From: Greg Kroah-Hartman Date: Tue, 1 Oct 2024 09:53:18 +0000 (+0200) Subject: 6.11-stable patches X-Git-Tag: v6.6.54~94 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=aa30b87c56168fd944bd0e3d26adb5b571b1e97a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.11-stable patches added patches: asoc-rt5682-return-devm_of_clk_add_hw_provider-to-transfer-the-error.patch drm-amd-display-add-hdmi-dsc-native-ycbcr422-support.patch drm-amd-display-skip-recompute-dsc-params-if-no-stream-on-link.patch drm-amd-pm-update-workload-mask-after-the-setting.patch drm-amdgpu-bump-driver-version-for-cleared-vram.patch drm-amdgpu-fix-pte-copy-corruption-for-sdma-7.patch drm-amdgpu-fix-selfring-initialization-sequence-on-soc24.patch drm-amdgpu-mes11-reduce-timeout.patch drm-amdgpu-mes12-reduce-timeout.patch drm-amdgpu-mes12-set-enable_level_process_quantum_check.patch drm-amdgpu-mes12-switch-set_shader_debugger-pkt-to-mes-schq-pipe.patch drm-amdgpu-update-golden-regs-for-gfx12.patch drm-amdgpu-vcn-enable-av1-on-both-instances.patch drm-amdkfd-add-sdma-queue-quantum-support-for-gfx12.patch input-adp5588-keys-fix-check-on-return-code.patch input-i8042-add-another-board-name-for-tuxedo-stellaris-gen5-amd-line.patch input-i8042-add-tuxedo-stellaris-15-slim-gen6-amd-to-i8042-quirk-table.patch input-i8042-add-tuxedo-stellaris-16-gen5-amd-to-i8042-quirk-table.patch iommu-amd-fix-argument-order-in-amd_iommu_dev_flush_pasid_all.patch iommufd-protect-against-overflow-of-align-during-iova-allocation.patch kvm-arm64-add-memory-length-checks-and-remove-inline-in-do_ffa_mem_xfer.patch kvm-use-dedicated-mutex-to-protect-kvm_usage_count-to-avoid-deadlock.patch kvm-x86-enforce-x2apic-s-must-be-zero-reserved-icr-bits.patch kvm-x86-move-x2apic-icr-helper-above-kvm_apic_write_nodecode.patch kvm-x86-re-split-x2apic-icr-into-icr-icr2-for-amd-x2avic.patch pci-clear-the-lbms-bit-after-a-link-retrain.patch pci-correct-error-reporting-with-pcie-failed-link-retraining.patch pci-dra7xx-fix-error-handling-when-irq-request-fails-in-probe.patch pci-dra7xx-fix-threaded-irq-request-for-dra7xx-pcie-main-irq.patch pci-imx6-fix-establish-link-failure-in-ep-mode-for-i.mx8mm-and-i.mx8mp.patch pci-imx6-fix-i.mx8mp-pcie-ep-s-occasional-failure-to-trigger-msi.patch pci-imx6-fix-missing-call-to-phy_power_off-in-error-handling.patch pci-revert-to-the-original-speed-after-pcie-failed-link-retraining.patch pci-use-an-error-code-with-pcie-failed-link-retraining.patch pci-xilinx-nwl-fix-off-by-one-in-intx-irq-handler.patch revert-f2fs-use-flush-command-instead-of-fua-for-zoned-device.patch revert-media-tuners-fix-error-return-code-of-hybrid_tuner_request_state.patch revert-soc-qcom-smd-rpm-match-rpmsg-channel-instead-of-compatible.patch soc-fsl-cpm1-qmc-update-trnsync-only-in-transparent-mode.patch soc-fsl-cpm1-tsa-fix-tsa_write8.patch soc-versatile-integrator-fix-of-node-leak-in-probe-error-path.patch --- diff --git a/queue-6.11/asoc-rt5682-return-devm_of_clk_add_hw_provider-to-transfer-the-error.patch b/queue-6.11/asoc-rt5682-return-devm_of_clk_add_hw_provider-to-transfer-the-error.patch new file mode 100644 index 00000000000..0672fc6cb2d --- /dev/null +++ b/queue-6.11/asoc-rt5682-return-devm_of_clk_add_hw_provider-to-transfer-the-error.patch @@ -0,0 +1,37 @@ +From fcca6d05ef49d5650514ea1dcfd12e4ae3ff2be6 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Fri, 30 Aug 2024 22:31:54 +0800 +Subject: ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error + +From: Ma Ke + +commit fcca6d05ef49d5650514ea1dcfd12e4ae3ff2be6 upstream. + +Return devm_of_clk_add_hw_provider() in order to transfer the error, if it +fails due to resource allocation failure or device tree clock provider +registration failure. + +Cc: stable@vger.kernel.org +Fixes: ebbfabc16d23 ("ASoC: rt5682: Add CCF usage for providing I2S clks") +Signed-off-by: Ma Ke +Link: https://patch.msgid.link/20240830143154.3448004-1-make24@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/rt5682.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/soc/codecs/rt5682.c ++++ b/sound/soc/codecs/rt5682.c +@@ -2903,8 +2903,10 @@ int rt5682_register_dai_clks(struct rt56 + } + + if (dev->of_node) { +- devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, ++ ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, + dai_clk_hw); ++ if (ret) ++ return ret; + } else { + ret = devm_clk_hw_register_clkdev(dev, dai_clk_hw, + init.name, diff --git a/queue-6.11/drm-amd-display-add-hdmi-dsc-native-ycbcr422-support.patch b/queue-6.11/drm-amd-display-add-hdmi-dsc-native-ycbcr422-support.patch new file mode 100644 index 00000000000..1ff6f0cabe0 --- /dev/null +++ b/queue-6.11/drm-amd-display-add-hdmi-dsc-native-ycbcr422-support.patch @@ -0,0 +1,82 @@ +From 07bfa9cdbf3cd2daadfaaba0601f126f45951ffa Mon Sep 17 00:00:00 2001 +From: Leo Ma +Date: Mon, 19 Aug 2024 13:25:27 -0400 +Subject: drm/amd/display: Add HDMI DSC native YCbCr422 support + +From: Leo Ma + +commit 07bfa9cdbf3cd2daadfaaba0601f126f45951ffa upstream. + +[WHY && HOW] +For some HDMI OVT timing, YCbCr422 encoding fails at the DSC +bandwidth check. The root cause is our DSC policy for timing +doesn't account for HDMI YCbCr422 native support. + +Cc: Mario Limonciello +Cc: Alex Deucher +Cc: stable@vger.kernel.org +Reviewed-by: Chris Park +Signed-off-by: Leo Ma +Signed-off-by: Alex Hung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 4 ++-- + drivers/gpu/drm/amd/display/dc/dc_dsc.h | 3 ++- + drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c | 5 +++-- + 3 files changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -1147,7 +1147,7 @@ static int compute_mst_dsc_configs_for_l + params[count].num_slices_v = aconnector->dsc_settings.dsc_num_slices_v; + params[count].bpp_overwrite = aconnector->dsc_settings.dsc_bits_per_pixel; + params[count].compression_possible = stream->sink->dsc_caps.dsc_dec_caps.is_dsc_supported; +- dc_dsc_get_policy_for_timing(params[count].timing, 0, &dsc_policy); ++ dc_dsc_get_policy_for_timing(params[count].timing, 0, &dsc_policy, dc_link_get_highest_encoding_format(stream->link)); + if (!dc_dsc_compute_bandwidth_range( + stream->sink->ctx->dc->res_pool->dscs[0], + stream->sink->ctx->dc->debug.dsc_min_slice_height_override, +@@ -1684,7 +1684,7 @@ static bool is_dsc_common_config_possibl + { + struct dc_dsc_policy dsc_policy = {0}; + +- dc_dsc_get_policy_for_timing(&stream->timing, 0, &dsc_policy); ++ dc_dsc_get_policy_for_timing(&stream->timing, 0, &dsc_policy, dc_link_get_highest_encoding_format(stream->link)); + dc_dsc_compute_bandwidth_range(stream->sink->ctx->dc->res_pool->dscs[0], + stream->sink->ctx->dc->debug.dsc_min_slice_height_override, + dsc_policy.min_target_bpp * 16, +--- a/drivers/gpu/drm/amd/display/dc/dc_dsc.h ++++ b/drivers/gpu/drm/amd/display/dc/dc_dsc.h +@@ -100,7 +100,8 @@ uint32_t dc_dsc_stream_bandwidth_overhea + */ + void dc_dsc_get_policy_for_timing(const struct dc_crtc_timing *timing, + uint32_t max_target_bpp_limit_override_x16, +- struct dc_dsc_policy *policy); ++ struct dc_dsc_policy *policy, ++ const enum dc_link_encoding_format link_encoding); + + void dc_dsc_policy_set_max_target_bpp_limit(uint32_t limit); + +--- a/drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c ++++ b/drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c +@@ -882,7 +882,7 @@ static bool setup_dsc_config( + + memset(dsc_cfg, 0, sizeof(struct dc_dsc_config)); + +- dc_dsc_get_policy_for_timing(timing, options->max_target_bpp_limit_override_x16, &policy); ++ dc_dsc_get_policy_for_timing(timing, options->max_target_bpp_limit_override_x16, &policy, link_encoding); + pic_width = timing->h_addressable + timing->h_border_left + timing->h_border_right; + pic_height = timing->v_addressable + timing->v_border_top + timing->v_border_bottom; + +@@ -1171,7 +1171,8 @@ uint32_t dc_dsc_stream_bandwidth_overhea + + void dc_dsc_get_policy_for_timing(const struct dc_crtc_timing *timing, + uint32_t max_target_bpp_limit_override_x16, +- struct dc_dsc_policy *policy) ++ struct dc_dsc_policy *policy, ++ const enum dc_link_encoding_format link_encoding) + { + uint32_t bpc = 0; + diff --git a/queue-6.11/drm-amd-display-skip-recompute-dsc-params-if-no-stream-on-link.patch b/queue-6.11/drm-amd-display-skip-recompute-dsc-params-if-no-stream-on-link.patch new file mode 100644 index 00000000000..53763b1e32b --- /dev/null +++ b/queue-6.11/drm-amd-display-skip-recompute-dsc-params-if-no-stream-on-link.patch @@ -0,0 +1,74 @@ +From 8151a6c13111b465dbabe07c19f572f7cbd16fef Mon Sep 17 00:00:00 2001 +From: Fangzhi Zuo +Date: Fri, 12 Jul 2024 16:30:03 -0400 +Subject: drm/amd/display: Skip Recompute DSC Params if no Stream on Link + +From: Fangzhi Zuo + +commit 8151a6c13111b465dbabe07c19f572f7cbd16fef upstream. + +[why] +Encounter NULL pointer dereference uner mst + dsc setup. + +BUG: kernel NULL pointer dereference, address: 0000000000000008 + PGD 0 P4D 0 + Oops: 0000 [#1] PREEMPT SMP NOPTI + CPU: 4 PID: 917 Comm: sway Not tainted 6.3.9-arch1-1 #1 124dc55df4f5272ccb409f39ef4872fc2b3376a2 + Hardware name: LENOVO 20NKS01Y00/20NKS01Y00, BIOS R12ET61W(1.31 ) 07/28/2022 + RIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper] + Code: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 <48> 8> + RSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293 + RAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224 + RDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280 + RBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850 + R10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000 + R13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224 + FS: 00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000008 CR3: 000000010ddc6000 CR4: 00000000003506e0 + Call Trace: + + ? __die+0x23/0x70 + ? page_fault_oops+0x171/0x4e0 + ? plist_add+0xbe/0x100 + ? exc_page_fault+0x7c/0x180 + ? asm_exc_page_fault+0x26/0x30 + ? drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026] + ? drm_dp_atomic_find_time_slots+0x28/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026] + compute_mst_dsc_configs_for_link+0x2ff/0xa40 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054] + ? fill_plane_buffer_attributes+0x419/0x510 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054] + compute_mst_dsc_configs_for_state+0x1e1/0x250 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054] + amdgpu_dm_atomic_check+0xecd/0x1190 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054] + drm_atomic_check_only+0x5c5/0xa40 + drm_mode_atomic_ioctl+0x76e/0xbc0 + +[how] +dsc recompute should be skipped if no mode change detected on the new +request. If detected, keep checking whether the stream is already on +current state or not. + +Cc: Mario Limonciello +Cc: Alex Deucher +Cc: stable@vger.kernel.org +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Fangzhi Zuo +Signed-off-by: Wayne Lin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -1344,6 +1344,9 @@ static bool is_dsc_need_re_compute( + DRM_DEBUG_DRIVER("%s: MST_DSC check on %d streams in current dc_state\n", + __func__, dc->current_state->stream_count); + ++ if (new_stream_on_link_num == 0) ++ return false; ++ + /* check current_state if there stream on link but it is not in + * new request state + */ diff --git a/queue-6.11/drm-amd-pm-update-workload-mask-after-the-setting.patch b/queue-6.11/drm-amd-pm-update-workload-mask-after-the-setting.patch new file mode 100644 index 00000000000..75f09b7a2ed --- /dev/null +++ b/queue-6.11/drm-amd-pm-update-workload-mask-after-the-setting.patch @@ -0,0 +1,73 @@ +From d7d2688bf4ea58734d73e18edcbf4684b1496d30 Mon Sep 17 00:00:00 2001 +From: Kenneth Feng +Date: Fri, 20 Sep 2024 19:05:37 +0800 +Subject: drm/amd/pm: update workload mask after the setting + +From: Kenneth Feng + +commit d7d2688bf4ea58734d73e18edcbf4684b1496d30 upstream. + +update workload mask after the setting. + +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3625 +Signed-off-by: Kenneth Feng +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 6 +++++- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 3 +++ + drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 6 +++++- + 3 files changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +@@ -2569,10 +2569,14 @@ static int smu_v13_0_0_set_power_profile + } + } + +- return smu_cmn_send_smc_msg_with_param(smu, ++ ret = smu_cmn_send_smc_msg_with_param(smu, + SMU_MSG_SetWorkloadMask, + workload_mask, + NULL); ++ if (!ret) ++ smu->workload_mask = workload_mask; ++ ++ return ret; + } + + static bool smu_v13_0_0_is_mode1_reset_supported(struct smu_context *smu) +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +@@ -2501,8 +2501,11 @@ static int smu_v13_0_7_set_power_profile + return -EINVAL; + ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_SetWorkloadMask, + 1 << workload_type, NULL); ++ + if (ret) + dev_err(smu->adev->dev, "[%s] Failed to set work load mask!", __func__); ++ else ++ smu->workload_mask = (1 << workload_type); + + return ret; + } +--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +@@ -1570,10 +1570,14 @@ static int smu_v14_0_2_set_power_profile + if (workload_type < 0) + return -EINVAL; + +- return smu_cmn_send_smc_msg_with_param(smu, ++ ret = smu_cmn_send_smc_msg_with_param(smu, + SMU_MSG_SetWorkloadMask, + 1 << workload_type, + NULL); ++ if (!ret) ++ smu->workload_mask = 1 << workload_type; ++ ++ return ret; + } + + static int smu_v14_0_2_baco_enter(struct smu_context *smu) diff --git a/queue-6.11/drm-amdgpu-bump-driver-version-for-cleared-vram.patch b/queue-6.11/drm-amdgpu-bump-driver-version-for-cleared-vram.patch new file mode 100644 index 00000000000..7013f31ee93 --- /dev/null +++ b/queue-6.11/drm-amdgpu-bump-driver-version-for-cleared-vram.patch @@ -0,0 +1,44 @@ +From 34ad56a467c320d07db22146cfb99ee01704a5de Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 6 Sep 2024 13:51:06 -0400 +Subject: drm/amdgpu: bump driver version for cleared VRAM +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 34ad56a467c320d07db22146cfb99ee01704a5de upstream. + +Driver now clears VRAM on allocation. Bump the +driver version so mesa knows when it will get +cleared vram by default. + +Reviewed-by: Marek Olšák +Reviewed-by: Rajneesh Bhardwaj +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.11.