
+- mutex_unlock(&kvm_lock);
++ mutex_unlock(&kvm_usage_lock);
+ return 0;
+ }
+
+@@ -5649,9 +5650,9 @@ static void hardware_disable_all_nolock(
+ static void hardware_disable_all(void)
+ {
+ cpus_read_lock();
+- mutex_lock(&kvm_lock);
++ mutex_lock(&kvm_usage_lock);
+ hardware_disable_all_nolock();
+- mutex_unlock(&kvm_lock);
++ mutex_unlock(&kvm_usage_lock);
+ cpus_read_unlock();
+ }
+
+@@ -5682,7 +5683,7 @@ static int hardware_enable_all(void)
+ * enable hardware multiple times.
+ */
+ cpus_read_lock();
+- mutex_lock(&kvm_lock);
++ mutex_lock(&kvm_usage_lock);
+
+ r = 0;
+
+@@ -5696,7 +5697,7 @@ static int hardware_enable_all(void)
+ }
+ }
+
+- mutex_unlock(&kvm_lock);
++ mutex_unlock(&kvm_usage_lock);
+ cpus_read_unlock();
+
+ return r;
+@@ -5724,13 +5725,13 @@ static int kvm_suspend(void)
+ {
+ /*
+ * Secondary CPUs and CPU hotplug are disabled across the suspend/resume
+- * callbacks, i.e. no need to acquire kvm_lock to ensure the usage count
+- * is stable. Assert that kvm_lock is not held to ensure the system
+- * isn't suspended while KVM is enabling hardware. Hardware enabling
+- * can be preempted, but the task cannot be frozen until it has dropped
+- * all locks (userspace tasks are frozen via a fake signal).
++ * callbacks, i.e. no need to acquire kvm_usage_lock to ensure the usage
++ * count is stable. Assert that kvm_usage_lock is not held to ensure
++ * the system isn't suspended while KVM is enabling hardware. Hardware
++ * enabling can be preempted, but the task cannot be frozen until it has
++ * dropped all locks (userspace tasks are frozen via a fake signal).
+ */
+- lockdep_assert_not_held(&kvm_lock);
++ lockdep_assert_not_held(&kvm_usage_lock);
+ lockdep_assert_irqs_disabled();
+
+ if (kvm_usage_count)
+@@ -5740,7 +5741,7 @@ static int kvm_suspend(void)
+
+ static void kvm_resume(void)
+ {
+- lockdep_assert_not_held(&kvm_lock);
++ lockdep_assert_not_held(&kvm_usage_lock);
+ lockdep_assert_irqs_disabled();
+
+ if (kvm_usage_count)
--- /dev/null
+From 71bf395a276f0578d19e0ae137a7d1d816d08e0e Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Fri, 19 Jul 2024 16:50:58 -0700
+Subject: KVM: x86: Enforce x2APIC's must-be-zero reserved ICR bits
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit 71bf395a276f0578d19e0ae137a7d1d816d08e0e upstream.
+
+Inject a #GP on a WRMSR(ICR) that attempts to set any reserved bits that
+are must-be-zero on both Intel and AMD, i.e. any reserved bits other than
+the BUSY bit, which Intel ignores and basically says is undefined.
+
+KVM's xapic_state_test selftest has been fudging the bug since commit
+4b88b1a518b3 ("KVM: selftests: Enhance handling WRMSR ICR register in
+x2APIC mode"), which essentially removed the testcase instead of fixing
+the bug.
+
+WARN if the nodecode path triggers a #GP, as the CPU is supposed to check
+reserved bits for ICR when it's partially virtualized.
+
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240719235107.3023592-2-seanjc@google.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/lapic.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2470,7 +2470,7 @@ void kvm_apic_write_nodecode(struct kvm_
+ * maybe-unecessary write, and both are in the noise anyways.
+ */
+ if (apic_x2apic_mode(apic) && offset == APIC_ICR)
+- kvm_x2apic_icr_write(apic, kvm_lapic_get_reg64(apic, APIC_ICR));
++ WARN_ON_ONCE(kvm_x2apic_icr_write(apic, kvm_lapic_get_reg64(apic, APIC_ICR)));
+ else
+ kvm_lapic_reg_write(apic, offset, kvm_lapic_get_reg(apic, offset));
+ }
+@@ -3194,8 +3194,21 @@ int kvm_lapic_set_vapic_addr(struct kvm_
+ return 0;
+ }
+
++#define X2APIC_ICR_RESERVED_BITS (GENMASK_ULL(31, 20) | GENMASK_ULL(17, 16) | BIT(13))
++
+ int kvm_x2apic_icr_write(struct kvm_lapic *apic, u64 data)
+ {
++ if (data & X2APIC_ICR_RESERVED_BITS)
++ return 1;
++
++ /*
++ * The BUSY bit is reserved on both Intel and AMD in x2APIC mode, but
++ * only AMD requires it to be zero, Intel essentially just ignores the
++ * bit. And if IPI virtualization (Intel) or x2AVIC (AMD) is enabled,
++ * the CPU performs the reserved bits checks, i.e. the underlying CPU
++ * behavior will "win". Arbitrarily clear the BUSY bit, as there is no
++ * sane way to provide consistent behavior with respect to hardware.
++ */
+ data &= ~APIC_ICR_BUSY;
+
+ kvm_apic_send_ipi(apic, (u32)data, (u32)(data >> 32));
--- /dev/null
+From d33234342f8b468e719e05649fd26549fb37ef8a Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Fri, 19 Jul 2024 16:50:59 -0700
+Subject: KVM: x86: Move x2APIC ICR helper above kvm_apic_write_nodecode()
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit d33234342f8b468e719e05649fd26549fb37ef8a upstream.
+
+Hoist kvm_x2apic_icr_write() above kvm_apic_write_nodecode() so that a
+local helper to _read_ the x2APIC ICR can be added and used in the
+nodecode path without needing a forward declaration.
+
+No functional change intended.
+
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240719235107.3023592-3-seanjc@google.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/lapic.c | 46 +++++++++++++++++++++++-----------------------
+ 1 file changed, 23 insertions(+), 23 deletions(-)
+
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2453,6 +2453,29 @@ void kvm_lapic_set_eoi(struct kvm_vcpu *
+ }
+ EXPORT_SYMBOL_GPL(kvm_lapic_set_eoi);
+
++#define X2APIC_ICR_RESERVED_BITS (GENMASK_ULL(31, 20) | GENMASK_ULL(17, 16) | BIT(13))
++
++int kvm_x2apic_icr_write(struct kvm_lapic *apic, u64 data)
++{
++ if (data & X2APIC_ICR_RESERVED_BITS)
++ return 1;
++
++ /*
++ * The BUSY bit is reserved on both Intel and AMD in x2APIC mode, but
++ * only AMD requires it to be zero, Intel essentially just ignores the
++ * bit. And if IPI virtualization (Intel) or x2AVIC (AMD) is enabled,
++ * the CPU performs the reserved bits checks, i.e. the underlying CPU
++ * behavior will "win". Arbitrarily clear the BUSY bit, as there is no
++ * sane way to provide consistent behavior with respect to hardware.
++ */
++ data &= ~APIC_ICR_BUSY;
++
++ kvm_apic_send_ipi(apic, (u32)data, (u32)(data >> 32));
++ kvm_lapic_set_reg64(apic, APIC_ICR, data);
++ trace_kvm_apic_write(APIC_ICR, data);
++ return 0;
++}
++
+ /* emulate APIC access in a trap manner */
+ void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset)
+ {
+@@ -3194,29 +3217,6 @@ int kvm_lapic_set_vapic_addr(struct kvm_
+ return 0;
+ }
+
+-#define X2APIC_ICR_RESERVED_BITS (GENMASK_ULL(31, 20) | GENMASK_ULL(17, 16) | BIT(13))
+-
+-int kvm_x2apic_icr_write(struct kvm_lapic *apic, u64 data)
+-{
+- if (data & X2APIC_ICR_RESERVED_BITS)
+- return 1;
+-
+- /*
+- * The BUSY bit is reserved on both Intel and AMD in x2APIC mode, but
+- * only AMD requires it to be zero, Intel essentially just ignores the
+- * bit. And if IPI virtualization (Intel) or x2AVIC (AMD) is enabled,
+- * the CPU performs the reserved bits checks, i.e. the underlying CPU
+- * behavior will "win". Arbitrarily clear the BUSY bit, as there is no
+- * sane way to provide consistent behavior with respect to hardware.