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index 86cff30d5c4e..db0763ffeff7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -117,9 +117,10 @@ + * - 3.56.0 - Update IB start address and size alignment for decode and encode + * - 3.57.0 - Compute tunneling on GFX10+ + * - 3.58.0 - Add GFX12 DCC support ++ * - 3.59.0 - Cleared VRAM + */ + #define KMS_DRIVER_MAJOR 3 +-#define KMS_DRIVER_MINOR 58 ++#define KMS_DRIVER_MINOR 59 + #define KMS_DRIVER_PATCHLEVEL 0 + + /* +-- +2.46.2 + diff --git a/queue-6.11/drm-amdgpu-fix-pte-copy-corruption-for-sdma-7.patch b/queue-6.11/drm-amdgpu-fix-pte-copy-corruption-for-sdma-7.patch new file mode 100644 index 00000000000..a405061afec --- /dev/null +++ b/queue-6.11/drm-amdgpu-fix-pte-copy-corruption-for-sdma-7.patch @@ -0,0 +1,55 @@ +From 3cb576bc6dfb8940228b8130638860b631dd428a Mon Sep 17 00:00:00 2001 +From: Frank Min +Date: Wed, 25 Sep 2024 11:39:06 +0800 +Subject: drm/amdgpu: fix PTE copy corruption for sdma 7 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frank Min + +commit 3cb576bc6dfb8940228b8130638860b631dd428a upstream. + +Without setting dcc bit, there is ramdon PTE copy corruption on sdma 7. + +so add this bit and update the packet format accordingly. + +Acked-by: Alex Deucher +Signed-off-by: Frank Min +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.11.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c +@@ -1022,13 +1022,16 @@ static void sdma_v7_0_vm_copy_pte(struct + unsigned bytes = count * 8; + + ib->ptr[ib->length_dw++] = SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_COPY) | +- SDMA_PKT_COPY_LINEAR_HEADER_SUB_OP(SDMA_SUBOP_COPY_LINEAR); ++ SDMA_PKT_COPY_LINEAR_HEADER_SUB_OP(SDMA_SUBOP_COPY_LINEAR) | ++ SDMA_PKT_COPY_LINEAR_HEADER_CPV(1); ++ + ib->ptr[ib->length_dw++] = bytes - 1; + ib->ptr[ib->length_dw++] = 0; /* src/dst endian swap */ + ib->ptr[ib->length_dw++] = lower_32_bits(src); + ib->ptr[ib->length_dw++] = upper_32_bits(src); + ib->ptr[ib->length_dw++] = lower_32_bits(pe); + ib->ptr[ib->length_dw++] = upper_32_bits(pe); ++ ib->ptr[ib->length_dw++] = 0; + + } + +@@ -1631,7 +1634,7 @@ static void sdma_v7_0_set_buffer_funcs(s + } + + static const struct amdgpu_vm_pte_funcs sdma_v7_0_vm_pte_funcs = { +- .copy_pte_num_dw = 7, ++ .copy_pte_num_dw = 8, + .copy_pte = sdma_v7_0_vm_copy_pte, + .write_pte = sdma_v7_0_vm_write_pte, + .set_pte_pde = sdma_v7_0_vm_set_pte_pde, diff --git a/queue-6.11/drm-amdgpu-fix-selfring-initialization-sequence-on-soc24.patch b/queue-6.11/drm-amdgpu-fix-selfring-initialization-sequence-on-soc24.patch new file mode 100644 index 00000000000..c771ab36aac --- /dev/null +++ b/queue-6.11/drm-amdgpu-fix-selfring-initialization-sequence-on-soc24.patch @@ -0,0 +1,83 @@ +From 03b5038c0ad069380fab7e251d2bf3f1540d20f4 Mon Sep 17 00:00:00 2001 +From: David Belanger +Date: Wed, 11 Sep 2024 11:16:50 -0400 +Subject: drm/amdgpu: Fix selfring initialization sequence on soc24 + +From: David Belanger + +commit 03b5038c0ad069380fab7e251d2bf3f1540d20f4 upstream. + +Move enable_doorbell_selfring_aperture from common_hw_init +to common_late_init in soc24, otherwise selfring aperture is +initialized with an incorrect doorbell aperture base. + +Port changes from this commit from soc21 to soc24: +commit 1c312e816c40 ("drm/amdgpu: Enable doorbell selfring after resize FB BAR") + +Signed-off-by: David Belanger +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.11.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/soc24.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc24.c b/drivers/gpu/drm/amd/amdgpu/soc24.c +index b0c3678cfb31..fd4c3d4f8387 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc24.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc24.c +@@ -250,13 +250,6 @@ static void soc24_program_aspm(struct amdgpu_device *adev) + adev->nbio.funcs->program_aspm(adev); + } + +-static void soc24_enable_doorbell_aperture(struct amdgpu_device *adev, +- bool enable) +-{ +- adev->nbio.funcs->enable_doorbell_aperture(adev, enable); +- adev->nbio.funcs->enable_doorbell_selfring_aperture(adev, enable); +-} +- + const struct amdgpu_ip_block_version soc24_common_ip_block = { + .type = AMD_IP_BLOCK_TYPE_COMMON, + .major = 1, +@@ -454,6 +447,11 @@ static int soc24_common_late_init(void *handle) + if (amdgpu_sriov_vf(adev)) + xgpu_nv_mailbox_get_irq(adev); + ++ /* Enable selfring doorbell aperture late because doorbell BAR ++ * aperture will change if resize BAR successfully in gmc sw_init. ++ */ ++ adev->nbio.funcs->enable_doorbell_selfring_aperture(adev, true); ++ + return 0; + } + +@@ -491,7 +489,7 @@ static int soc24_common_hw_init(void *handle) + adev->df.funcs->hw_init(adev); + + /* enable the doorbell aperture */ +- soc24_enable_doorbell_aperture(adev, true); ++ adev->nbio.funcs->enable_doorbell_aperture(adev, true); + + return 0; + } +@@ -500,8 +498,13 @@ static int soc24_common_hw_fini(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + +- /* disable the doorbell aperture */ +- soc24_enable_doorbell_aperture(adev, false); ++ /* Disable the doorbell aperture and selfring doorbell aperture ++ * separately in hw_fini because soc21_enable_doorbell_aperture ++ * has been removed and there is no need to delay disabling ++ * selfring doorbell. ++ */ ++ adev->nbio.funcs->enable_doorbell_aperture(adev, false); ++ adev->nbio.funcs->enable_doorbell_selfring_aperture(adev, false); + + if (amdgpu_sriov_vf(adev)) + xgpu_nv_mailbox_put_irq(adev); +-- +2.46.2 + diff --git a/queue-6.11/drm-amdgpu-mes11-reduce-timeout.patch b/queue-6.11/drm-amdgpu-mes11-reduce-timeout.patch new file mode 100644 index 00000000000..2863e71504b --- /dev/null +++ b/queue-6.11/drm-amdgpu-mes11-reduce-timeout.patch @@ -0,0 +1,36 @@ +From 856265caa94a3c78feaa23ec1acd799fe1989201 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 16 Sep 2024 10:52:24 -0400 +Subject: drm/amdgpu/mes11: reduce timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 856265caa94a3c78feaa23ec1acd799fe1989201 upstream. + +The firmware timeout is 2s. Reduce the driver timeout to +2.1 seconds to avoid back pressure on queue submissions. + +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3627 +Fixes: f7c161a4c250 ("drm/amdgpu: increase mes submission timeout") +Acked-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c +@@ -160,7 +160,7 @@ static int mes_v11_0_submit_pkt_and_poll + int api_status_off) + { + union MESAPI__QUERY_MES_STATUS mes_status_pkt; +- signed long timeout = 3000000; /* 3000 ms */ ++ signed long timeout = 2100000; /* 2100 ms */ + struct amdgpu_device *adev = mes->adev; + struct amdgpu_ring *ring = &mes->ring[0]; + struct MES_API_STATUS *api_status; diff --git a/queue-6.11/drm-amdgpu-mes12-reduce-timeout.patch b/queue-6.11/drm-amdgpu-mes12-reduce-timeout.patch new file mode 100644 index 00000000000..9fe7c2a4813 --- /dev/null +++ b/queue-6.11/drm-amdgpu-mes12-reduce-timeout.patch @@ -0,0 +1,40 @@ +From 84f76408abe989809de19d02e476b044fd985adc Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 18 Sep 2024 09:37:31 -0400 +Subject: drm/amdgpu/mes12: reduce timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 84f76408abe989809de19d02e476b044fd985adc upstream. + +The firmware timeout is 2s. Reduce the driver timeout to +2.1 seconds to avoid back pressure on queue submissions. + +Fixes: 94b51a3d01ed ("drm/amdgpu/mes12: increase mes submission timeout") +Acked-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.11.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c +index ef05a4116230..186f77813397 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c +@@ -146,7 +146,7 @@ static int mes_v12_0_submit_pkt_and_poll_completion(struct amdgpu_mes *mes, + int api_status_off) + { + union MESAPI__QUERY_MES_STATUS mes_status_pkt; +- signed long timeout = 3000000; /* 3000 ms */ ++ signed long timeout = 2100000; /* 2100 ms */ + struct amdgpu_device *adev = mes->adev; + struct amdgpu_ring *ring = &mes->ring[pipe]; + spinlock_t *ring_lock = &mes->ring_lock[pipe]; +-- +2.46.2 + diff --git a/queue-6.11/drm-amdgpu-mes12-set-enable_level_process_quantum_check.patch b/queue-6.11/drm-amdgpu-mes12-set-enable_level_process_quantum_check.patch new file mode 100644 index 00000000000..5118d6c378d --- /dev/null +++ b/queue-6.11/drm-amdgpu-mes12-set-enable_level_process_quantum_check.patch @@ -0,0 +1,31 @@ +From 4771d2ecb7b9e4c2c73ede2908d7e7c989460981 Mon Sep 17 00:00:00 2001 +From: Jack Xiao +Date: Wed, 18 Sep 2024 17:07:13 +0800 +Subject: drm/amdgpu/mes12: set enable_level_process_quantum_check + +From: Jack Xiao + +commit 4771d2ecb7b9e4c2c73ede2908d7e7c989460981 upstream. + +enable_level_process_quantum_check is requried to enable process +quantum based scheduling. + +Signed-off-by: Jack Xiao +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.11.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c +@@ -582,6 +582,7 @@ static int mes_v12_0_set_hw_resources(st + mes_set_hw_res_pkt.disable_mes_log = 1; + mes_set_hw_res_pkt.use_different_vmid_compute = 1; + mes_set_hw_res_pkt.enable_reg_active_poll = 1; ++ mes_set_hw_res_pkt.enable_level_process_quantum_check = 1; + + /* + * Keep oversubscribe timer for sdma . When we have unmapped doorbell diff --git a/queue-6.11/drm-amdgpu-mes12-switch-set_shader_debugger-pkt-to-mes-schq-pipe.patch b/queue-6.11/drm-amdgpu-mes12-switch-set_shader_debugger-pkt-to-mes-schq-pipe.patch new file mode 100644 index 00000000000..ae4fd534299 --- /dev/null +++ b/queue-6.11/drm-amdgpu-mes12-switch-set_shader_debugger-pkt-to-mes-schq-pipe.patch @@ -0,0 +1,55 @@ +From 3c75518cf27aa5a7e22e1f8f33339ded3779079b Mon Sep 17 00:00:00 2001 +From: Jack Xiao +Date: Wed, 11 Sep 2024 16:24:35 +0800 +Subject: drm/amdgpu/mes12: switch SET_SHADER_DEBUGGER pkt to mes schq pipe + +From: Jack Xiao + +commit 3c75518cf27aa5a7e22e1f8f33339ded3779079b upstream. + +The SET_SHADER_DEBUGGER packet must work with the added +hardware queue, switch the packet submitting to mes schq pipe. + +Signed-off-by: Jack Xiao +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.11.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c +@@ -453,6 +453,11 @@ static int mes_v12_0_misc_op(struct amdg + union MESAPI__MISC misc_pkt; + int pipe; + ++ if (mes->adev->enable_uni_mes) ++ pipe = AMDGPU_MES_KIQ_PIPE; ++ else ++ pipe = AMDGPU_MES_SCHED_PIPE; ++ + memset(&misc_pkt, 0, sizeof(misc_pkt)); + + misc_pkt.header.type = MES_API_TYPE_SCHEDULER; +@@ -487,6 +492,7 @@ static int mes_v12_0_misc_op(struct amdg + misc_pkt.wait_reg_mem.reg_offset2 = input->wrm_reg.reg1; + break; + case MES_MISC_OP_SET_SHADER_DEBUGGER: ++ pipe = AMDGPU_MES_SCHED_PIPE; + misc_pkt.opcode = MESAPI_MISC__SET_SHADER_DEBUGGER; + misc_pkt.set_shader_debugger.process_context_addr = + input->set_shader_debugger.process_context_addr; +@@ -504,11 +510,6 @@ static int mes_v12_0_misc_op(struct amdg + return -EINVAL; + } + +- if (mes->adev->enable_uni_mes) +- pipe = AMDGPU_MES_KIQ_PIPE; +- else +- pipe = AMDGPU_MES_SCHED_PIPE; +- + return mes_v12_0_submit_pkt_and_poll_completion(mes, pipe, + &misc_pkt, sizeof(misc_pkt), + offsetof(union MESAPI__MISC, api_status)); diff --git a/queue-6.11/drm-amdgpu-update-golden-regs-for-gfx12.patch b/queue-6.11/drm-amdgpu-update-golden-regs-for-gfx12.patch new file mode 100644 index 00000000000..106d0c7d211 --- /dev/null +++ b/queue-6.11/drm-amdgpu-update-golden-regs-for-gfx12.patch @@ -0,0 +1,58 @@ +From 7b6df1d73290961ff0a00fd0022f28dd19e37181 Mon Sep 17 00:00:00 2001 +From: Frank Min +Date: Wed, 4 Sep 2024 10:50:33 +0800 +Subject: drm/amdgpu: update golden regs for gfx12 + +From: Frank Min + +commit 7b6df1d73290961ff0a00fd0022f28dd19e37181 upstream. + +update golden regs for gfx12 + +Signed-off-by: Frank Min +Reviewed-by: Likun Gao +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.11.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +@@ -202,12 +202,16 @@ static const struct amdgpu_hwip_reg_entr + SOC15_REG_ENTRY_STR(GC, 0, regCP_IB1_BUFSZ) + }; + +-static const struct soc15_reg_golden golden_settings_gc_12_0[] = { ++static const struct soc15_reg_golden golden_settings_gc_12_0_rev0[] = { + SOC15_REG_GOLDEN_VALUE(GC, 0, regDB_MEM_CONFIG, 0x0000000f, 0x0000000f), + SOC15_REG_GOLDEN_VALUE(GC, 0, regCB_HW_CONTROL_1, 0x03000000, 0x03000000), + SOC15_REG_GOLDEN_VALUE(GC, 0, regGL2C_CTRL5, 0x00000070, 0x00000020) + }; + ++static const struct soc15_reg_golden golden_settings_gc_12_0[] = { ++ SOC15_REG_GOLDEN_VALUE(GC, 0, regDB_MEM_CONFIG, 0x00008000, 0x00008000), ++}; ++ + #define DEFAULT_SH_MEM_CONFIG \ + ((SH_MEM_ADDRESS_MODE_64 << SH_MEM_CONFIG__ADDRESS_MODE__SHIFT) | \ + (SH_MEM_ALIGNMENT_MODE_UNALIGNED << SH_MEM_CONFIG__ALIGNMENT_MODE__SHIFT) | \ +@@ -3446,10 +3450,14 @@ static void gfx_v12_0_init_golden_regist + switch (amdgpu_ip_version(adev, GC_HWIP, 0)) { + case IP_VERSION(12, 0, 0): + case IP_VERSION(12, 0, 1): ++ soc15_program_register_sequence(adev, ++ golden_settings_gc_12_0, ++ (const u32)ARRAY_SIZE(golden_settings_gc_12_0)); ++ + if (adev->rev_id == 0) + soc15_program_register_sequence(adev, +- golden_settings_gc_12_0, +- (const u32)ARRAY_SIZE(golden_settings_gc_12_0)); ++ golden_settings_gc_12_0_rev0, ++ (const u32)ARRAY_SIZE(golden_settings_gc_12_0_rev0)); + break; + default: + break; diff --git a/queue-6.11/drm-amdgpu-vcn-enable-av1-on-both-instances.patch b/queue-6.11/drm-amdgpu-vcn-enable-av1-on-both-instances.patch new file mode 100644 index 00000000000..2afdfcfc911 --- /dev/null +++ b/queue-6.11/drm-amdgpu-vcn-enable-av1-on-both-instances.patch @@ -0,0 +1,205 @@ +From 8048e5ade8224969023902b0b3f64470f9c250a7 Mon Sep 17 00:00:00 2001 +From: Saleemkhan Jamadar +Date: Fri, 20 Sep 2024 18:40:18 +0530 +Subject: drm/amdgpu/vcn: enable AV1 on both instances + +From: Saleemkhan Jamadar + +commit 8048e5ade8224969023902b0b3f64470f9c250a7 upstream. + +v1 - remove cs parse code (Christian) + +On VCN v4_0_6 AV1 is supported on both the instances. +Remove cs IB parse code since explict handling of AV1 schedule is +not required. + +Signed-off-by: Saleemkhan Jamadar +Reviewed-by: Leo Liu +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c | 165 -------------------------------- + 1 file changed, 165 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c +@@ -1347,170 +1347,6 @@ static void vcn_v4_0_5_unified_ring_set_ + } + } + +-static int vcn_v4_0_5_limit_sched(struct amdgpu_cs_parser *p, +- struct amdgpu_job *job) +-{ +- struct drm_gpu_scheduler **scheds; +- +- /* The create msg must be in the first IB submitted */ +- if (atomic_read(&job->base.entity->fence_seq)) +- return -EINVAL; +- +- /* if VCN0 is harvested, we can't support AV1 */ +- if (p->adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0) +- return -EINVAL; +- +- scheds = p->adev->gpu_sched[AMDGPU_HW_IP_VCN_ENC] +- [AMDGPU_RING_PRIO_0].sched; +- drm_sched_entity_modify_sched(job->base.entity, scheds, 1); +- return 0; +-} +- +-static int vcn_v4_0_5_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job, +- uint64_t addr) +-{ +- struct ttm_operation_ctx ctx = { false, false }; +- struct amdgpu_bo_va_mapping *map; +- uint32_t *msg, num_buffers; +- struct amdgpu_bo *bo; +- uint64_t start, end; +- unsigned int i; +- void *ptr; +- int r; +- +- addr &= AMDGPU_GMC_HOLE_MASK; +- r = amdgpu_cs_find_mapping(p, addr, &bo, &map); +- if (r) { +- DRM_ERROR("Can't find BO for addr 0x%08llx\n", addr); +- return r; +- } +- +- start = map->start * AMDGPU_GPU_PAGE_SIZE; +- end = (map->last + 1) * AMDGPU_GPU_PAGE_SIZE; +- if (addr & 0x7) { +- DRM_ERROR("VCN messages must be 8 byte aligned!\n"); +- return -EINVAL; +- } +- +- bo->flags |= AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED; +- amdgpu_bo_placement_from_domain(bo, bo->allowed_domains); +- r = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx); +- if (r) { +- DRM_ERROR("Failed validating the VCN message BO (%d)!\n", r); +- return r; +- } +- +- r = amdgpu_bo_kmap(bo, &ptr); +- if (r) { +- DRM_ERROR("Failed mapping the VCN message (%d)!\n", r); +- return r; +- } +- +- msg = ptr + addr - start; +- +- /* Check length */ +- if (msg[1] > end - addr) { +- r = -EINVAL; +- goto out; +- } +- +- if (msg[3] != RDECODE_MSG_CREATE) +- goto out; +- +- num_buffers = msg[2]; +- for (i = 0, msg = &msg[6]; i < num_buffers; ++i, msg += 4) { +- uint32_t offset, size, *create; +- +- if (msg[0] != RDECODE_MESSAGE_CREATE) +- continue; +- +- offset = msg[1]; +- size = msg[2]; +- +- if (offset + size > end) { +- r = -EINVAL; +- goto out; +- } +- +- create = ptr + addr + offset - start; +- +- /* H264, HEVC and VP9 can run on any instance */ +- if (create[0] == 0x7 || create[0] == 0x10 || create[0] == 0x11) +- continue; +- +- r = vcn_v4_0_5_limit_sched(p, job); +- if (r) +- goto out; +- } +- +-out: +- amdgpu_bo_kunmap(bo); +- return r; +-} +- +-#define RADEON_VCN_ENGINE_TYPE_ENCODE (0x00000002) +-#define RADEON_VCN_ENGINE_TYPE_DECODE (0x00000003) +- +-#define RADEON_VCN_ENGINE_INFO (0x30000001) +-#define RADEON_VCN_ENGINE_INFO_MAX_OFFSET 16 +- +-#define RENCODE_ENCODE_STANDARD_AV1 2 +-#define RENCODE_IB_PARAM_SESSION_INIT 0x00000003 +-#define RENCODE_IB_PARAM_SESSION_INIT_MAX_OFFSET 64 +- +-/* return the offset in ib if id is found, -1 otherwise +- * to speed up the searching we only search upto max_offset +- */ +-static int vcn_v4_0_5_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int max_offset) +-{ +- int i; +- +- for (i = 0; i < ib->length_dw && i < max_offset && ib->ptr[i] >= 8; i += ib->ptr[i]/4) { +- if (ib->ptr[i + 1] == id) +- return i; +- } +- return -1; +-} +- +-static int vcn_v4_0_5_ring_patch_cs_in_place(struct amdgpu_cs_parser *p, +- struct amdgpu_job *job, +- struct amdgpu_ib *ib) +-{ +- struct amdgpu_ring *ring = amdgpu_job_ring(job); +- struct amdgpu_vcn_decode_buffer *decode_buffer; +- uint64_t addr; +- uint32_t val; +- int idx; +- +- /* The first instance can decode anything */ +- if (!ring->me) +- return 0; +- +- /* RADEON_VCN_ENGINE_INFO is at the top of ib block */ +- idx = vcn_v4_0_5_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO, +- RADEON_VCN_ENGINE_INFO_MAX_OFFSET); +- if (idx < 0) /* engine info is missing */ +- return 0; +- +- val = amdgpu_ib_get_value(ib, idx + 2); /* RADEON_VCN_ENGINE_TYPE */ +- if (val == RADEON_VCN_ENGINE_TYPE_DECODE) { +- decode_buffer = (struct amdgpu_vcn_decode_buffer *)&ib->ptr[idx + 6]; +- +- if (!(decode_buffer->valid_buf_flag & 0x1)) +- return 0; +- +- addr = ((u64)decode_buffer->msg_buffer_address_hi) << 32 | +- decode_buffer->msg_buffer_address_lo; +- return vcn_v4_0_5_dec_msg(p, job, addr); +- } else if (val == RADEON_VCN_ENGINE_TYPE_ENCODE) { +- idx = vcn_v4_0_5_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT, +- RENCODE_IB_PARAM_SESSION_INIT_MAX_OFFSET); +- if (idx >= 0 && ib->ptr[idx + 2] == RENCODE_ENCODE_STANDARD_AV1) +- return vcn_v4_0_5_limit_sched(p, job); +- } +- return 0; +-} +- + static const struct amdgpu_ring_funcs vcn_v4_0_5_unified_ring_vm_funcs = { + .type = AMDGPU_RING_TYPE_VCN_ENC, + .align_mask = 0x3f, +@@ -1518,7 +1354,6 @@ static const struct amdgpu_ring_funcs vc + .get_rptr = vcn_v4_0_5_unified_ring_get_rptr, + .get_wptr = vcn_v4_0_5_unified_ring_get_wptr, + .set_wptr = vcn_v4_0_5_unified_ring_set_wptr, +- .patch_cs_in_place = vcn_v4_0_5_ring_patch_cs_in_place, + .emit_frame_size = + SOC15_FLUSH_GPU_TLB_NUM_WREG * 3 + + SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 4 + diff --git a/queue-6.11/drm-amdkfd-add-sdma-queue-quantum-support-for-gfx12.patch b/queue-6.11/drm-amdkfd-add-sdma-queue-quantum-support-for-gfx12.patch new file mode 100644 index 00000000000..97643c55d8c --- /dev/null +++ b/queue-6.11/drm-amdkfd-add-sdma-queue-quantum-support-for-gfx12.patch @@ -0,0 +1,34 @@ +From d52ac79053a2f3eba04c1e7b56334df84d1d289f Mon Sep 17 00:00:00 2001 +From: Sreekant Somasekharan +Date: Fri, 20 Sep 2024 01:53:17 -0400 +Subject: drm/amdkfd: Add SDMA queue quantum support for GFX12 + +From: Sreekant Somasekharan + +commit d52ac79053a2f3eba04c1e7b56334df84d1d289f upstream. + +program SDMAx_QUEUEx_SCHEDULE_CNTL for context switch due to +quantum in KFD for GFX12. + +Signed-off-by: Sreekant Somasekharan +Reviewed-by: Harish Kasiviswanathan +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.11.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c +@@ -341,6 +341,10 @@ static void update_mqd_sdma(struct mqd_m + m->sdmax_rlcx_doorbell_offset = + q->doorbell_off << SDMA0_QUEUE0_DOORBELL_OFFSET__OFFSET__SHIFT; + ++ m->sdmax_rlcx_sched_cntl = (amdgpu_sdma_phase_quantum ++ << SDMA0_QUEUE0_SCHEDULE_CNTL__CONTEXT_QUANTUM__SHIFT) ++ & SDMA0_QUEUE0_SCHEDULE_CNTL__CONTEXT_QUANTUM_MASK; ++ + m->sdma_engine_id = q->sdma_engine_id; + m->sdma_queue_id = q->sdma_queue_id; + diff --git a/queue-6.11/input-adp5588-keys-fix-check-on-return-code.patch b/queue-6.11/input-adp5588-keys-fix-check-on-return-code.patch new file mode 100644 index 00000000000..e782fa0b7b5 --- /dev/null +++ b/queue-6.11/input-adp5588-keys-fix-check-on-return-code.patch @@ -0,0 +1,36 @@ +From eb017f4ea13b1a5ad7f4332279f2e4c67b44bdea Mon Sep 17 00:00:00 2001 +From: Nuno Sa +Date: Fri, 20 Sep 2024 09:22:52 +0200 +Subject: Input: adp5588-keys - fix check on return code + +From: Nuno Sa + +commit eb017f4ea13b1a5ad7f4332279f2e4c67b44bdea upstream. + +During adp5588_setup(), we read all the events to clear the event FIFO. +However, adp5588_read() just calls i2c_smbus_read_byte_data() which +returns the byte read in case everything goes well. Hence, we need to +explicitly check for a negative error code instead of checking for +something different than 0. + +Fixes: e960309ce318 ("Input: adp5588-keys - bail out on returned error") +Cc: stable@vger.kernel.org +Signed-off-by: Nuno Sa +Link: https://lore.kernel.org/r/20240920-fix-adp5588-err-check-v1-1-81f6e957ef24@analog.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/keyboard/adp5588-keys.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/keyboard/adp5588-keys.c ++++ b/drivers/input/keyboard/adp5588-keys.c +@@ -627,7 +627,7 @@ static int adp5588_setup(struct adp5588_ + + for (i = 0; i < KEYP_MAX_EVENT; i++) { + ret = adp5588_read(client, KEY_EVENTA); +- if (ret) ++ if (ret < 0) + return ret; + } + diff --git a/queue-6.11/input-i8042-add-another-board-name-for-tuxedo-stellaris-gen5-amd-line.patch b/queue-6.11/input-i8042-add-another-board-name-for-tuxedo-stellaris-gen5-amd-line.patch new file mode 100644 index 00000000000..a8766b05d0f --- /dev/null +++ b/queue-6.11/input-i8042-add-another-board-name-for-tuxedo-stellaris-gen5-amd-line.patch @@ -0,0 +1,39 @@ +From 01eed86d50af9fab27d876fd677b86259ebe9de3 Mon Sep 17 00:00:00 2001 +From: Werner Sembach +Date: Tue, 10 Sep 2024 11:40:07 +0200 +Subject: Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line + +From: Werner Sembach + +commit 01eed86d50af9fab27d876fd677b86259ebe9de3 upstream. + +There might be devices out in the wild where the board name is GMxXGxx +instead of GMxXGxX. + +Adding both to be on the safe side. + +Signed-off-by: Werner Sembach +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240910094008.1601230-2-wse@tuxedocomputers.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/serio/i8042-acpipnpio.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -1138,6 +1138,13 @@ static const struct dmi_system_id i8042_ + }, + { + .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "GMxXGxx"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | ++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ }, ++ { ++ .matches = { + DMI_MATCH(DMI_BOARD_NAME, "GMxXGxX"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | diff --git a/queue-6.11/input-i8042-add-tuxedo-stellaris-15-slim-gen6-amd-to-i8042-quirk-table.patch b/queue-6.11/input-i8042-add-tuxedo-stellaris-15-slim-gen6-amd-to-i8042-quirk-table.patch new file mode 100644 index 00000000000..850960b3877 --- /dev/null +++ b/queue-6.11/input-i8042-add-tuxedo-stellaris-15-slim-gen6-amd-to-i8042-quirk-table.patch @@ -0,0 +1,46 @@ +From 3870e2850b56306d1d1e435c5a1ccbccd7c59291 Mon Sep 17 00:00:00 2001 +From: Werner Sembach +Date: Tue, 10 Sep 2024 11:40:08 +0200 +Subject: Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table + +From: Werner Sembach + +commit 3870e2850b56306d1d1e435c5a1ccbccd7c59291 upstream. + +The Gen6 devices have the same problem and the same Solution as the Gen5 +ones. + +Some TongFang barebones have touchpad and/or keyboard issues after +suspend, fixable with nomux + reset + noloop + nopnp. Luckily, none of +them have an external PS/2 port so this can safely be set for all of +them. + +I'm not entirely sure if every device listed really needs all four quirks, +but after testing and production use, no negative effects could be +observed when setting all four. + +Signed-off-by: Werner Sembach +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240910094008.1601230-3-wse@tuxedocomputers.