+- */
+- data &= ~APIC_ICR_BUSY;
+-
+- kvm_apic_send_ipi(apic, (u32)data, (u32)(data >> 32));
+- kvm_lapic_set_reg64(apic, APIC_ICR, data);
+- trace_kvm_apic_write(APIC_ICR, data);
+- return 0;
+-}
+-
+ static int kvm_lapic_msr_read(struct kvm_lapic *apic, u32 reg, u64 *data)
+ {
+ u32 low;
--- /dev/null
+From 73b42dc69be8564d4951a14d00f827929fe5ef79 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Fri, 19 Jul 2024 16:51:00 -0700
+Subject: KVM: x86: Re-split x2APIC ICR into ICR+ICR2 for AMD (x2AVIC)
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit 73b42dc69be8564d4951a14d00f827929fe5ef79 upstream.
+
+Re-introduce the "split" x2APIC ICR storage that KVM used prior to Intel's
+IPI virtualization support, but only for AMD. While not stated anywhere
+in the APM, despite stating the ICR is a single 64-bit register, AMD CPUs
+store the 64-bit ICR as two separate 32-bit values in ICR and ICR2. When
+IPI virtualization (IPIv on Intel, all AVIC flavors on AMD) is enabled,
+KVM needs to match CPU behavior as some ICR ICR writes will be handled by
+the CPU, not by KVM.
+
+Add a kvm_x86_ops knob to control the underlying format used by the CPU to
+store the x2APIC ICR, and tune it to AMD vs. Intel regardless of whether
+or not x2AVIC is enabled. If KVM is handling all ICR writes, the storage
+format for x2APIC mode doesn't matter, and having the behavior follow AMD
+versus Intel will provide better test coverage and ease debugging.
+
+Fixes: 4d1d7942e36a ("KVM: SVM: Introduce logic to (de)activate x2AVIC mode")
+Cc: stable@vger.kernel.org
+Cc: Maxim Levitsky <mlevitsk@redhat.com>
+Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Link: https://lore.kernel.org/r/20240719235107.3023592-4-seanjc@google.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/kvm_host.h | 2 +
+ arch/x86/kvm/lapic.c | 42 ++++++++++++++++++++++++++++------------
+ arch/x86/kvm/svm/svm.c | 2 +
+ arch/x86/kvm/vmx/main.c | 2 +
+ 4 files changed, 36 insertions(+), 12 deletions(-)
+
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1727,6 +1727,8 @@ struct kvm_x86_ops {
+ void (*enable_nmi_window)(struct kvm_vcpu *vcpu);
+ void (*enable_irq_window)(struct kvm_vcpu *vcpu);
+ void (*update_cr8_intercept)(struct kvm_vcpu *vcpu, int tpr, int irr);
++
++ const bool x2apic_icr_is_split;
+ const unsigned long required_apicv_inhibits;
+ bool allow_apicv_in_x2apic_without_x2apic_virtualization;
+ void (*refresh_apicv_exec_ctrl)(struct kvm_vcpu *vcpu);
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2471,11 +2471,25 @@ int kvm_x2apic_icr_write(struct kvm_lapi
+ data &= ~APIC_ICR_BUSY;
+
+ kvm_apic_send_ipi(apic, (u32)data, (u32)(data >> 32));
+- kvm_lapic_set_reg64(apic, APIC_ICR, data);
++ if (kvm_x86_ops.x2apic_icr_is_split) {
++ kvm_lapic_set_reg(apic, APIC_ICR, data);
++ kvm_lapic_set_reg(apic, APIC_ICR2, data >> 32);
++ } else {
++ kvm_lapic_set_reg64(apic, APIC_ICR, data);
++ }
+ trace_kvm_apic_write(APIC_ICR, data);
+ return 0;
+ }
+
++static u64 kvm_x2apic_icr_read(struct kvm_lapic *apic)
++{
++ if (kvm_x86_ops.x2apic_icr_is_split)
++ return (u64)kvm_lapic_get_reg(apic, APIC_ICR) |
++ (u64)kvm_lapic_get_reg(apic, APIC_ICR2) << 32;
++
++ return kvm_lapic_get_reg64(apic, APIC_ICR);
++}
++
+ /* emulate APIC access in a trap manner */
+ void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset)
+ {
+@@ -2493,7 +2507,7 @@ void kvm_apic_write_nodecode(struct kvm_
+ * maybe-unecessary write, and both are in the noise anyways.
+ */
+ if (apic_x2apic_mode(apic) && offset == APIC_ICR)
+- WARN_ON_ONCE(kvm_x2apic_icr_write(apic, kvm_lapic_get_reg64(apic, APIC_ICR)));
++ WARN_ON_ONCE(kvm_x2apic_icr_write(apic, kvm_x2apic_icr_read(apic)));
+ else
+ kvm_lapic_reg_write(apic, offset, kvm_lapic_get_reg(apic, offset));
+ }
+@@ -3013,18 +3027,22 @@ static int kvm_apic_state_fixup(struct k
+
+ /*
+ * In x2APIC mode, the LDR is fixed and based on the id. And
+- * ICR is internally a single 64-bit register, but needs to be
+- * split to ICR+ICR2 in userspace for backwards compatibility.
++ * if the ICR is _not_ split, ICR is internally a single 64-bit
++ * register, but needs to be split to ICR+ICR2 in userspace for
++ * backwards compatibility.
+ */
+- if (set) {
++ if (set)
+ *ldr = kvm_apic_calc_x2apic_ldr(x2apic_id);
+
+- icr = __kvm_lapic_get_reg(s->regs, APIC_ICR) |
+- (u64)__kvm_lapic_get_reg(s->regs, APIC_ICR2) << 32;
+- __kvm_lapic_set_reg64(s->regs, APIC_ICR, icr);
+- } else {
+- icr = __kvm_lapic_get_reg64(s->regs, APIC_ICR);
+- __kvm_lapic_set_reg(s->regs, APIC_ICR2, icr >> 32);
++ if (!kvm_x86_ops.x2apic_icr_is_split) {
++ if (set) {
++ icr = __kvm_lapic_get_reg(s->regs, APIC_ICR) |
++ (u64)__kvm_lapic_get_reg(s->regs, APIC_ICR2) << 32;
++ __kvm_lapic_set_reg64(s->regs, APIC_ICR, icr);
++ } else {
++ icr = __kvm_lapic_get_reg64(s->regs, APIC_ICR);
++ __kvm_lapic_set_reg(s->regs, APIC_ICR2, icr >> 32);
++ }
+ }
+ }
+
+@@ -3222,7 +3240,7 @@ static int kvm_lapic_msr_read(struct kvm
+ u32 low;
+
+ if (reg == APIC_ICR) {
+- *data = kvm_lapic_get_reg64(apic, APIC_ICR);
++ *data = kvm_x2apic_icr_read(apic);
+ return 0;
+ }
+
+--- a/arch/x86/kvm/svm/svm.c
++++ b/arch/x86/kvm/svm/svm.c
+@@ -5062,6 +5062,8 @@ static struct kvm_x86_ops svm_x86_ops __
+ .enable_nmi_window = svm_enable_nmi_window,
+ .enable_irq_window = svm_enable_irq_window,
+ .update_cr8_intercept = svm_update_cr8_intercept,
++
++ .x2apic_icr_is_split = true,
+ .set_virtual_apic_mode = avic_refresh_virtual_apic_mode,
+ .refresh_apicv_exec_ctrl = avic_refresh_apicv_exec_ctrl,
+ .apicv_post_state_restore = avic_apicv_post_state_restore,
+--- a/arch/x86/kvm/vmx/main.c
++++ b/arch/x86/kvm/vmx/main.c
+@@ -89,6 +89,8 @@ struct kvm_x86_ops vt_x86_ops __initdata
+ .enable_nmi_window = vmx_enable_nmi_window,
+ .enable_irq_window = vmx_enable_irq_window,
+ .update_cr8_intercept = vmx_update_cr8_intercept,
++
++ .x2apic_icr_is_split = false,
+ .set_virtual_apic_mode = vmx_set_virtual_apic_mode,
+ .set_apic_access_page_addr = vmx_set_apic_access_page_addr,
+ .refresh_apicv_exec_ctrl = vmx_refresh_apicv_exec_ctrl,
--- /dev/null
+From 8037ac08c2bbb3186f83a5a924f52d1048dbaec5 Mon Sep 17 00:00:00 2001
+From: "Maciej W. Rozycki" <macro@orcam.me.uk>
+Date: Fri, 9 Aug 2024 14:24:46 +0100
+Subject: PCI: Clear the LBMS bit after a link retrain
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maciej W. Rozycki <macro@orcam.me.uk>
+
+commit 8037ac08c2bbb3186f83a5a924f52d1048dbaec5 upstream.
+
+The LBMS bit, where implemented, is set by hardware either in response
+to the completion of retraining caused by writing 1 to the Retrain Link
+bit or whenever hardware has changed the link speed or width in attempt
+to correct unreliable link operation. It is never cleared by hardware
+other than by software writing 1 to the bit position in the Link Status
+register and we never do such a write.
+
+We currently have two places, namely apply_bad_link_workaround() and
+pcie_failed_link_retrain() in drivers/pci/controller/dwc/pcie-tegra194.c
+and drivers/pci/quirks.c respectively where we check the state of the LBMS
+bit and neither is interested in the state of the bit resulting from the
+completion of retraining, both check for a link fault.
+
+And in particular pcie_failed_link_retrain() causes issues consequently, by
+trying to retrain a link where there's no downstream device anymore and the
+state of 1 in the LBMS bit has been retained from when there was a device
+downstream that has since been removed.
+
+Clear the LBMS bit then at the conclusion of pcie_retrain_link(), so that
+we have a single place that controls it and that our code can track link
+speed or width changes resulting from unreliable link operation.
+
+Fixes: a89c82249c37 ("PCI: Work around PCIe link training failures")
+Link: https://lore.kernel.org/r/alpine.DEB.2.21.2408091133140.61955@angie.orcam.me.uk
+Reported-by: Matthew W Carlis <mattc@purestorage.com>
+Link: https://lore.kernel.org/r/20240806000659.30859-1-mattc@purestorage.com/
+Link: https://lore.kernel.org/r/20240722193407.23255-1-mattc@purestorage.com/
+Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Cc: <stable@vger.kernel.org> # v6.5+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/pci.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -4718,7 +4718,15 @@ int pcie_retrain_link(struct pci_dev *pd
+ pcie_capability_clear_word(pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_RL);
+ }
+
+- return pcie_wait_for_link_status(pdev, use_lt, !use_lt);
++ rc = pcie_wait_for_link_status(pdev, use_lt, !use_lt);
++
++ /*
++ * Clear LBMS after a manual retrain so that the bit can be used
++ * to track link speed or width changes made by hardware itself
++ * in attempt to correct unreliable link operation.
++ */
++ pcie_capability_write_word(pdev, PCI_EXP_LNKSTA, PCI_EXP_LNKSTA_LBMS);
++ return rc;
+ }
+
+ /**
--- /dev/null
+From 712e49c967064a3a7a5738c6f65ac540a3f6a1df Mon Sep 17 00:00:00 2001
+From: "Maciej W. Rozycki" <macro@orcam.me.uk>
+Date: Fri, 9 Aug 2024 14:24:56 +0100
+Subject: PCI: Correct error reporting with PCIe failed link retraining
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maciej W. Rozycki <macro@orcam.me.uk>
+
+commit 712e49c967064a3a7a5738c6f65ac540a3f6a1df upstream.
+
+Only return successful completion status from pcie_failed_link_retrain() if
+retraining has actually been done, preventing excessive delays from being
+triggered at call sites in a hope that communication will finally be
+established with the downstream device where in fact nothing has been done
+about the link in question that would justify such a hope.
+
+Fixes: a89c82249c37 ("PCI: Work around PCIe link training failures")
+Link: https://lore.kernel.org/r/alpine.DEB.2.21.2408091133260.61955@angie.orcam.me.uk
+Reported-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/aa2d1c4e-9961-d54a-00c7-ddf8e858a9b0@linux.intel.com/
+Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v6.5+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/quirks.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -78,7 +78,8 @@
+ * again to remove any residual state, ignoring the result as it's supposed
+ * to fail anyway.
+ *
+- * Return TRUE if the link has been successfully retrained, otherwise FALSE.
++ * Return TRUE if the link has been successfully retrained. Return FALSE
++ * if retraining was not needed or we attempted a retrain and it failed.
+ */
+ bool pcie_failed_link_retrain(struct pci_dev *dev)
+ {
+@@ -87,6 +88,7 @@ bool pcie_failed_link_retrain(struct pci
+ {}
+ };
+ u16 lnksta, lnkctl2;
++ bool ret = false;
+
+ if (!pci_is_pcie(dev) || !pcie_downstream_port(dev) ||
+ !pcie_cap_has_lnkctl2(dev) || !dev->link_active_reporting)
+@@ -104,7 +106,8 @@ bool pcie_failed_link_retrain(struct pci
+ lnkctl2 |= PCI_EXP_LNKCTL2_TLS_2_5GT;
+ pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, lnkctl2);
+
+- if (pcie_retrain_link(dev, false)) {
++ ret = pcie_retrain_link(dev, false) == 0;
++ if (!ret) {
+ pci_info(dev, "retraining failed\n");
+ pcie_capability_write_word(dev, PCI_EXP_LNKCTL2,
+ oldlnkctl2);
+@@ -126,13 +129,14 @@ bool pcie_failed_link_retrain(struct pci
+ lnkctl2 |= lnkcap & PCI_EXP_LNKCAP_SLS;
+ pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, lnkctl2);
+
+- if (pcie_retrain_link(dev, false)) {
++ ret = pcie_retrain_link(dev, false) == 0;
++ if (!ret) {
+ pci_info(dev, "retraining failed\n");
+ return false;
+ }
+ }
+
+- return true;
++ return ret;
+ }
+
+ static ktime_t fixup_debug_start(struct pci_dev *dev,
--- /dev/null
+From 4d60f6d4b8fa4d7bad4aeb2b3ee5c10425bc60a4 Mon Sep 17 00:00:00 2001
+From: Siddharth Vadapalli <s-vadapalli@ti.com>
+Date: Tue, 27 Aug 2024 17:54:22 +0530
+Subject: PCI: dra7xx: Fix error handling when IRQ request fails in probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Siddharth Vadapalli <s-vadapalli@ti.com>
+
+commit 4d60f6d4b8fa4d7bad4aeb2b3ee5c10425bc60a4 upstream.
+
+Commit d4c7d1a089d6 ("PCI: dwc: dra7xx: Push request_irq()
+call to the bottom of probe") moved the IRQ request for
+"dra7xx-pcie-main" towards the end of dra7xx_pcie_probe().