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/serio/i8042-acpipnpio.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -1143,6 +1143,13 @@ static const struct dmi_system_id i8042_ + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | ++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ }, + /* + * A lot of modern Clevo barebones have touchpad and/or keyboard issues + * after suspend fixable with nomux + reset + noloop + nopnp. Luckily, diff --git a/queue-6.11/input-i8042-add-tuxedo-stellaris-16-gen5-amd-to-i8042-quirk-table.patch b/queue-6.11/input-i8042-add-tuxedo-stellaris-16-gen5-amd-to-i8042-quirk-table.patch new file mode 100644 index 00000000000..793f54a0bf6 --- /dev/null +++ b/queue-6.11/input-i8042-add-tuxedo-stellaris-16-gen5-amd-to-i8042-quirk-table.patch @@ -0,0 +1,59 @@ +From e06edf96dea065dd1d9df695bf8b92784992333e Mon Sep 17 00:00:00 2001 +From: Werner Sembach +Date: Thu, 5 Sep 2024 18:48:51 +0200 +Subject: Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table + +From: Werner Sembach + +commit e06edf96dea065dd1d9df695bf8b92784992333e upstream. + +Some TongFang barebones have touchpad and/or keyboard issues after +suspend, fixable with nomux + reset + noloop + nopnp. Luckily, none of +them have an external PS/2 port so this can safely be set for all of +them. + +I'm not entirely sure if every device listed really needs all four quirks, +but after testing and production use, no negative effects could be +observed when setting all four. + +Signed-off-by: Werner Sembach +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240905164851.771578-1-wse@tuxedocomputers.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/serio/i8042-acpipnpio.h | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -1121,6 +1121,29 @@ static const struct dmi_system_id i8042_ + .driver_data = (void *)(SERIO_QUIRK_NOLOOP) + }, + /* ++ * Some TongFang barebones have touchpad and/or keyboard issues after ++ * suspend fixable with nomux + reset + noloop + nopnp. Luckily, none of ++ * them have an external PS/2 port so this can safely be set for all of ++ * them. ++ * TongFang barebones come with board_vendor and/or system_vendor set to ++ * a different value for each individual reseller. The only somewhat ++ * universal way to identify them is by board_name. ++ */ ++ { ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "GM6XGxX"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | ++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "GMxXGxX"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | ++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ }, ++ /* + * A lot of modern Clevo barebones have touchpad and/or keyboard issues + * after suspend fixable with nomux + reset + noloop + nopnp. Luckily, + * none of them have an external PS/2 port so this can safely be set for diff --git a/queue-6.11/iommu-amd-fix-argument-order-in-amd_iommu_dev_flush_pasid_all.patch b/queue-6.11/iommu-amd-fix-argument-order-in-amd_iommu_dev_flush_pasid_all.patch new file mode 100644 index 00000000000..b0911064cab --- /dev/null +++ b/queue-6.11/iommu-amd-fix-argument-order-in-amd_iommu_dev_flush_pasid_all.patch @@ -0,0 +1,45 @@ +From 8386207f37e98453e1de3f51e50eeeea089103f9 Mon Sep 17 00:00:00 2001 +From: Eliav Bar-ilan +Date: Tue, 10 Sep 2024 16:44:16 -0300 +Subject: iommu/amd: Fix argument order in amd_iommu_dev_flush_pasid_all() + +From: Eliav Bar-ilan + +commit 8386207f37e98453e1de3f51e50eeeea089103f9 upstream. + +An incorrect argument order calling amd_iommu_dev_flush_pasid_pages() +causes improper flushing of the IOMMU, leaving the old value of GCR3 from +a previous process attached to the same PASID. + +The function has the signature: + +void amd_iommu_dev_flush_pasid_pages(struct iommu_dev_data *dev_data, + ioasid_t pasid, u64 address, size_t size) + +Correct the argument order. + +Cc: stable@vger.kernel.org +Fixes: 474bf01ed9f0 ("iommu/amd: Add support for device based TLB invalidation") +Signed-off-by: Eliav Bar-ilan +Signed-off-by: Jason Gunthorpe +Reviewed-by: Vasant Hegde +Link: https://lore.kernel.org/r/0-v1-fc6bc37d8208+250b-amd_pasid_flush_jgg@nvidia.com +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/amd/iommu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -1550,8 +1550,8 @@ void amd_iommu_dev_flush_pasid_pages(str + void amd_iommu_dev_flush_pasid_all(struct iommu_dev_data *dev_data, + ioasid_t pasid) + { +- amd_iommu_dev_flush_pasid_pages(dev_data, 0, +- CMD_INV_IOMMU_ALL_PAGES_ADDRESS, pasid); ++ amd_iommu_dev_flush_pasid_pages(dev_data, pasid, 0, ++ CMD_INV_IOMMU_ALL_PAGES_ADDRESS); + } + + void amd_iommu_domain_flush_complete(struct protection_domain *domain) diff --git a/queue-6.11/iommufd-protect-against-overflow-of-align-during-iova-allocation.patch b/queue-6.11/iommufd-protect-against-overflow-of-align-during-iova-allocation.patch new file mode 100644 index 00000000000..9c157ec4ffc --- /dev/null +++ b/queue-6.11/iommufd-protect-against-overflow-of-align-during-iova-allocation.patch @@ -0,0 +1,83 @@ +From 8f6887349b2f829a4121c518aeb064fc922714e4 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Tue, 27 Aug 2024 13:46:45 -0300 +Subject: iommufd: Protect against overflow of ALIGN() during iova allocation + +From: Jason Gunthorpe + +commit 8f6887349b2f829a4121c518aeb064fc922714e4 upstream. + +Userspace can supply an iova and uptr such that the target iova alignment +becomes really big and ALIGN() overflows which corrupts the selected area +range during allocation. CONFIG_IOMMUFD_TEST can detect this: + + WARNING: CPU: 1 PID: 5092 at drivers/iommu/iommufd/io_pagetable.c:268 iopt_alloc_area_pages drivers/iommu/iommufd/io_pagetable.c:268 [inline] + WARNING: CPU: 1 PID: 5092 at drivers/iommu/iommufd/io_pagetable.c:268 iopt_map_pages+0xf95/0x1050 drivers/iommu/iommufd/io_pagetable.c:352 + Modules linked in: + CPU: 1 PID: 5092 Comm: syz-executor294 Not tainted 6.10.0-rc5-syzkaller-00294-g3ffea9a7a6f7 #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 + RIP: 0010:iopt_alloc_area_pages drivers/iommu/iommufd/io_pagetable.c:268 [inline] + RIP: 0010:iopt_map_pages+0xf95/0x1050 drivers/iommu/iommufd/io_pagetable.c:352 + Code: fc e9 a4 f3 ff ff e8 1a 8b 4c fc 41 be e4 ff ff ff e9 8a f3 ff ff e8 0a 8b 4c fc 90 0f 0b 90 e9 37 f5 ff ff e8 fc 8a 4c fc 90 <0f> 0b 90 e9 68 f3 ff ff 48 c7 c1 ec 82 ad 8f 80 e1 07 80 c1 03 38 + RSP: 0018:ffffc90003ebf9e0 EFLAGS: 00010293 + RAX: ffffffff85499fa4 RBX: 00000000ffffffef RCX: ffff888079b49e00 + RDX: 0000000000000000 RSI: 00000000ffffffef RDI: 0000000000000000 + RBP: ffffc90003ebfc50 R08: ffffffff85499b30 R09: ffffffff85499942 + R10: 0000000000000002 R11: ffff888079b49e00 R12: ffff8880228e0010 + R13: 0000000000000000 R14: 1ffff920007d7f68 R15: ffffc90003ebfd00 + FS: 000055557d760380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00000000005fdeb8 CR3: 000000007404a000 CR4: 00000000003506f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + iommufd_ioas_copy+0x610/0x7b0 drivers/iommu/iommufd/ioas.c:274 + iommufd_fops_ioctl+0x4d9/0x5a0 drivers/iommu/iommufd/main.c:421 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:907 [inline] + __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Cap the automatic alignment to the huge page size, which is probably a +better idea overall. Huge automatic alignments can fragment and chew up +the available IOVA space without any reason. + +Link: https://patch.msgid.link/r/0-v1-8009738b9891+1f7-iommufd_align_overflow_jgg@nvidia.com +Cc: stable@vger.kernel.org +Fixes: 51fe6141f0f6 ("iommufd: Data structure to provide IOVA to PFN mapping") +Reviewed-by: Nicolin Chen +Reported-by: syzbot+16073ebbc4c64b819b47@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/r/000000000000388410061a74f014@google.com +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/iommufd/io_pagetable.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/iommu/iommufd/io_pagetable.c ++++ b/drivers/iommu/iommufd/io_pagetable.c +@@ -112,6 +112,7 @@ static int iopt_alloc_iova(struct io_pag + unsigned long page_offset = uptr % PAGE_SIZE; + struct interval_tree_double_span_iter used_span; + struct interval_tree_span_iter allowed_span; ++ unsigned long max_alignment = PAGE_SIZE; + unsigned long iova_alignment; + + lockdep_assert_held(&iopt->iova_rwsem); +@@ -131,6 +132,13 @@ static int iopt_alloc_iova(struct io_pag + roundup_pow_of_two(length), + 1UL << __ffs64(uptr)); + ++#ifdef CONFIG_TRANSPARENT_HUGEPAGE ++ max_alignment = HPAGE_SIZE; ++#endif ++ /* Protect against ALIGN() overflow */ ++ if (iova_alignment >= max_alignment) ++ iova_alignment = max_alignment; ++ + if (iova_alignment < iopt->iova_alignment) + return -EINVAL; + diff --git a/queue-6.11/kvm-arm64-add-memory-length-checks-and-remove-inline-in-do_ffa_mem_xfer.patch b/queue-6.11/kvm-arm64-add-memory-length-checks-and-remove-inline-in-do_ffa_mem_xfer.patch new file mode 100644 index 00000000000..bc1fab5765c --- /dev/null +++ b/queue-6.11/kvm-arm64-add-memory-length-checks-and-remove-inline-in-do_ffa_mem_xfer.patch @@ -0,0 +1,89 @@ +From f26a525b77e040d584e967369af1e018d2d59112 Mon Sep 17 00:00:00 2001 +From: Snehal Koukuntla +Date: Mon, 9 Sep 2024 18:01:54 +0000 +Subject: KVM: arm64: Add memory length checks and remove inline in do_ffa_mem_xfer + +From: Snehal Koukuntla + +commit f26a525b77e040d584e967369af1e018d2d59112 upstream. + +When we share memory through FF-A and the description of the buffers +exceeds the size of the mapped buffer, the fragmentation API is used. +The fragmentation API allows specifying chunks of descriptors in subsequent +FF-A fragment calls and no upper limit has been established for this. +The entire memory region transferred is identified by a handle which can be +used to reclaim the transferred memory. +To be able to reclaim the memory, the description of the buffers has to fit +in the ffa_desc_buf. +Add a bounds check on the FF-A sharing path to prevent the memory reclaim +from failing. + +Also do_ffa_mem_xfer() does not need __always_inline, except for the +BUILD_BUG_ON() aspect, which gets moved to a macro. + +[maz: fixed the BUILD_BUG_ON() breakage with LLVM, thanks to Wei-Lin Chang + for the timely report] + +Fixes: 634d90cf0ac65 ("KVM: arm64: Handle FFA_MEM_LEND calls from the host") +Cc: stable@vger.kernel.org +Reviewed-by: Sebastian Ene +Signed-off-by: Snehal Koukuntla +Reviewed-by: Oliver Upton +Link: https://lore.kernel.org/r/20240909180154.3267939-1-snehalreddy@google.com +Signed-off-by: Marc Zyngier +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kvm/hyp/nvhe/ffa.