+
+However, the error handling does not take into account the
+initialization performed by either dra7xx_add_pcie_port() or
+dra7xx_add_pcie_ep(), depending on the mode of operation.
+
+Fix the error handling to address this.
+
+Fixes: d4c7d1a089d6 ("PCI: dwc: dra7xx: Push request_irq() call to the bottom of probe")
+Link: https://lore.kernel.org/linux-pci/20240827122422.985547-3-s-vadapalli@ti.com
+Tested-by: Udit Kumar <u-kumar1@ti.com>
+Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/dwc/pci-dra7xx.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/controller/dwc/pci-dra7xx.c
++++ b/drivers/pci/controller/dwc/pci-dra7xx.c
+@@ -854,11 +854,17 @@ static int dra7xx_pcie_probe(struct plat
+ "dra7xx-pcie-main", dra7xx);
+ if (ret) {
+ dev_err(dev, "failed to request irq\n");
+- goto err_gpio;
++ goto err_deinit;
+ }
+
+ return 0;
+
++err_deinit:
++ if (dra7xx->mode == DW_PCIE_RC_TYPE)
++ dw_pcie_host_deinit(&dra7xx->pci->pp);
++ else
++ dw_pcie_ep_deinit(&dra7xx->pci->ep);
++
+ err_gpio:
+ err_get_sync:
+ pm_runtime_put(dev);
--- /dev/null
+From 03f84b3baba7836bdfc162c19288d5ce1aa92890 Mon Sep 17 00:00:00 2001
+From: Siddharth Vadapalli <s-vadapalli@ti.com>
+Date: Tue, 27 Aug 2024 17:54:21 +0530
+Subject: PCI: dra7xx: Fix threaded IRQ request for "dra7xx-pcie-main" IRQ
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Siddharth Vadapalli <s-vadapalli@ti.com>
+
+commit 03f84b3baba7836bdfc162c19288d5ce1aa92890 upstream.
+
+Commit da87d35a6e51 ("PCI: dra7xx: Use threaded IRQ handler for
+"dra7xx-pcie-main" IRQ") switched from devm_request_irq() to
+devm_request_threaded_irq() for the "dra7xx-pcie-main" interrupt.
+
+Since the primary handler was set to NULL, the "IRQF_ONESHOT" flag
+should have also been set. Fix this.
+
+Fixes: da87d35a6e51 ("PCI: dra7xx: Use threaded IRQ handler for "dra7xx-pcie-main" IRQ")
+Suggested-by: Vignesh Raghavendra <vigneshr@ti.com>
+Link: https://lore.kernel.org/linux-pci/20240827122422.985547-2-s-vadapalli@ti.com
+Reported-by: Udit Kumar <u-kumar1@ti.com>
+Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/dwc/pci-dra7xx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/controller/dwc/pci-dra7xx.c
++++ b/drivers/pci/controller/dwc/pci-dra7xx.c
+@@ -850,7 +850,8 @@ static int dra7xx_pcie_probe(struct plat
+ dra7xx->mode = mode;
+
+ ret = devm_request_threaded_irq(dev, irq, NULL, dra7xx_pcie_irq_handler,
+- IRQF_SHARED, "dra7xx-pcie-main", dra7xx);
++ IRQF_SHARED | IRQF_ONESHOT,
++ "dra7xx-pcie-main", dra7xx);
+ if (ret) {
+ dev_err(dev, "failed to request irq\n");
+ goto err_gpio;
--- /dev/null
+From 5214ff221a14cadab1e2ee29499750fd5e884feb Mon Sep 17 00:00:00 2001
+From: Richard Zhu <hongxing.zhu@nxp.com>
+Date: Mon, 29 Jul 2024 16:18:08 -0400
+Subject: PCI: imx6: Fix establish link failure in EP mode for i.MX8MM and i.MX8MP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Richard Zhu <hongxing.zhu@nxp.com>
+
+commit 5214ff221a14cadab1e2ee29499750fd5e884feb upstream.
+
+Add IMX6_PCIE_FLAG_HAS_APP_RESET flag to IMX8MM_EP and IMX8MP_EP drvdata.
+
+This flag was overlooked during code restructuring. It is crucial to
+release the app-reset from the System Reset Controller before initiating
+LTSSM to rectify the issue.
+
+Fixes: 0c9651c21f2a ("PCI: imx6: Simplify reset handling by using *_FLAG_HAS_*_RESET")
+Link: https://lore.kernel.org/linux-pci/20240729-pci2_upstream-v8-1-b68ee5ef2b4d@nxp.com
+Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Cc: <stable@vger.kernel.org> # 6.9+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -1563,7 +1563,8 @@ static const struct imx6_pcie_drvdata dr
+ },
+ [IMX8MM_EP] = {
+ .variant = IMX8MM_EP,
+- .flags = IMX6_PCIE_FLAG_HAS_PHYDRV,
++ .flags = IMX6_PCIE_FLAG_HAS_APP_RESET |
++ IMX6_PCIE_FLAG_HAS_PHYDRV,
+ .mode = DW_PCIE_EP_TYPE,
+ .gpr = "fsl,imx8mm-iomuxc-gpr",
+ .clk_names = imx8mm_clks,
+@@ -1574,7 +1575,8 @@ static const struct imx6_pcie_drvdata dr
+ },
+ [IMX8MP_EP] = {
+ .variant = IMX8MP_EP,
+- .flags = IMX6_PCIE_FLAG_HAS_PHYDRV,
++ .flags = IMX6_PCIE_FLAG_HAS_APP_RESET |
++ IMX6_PCIE_FLAG_HAS_PHYDRV,
+ .mode = DW_PCIE_EP_TYPE,
+ .gpr = "fsl,imx8mp-iomuxc-gpr",
+ .clk_names = imx8mm_clks,
--- /dev/null
+From 5cb3aa92c7cf182940ae575c3f450d3708af087c Mon Sep 17 00:00:00 2001
+From: Richard Zhu <hongxing.zhu@nxp.com>
+Date: Mon, 29 Jul 2024 16:18:09 -0400
+Subject: PCI: imx6: Fix i.MX8MP PCIe EP's occasional failure to trigger MSI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Richard Zhu <hongxing.zhu@nxp.com>
+
+commit 5cb3aa92c7cf182940ae575c3f450d3708af087c upstream.
+
+Correct occasional MSI triggering failures in i.MX8MP PCIe EP by applying
+the correct hardware outbound alignment requirement.
+
+The i.MX platform has a restriction about outbound address translation. The
+pci-epc-mem uses page_size to manage it. Set the correct page_size for i.MX
+platform to meet the hardware requirement, which is the same as inbound
+address alignment.
+
+Thus, align it with epc_features::align.
+
+Fixes: 1bd0d43dcf3b ("PCI: imx6: Clean up addr_space retrieval code")
+Link: https://lore.kernel.org/linux-pci/20240729-pci2_upstream-v8-2-b68ee5ef2b4d@nxp.com
+Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Acked-by: Jason Liu <jason.hui.liu@nxp.com>
+Cc: <stable@vger.kernel.org> # 6.9+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -1114,6 +1114,8 @@ static int imx6_add_pcie_ep(struct imx6_
+ if (imx6_check_flag(imx6_pcie, IMX6_PCIE_FLAG_SUPPORT_64BIT))
+ dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
+
++ ep->page_size = imx6_pcie->drvdata->epc_features->align;
++
+ ret = dw_pcie_ep_init(ep);
+ if (ret) {
+ dev_err(dev, "failed to initialize endpoint\n");
--- /dev/null
+From 5b04d44d5c74e4d8aab1678496b84700b4b343fe Mon Sep 17 00:00:00 2001
+From: Frank Li <Frank.Li@nxp.com>
+Date: Mon, 29 Jul 2024 16:18:10 -0400
+Subject: PCI: imx6: Fix missing call to phy_power_off() in error handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Frank Li <Frank.Li@nxp.com>
+
+commit 5b04d44d5c74e4d8aab1678496b84700b4b343fe upstream.
+
+Fix missing call to phy_power_off() in the error path of
+imx6_pcie_host_init(). Remove unnecessary check for imx6_pcie->phy
+as the PHY API already handles NULL pointers.
+
+Fixes: cbcf8722b523 ("phy: freescale: imx8m-pcie: Fix the wrong order of phy_init() and phy_power_on()")
+Link: https://lore.kernel.org/linux-pci/20240729-pci2_upstream-v8-3-b68ee5ef2b4d@nxp.com
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Cc: <stable@vger.kernel.org> # 6.1+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -953,7 +953,7 @@ static int imx6_pcie_host_init(struct dw
+ ret = phy_power_on(imx6_pcie->phy);
+ if (ret) {
+ dev_err(dev, "waiting for PHY ready timeout!\n");
+- goto err_phy_off;
++ goto err_phy_exit;
+ }
+ }
+
+@@ -968,8 +968,9 @@ static int imx6_pcie_host_init(struct dw
+ return 0;
+
+ err_phy_off:
+- if (imx6_pcie->phy)
+- phy_exit(imx6_pcie->phy);
++ phy_power_off(imx6_pcie->phy);
++err_phy_exit:
++ phy_exit(imx6_pcie->phy);
+ err_clk_disable:
+ imx6_pcie_clk_disable(imx6_pcie);
+ err_reg_disable:
--- /dev/null
+From f68dea13405c94381d08f42dbf0416261622bdad Mon Sep 17 00:00:00 2001
+From: "Maciej W. Rozycki" <macro@orcam.me.uk>
+Date: Fri, 9 Aug 2024 14:24:51 +0100
+Subject: PCI: Revert to the original speed after PCIe failed link retraining
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maciej W. Rozycki <macro@orcam.me.uk>
+
+commit f68dea13405c94381d08f42dbf0416261622bdad upstream.
+
+When `pcie_failed_link_retrain' has failed to retrain the link by hand
+it leaves the link speed restricted to 2.5GT/s, which will then affect
+any device that has been plugged in later on, which may not suffer from
+the problem that caused the speed restriction to have been attempted.
+Consequently such a downstream device will suffer from an unnecessary
+communication throughput limitation and therefore performance loss.
+
+Remove the speed restriction then and revert the Link Control 2 register
+to its original state if link retraining with the speed restriction in
+place has failed. Retrain the link again afterwards so as to remove any
+residual state, waiting on LT rather than DLLLA to avoid an excessive
+delay and ignoring the result as this training is supposed to fail
+anyway.
+
+Fixes: a89c82249c37 ("PCI: Work around PCIe link training failures")
+Link: https://lore.kernel.org/linux-pci/alpine.DEB.2.21.2408251412590.30766@angie.orcam.me.uk
+Reported-by: Matthew W Carlis <mattc@purestorage.com>
+Link: https://lore.kernel.org/r/20240806000659.30859-1-mattc@purestorage.com/
+Link: https://lore.kernel.org/r/20240722193407.23255-1-mattc@purestorage.com/
+Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v6.5+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/quirks.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -66,7 +66,7 @@
+ * apply this erratum workaround to any downstream ports as long as they
+ * support Link Active reporting and have the Link Control 2 register.
+ * Restrict the speed to 2.5GT/s then with the Target Link Speed field,
+- * request a retrain and wait 200ms for the data link to go up.
++ * request a retrain and check the result.
+ *
+ * If this turns out successful and we know by the Vendor:Device ID it is
+ * safe to do so, then lift the restriction, letting the devices negotiate
+@@ -74,6 +74,10 @@
+ * firmware may have already arranged and lift it with ports that already
+ * report their data link being up.
+ *
++ * Otherwise revert the speed to the original setting and request a retrain
++ * again to remove any residual state, ignoring the result as it's supposed
++ * to fail anyway.
++ *
+ * Return TRUE if the link has been successfully retrained, otherwise FALSE.
+ */
+ bool pcie_failed_link_retrain(struct pci_dev *dev)
+@@ -92,6 +96,8 @@ bool pcie_failed_link_retrain(struct pci
+ pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta);
+ if ((lnksta & (PCI_EXP_LNKSTA_LBMS | PCI_EXP_LNKSTA_DLLLA)) ==
+ PCI_EXP_LNKSTA_LBMS) {
++ u16 oldlnkctl2 = lnkctl2;
++
+ pci_info(dev, "broken device, retraining non-functional downstream link at 2.5GT/s\n");
+
+ lnkctl2 &= ~PCI_EXP_LNKCTL2_TLS;
+@@ -100,6 +106,9 @@ bool pcie_failed_link_retrain(struct pci
+
+ if (pcie_retrain_link(dev, false)) {
+ pci_info(dev, "retraining failed\n");
++ pcie_capability_write_word(dev, PCI_EXP_LNKCTL2,
++ oldlnkctl2);
++ pcie_retrain_link(dev, true);
+ return false;
+ }
+
--- /dev/null
+From 59100eb248c0b15585affa546c7f6834b30eb5a4 Mon Sep 17 00:00:00 2001
+From: "Maciej W. Rozycki" <macro@orcam.me.uk>
+Date: Fri, 9 Aug 2024 14:25:02 +0100
+Subject: PCI: Use an error code with PCIe failed link retraining
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maciej W. Rozycki <macro@orcam.me.uk>
+
+commit 59100eb248c0b15585affa546c7f6834b30eb5a4 upstream.
+
+Given how the call place in pcie_wait_for_link_delay() got structured now,
+and that pcie_retrain_link() returns a potentially useful error code,
+convert pcie_failed_link_retrain() to return an error code rather than a
+boolean status, fixing handling at the call site mentioned. Update the
+other call site accordingly.
+
+Fixes: 1abb47390350 ("Merge branch 'pci/enumeration'")
+Link: https://lore.kernel.org/r/alpine.DEB.2.21.2408091156530.61955@angie.orcam.me.uk
+Reported-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/aa2d1c4e-9961-d54a-00c7-ddf8e858a9b0@linux.intel.com/
+Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v6.5+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/pci.c | 2 +-
+ drivers/pci/pci.h | 6 +++---
+ drivers/pci/quirks.c | 20 ++++++++++----------
+ 3 files changed, 14 insertions(+), 14 deletions(-)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1324,7 +1324,7 @@ static int pci_dev_wait(struct pci_dev *
+ if (delay > PCI_RESET_WAIT) {
+ if (retrain) {
+ retrain = false;
+- if (pcie_failed_link_retrain(bridge)) {
++ if (pcie_failed_link_retrain(bridge) == 0) {
+ delay = 1;
+ continue;
+ }
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -606,7 +606,7 @@ void pci_acs_init(struct pci_dev *dev);
+ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags);
+ int pci_dev_specific_enable_acs(struct pci_dev *dev);
+ int pci_dev_specific_disable_acs_redir(struct pci_dev *dev);
+-bool pcie_failed_link_retrain(struct pci_dev *dev);
++int pcie_failed_link_retrain(struct pci_dev *dev);
+ #else
+ static inline int pci_dev_specific_acs_enabled(struct pci_dev *dev,
+ u16 acs_flags)
+@@ -621,9 +621,9 @@ static inline int pci_dev_specific_disab
+ {
+ return -ENOTTY;
+ }
+-static inline bool pcie_failed_link_retrain(struct pci_dev *dev)
++static inline int pcie_failed_link_retrain(struct pci_dev *dev)
+ {
+- return false;
++ return -ENOTTY;
+ }
+ #endif
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -78,21 +78,21 @@
+ * again to remove any residual state, ignoring the result as it's supposed
+ * to fail anyway.