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/arch/arm64/kvm/hyp/nvhe/ffa.c ++++ b/arch/arm64/kvm/hyp/nvhe/ffa.c +@@ -426,9 +426,9 @@ out: + return; + } + +-static __always_inline void do_ffa_mem_xfer(const u64 func_id, +- struct arm_smccc_res *res, +- struct kvm_cpu_context *ctxt) ++static void __do_ffa_mem_xfer(const u64 func_id, ++ struct arm_smccc_res *res, ++ struct kvm_cpu_context *ctxt) + { + DECLARE_REG(u32, len, ctxt, 1); + DECLARE_REG(u32, fraglen, ctxt, 2); +@@ -440,9 +440,6 @@ static __always_inline void do_ffa_mem_x + u32 offset, nr_ranges; + int ret = 0; + +- BUILD_BUG_ON(func_id != FFA_FN64_MEM_SHARE && +- func_id != FFA_FN64_MEM_LEND); +- + if (addr_mbz || npages_mbz || fraglen > len || + fraglen > KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE) { + ret = FFA_RET_INVALID_PARAMETERS; +@@ -461,6 +458,11 @@ static __always_inline void do_ffa_mem_x + goto out_unlock; + } + ++ if (len > ffa_desc_buf.len) { ++ ret = FFA_RET_NO_MEMORY; ++ goto out_unlock; ++ } ++ + buf = hyp_buffers.tx; + memcpy(buf, host_buffers.tx, fraglen); + +@@ -512,6 +514,13 @@ err_unshare: + goto out_unlock; + } + ++#define do_ffa_mem_xfer(fid, res, ctxt) \ ++ do { \ ++ BUILD_BUG_ON((fid) != FFA_FN64_MEM_SHARE && \ ++ (fid) != FFA_FN64_MEM_LEND); \ ++ __do_ffa_mem_xfer((fid), (res), (ctxt)); \ ++ } while (0); ++ + static void do_ffa_mem_reclaim(struct arm_smccc_res *res, + struct kvm_cpu_context *ctxt) + { diff --git a/queue-6.11/kvm-use-dedicated-mutex-to-protect-kvm_usage_count-to-avoid-deadlock.patch b/queue-6.11/kvm-use-dedicated-mutex-to-protect-kvm_usage_count-to-avoid-deadlock.patch new file mode 100644 index 00000000000..1eca3bc419d --- /dev/null +++ b/queue-6.11/kvm-use-dedicated-mutex-to-protect-kvm_usage_count-to-avoid-deadlock.patch @@ -0,0 +1,303 @@ +From 44d17459626052a2390457e550a12cb973506b2f Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Thu, 29 Aug 2024 21:35:51 -0700 +Subject: KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock + +From: Sean Christopherson + +commit 44d17459626052a2390457e550a12cb973506b2f upstream. + +Use a dedicated mutex to guard kvm_usage_count to fix a potential deadlock +on x86 due to a chain of locks and SRCU synchronizations. Translating the +below lockdep splat, CPU1 #6 will wait on CPU0 #1, CPU0 #8 will wait on +CPU2 #3, and CPU2 #7 will wait on CPU1 #4 (if there's a writer, due to the +fairness of r/w semaphores). + + CPU0 CPU1 CPU2 +1 lock(&kvm->slots_lock); +2 lock(&vcpu->mutex); +3 lock(&kvm->srcu); +4 lock(cpu_hotplug_lock); +5 lock(kvm_lock); +6 lock(&kvm->slots_lock); +7 lock(cpu_hotplug_lock); +8 sync(&kvm->srcu); + +Note, there are likely more potential deadlocks in KVM x86, e.g. the same +pattern of taking cpu_hotplug_lock outside of kvm_lock likely exists with +__kvmclock_cpufreq_notifier(): + + cpuhp_cpufreq_online() + | + -> cpufreq_online() + | + -> cpufreq_gov_performance_limits() + | + -> __cpufreq_driver_target() + | + -> __target_index() + | + -> cpufreq_freq_transition_begin() + | + -> cpufreq_notify_transition() + | + -> ... __kvmclock_cpufreq_notifier() + +But, actually triggering such deadlocks is beyond rare due to the +combination of dependencies and timings involved. E.g. the cpufreq +notifier is only used on older CPUs without a constant TSC, mucking with +the NX hugepage mitigation while VMs are running is very uncommon, and +doing so while also onlining/offlining a CPU (necessary to generate +contention on cpu_hotplug_lock) would be even more unusual. + +The most robust solution to the general cpu_hotplug_lock issue is likely +to switch vm_list to be an RCU-protected list, e.g. so that x86's cpufreq +notifier doesn't to take kvm_lock. For now, settle for fixing the most +blatant deadlock, as switching to an RCU-protected list is a much more +involved change, but add a comment in locking.rst to call out that care +needs to be taken when walking holding kvm_lock and walking vm_list. + + ====================================================== + WARNING: possible circular locking dependency detected + 6.10.0-smp--c257535a0c9d-pip #330 Tainted: G S O + ------------------------------------------------------ + tee/35048 is trying to acquire lock: + ff6a80eced71e0a8 (&kvm->slots_lock){+.+.}-{3:3}, at: set_nx_huge_pages+0x179/0x1e0 [kvm] + + but task is already holding lock: + ffffffffc07abb08 (kvm_lock){+.+.}-{3:3}, at: set_nx_huge_pages+0x14a/0x1e0 [kvm] + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #3 (kvm_lock){+.+.}-{3:3}: + __mutex_lock+0x6a/0xb40 + mutex_lock_nested+0x1f/0x30 + kvm_dev_ioctl+0x4fb/0xe50 [kvm] + __se_sys_ioctl+0x7b/0xd0 + __x64_sys_ioctl+0x21/0x30 + x64_sys_call+0x15d0/0x2e60 + do_syscall_64+0x83/0x160 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + -> #2 (cpu_hotplug_lock){++++}-{0:0}: + cpus_read_lock+0x2e/0xb0 + static_key_slow_inc+0x16/0x30 + kvm_lapic_set_base+0x6a/0x1c0 [kvm] + kvm_set_apic_base+0x8f/0xe0 [kvm] + kvm_set_msr_common+0x9ae/0xf80 [kvm] + vmx_set_msr+0xa54/0xbe0 [kvm_intel] + __kvm_set_msr+0xb6/0x1a0 [kvm] + kvm_arch_vcpu_ioctl+0xeca/0x10c0 [kvm] + kvm_vcpu_ioctl+0x485/0x5b0 [kvm] + __se_sys_ioctl+0x7b/0xd0 + __x64_sys_ioctl+0x21/0x30 + x64_sys_call+0x15d0/0x2e60 + do_syscall_64+0x83/0x160 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + -> #1 (&kvm->srcu){.+.+}-{0:0}: + __synchronize_srcu+0x44/0x1a0 + synchronize_srcu_expedited+0x21/0x30 + kvm_swap_active_memslots+0x110/0x1c0 [kvm] + kvm_set_memslot+0x360/0x620 [kvm] + __kvm_set_memory_region+0x27b/0x300 [kvm] + kvm_vm_ioctl_set_memory_region+0x43/0x60 [kvm] + kvm_vm_ioctl+0x295/0x650 [kvm] + __se_sys_ioctl+0x7b/0xd0 + __x64_sys_ioctl+0x21/0x30 + x64_sys_call+0x15d0/0x2e60 + do_syscall_64+0x83/0x160 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + -> #0 (&kvm->slots_lock){+.+.}-{3:3}: + __lock_acquire+0x15ef/0x2e30 + lock_acquire+0xe0/0x260 + __mutex_lock+0x6a/0xb40 + mutex_lock_nested+0x1f/0x30 + set_nx_huge_pages+0x179/0x1e0 [kvm] + param_attr_store+0x93/0x100 + module_attr_store+0x22/0x40 + sysfs_kf_write+0x81/0xb0 + kernfs_fop_write_iter+0x133/0x1d0 + vfs_write+0x28d/0x380 + ksys_write+0x70/0xe0 + __x64_sys_write+0x1f/0x30 + x64_sys_call+0x281b/0x2e60 + do_syscall_64+0x83/0x160 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Cc: Chao Gao +Fixes: 0bf50497f03b ("KVM: Drop kvm_count_lock and instead protect kvm_usage_count with kvm_lock") +Cc: stable@vger.kernel.org +Reviewed-by: Kai Huang +Acked-by: Kai Huang +Tested-by: Farrah Chen +Signed-off-by: Sean Christopherson +Message-ID: <20240830043600.127750-2-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/virt/kvm/locking.rst | 32 +++++++++++++++++++++++--------- + virt/kvm/kvm_main.c | 31 ++++++++++++++++--------------- + 2 files changed, 39 insertions(+), 24 deletions(-) + +--- a/Documentation/virt/kvm/locking.rst ++++ b/Documentation/virt/kvm/locking.rst +@@ -9,7 +9,7 @@ KVM Lock Overview + + The acquisition orders for mutexes are as follows: + +-- cpus_read_lock() is taken outside kvm_lock ++- cpus_read_lock() is taken outside kvm_lock and kvm_usage_lock + + - kvm->lock is taken outside vcpu->mutex + +@@ -24,6 +24,12 @@ The acquisition orders for mutexes are a + are taken on the waiting side when modifying memslots, so MMU notifiers + must not take either kvm->slots_lock or kvm->slots_arch_lock. + ++cpus_read_lock() vs kvm_lock: ++- Taking cpus_read_lock() outside of kvm_lock is problematic, despite that ++ being the official ordering, as it is quite easy to unknowingly trigger ++ cpus_read_lock() while holding kvm_lock. Use caution when walking vm_list, ++ e.g. avoid complex operations when possible. ++ + For SRCU: + + - ``synchronize_srcu(&kvm->srcu)`` is called inside critical sections +@@ -227,10 +233,17 @@ time it will be set using the Dirty trac + :Type: mutex + :Arch: any + :Protects: - vm_list +- - kvm_usage_count ++ ++``kvm_usage_lock`` ++^^^^^^^^^^^^^^^^^^ ++ ++:Type: mutex ++:Arch: any ++:Protects: - kvm_usage_count + - hardware virtualization enable/disable +-:Comment: KVM also disables CPU hotplug via cpus_read_lock() during +- enable/disable. ++:Comment: Exists because using kvm_lock leads to deadlock (see earlier comment ++ on cpus_read_lock() vs kvm_lock). Note, KVM also disables CPU hotplug via ++ cpus_read_lock() when enabling/disabling virtualization. + + ``kvm->mn_invalidate_lock`` + ^^^^^^^^^^^^^^^^^^^^^^^^^^^ +@@ -290,11 +303,12 @@ time it will be set using the Dirty trac + wakeup. + + ``vendor_module_lock`` +-^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ++^^^^^^^^^^^^^^^^^^^^^^ + :Type: mutex + :Arch: x86 + :Protects: loading a vendor module (kvm_amd or kvm_intel) +-:Comment: Exists because using kvm_lock leads to deadlock. cpu_hotplug_lock is +- taken outside of kvm_lock, e.g. in KVM's CPU online/offline callbacks, and +- many operations need to take cpu_hotplug_lock when loading a vendor module, +- e.g. updating static calls. ++:Comment: Exists because using kvm_lock leads to deadlock. kvm_lock is taken ++ in notifiers, e.g. __kvmclock_cpufreq_notifier(), that may be invoked while ++ cpu_hotplug_lock is held, e.g. from cpufreq_boost_trigger_state(), and many ++ operations need to take cpu_hotplug_lock when loading a vendor module, e.g. ++ updating static calls. +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -5575,6 +5575,7 @@ __visible bool kvm_rebooting; + EXPORT_SYMBOL_GPL(kvm_rebooting); + + static DEFINE_PER_CPU(bool, hardware_enabled); ++static DEFINE_MUTEX(kvm_usage_lock); + static int kvm_usage_count; + + static int __hardware_enable_nolock(void) +@@ -5607,10 +5608,10 @@ static int kvm_online_cpu(unsigned int c + * be enabled. Otherwise running VMs would encounter unrecoverable + * errors when scheduled to this CPU. + */ +- mutex_lock(&kvm_lock); ++ mutex_lock(&kvm_usage_lock); + if (kvm_usage_count) + ret = __hardware_enable_nolock(); +- mutex_unlock(&kvm_lock); ++ mutex_unlock(&kvm_usage_lock); + return ret; + } + +@@ -5630,10 +5631,10 @@ static void hardware_disable_nolock(void + + static int kvm_offline_cpu(unsigned int cpu) + { +- mutex_lock(&kvm_lock); ++ mutex_lock(&kvm_usage_lock); + if (kvm_usage_count) + hardware_disable_nolock(NULL); +- mutex_unlock(&kvm_lock); ++ mutex_unlock(&kvm_usage_lock); + return 0; + } + +@@ -5649,9 +5650,9 @@ static void hardware_disable_all_nolock( + static void hardware_disable_all(void) + { + cpus_read_lock(); +- mutex_lock(&kvm_lock); ++ mutex_lock(&kvm_usage_lock); + hardware_disable_all_nolock(); +- mutex_unlock(&kvm_lock); ++ mutex_unlock(&kvm_usage_lock); + cpus_read_unlock(); + } + +@@ -5682,7 +5683,7 @@ static int hardware_enable_all(void) + * enable hardware multiple times. + */ + cpus_read_lock(); +- mutex_lock(&kvm_lock); ++ mutex_lock(&kvm_usage_lock); + + r = 0; + +@@ -5696,7 +5697,7 @@ static int hardware_enable_all(void) + } + } + +- mutex_unlock(&kvm_lock); ++ mutex_unlock(&kvm_usage_lock); + cpus_read_unlock(); + + return r; +@@ -5724,13 +5725,13 @@ static int kvm_suspend(void) + { + /* + * Secondary CPUs and CPU hotplug are disabled across the suspend/resume +- * callbacks, i.e. no need to acquire kvm_lock to ensure the usage count +- * is stable. Assert that kvm_lock is not held to ensure the system +- * isn't suspended while KVM is enabling hardware. Hardware enabling +- * can be preempted, but the task cannot be frozen until it has dropped +- * all locks (userspace tasks are frozen via a fake signal). ++ * callbacks, i.e. no need to acquire kvm_usage_lock to ensure the usage ++ * count is stable. Assert that kvm_usage_lock is not held to ensure ++ * the system isn't suspended while KVM is enabling hardware. Hardware ++ * enabling can be preempted, but the task cannot be frozen until it has ++ * dropped all locks (userspace tasks are frozen via a fake signal). + */ +- lockdep_assert_not_held(&kvm_lock); ++ lockdep_assert_not_held(&kvm_usage_lock); + lockdep_assert_irqs_disabled(); + + if (kvm_usage_count) +@@ -5740,7 +5741,7 @@ static int kvm_suspend(void) + + static void kvm_resume(void) + { +- lockdep_assert_not_held(&kvm_lock); ++ lockdep_assert_not_held(&kvm_usage_lock); + lockdep_assert_irqs_disabled(); + + if (kvm_usage_count) diff --git a/queue-6.11/kvm-x86-enforce-x2apic-s-must-be-zero-reserved-icr-bits.patch b/queue-6.11/kvm-x86-enforce-x2apic-s-must-be-zero-reserved-icr-bits.patch new file mode 100644 index 00000000000..4f688eab6b7 --- /dev/null +++ b/queue-6.11/kvm-x86-enforce-x2apic-s-must-be-zero-reserved-icr-bits.patch @@ -0,0 +1,62 @@ +From 71bf395a276f0578d19e0ae137a7d1d816d08e0e Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Fri, 19 Jul 2024 16:50:58 -0700 +Subject: KVM: x86: Enforce x2APIC's must-be-zero reserved ICR bits + +From: Sean Christopherson + +commit 71bf395a276f0578d19e0ae137a7d1d816d08e0e upstream. + +Inject a #GP on a WRMSR(ICR) that attempts to set any reserved bits that +are must-be-zero on both Intel and AMD, i.e. any reserved bits other than +the BUSY bit, which Intel ignores and basically says is undefined. + +KVM's xapic_state_test selftest has been fudging the bug since commit +4b88b1a518b3 ("KVM: selftests: Enhance handling WRMSR ICR register in +x2APIC mode"), which essentially removed the testcase instead of fixing +the bug. + +WARN if the nodecode path triggers a #GP, as the CPU is supposed to check +reserved bits for ICR when it's partially virtualized. + +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240719235107.3023592-2-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/lapic.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2470,7 +2470,7 @@ void kvm_apic_write_nodecode(struct kvm_ + * maybe-unecessary write, and both are in the noise anyways. + */ + if (apic_x2apic_mode(apic) && offset == APIC_ICR) +- kvm_x2apic_icr_write(apic, kvm_lapic_get_reg64(apic, APIC_ICR)); ++ WARN_ON_ONCE(kvm_x2apic_icr_write(apic, kvm_lapic_get_reg64(apic, APIC_ICR))); + else + kvm_lapic_reg_write(apic, offset, kvm_lapic_get_reg(apic, offset)); + } +@@ -3194,8 +3194,21 @@ int kvm_lapic_set_vapic_addr(struct kvm_ + return 0; + } + ++#define X2APIC_ICR_RESERVED_BITS (GENMASK_ULL(31, 20) | GENMASK_ULL(17, 16) | BIT(13)) ++ + int kvm_x2apic_icr_write(struct kvm_lapic *apic, u64 data) + { ++ if (data & X2APIC_ICR_RESERVED_BITS) ++ return 1; ++ ++ /* ++ * The BUSY bit is reserved on both Intel and AMD in x2APIC mode, but ++ * only AMD requires it to be zero, Intel essentially just ignores the ++ * bit. And if IPI virtualization (Intel) or x2AVIC (AMD) is enabled, ++ * the CPU performs the reserved bits checks, i.e. the underlying CPU ++ * behavior will "win". Arbitrarily clear the BUSY bit, as there is no ++ * sane way to provide consistent behavior with respect to hardware. ++ */ + data &= ~APIC_ICR_BUSY; + + kvm_apic_send_ipi(apic, (u32)data, (u32)(data >> 32)); diff --git a/queue-6.11/kvm-x86-move-x2apic-icr-helper-above-kvm_apic_write_nodecode.patch b/queue-6.11/kvm-x86-move-x2apic-icr-helper-above-kvm_apic_write_nodecode.patch new file mode 100644 index 00000000000..d00afcb1064 --- /dev/null +++ b/queue-6.11/kvm-x86-move-x2apic-icr-helper-above-kvm_apic_write_nodecode.patch @@ -0,0 +1,85 @@ +From d33234342f8b468e719e05649fd26549fb37ef8a Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Fri, 19 Jul 2024 16:50:59 -0700 +Subject: KVM: x86: Move x2APIC ICR helper above kvm_apic_write_nodecode() + +From: Sean Christopherson + +commit d33234342f8b468e719e05649fd26549fb37ef8a upstream. + +Hoist kvm_x2apic_icr_write() above kvm_apic_write_nodecode() so that a +local helper to _read_ the x2APIC ICR can be added and used in the +nodecode path without needing a forward declaration. + +No functional change intended. + +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240719235107.3023592-3-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/lapic.c | 46 +++++++++++++++++++++++----------------------- + 1 file changed, 23 insertions(+), 23 deletions(-) + +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2453,6 +2453,29 @@ void kvm_lapic_set_eoi(struct kvm_vcpu * + } + EXPORT_SYMBOL_GPL(kvm_lapic_set_eoi); + ++#define X2APIC_ICR_RESERVED_BITS (GENMASK_ULL(31, 20) | GENMASK_ULL(17, 16) | BIT(13)) ++ ++int kvm_x2apic_icr_write(struct kvm_lapic *apic, u64 data) ++{ ++ if (data & X2APIC_ICR_RESERVED_BITS) ++ return 1; ++ ++ /* ++ * The BUSY bit is reserved on both Intel and AMD in x2APIC mode, but ++ * only AMD requires it to be zero, Intel essentially just ignores the ++ * bit. And if IPI virtualization (Intel) or x2AVIC (AMD) is enabled, ++ * the CPU performs the reserved bits checks, i.e. the underlying CPU ++ * behavior will "win". Arbitrarily clear the BUSY bit, as there is no ++ * sane way to provide consistent behavior with respect to hardware. ++ */ ++ data &= ~APIC_ICR_BUSY; ++ ++ kvm_apic_send_ipi(apic, (u32)data, (u32)(data >> 32)); ++ kvm_lapic_set_reg64(apic, APIC_ICR, data); ++ trace_kvm_apic_write(APIC_ICR, data); ++ return 0; ++} ++ + /* emulate APIC access in a trap manner */ + void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset) + { +@@ -3194,29 +3217,6 @@ int kvm_lapic_set_vapic_addr(struct kvm_ + return 0; + } + +-#define X2APIC_ICR_RESERVED_BITS (GENMASK_ULL(31, 20) | GENMASK_ULL(17, 16) | BIT(13)) +- +-int kvm_x2apic_icr_write(struct kvm_lapic *apic, u64 data) +-{ +- if (data & X2APIC_ICR_RESERVED_BITS) +- return 1; +- +- /* +- * The BUSY bit is reserved on both Intel and AMD in x2APIC mode, but +- * only AMD requires it to be zero, Intel essentially just ignores the +- * bit. And if IPI virtualization (Intel) or x2AVIC (AMD) is enabled, +- * the CPU performs the reserved bits checks, i.e. the underlying CPU +- * behavior will "win". Arbitrarily clear the BUSY bit, as there is no +- * sane way to provide consistent behavior with respect to hardware. +- */ +- data &= ~APIC_ICR_BUSY; +- +- kvm_apic_send_ipi(apic, (u32)data, (u32)(data >> 32)); +- kvm_lapic_set_reg64(apic, APIC_ICR, data); +- trace_kvm_apic_write(APIC_ICR, data); +- return 0; +-} +- + static int kvm_lapic_msr_read(struct kvm_lapic *apic, u32 reg, u64 *data) + { + u32 low; diff --git a/queue-6.11/kvm-x86-re-split-x2apic-icr-into-icr-icr2-for-amd-x2avic.patch b/queue-6.11/kvm-x86-re-split-x2apic-icr-into-icr-icr2-for-amd-x2avic.patch new file mode 100644 index 00000000000..413184e3d27 --- /dev/null +++ b/queue-6.11/kvm-x86-re-split-x2apic-icr-into-icr-icr2-for-amd-x2avic.patch @@ -0,0 +1,149 @@ +From 73b42dc69be8564d4951a14d00f827929fe5ef79 Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Fri, 19 Jul 2024 16:51:00 -0700 +Subject: KVM: x86: Re-split x2APIC ICR into ICR+ICR2 for AMD (x2AVIC) + +From: Sean Christopherson + +commit 73b42dc69be8564d4951a14d00f827929fe5ef79 upstream. + +Re-introduce the "split" x2APIC ICR storage that KVM used prior to Intel's +IPI virtualization support, but only for AMD. While not stated anywhere +in the APM, despite stating the ICR is a single 64-bit register, AMD CPUs +store the 64-bit ICR as two separate 32-bit values in ICR and ICR2. When +IPI virtualization (IPIv on Intel, all AVIC flavors on AMD) is enabled, +KVM needs to match CPU behavior as some ICR ICR writes will be handled by +the CPU, not by KVM. + +Add a kvm_x86_ops knob to control the underlying format used by the CPU to +store the x2APIC ICR, and tune it to AMD vs. Intel regardless of whether +or not x2AVIC is enabled. If KVM is handling all ICR writes, the storage +format for x2APIC mode doesn't matter, and having the behavior follow AMD +versus Intel will provide better test coverage and ease debugging. + +Fixes: 4d1d7942e36a ("KVM: SVM: Introduce logic to (de)activate x2AVIC mode") +Cc: stable@vger.kernel.org +Cc: Maxim Levitsky +Cc: Suravee Suthikulpanit +Link: https://lore.kernel.org/r/20240719235107.3023592-4-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/kvm_host.h | 2 + + arch/x86/kvm/lapic.c | 42 ++++++++++++++++++++++++++++------------ + arch/x86/kvm/svm/svm.c | 2 + + arch/x86/kvm/vmx/main.c | 2 + + 4 files changed, 36 insertions(+), 12 deletions(-) + +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -1727,6 +1727,8 @@ struct kvm_x86_ops { + void (*enable_nmi_window)(struct kvm_vcpu *vcpu); + void (*enable_irq_window)(struct kvm_vcpu *vcpu); + void (*update_cr8_intercept)(struct kvm_vcpu *vcpu, int tpr, int irr); ++ ++ const bool x2apic_icr_is_split; + const unsigned long required_apicv_inhibits; + bool allow_apicv_in_x2apic_without_x2apic_virtualization; + void (*refresh_apicv_exec_ctrl)(struct kvm_vcpu *vcpu); +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2471,11 +2471,25 @@ int kvm_x2apic_icr_write(struct kvm_lapi + data &= ~APIC_ICR_BUSY; + + kvm_apic_send_ipi(apic, (u32)data, (u32)(data >> 32)); +- kvm_lapic_set_reg64(apic, APIC_ICR, data); ++ if (kvm_x86_ops.x2apic_icr_is_split) { ++ kvm_lapic_set_reg(apic, APIC_ICR, data); ++ kvm_lapic_set_reg(apic, APIC_ICR2, data >> 32); ++ } else { ++ kvm_lapic_set_reg64(apic, APIC_ICR, data); ++ } + trace_kvm_apic_write(APIC_ICR, data); + return 0; + } + ++static u64 kvm_x2apic_icr_read(struct kvm_lapic *apic) ++{ ++ if (kvm_x86_ops.x2apic_icr_is_split) ++ return (u64)kvm_lapic_get_reg(apic, APIC_ICR) | ++ (u64)kvm_lapic_get_reg(apic, APIC_ICR2) << 32; ++ ++ return kvm_lapic_get_reg64(apic, APIC_ICR); ++} ++ + /* emulate APIC access in a trap manner */ + void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset) + { +@@ -2493,7 +2507,7 @@ void kvm_apic_write_nodecode(struct kvm_ + * maybe-unecessary write, and both are in the noise anyways. + */ + if (apic_x2apic_mode(apic) && offset == APIC_ICR) +- WARN_ON_ONCE(kvm_x2apic_icr_write(apic, kvm_lapic_get_reg64(apic, APIC_ICR))); ++ WARN_ON_ONCE(kvm_x2apic_icr_write(apic, kvm_x2apic_icr_read(apic))); + else + kvm_lapic_reg_write(apic, offset, kvm_lapic_get_reg(apic, offset)); + } +@@ -3013,18 +3027,22 @@ static int kvm_apic_state_fixup(struct k + + /* + * In x2APIC mode, the LDR is fixed and based on the id. And +- * ICR is internally a single 64-bit register, but needs to be +- * split to ICR+ICR2 in userspace for backwards compatibility. ++ * if the ICR is _not_ split, ICR is internally a single 64-bit ++ * register, but needs to be split to ICR+ICR2 in userspace for ++ * backwards compatibility. + */ +- if (set) { ++ if (set) + *ldr = kvm_apic_calc_x2apic_ldr(x2apic_id); + +- icr = __kvm_lapic_get_reg(s->regs, APIC_ICR) | +- (u64)__kvm_lapic_get_reg(s->regs, APIC_ICR2) << 32; +- __kvm_lapic_set_reg64(s->regs, APIC_ICR, icr); +- } else { +- icr = __kvm_lapic_get_reg64(s->regs, APIC_ICR); +- __kvm_lapic_set_reg(s->regs, APIC_ICR2, icr >> 32); ++ if (!kvm_x86_ops.x2apic_icr_is_split) { ++ if (set) { ++ icr = __kvm_lapic_get_reg(s->regs, APIC_ICR) | ++ (u64)__kvm_lapic_get_reg(s->regs, APIC_ICR2) << 32; ++ __kvm_lapic_set_reg64(s->regs, APIC_ICR, icr); ++ } else { ++ icr = __kvm_lapic_get_reg64(s->regs, APIC_ICR); ++ __kvm_lapic_set_reg(s->regs, APIC_ICR2, icr >> 32); ++ } + } + } + +@@ -3222,7 +3240,7 @@ static int kvm_lapic_msr_read(struct kvm + u32 low; + + if (reg == APIC_ICR) { +- *data = kvm_lapic_get_reg64(apic, APIC_ICR); ++ *data = kvm_x2apic_icr_read(apic); + return 0; + } + +--- a/arch/x86/kvm/svm/svm.c ++++ b/arch/x86/kvm/svm/svm.c +@@ -5062,6 +5062,8 @@ static struct kvm_x86_ops svm_x86_ops __ + .enable_nmi_window = svm_enable_nmi_window, + .enable_irq_window = svm_enable_irq_window, + .update_cr8_intercept = svm_update_cr8_intercept, ++ ++ .x2apic_icr_is_split = true, + .set_virtual_apic_mode = avic_refresh_virtual_apic_mode, + .refresh_apicv_exec_ctrl = avic_refresh_apicv_exec_ctrl, + .apicv_post_state_restore = avic_apicv_post_state_restore, +--- a/arch/x86/kvm/vmx/main.c ++++ b/arch/x86/kvm/vmx/main.c +@@ -89,6 +89,8 @@ struct kvm_x86_ops vt_x86_ops __initdata + .enable_nmi_window = vmx_enable_nmi_window, + .enable_irq_window = vmx_enable_irq_window, + .update_cr8_intercept = vmx_update_cr8_intercept, ++ ++ .x2apic_icr_is_split = false, + .set_virtual_apic_mode = vmx_set_virtual_apic_mode, + .set_apic_access_page_addr = vmx_set_apic_access_page_addr, + .refresh_apicv_exec_ctrl = vmx_refresh_apicv_exec_ctrl, diff --git a/queue-6.11/pci-clear-the-lbms-bit-after-a-link-retrain.patch b/queue-6.11/pci-clear-the-lbms-bit-after-a-link-retrain.patch new file mode 100644 index 00000000000..a6e19fabce8 --- /dev/null +++ b/queue-6.11/pci-clear-the-lbms-bit-after-a-link-retrain.patch @@ -0,0 +1,67 @@ +From 8037ac08c2bbb3186f83a5a924f52d1048dbaec5 Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Fri, 9 Aug 2024 14:24:46 +0100 +Subject: PCI: Clear the LBMS bit after a link retrain +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej W. Rozycki + +commit 8037ac08c2bbb3186f83a5a924f52d1048dbaec5 upstream. + +The LBMS bit, where implemented, is set by hardware either in response +to the completion of retraining caused by writing 1 to the Retrain Link +bit or whenever hardware has changed the link speed or width in attempt +to correct unreliable link operation. It is never cleared by hardware +other than by software writing 1 to the bit position in the Link Status +register and we never do such a write. + +We currently have two places, namely apply_bad_link_workaround() and +pcie_failed_link_retrain() in drivers/pci/controller/dwc/pcie-tegra194.c +and drivers/pci/quirks.c respectively where we check the state of the LBMS +bit and neither is interested in the state of the bit resulting from the +completion of retraining, both check for a link fault. + +And in particular pcie_failed_link_retrain() causes issues consequently, by +trying to retrain a link where there's no downstream device anymore and the +state of 1 in the LBMS bit has been retained from when there was a device +downstream that has since been removed. + +Clear the LBMS bit then at the conclusion of pcie_retrain_link(), so that +we have a single place that controls it and that our code can track link +speed or width changes resulting from unreliable link operation. + +Fixes: a89c82249c37 ("PCI: Work around PCIe link training failures") +Link: https://lore.kernel.org/r/alpine.DEB.2.21.2408091133140.61955@angie.orcam.me.uk +Reported-by: Matthew W Carlis +Link: https://lore.kernel.org/r/20240806000659.30859-1-mattc@purestorage.com/ +Link: https://lore.kernel.org/r/20240722193407.23255-1-mattc@purestorage.com/ +Signed-off-by: Maciej W. Rozycki +Signed-off-by: Bjorn Helgaas +Signed-off-by: Krzysztof Wilczyński +Cc: # v6.5+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/pci.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -4718,7 +4718,15 @@ int pcie_retrain_link(struct pci_dev *pd + pcie_capability_clear_word(pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_RL); + } + +- return pcie_wait_for_link_status(pdev, use_lt, !use_lt); ++ rc = pcie_wait_for_link_status(pdev, use_lt, !use_lt); ++ ++ /* ++ * Clear LBMS after a manual retrain so that the bit can be used ++ * to track link speed or width changes made by hardware itself ++ * in attempt to correct unreliable link operation. ++ */ ++ pcie_capability_write_word(pdev, PCI_EXP_LNKSTA, PCI_EXP_LNKSTA_LBMS); ++ return rc; + } + + /** diff --git a/queue-6.11/pci-correct-error-reporting-with-pcie-failed-link-retraining.patch b/queue-6.11/pci-correct-error-reporting-with-pcie-failed-link-retraining.patch new file mode 100644 index 00000000000..20231bc6c9c --- /dev/null +++ b/queue-6.11/pci-correct-error-reporting-with-pcie-failed-link-retraining.patch @@ -0,0 +1,79 @@ +From 712e49c967064a3a7a5738c6f65ac540a3f6a1df Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Fri, 9 Aug 2024 14:24:56 +0100 +Subject: PCI: Correct error reporting with PCIe failed link retraining +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej W. Rozycki + +commit 712e49c967064a3a7a5738c6f65ac540a3f6a1df upstream. + +Only return successful completion status from pcie_failed_link_retrain() if +retraining has actually been done, preventing excessive delays from being +triggered at call sites in a hope that communication will finally be +established with the downstream device where in fact nothing has been done +about the link in question that would justify such a hope. + +Fixes: a89c82249c37 ("PCI: Work around PCIe link training failures") +Link: https://lore.kernel.org/r/alpine.DEB.2.21.2408091133260.61955@angie.orcam.me.uk +Reported-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/aa2d1c4e-9961-d54a-00c7-ddf8e858a9b0@linux.intel.com/ +Signed-off-by: Maciej W. Rozycki +Signed-off-by: Bjorn Helgaas +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Ilpo Järvinen +Cc: # v6.5+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/quirks.