+ *
+- * Return TRUE if the link has been successfully retrained. Return FALSE
++ * Return 0 if the link has been successfully retrained. Return an error
+ * if retraining was not needed or we attempted a retrain and it failed.
+ */
+-bool pcie_failed_link_retrain(struct pci_dev *dev)
++int pcie_failed_link_retrain(struct pci_dev *dev)
+ {
+ static const struct pci_device_id ids[] = {
+ { PCI_VDEVICE(ASMEDIA, 0x2824) }, /* ASMedia ASM2824 */
+ {}
+ };
+ u16 lnksta, lnkctl2;
+- bool ret = false;
++ int ret = -ENOTTY;
+
+ if (!pci_is_pcie(dev) || !pcie_downstream_port(dev) ||
+ !pcie_cap_has_lnkctl2(dev) || !dev->link_active_reporting)
+- return false;
++ return ret;
+
+ pcie_capability_read_word(dev, PCI_EXP_LNKCTL2, &lnkctl2);
+ pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta);
+@@ -106,13 +106,13 @@ bool pcie_failed_link_retrain(struct pci
+ lnkctl2 |= PCI_EXP_LNKCTL2_TLS_2_5GT;
+ pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, lnkctl2);
+
+- ret = pcie_retrain_link(dev, false) == 0;
+- if (!ret) {
++ ret = pcie_retrain_link(dev, false);
++ if (ret) {
+ pci_info(dev, "retraining failed\n");
+ pcie_capability_write_word(dev, PCI_EXP_LNKCTL2,
+ oldlnkctl2);
+ pcie_retrain_link(dev, true);
+- return false;
++ return ret;
+ }
+
+ pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta);
+@@ -129,10 +129,10 @@ bool pcie_failed_link_retrain(struct pci
+ lnkctl2 |= lnkcap & PCI_EXP_LNKCAP_SLS;
+ pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, lnkctl2);
+
+- ret = pcie_retrain_link(dev, false) == 0;
+- if (!ret) {
++ ret = pcie_retrain_link(dev, false);
++ if (ret) {
+ pci_info(dev, "retraining failed\n");
+- return false;
++ return ret;
+ }
+ }
+
--- /dev/null
+From 0199d2f2bd8cd97b310f7ed82a067247d7456029 Mon Sep 17 00:00:00 2001
+From: Sean Anderson <sean.anderson@linux.dev>
+Date: Fri, 31 May 2024 12:13:32 -0400
+Subject: PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
+
+From: Sean Anderson <sean.anderson@linux.dev>
+
+commit 0199d2f2bd8cd97b310f7ed82a067247d7456029 upstream.
+
+MSGF_LEG_MASK is laid out with INTA in bit 0, INTB in bit 1, INTC in bit 2,
+and INTD in bit 3. Hardware IRQ numbers start at 0, and we register
+PCI_NUM_INTX IRQs. So to enable INTA (aka hwirq 0) we should set bit 0.
+Remove the subtraction of one.
+
+This bug would cause INTx interrupts not to be delivered, as enabling INTB
+would actually enable INTA, and enabling INTA wouldn't enable anything at
+all. It is likely that this got overlooked for so long since most PCIe
+hardware uses MSIs. This fixes the following UBSAN error:
+
+ UBSAN: shift-out-of-bounds in ../drivers/pci/controller/pcie-xilinx-nwl.c:389:11
+ shift exponent 18446744073709551615 is too large for 32-bit type 'int'
+ CPU: 1 PID: 61 Comm: kworker/u10:1 Not tainted 6.6.20+ #268
+ Hardware name: xlnx,zynqmp (DT)
+ Workqueue: events_unbound deferred_probe_work_func
+ Call trace:
+ dump_backtrace (arch/arm64/kernel/stacktrace.c:235)
+ show_stack (arch/arm64/kernel/stacktrace.c:242)
+ dump_stack_lvl (lib/dump_stack.c:107)
+ dump_stack (lib/dump_stack.c:114)
+ __ubsan_handle_shift_out_of_bounds (lib/ubsan.c:218 lib/ubsan.c:387)
+ nwl_unmask_leg_irq (drivers/pci/controller/pcie-xilinx-nwl.c:389 (discriminator 1))
+ irq_enable (kernel/irq/internals.h:234 kernel/irq/chip.c:170 kernel/irq/chip.c:439 kernel/irq/chip.c:432 kernel/irq/chip.c:345)
+ __irq_startup (kernel/irq/internals.h:239 kernel/irq/chip.c:180 kernel/irq/chip.c:250)
+ irq_startup (kernel/irq/chip.c:270)
+ __setup_irq (kernel/irq/manage.c:1800)
+ request_threaded_irq (kernel/irq/manage.c:2206)
+ pcie_pme_probe (include/linux/interrupt.h:168 drivers/pci/pcie/pme.c:348)
+
+Fixes: 9a181e1093af ("PCI: xilinx-nwl: Modify IRQ chip for legacy interrupts")
+Link: https://lore.kernel.org/r/20240531161337.864994-3-sean.anderson@linux.dev
+Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/pcie-xilinx-nwl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pci/controller/pcie-xilinx-nwl.c
++++ b/drivers/pci/controller/pcie-xilinx-nwl.c
+@@ -371,7 +371,7 @@ static void nwl_mask_intx_irq(struct irq
+ u32 mask;
+ u32 val;
+
+- mask = 1 << (data->hwirq - 1);
++ mask = 1 << data->hwirq;
+ raw_spin_lock_irqsave(&pcie->leg_mask_lock, flags);
+ val = nwl_bridge_readl(pcie, MSGF_LEG_MASK);
+ nwl_bridge_writel(pcie, (val & (~mask)), MSGF_LEG_MASK);
+@@ -385,7 +385,7 @@ static void nwl_unmask_intx_irq(struct i
+ u32 mask;
+ u32 val;
+
+- mask = 1 << (data->hwirq - 1);
++ mask = 1 << data->hwirq;
+ raw_spin_lock_irqsave(&pcie->leg_mask_lock, flags);
+ val = nwl_bridge_readl(pcie, MSGF_LEG_MASK);
+ nwl_bridge_writel(pcie, (val | mask), MSGF_LEG_MASK);
--- /dev/null
+From b722ff8ad66cf9beba971d9eb4bb7b5e6265ae5c Mon Sep 17 00:00:00 2001
+From: Wenjie Cheng <cwjhust@gmail.com>
+Date: Fri, 14 Jun 2024 00:48:41 +0000
+Subject: Revert "f2fs: use flush command instead of FUA for zoned device"
+
+From: Wenjie Cheng <cwjhust@gmail.com>
+
+commit b722ff8ad66cf9beba971d9eb4bb7b5e6265ae5c upstream.
+
+This reverts commit c550e25bca660ed2554cbb48d32b82d0bb98e4b1.
+
+Commit c550e25bca660ed2554cbb48d32b82d0bb98e4b1 ("f2fs: use flush
+command instead of FUA for zoned device") used additional flush
+command to keep write order.
+
+Since Commit dd291d77cc90eb6a86e9860ba8e6e38eebd57d12 ("block:
+Introduce zone write plugging") has enabled the block layer to
+handle this order issue, there is no need to use flush command.