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -78,7 +78,8 @@ + * again to remove any residual state, ignoring the result as it's supposed + * to fail anyway. + * +- * Return TRUE if the link has been successfully retrained, otherwise FALSE. ++ * Return TRUE if the link has been successfully retrained. Return FALSE ++ * if retraining was not needed or we attempted a retrain and it failed. + */ + bool pcie_failed_link_retrain(struct pci_dev *dev) + { +@@ -87,6 +88,7 @@ bool pcie_failed_link_retrain(struct pci + {} + }; + u16 lnksta, lnkctl2; ++ bool ret = false; + + if (!pci_is_pcie(dev) || !pcie_downstream_port(dev) || + !pcie_cap_has_lnkctl2(dev) || !dev->link_active_reporting) +@@ -104,7 +106,8 @@ bool pcie_failed_link_retrain(struct pci + lnkctl2 |= PCI_EXP_LNKCTL2_TLS_2_5GT; + pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, lnkctl2); + +- if (pcie_retrain_link(dev, false)) { ++ ret = pcie_retrain_link(dev, false) == 0; ++ if (!ret) { + pci_info(dev, "retraining failed\n"); + pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, + oldlnkctl2); +@@ -126,13 +129,14 @@ bool pcie_failed_link_retrain(struct pci + lnkctl2 |= lnkcap & PCI_EXP_LNKCAP_SLS; + pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, lnkctl2); + +- if (pcie_retrain_link(dev, false)) { ++ ret = pcie_retrain_link(dev, false) == 0; ++ if (!ret) { + pci_info(dev, "retraining failed\n"); + return false; + } + } + +- return true; ++ return ret; + } + + static ktime_t fixup_debug_start(struct pci_dev *dev, diff --git a/queue-6.11/pci-dra7xx-fix-error-handling-when-irq-request-fails-in-probe.patch b/queue-6.11/pci-dra7xx-fix-error-handling-when-irq-request-fails-in-probe.patch new file mode 100644 index 00000000000..e9a62822a8a --- /dev/null +++ b/queue-6.11/pci-dra7xx-fix-error-handling-when-irq-request-fails-in-probe.patch @@ -0,0 +1,57 @@ +From 4d60f6d4b8fa4d7bad4aeb2b3ee5c10425bc60a4 Mon Sep 17 00:00:00 2001 +From: Siddharth Vadapalli +Date: Tue, 27 Aug 2024 17:54:22 +0530 +Subject: PCI: dra7xx: Fix error handling when IRQ request fails in probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Siddharth Vadapalli + +commit 4d60f6d4b8fa4d7bad4aeb2b3ee5c10425bc60a4 upstream. + +Commit d4c7d1a089d6 ("PCI: dwc: dra7xx: Push request_irq() +call to the bottom of probe") moved the IRQ request for +"dra7xx-pcie-main" towards the end of dra7xx_pcie_probe(). + +However, the error handling does not take into account the +initialization performed by either dra7xx_add_pcie_port() or +dra7xx_add_pcie_ep(), depending on the mode of operation. + +Fix the error handling to address this. + +Fixes: d4c7d1a089d6 ("PCI: dwc: dra7xx: Push request_irq() call to the bottom of probe") +Link: https://lore.kernel.org/linux-pci/20240827122422.985547-3-s-vadapalli@ti.com +Tested-by: Udit Kumar +Signed-off-by: Siddharth Vadapalli +[kwilczynski: commit log] +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Kevin Hilman +Reviewed-by: Manivannan Sadhasivam +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/dwc/pci-dra7xx.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/pci/controller/dwc/pci-dra7xx.c ++++ b/drivers/pci/controller/dwc/pci-dra7xx.c +@@ -854,11 +854,17 @@ static int dra7xx_pcie_probe(struct plat + "dra7xx-pcie-main", dra7xx); + if (ret) { + dev_err(dev, "failed to request irq\n"); +- goto err_gpio; ++ goto err_deinit; + } + + return 0; + ++err_deinit: ++ if (dra7xx->mode == DW_PCIE_RC_TYPE) ++ dw_pcie_host_deinit(&dra7xx->pci->pp); ++ else ++ dw_pcie_ep_deinit(&dra7xx->pci->ep); ++ + err_gpio: + err_get_sync: + pm_runtime_put(dev); diff --git a/queue-6.11/pci-dra7xx-fix-threaded-irq-request-for-dra7xx-pcie-main-irq.patch b/queue-6.11/pci-dra7xx-fix-threaded-irq-request-for-dra7xx-pcie-main-irq.patch new file mode 100644 index 00000000000..10ca8ec78c9 --- /dev/null +++ b/queue-6.11/pci-dra7xx-fix-threaded-irq-request-for-dra7xx-pcie-main-irq.patch @@ -0,0 +1,45 @@ +From 03f84b3baba7836bdfc162c19288d5ce1aa92890 Mon Sep 17 00:00:00 2001 +From: Siddharth Vadapalli +Date: Tue, 27 Aug 2024 17:54:21 +0530 +Subject: PCI: dra7xx: Fix threaded IRQ request for "dra7xx-pcie-main" IRQ +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Siddharth Vadapalli + +commit 03f84b3baba7836bdfc162c19288d5ce1aa92890 upstream. + +Commit da87d35a6e51 ("PCI: dra7xx: Use threaded IRQ handler for +"dra7xx-pcie-main" IRQ") switched from devm_request_irq() to +devm_request_threaded_irq() for the "dra7xx-pcie-main" interrupt. + +Since the primary handler was set to NULL, the "IRQF_ONESHOT" flag +should have also been set. Fix this. + +Fixes: da87d35a6e51 ("PCI: dra7xx: Use threaded IRQ handler for "dra7xx-pcie-main" IRQ") +Suggested-by: Vignesh Raghavendra +Link: https://lore.kernel.org/linux-pci/20240827122422.985547-2-s-vadapalli@ti.com +Reported-by: Udit Kumar +Signed-off-by: Siddharth Vadapalli +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Kevin Hilman +Reviewed-by: Manivannan Sadhasivam +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/dwc/pci-dra7xx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/pci/controller/dwc/pci-dra7xx.c ++++ b/drivers/pci/controller/dwc/pci-dra7xx.c +@@ -850,7 +850,8 @@ static int dra7xx_pcie_probe(struct plat + dra7xx->mode = mode; + + ret = devm_request_threaded_irq(dev, irq, NULL, dra7xx_pcie_irq_handler, +- IRQF_SHARED, "dra7xx-pcie-main", dra7xx); ++ IRQF_SHARED | IRQF_ONESHOT, ++ "dra7xx-pcie-main", dra7xx); + if (ret) { + dev_err(dev, "failed to request irq\n"); + goto err_gpio; diff --git a/queue-6.11/pci-imx6-fix-establish-link-failure-in-ep-mode-for-i.mx8mm-and-i.mx8mp.patch b/queue-6.11/pci-imx6-fix-establish-link-failure-in-ep-mode-for-i.mx8mm-and-i.mx8mp.patch new file mode 100644 index 00000000000..f4689fc5694 --- /dev/null +++ b/queue-6.11/pci-imx6-fix-establish-link-failure-in-ep-mode-for-i.mx8mm-and-i.mx8mp.patch @@ -0,0 +1,53 @@ +From 5214ff221a14cadab1e2ee29499750fd5e884feb Mon Sep 17 00:00:00 2001 +From: Richard Zhu +Date: Mon, 29 Jul 2024 16:18:08 -0400 +Subject: PCI: imx6: Fix establish link failure in EP mode for i.MX8MM and i.MX8MP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Richard Zhu + +commit 5214ff221a14cadab1e2ee29499750fd5e884feb upstream. + +Add IMX6_PCIE_FLAG_HAS_APP_RESET flag to IMX8MM_EP and IMX8MP_EP drvdata. + +This flag was overlooked during code restructuring. It is crucial to +release the app-reset from the System Reset Controller before initiating +LTSSM to rectify the issue. + +Fixes: 0c9651c21f2a ("PCI: imx6: Simplify reset handling by using *_FLAG_HAS_*_RESET") +Link: https://lore.kernel.org/linux-pci/20240729-pci2_upstream-v8-1-b68ee5ef2b4d@nxp.com +Signed-off-by: Richard Zhu +Signed-off-by: Frank Li +[kwilczynski: commit log] +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Manivannan Sadhasivam +Cc: # 6.9+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/dwc/pci-imx6.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -1563,7 +1563,8 @@ static const struct imx6_pcie_drvdata dr + }, + [IMX8MM_EP] = { + .variant = IMX8MM_EP, +- .flags = IMX6_PCIE_FLAG_HAS_PHYDRV, ++ .flags = IMX6_PCIE_FLAG_HAS_APP_RESET | ++ IMX6_PCIE_FLAG_HAS_PHYDRV, + .mode = DW_PCIE_EP_TYPE, + .gpr = "fsl,imx8mm-iomuxc-gpr", + .clk_names = imx8mm_clks, +@@ -1574,7 +1575,8 @@ static const struct imx6_pcie_drvdata dr + }, + [IMX8MP_EP] = { + .variant = IMX8MP_EP, +- .flags = IMX6_PCIE_FLAG_HAS_PHYDRV, ++ .flags = IMX6_PCIE_FLAG_HAS_APP_RESET | ++ IMX6_PCIE_FLAG_HAS_PHYDRV, + .mode = DW_PCIE_EP_TYPE, + .gpr = "fsl,imx8mp-iomuxc-gpr", + .clk_names = imx8mm_clks, diff --git a/queue-6.11/pci-imx6-fix-i.mx8mp-pcie-ep-s-occasional-failure-to-trigger-msi.patch b/queue-6.11/pci-imx6-fix-i.mx8mp-pcie-ep-s-occasional-failure-to-trigger-msi.patch new file mode 100644 index 00000000000..1e0f6df5d48 --- /dev/null +++ b/queue-6.11/pci-imx6-fix-i.mx8mp-pcie-ep-s-occasional-failure-to-trigger-msi.patch @@ -0,0 +1,47 @@ +From 5cb3aa92c7cf182940ae575c3f450d3708af087c Mon Sep 17 00:00:00 2001 +From: Richard Zhu +Date: Mon, 29 Jul 2024 16:18:09 -0400 +Subject: PCI: imx6: Fix i.MX8MP PCIe EP's occasional failure to trigger MSI +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Richard Zhu + +commit 5cb3aa92c7cf182940ae575c3f450d3708af087c upstream. + +Correct occasional MSI triggering failures in i.MX8MP PCIe EP by applying +the correct hardware outbound alignment requirement. + +The i.MX platform has a restriction about outbound address translation. The +pci-epc-mem uses page_size to manage it. Set the correct page_size for i.MX +platform to meet the hardware requirement, which is the same as inbound +address alignment. + +Thus, align it with epc_features::align. + +Fixes: 1bd0d43dcf3b ("PCI: imx6: Clean up addr_space retrieval code") +Link: https://lore.kernel.org/linux-pci/20240729-pci2_upstream-v8-2-b68ee5ef2b4d@nxp.com +Signed-off-by: Richard Zhu +Signed-off-by: Frank Li +[kwilczynski: commit log] +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Manivannan Sadhasivam +Acked-by: Jason Liu +Cc: # 6.9+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/dwc/pci-imx6.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -1114,6 +1114,8 @@ static int imx6_add_pcie_ep(struct imx6_ + if (imx6_check_flag(imx6_pcie, IMX6_PCIE_FLAG_SUPPORT_64BIT)) + dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64)); + ++ ep->page_size = imx6_pcie->drvdata->epc_features->align; ++ + ret = dw_pcie_ep_init(ep); + if (ret) { + dev_err(dev, "failed to initialize endpoint\n"); diff --git a/queue-6.11/pci-imx6-fix-missing-call-to-phy_power_off-in-error-handling.patch b/queue-6.11/pci-imx6-fix-missing-call-to-phy_power_off-in-error-handling.patch new file mode 100644 index 00000000000..7d3ac660833 --- /dev/null +++ b/queue-6.11/pci-imx6-fix-missing-call-to-phy_power_off-in-error-handling.patch @@ -0,0 +1,51 @@ +From 5b04d44d5c74e4d8aab1678496b84700b4b343fe Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Mon, 29 Jul 2024 16:18:10 -0400 +Subject: PCI: imx6: Fix missing call to phy_power_off() in error handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frank Li + +commit 5b04d44d5c74e4d8aab1678496b84700b4b343fe upstream. + +Fix missing call to phy_power_off() in the error path of +imx6_pcie_host_init(). Remove unnecessary check for imx6_pcie->phy +as the PHY API already handles NULL pointers. + +Fixes: cbcf8722b523 ("phy: freescale: imx8m-pcie: Fix the wrong order of phy_init() and phy_power_on()") +Link: https://lore.kernel.org/linux-pci/20240729-pci2_upstream-v8-3-b68ee5ef2b4d@nxp.com +Signed-off-by: Frank Li +[kwilczynski: commit log] +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Manivannan Sadhasivam +Cc: # 6.1+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/dwc/pci-imx6.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -953,7 +953,7 @@ static int imx6_pcie_host_init(struct dw + ret = phy_power_on(imx6_pcie->phy); + if (ret) { + dev_err(dev, "waiting for PHY ready timeout!