+
+Signed-off-by: Wenjie Cheng <cwjhust@gmail.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/file.c | 3 +--
+ fs/f2fs/node.c | 2 +-
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -376,8 +376,7 @@ sync_nodes:
+ f2fs_remove_ino_entry(sbi, ino, APPEND_INO);
+ clear_inode_flag(inode, FI_APPEND_WRITE);
+ flush_out:
+- if ((!atomic && F2FS_OPTION(sbi).fsync_mode != FSYNC_MODE_NOBARRIER) ||
+- (atomic && !test_opt(sbi, NOBARRIER) && f2fs_sb_has_blkzoned(sbi)))
++ if (!atomic && F2FS_OPTION(sbi).fsync_mode != FSYNC_MODE_NOBARRIER)
+ ret = f2fs_issue_flush(sbi, inode->i_ino);
+ if (!ret) {
+ f2fs_remove_ino_entry(sbi, ino, UPDATE_INO);
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1674,7 +1674,7 @@ static int __write_node_page(struct page
+ goto redirty_out;
+ }
+
+- if (atomic && !test_opt(sbi, NOBARRIER) && !f2fs_sb_has_blkzoned(sbi))
++ if (atomic && !test_opt(sbi, NOBARRIER))
+ fio.op_flags |= REQ_PREFLUSH | REQ_FUA;
+
+ /* should add to global list before clearing PAGECACHE status */
--- /dev/null
+From e25cc4be4616fcf5689622b3226d648aab253cdb Mon Sep 17 00:00:00 2001
+From: Roman Smirnov <r.smirnov@omp.ru>
+Date: Tue, 16 Jul 2024 12:10:40 +0300
+Subject: Revert "media: tuners: fix error return code of hybrid_tuner_request_state()"
+
+From: Roman Smirnov <r.smirnov@omp.ru>
+
+commit e25cc4be4616fcf5689622b3226d648aab253cdb upstream.
+
+This reverts commit b9302fa7ed979e84b454e4ca92192cf485a4ed41.
+
+As Fedor Pchelkin pointed out, this commit violates the
+convention of using the macro return value, which causes errors.
+For example, in functions tda18271_attach(), xc5000_attach(),
+simple_tuner_attach().
+
+Link: https://lore.kernel.org/linux-media/20240424202031.syigrtrtipbq5f2l@fpc/
+Suggested-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Roman Smirnov <r.smirnov@omp.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/tuners/tuner-i2c.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/media/tuners/tuner-i2c.h
++++ b/drivers/media/tuners/tuner-i2c.h
+@@ -133,10 +133,8 @@ static inline int tuner_i2c_xfer_send_re
+ } \
+ if (0 == __ret) { \
+ state = kzalloc(sizeof(type), GFP_KERNEL); \
+- if (!state) { \
+- __ret = -ENOMEM; \
++ if (NULL == state) \
+ goto __fail; \
+- } \
+ state->i2c_props.addr = i2caddr; \
+ state->i2c_props.adap = i2cadap; \
+ state->i2c_props.name = devname; \
--- /dev/null
+From b17155133391d7f6dd18d3fb94a7d492fdec18fa Mon Sep 17 00:00:00 2001
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Date: Mon, 29 Jul 2024 22:52:14 +0300
+Subject: Revert "soc: qcom: smd-rpm: Match rpmsg channel instead of compatible"
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+commit b17155133391d7f6dd18d3fb94a7d492fdec18fa upstream.
+
+The rpm_requests device nodes have the compatible node. As such the
+rpmsg core uses OF modalias instead of a native rpmsg modalias. Thus if
+smd-rpm is built as a module, it doesn't get autoloaded for the device.
+
+Revert the commit bcabe1e09135 ("soc: qcom: smd-rpm: Match rpmsg channel
+instead of compatible")
+
+Fixes: bcabe1e09135 ("soc: qcom: smd-rpm: Match rpmsg channel instead of compatible")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20240729-fix-smd-rpm-v2-1-0776408a94c5@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/smd-rpm.c | 35 ++++++++++++++++++++++++++---------
+ 1 file changed, 26 insertions(+), 9 deletions(-)
+
+--- a/drivers/soc/qcom/smd-rpm.c
++++ b/drivers/soc/qcom/smd-rpm.c
+@@ -196,9 +196,6 @@ static int qcom_smd_rpm_probe(struct rpm
+ {
+ struct qcom_smd_rpm *rpm;
+
+- if (!rpdev->dev.of_node)
+- return -EINVAL;
+-
+ rpm = devm_kzalloc(&rpdev->dev, sizeof(*rpm), GFP_KERNEL);
+ if (!rpm)
+ return -ENOMEM;
+@@ -218,18 +215,38 @@ static void qcom_smd_rpm_remove(struct r
+ of_platform_depopulate(&rpdev->dev);
+ }
+
+-static const struct rpmsg_device_id qcom_smd_rpm_id_table[] = {
+- { .name = "rpm_requests", },
+- { /* sentinel */ }
++static const struct of_device_id qcom_smd_rpm_of_match[] = {
++ { .compatible = "qcom,rpm-apq8084" },
++ { .compatible = "qcom,rpm-ipq6018" },
++ { .compatible = "qcom,rpm-ipq9574" },
++ { .compatible = "qcom,rpm-msm8226" },
++ { .compatible = "qcom,rpm-msm8909" },
++ { .compatible = "qcom,rpm-msm8916" },
++ { .compatible = "qcom,rpm-msm8936" },
++ { .compatible = "qcom,rpm-msm8953" },
++ { .compatible = "qcom,rpm-msm8974" },
++ { .compatible = "qcom,rpm-msm8976" },
++ { .compatible = "qcom,rpm-msm8994" },
++ { .compatible = "qcom,rpm-msm8996" },
++ { .compatible = "qcom,rpm-msm8998" },
++ { .compatible = "qcom,rpm-sdm660" },
++ { .compatible = "qcom,rpm-sm6115" },
++ { .compatible = "qcom,rpm-sm6125" },
++ { .compatible = "qcom,rpm-sm6375" },
++ { .compatible = "qcom,rpm-qcm2290" },
++ { .compatible = "qcom,rpm-qcs404" },
++ {}
+ };
+-MODULE_DEVICE_TABLE(rpmsg, qcom_smd_rpm_id_table);
++MODULE_DEVICE_TABLE(of, qcom_smd_rpm_of_match);
+
+ static struct rpmsg_driver qcom_smd_rpm_driver = {
+ .probe = qcom_smd_rpm_probe,
+ .remove = qcom_smd_rpm_remove,
+ .callback = qcom_smd_rpm_callback,
+- .id_table = qcom_smd_rpm_id_table,
+- .drv.name = "qcom_smd_rpm",
++ .drv = {
++ .name = "qcom_smd_rpm",
++ .of_match_table = qcom_smd_rpm_of_match,
++ },
+ };
+
+ static int __init qcom_smd_rpm_init(void)
io_uring-sqpoll-do-not-put-cpumask-on-stack.patch
selftests-bpf-correctly-move-log-upon-successful-match.patch
remove-.orig-pattern-from-.gitignore.patch
+pci-revert-to-the-original-speed-after-pcie-failed-link-retraining.patch
+pci-clear-the-lbms-bit-after-a-link-retrain.patch
+pci-dra7xx-fix-threaded-irq-request-for-dra7xx-pcie-main-irq.patch
+pci-imx6-fix-missing-call-to-phy_power_off-in-error-handling.patch
+pci-imx6-fix-establish-link-failure-in-ep-mode-for-i.mx8mm-and-i.mx8mp.patch
+pci-imx6-fix-i.mx8mp-pcie-ep-s-occasional-failure-to-trigger-msi.patch
+pci-correct-error-reporting-with-pcie-failed-link-retraining.patch
+pci-use-an-error-code-with-pcie-failed-link-retraining.patch
+pci-xilinx-nwl-fix-off-by-one-in-intx-irq-handler.patch
+pci-dra7xx-fix-error-handling-when-irq-request-fails-in-probe.patch
+revert-soc-qcom-smd-rpm-match-rpmsg-channel-instead-of-compatible.patch
+asoc-rt5682-return-devm_of_clk_add_hw_provider-to-transfer-the-error.patch
+soc-fsl-cpm1-qmc-update-trnsync-only-in-transparent-mode.patch
+soc-fsl-cpm1-tsa-fix-tsa_write8.patch
+soc-versatile-integrator-fix-of-node-leak-in-probe-error-path.patch
+revert-f2fs-use-flush-command-instead-of-fua-for-zoned-device.patch
+revert-media-tuners-fix-error-return-code-of-hybrid_tuner_request_state.patch
+iommu-amd-fix-argument-order-in-amd_iommu_dev_flush_pasid_all.patch
+iommufd-protect-against-overflow-of-align-during-iova-allocation.patch
+input-adp5588-keys-fix-check-on-return-code.patch
+input-i8042-add-tuxedo-stellaris-16-gen5-amd-to-i8042-quirk-table.patch
+input-i8042-add-tuxedo-stellaris-15-slim-gen6-amd-to-i8042-quirk-table.patch
+input-i8042-add-another-board-name-for-tuxedo-stellaris-gen5-amd-line.patch
+kvm-arm64-add-memory-length-checks-and-remove-inline-in-do_ffa_mem_xfer.patch
+kvm-x86-enforce-x2apic-s-must-be-zero-reserved-icr-bits.patch
+kvm-x86-move-x2apic-icr-helper-above-kvm_apic_write_nodecode.patch
+kvm-x86-re-split-x2apic-icr-into-icr-icr2-for-amd-x2avic.patch
+kvm-use-dedicated-mutex-to-protect-kvm_usage_count-to-avoid-deadlock.patch
+drm-amd-display-skip-recompute-dsc-params-if-no-stream-on-link.patch
+drm-amdgpu-mes12-reduce-timeout.patch
+drm-amdgpu-mes11-reduce-timeout.patch
+drm-amdkfd-add-sdma-queue-quantum-support-for-gfx12.patch
+drm-amdgpu-update-golden-regs-for-gfx12.patch
+drm-amdgpu-mes12-set-enable_level_process_quantum_check.patch
+drm-amdgpu-vcn-enable-av1-on-both-instances.patch
+drm-amd-pm-update-workload-mask-after-the-setting.patch
+drm-amdgpu-fix-pte-copy-corruption-for-sdma-7.patch
+drm-amdgpu-bump-driver-version-for-cleared-vram.patch
+drm-amdgpu-mes12-switch-set_shader_debugger-pkt-to-mes-schq-pipe.patch
+drm-amdgpu-fix-selfring-initialization-sequence-on-soc24.patch
+drm-amd-display-add-hdmi-dsc-native-ycbcr422-support.patch
--- /dev/null
+From c3cc3e69b33fee3d276895e0e2d1a8fb37ea5d0e Mon Sep 17 00:00:00 2001
+From: Herve Codina <herve.codina@bootlin.com>
+Date: Thu, 8 Aug 2024 09:10:54 +0200
+Subject: soc: fsl: cpm1: qmc: Update TRNSYNC only in transparent mode
+
+From: Herve Codina <herve.codina@bootlin.com>
+
+commit c3cc3e69b33fee3d276895e0e2d1a8fb37ea5d0e upstream.
+
+The TRNSYNC feature is available (and enabled) only in transparent mode.
+
+Since commit 7cc9bda9c163 ("soc: fsl: cpm1: qmc: Handle timeslot entries
+at channel start() and stop()") TRNSYNC register is updated in
+transparent and hdlc mode. In hdlc mode, the address of the TRNSYNC
+register is used by the QMC for other internal purpose. Even if no weird
+results were observed in hdlc mode, touching this register in this mode
+is wrong.
+
+Update TRNSYNC only in transparent mode.
+
+Fixes: 7cc9bda9c163 ("soc: fsl: cpm1: qmc: Handle timeslot entries at channel start() and stop()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Herve Codina <herve.codina@bootlin.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Link: https://lore.kernel.org/r/20240808071132.149251-2-herve.codina@bootlin.com
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/fsl/qe/qmc.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+--- a/drivers/soc/fsl/qe/qmc.c
++++ b/drivers/soc/fsl/qe/qmc.c
+@@ -940,11 +940,13 @@ static int qmc_chan_start_rx(struct qmc_
+ goto end;
+ }
+
+- ret = qmc_setup_chan_trnsync(chan->qmc, chan);
+- if (ret) {
+- dev_err(chan->qmc->dev, "chan %u: setup TRNSYNC failed (%d)\n",
+- chan->id, ret);
+- goto end;
++ if (chan->mode == QMC_TRANSPARENT) {
++ ret = qmc_setup_chan_trnsync(chan->qmc, chan);
++ if (ret) {
++ dev_err(chan->qmc->dev, "chan %u: setup TRNSYNC failed (%d)\n",
++ chan->id, ret);
++ goto end;
++ }
+ }
+
+ /* Restart the receiver */
+@@ -982,11 +984,13 @@ static int qmc_chan_start_tx(struct qmc_
+ goto end;
+ }
+
+- ret = qmc_setup_chan_trnsync(chan->qmc, chan);
+- if (ret) {
+- dev_err(chan->qmc->dev, "chan %u: setup TRNSYNC failed (%d)\n",
+- chan->id, ret);
+- goto end;
++ if (chan->mode == QMC_TRANSPARENT) {
++ ret = qmc_setup_chan_trnsync(chan->qmc, chan);
++ if (ret) {
++ dev_err(chan->qmc->dev, "chan %u: setup TRNSYNC failed (%d)\n",
++ chan->id, ret);
++ goto end;
++ }
+ }
+
+ /*
--- /dev/null
+From 47a347bae9a491b467ab3543e4725a3e4fbe30f5 Mon Sep 17 00:00:00 2001
+From: Herve Codina <herve.codina@bootlin.com>
+Date: Thu, 8 Aug 2024 09:10:56 +0200
+Subject: soc: fsl: cpm1: tsa: Fix tsa_write8()
+
+From: Herve Codina <herve.codina@bootlin.com>
+
+commit 47a347bae9a491b467ab3543e4725a3e4fbe30f5 upstream.
+
+The tsa_write8() parameter is an u32 value. This is not consistent with
+the function itself. Indeed, tsa_write8() writes an 8bits value.
+
+Be consistent and use an u8 parameter value.
+
+Fixes: 1d4ba0b81c1c ("soc: fsl: cpm1: Add support for TSA")
+Cc: stable@vger.kernel.org
+Signed-off-by: Herve Codina <herve.codina@bootlin.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Link: https://lore.kernel.org/r/20240808071132.149251-4-herve.codina@bootlin.com
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/fsl/qe/tsa.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/soc/fsl/qe/tsa.c
++++ b/drivers/soc/fsl/qe/tsa.c
+@@ -140,7 +140,7 @@ static inline void tsa_write32(void __io
+ iowrite32be(val, addr);
+ }
+
+-static inline void tsa_write8(void __iomem *addr, u32 val)
++static inline void tsa_write8(void __iomem *addr, u8 val)
+ {
+ iowrite8(val, addr);
+ }
--- /dev/null
+From 874c5b601856adbfda10846b9770a6c66c41e229 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Sun, 25 Aug 2024 20:05:22 +0200
+Subject: soc: versatile: integrator: fix OF node leak in probe() error path
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 874c5b601856adbfda10846b9770a6c66c41e229 upstream.
+
+Driver is leaking OF node reference obtained from
+of_find_matching_node().
+
+Fixes: f956a785a282 ("soc: move SoC driver for the ARM Integrator")
+Cc: stable@vger.kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/20240825-soc-dev-fixes-v1-1-ff4b35abed83@linaro.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/versatile/soc-integrator.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/soc/versatile/soc-integrator.c
++++ b/drivers/soc/versatile/soc-integrator.c
+@@ -113,6 +113,7 @@ static int __init integrator_soc_init(vo
+ return -ENODEV;
+
+ syscon_regmap = syscon_node_to_regmap(np);
++ of_node_put(np);
+ if (IS_ERR(syscon_regmap))
+ return PTR_ERR(syscon_regmap);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