\n"); +- goto err_phy_off; ++ goto err_phy_exit; + } + } + +@@ -968,8 +968,9 @@ static int imx6_pcie_host_init(struct dw + return 0; + + err_phy_off: +- if (imx6_pcie->phy) +- phy_exit(imx6_pcie->phy); ++ phy_power_off(imx6_pcie->phy); ++err_phy_exit: ++ phy_exit(imx6_pcie->phy); + err_clk_disable: + imx6_pcie_clk_disable(imx6_pcie); + err_reg_disable: diff --git a/queue-6.11/pci-revert-to-the-original-speed-after-pcie-failed-link-retraining.patch b/queue-6.11/pci-revert-to-the-original-speed-after-pcie-failed-link-retraining.patch new file mode 100644 index 00000000000..e9e489f8473 --- /dev/null +++ b/queue-6.11/pci-revert-to-the-original-speed-after-pcie-failed-link-retraining.patch @@ -0,0 +1,82 @@ +From f68dea13405c94381d08f42dbf0416261622bdad Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Fri, 9 Aug 2024 14:24:51 +0100 +Subject: PCI: Revert to the original speed after PCIe failed link retraining +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej W. Rozycki + +commit f68dea13405c94381d08f42dbf0416261622bdad upstream. + +When `pcie_failed_link_retrain' has failed to retrain the link by hand +it leaves the link speed restricted to 2.5GT/s, which will then affect +any device that has been plugged in later on, which may not suffer from +the problem that caused the speed restriction to have been attempted. +Consequently such a downstream device will suffer from an unnecessary +communication throughput limitation and therefore performance loss. + +Remove the speed restriction then and revert the Link Control 2 register +to its original state if link retraining with the speed restriction in +place has failed. Retrain the link again afterwards so as to remove any +residual state, waiting on LT rather than DLLLA to avoid an excessive +delay and ignoring the result as this training is supposed to fail +anyway. + +Fixes: a89c82249c37 ("PCI: Work around PCIe link training failures") +Link: https://lore.kernel.org/linux-pci/alpine.DEB.2.21.2408251412590.30766@angie.orcam.me.uk +Reported-by: Matthew W Carlis +Link: https://lore.kernel.org/r/20240806000659.30859-1-mattc@purestorage.com/ +Link: https://lore.kernel.org/r/20240722193407.23255-1-mattc@purestorage.com/ +Signed-off-by: Maciej W. Rozycki +Signed-off-by: Bjorn Helgaas +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Ilpo Järvinen +Cc: # v6.5+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/quirks.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -66,7 +66,7 @@ + * apply this erratum workaround to any downstream ports as long as they + * support Link Active reporting and have the Link Control 2 register. + * Restrict the speed to 2.5GT/s then with the Target Link Speed field, +- * request a retrain and wait 200ms for the data link to go up. ++ * request a retrain and check the result. + * + * If this turns out successful and we know by the Vendor:Device ID it is + * safe to do so, then lift the restriction, letting the devices negotiate +@@ -74,6 +74,10 @@ + * firmware may have already arranged and lift it with ports that already + * report their data link being up. + * ++ * Otherwise revert the speed to the original setting and request a retrain ++ * again to remove any residual state, ignoring the result as it's supposed ++ * to fail anyway. ++ * + * Return TRUE if the link has been successfully retrained, otherwise FALSE. + */ + bool pcie_failed_link_retrain(struct pci_dev *dev) +@@ -92,6 +96,8 @@ bool pcie_failed_link_retrain(struct pci + pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta); + if ((lnksta & (PCI_EXP_LNKSTA_LBMS | PCI_EXP_LNKSTA_DLLLA)) == + PCI_EXP_LNKSTA_LBMS) { ++ u16 oldlnkctl2 = lnkctl2; ++ + pci_info(dev, "broken device, retraining non-functional downstream link at 2.5GT/s\n"); + + lnkctl2 &= ~PCI_EXP_LNKCTL2_TLS; +@@ -100,6 +106,9 @@ bool pcie_failed_link_retrain(struct pci + + if (pcie_retrain_link(dev, false)) { + pci_info(dev, "retraining failed\n"); ++ pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, ++ oldlnkctl2); ++ pcie_retrain_link(dev, true); + return false; + } + diff --git a/queue-6.11/pci-use-an-error-code-with-pcie-failed-link-retraining.patch b/queue-6.11/pci-use-an-error-code-with-pcie-failed-link-retraining.patch new file mode 100644 index 00000000000..3a0b0dc3d2b --- /dev/null +++ b/queue-6.11/pci-use-an-error-code-with-pcie-failed-link-retraining.patch @@ -0,0 +1,127 @@ +From 59100eb248c0b15585affa546c7f6834b30eb5a4 Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Fri, 9 Aug 2024 14:25:02 +0100 +Subject: PCI: Use an error code with PCIe failed link retraining +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej W. Rozycki + +commit 59100eb248c0b15585affa546c7f6834b30eb5a4 upstream. + +Given how the call place in pcie_wait_for_link_delay() got structured now, +and that pcie_retrain_link() returns a potentially useful error code, +convert pcie_failed_link_retrain() to return an error code rather than a +boolean status, fixing handling at the call site mentioned. Update the +other call site accordingly. + +Fixes: 1abb47390350 ("Merge branch 'pci/enumeration'") +Link: https://lore.kernel.org/r/alpine.DEB.2.21.2408091156530.61955@angie.orcam.me.uk +Reported-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/aa2d1c4e-9961-d54a-00c7-ddf8e858a9b0@linux.intel.com/ +Signed-off-by: Maciej W. Rozycki +Signed-off-by: Bjorn Helgaas +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Ilpo Järvinen +Cc: # v6.5+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/pci.c | 2 +- + drivers/pci/pci.h | 6 +++--- + drivers/pci/quirks.c | 20 ++++++++++---------- + 3 files changed, 14 insertions(+), 14 deletions(-) + +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1324,7 +1324,7 @@ static int pci_dev_wait(struct pci_dev * + if (delay > PCI_RESET_WAIT) { + if (retrain) { + retrain = false; +- if (pcie_failed_link_retrain(bridge)) { ++ if (pcie_failed_link_retrain(bridge) == 0) { + delay = 1; + continue; + } +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -606,7 +606,7 @@ void pci_acs_init(struct pci_dev *dev); + int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags); + int pci_dev_specific_enable_acs(struct pci_dev *dev); + int pci_dev_specific_disable_acs_redir(struct pci_dev *dev); +-bool pcie_failed_link_retrain(struct pci_dev *dev); ++int pcie_failed_link_retrain(struct pci_dev *dev); + #else + static inline int pci_dev_specific_acs_enabled(struct pci_dev *dev, + u16 acs_flags) +@@ -621,9 +621,9 @@ static inline int pci_dev_specific_disab + { + return -ENOTTY; + } +-static inline bool pcie_failed_link_retrain(struct pci_dev *dev) ++static inline int pcie_failed_link_retrain(struct pci_dev *dev) + { +- return false; ++ return -ENOTTY; + } + #endif + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -78,21 +78,21 @@ + * again to remove any residual state, ignoring the result as it's supposed + * to fail anyway. + * +- * Return TRUE if the link has been successfully retrained. Return FALSE ++ * Return 0 if the link has been successfully retrained. Return an error + * if retraining was not needed or we attempted a retrain and it failed. + */ +-bool pcie_failed_link_retrain(struct pci_dev *dev) ++int pcie_failed_link_retrain(struct pci_dev *dev) + { + static const struct pci_device_id ids[] = { + { PCI_VDEVICE(ASMEDIA, 0x2824) }, /* ASMedia ASM2824 */ + {} + }; + u16 lnksta, lnkctl2; +- bool ret = false; ++ int ret = -ENOTTY; + + if (!pci_is_pcie(dev) || !pcie_downstream_port(dev) || + !pcie_cap_has_lnkctl2(dev) || !dev->link_active_reporting) +- return false; ++ return ret; + + pcie_capability_read_word(dev, PCI_EXP_LNKCTL2, &lnkctl2); + pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta); +@@ -106,13 +106,13 @@ bool pcie_failed_link_retrain(struct pci + lnkctl2 |= PCI_EXP_LNKCTL2_TLS_2_5GT; + pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, lnkctl2); + +- ret = pcie_retrain_link(dev, false) == 0; +- if (!ret) { ++ ret = pcie_retrain_link(dev, false); ++ if (ret) { + pci_info(dev, "retraining failed\n"); + pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, + oldlnkctl2); + pcie_retrain_link(dev, true); +- return false; ++ return ret; + } + + pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta); +@@ -129,10 +129,10 @@ bool pcie_failed_link_retrain(struct pci + lnkctl2 |= lnkcap & PCI_EXP_LNKCAP_SLS; + pcie_capability_write_word(dev, PCI_EXP_LNKCTL2, lnkctl2); + +- ret = pcie_retrain_link(dev, false) == 0; +- if (!ret) { ++ ret = pcie_retrain_link(dev, false); ++ if (ret) { + pci_info(dev, "retraining failed\n"); +- return false; ++ return ret; + } + } + diff --git a/queue-6.11/pci-xilinx-nwl-fix-off-by-one-in-intx-irq-handler.patch b/queue-6.11/pci-xilinx-nwl-fix-off-by-one-in-intx-irq-handler.patch new file mode 100644 index 00000000000..300ee033953 --- /dev/null +++ b/queue-6.11/pci-xilinx-nwl-fix-off-by-one-in-intx-irq-handler.patch @@ -0,0 +1,68 @@ +From 0199d2f2bd8cd97b310f7ed82a067247d7456029 Mon Sep 17 00:00:00 2001 +From: Sean Anderson +Date: Fri, 31 May 2024 12:13:32 -0400 +Subject: PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler + +From: Sean Anderson + +commit 0199d2f2bd8cd97b310f7ed82a067247d7456029 upstream. + +MSGF_LEG_MASK is laid out with INTA in bit 0, INTB in bit 1, INTC in bit 2, +and INTD in bit 3. Hardware IRQ numbers start at 0, and we register +PCI_NUM_INTX IRQs. So to enable INTA (aka hwirq 0) we should set bit 0. +Remove the subtraction of one. + +This bug would cause INTx interrupts not to be delivered, as enabling INTB +would actually enable INTA, and enabling INTA wouldn't enable anything at +all. It is likely that this got overlooked for so long since most PCIe +hardware uses MSIs. This fixes the following UBSAN error: + + UBSAN: shift-out-of-bounds in ../drivers/pci/controller/pcie-xilinx-nwl.c:389:11 + shift exponent 18446744073709551615 is too large for 32-bit type 'int' + CPU: 1 PID: 61 Comm: kworker/u10:1 Not tainted 6.6.20+ #268 + Hardware name: xlnx,zynqmp (DT) + Workqueue: events_unbound deferred_probe_work_func + Call trace: + dump_backtrace (arch/arm64/kernel/stacktrace.c:235) + show_stack (arch/arm64/kernel/stacktrace.c:242) + dump_stack_lvl (lib/dump_stack.c:107) + dump_stack (lib/dump_stack.c:114) + __ubsan_handle_shift_out_of_bounds (lib/ubsan.c:218 lib/ubsan.c:387) + nwl_unmask_leg_irq (drivers/pci/controller/pcie-xilinx-nwl.c:389 (discriminator 1)) + irq_enable (kernel/irq/internals.h:234 kernel/irq/chip.c:170 kernel/irq/chip.c:439 kernel/irq/chip.c:432 kernel/irq/chip.c:345) + __irq_startup (kernel/irq/internals.h:239 kernel/irq/chip.c:180 kernel/irq/chip.c:250) + irq_startup (kernel/irq/chip.c:270) + __setup_irq (kernel/irq/manage.c:1800) + request_threaded_irq (kernel/irq/manage.c:2206) + pcie_pme_probe (include/linux/interrupt.h:168 drivers/pci/pcie/pme.c:348) + +Fixes: 9a181e1093af ("PCI: xilinx-nwl: Modify IRQ chip for legacy interrupts") +Link: https://lore.kernel.org/r/20240531161337.864994-3-sean.anderson@linux.dev +Signed-off-by: Sean Anderson +Signed-off-by: Bjorn Helgaas +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/pcie-xilinx-nwl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/pci/controller/pcie-xilinx-nwl.c ++++ b/drivers/pci/controller/pcie-xilinx-nwl.c +@@ -371,7 +371,7 @@ static void nwl_mask_intx_irq(struct irq + u32 mask; + u32 val; + +- mask = 1 << (data->hwirq - 1); ++ mask = 1 << data->hwirq; + raw_spin_lock_irqsave(&pcie->leg_mask_lock, flags); + val = nwl_bridge_readl(pcie, MSGF_LEG_MASK); + nwl_bridge_writel(pcie, (val & (~mask)), MSGF_LEG_MASK); +@@ -385,7 +385,7 @@ static void nwl_unmask_intx_irq(struct i + u32 mask; + u32 val; + +- mask = 1 << (data->hwirq - 1); ++ mask = 1 << data->hwirq; + raw_spin_lock_irqsave(&pcie->leg_mask_lock, flags); + val = nwl_bridge_readl(pcie, MSGF_LEG_MASK); + nwl_bridge_writel(pcie, (val | mask), MSGF_LEG_MASK); diff --git a/queue-6.11/revert-f2fs-use-flush-command-instead-of-fua-for-zoned-device.patch b/queue-6.11/revert-f2fs-use-flush-command-instead-of-fua-for-zoned-device.patch new file mode 100644 index 00000000000..8da3994bcb8 --- /dev/null +++ b/queue-6.11/revert-f2fs-use-flush-command-instead-of-fua-for-zoned-device.patch @@ -0,0 +1,51 @@ +From b722ff8ad66cf9beba971d9eb4bb7b5e6265ae5c Mon Sep 17 00:00:00 2001 +From: Wenjie Cheng +Date: Fri, 14 Jun 2024 00:48:41 +0000 +Subject: Revert "f2fs: use flush command instead of FUA for zoned device" + +From: Wenjie Cheng + +commit b722ff8ad66cf9beba971d9eb4bb7b5e6265ae5c upstream. + +This reverts commit c550e25bca660ed2554cbb48d32b82d0bb98e4b1. + +Commit c550e25bca660ed2554cbb48d32b82d0bb98e4b1 ("f2fs: use flush +command instead of FUA for zoned device") used additional flush +command to keep write order. + +Since Commit dd291d77cc90eb6a86e9860ba8e6e38eebd57d12 ("block: +Introduce zone write plugging") has enabled the block layer to +handle this order issue, there is no need to use flush command. + +Signed-off-by: Wenjie Cheng +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/file.c | 3 +-- + fs/f2fs/node.c | 2 +- + 2 files changed, 2 insertions(+), 3 deletions(-) + +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -376,8 +376,7 @@ sync_nodes: + f2fs_remove_ino_entry(sbi, ino, APPEND_INO); + clear_inode_flag(inode, FI_APPEND_WRITE); + flush_out: +- if ((!atomic && F2FS_OPTION(sbi).fsync_mode != FSYNC_MODE_NOBARRIER) || +- (atomic && !test_opt(sbi, NOBARRIER) && f2fs_sb_has_blkzoned(sbi))) ++ if (!atomic && F2FS_OPTION(sbi).fsync_mode != FSYNC_MODE_NOBARRIER) + ret = f2fs_issue_flush(sbi, inode->i_ino); + if (!ret) { + f2fs_remove_ino_entry(sbi, ino, UPDATE_INO); +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1674,7 +1674,7 @@ static int __write_node_page(struct page + goto redirty_out; + } + +- if (atomic && !test_opt(sbi, NOBARRIER) && !f2fs_sb_has_blkzoned(sbi)) ++ if (atomic && !test_opt(sbi, NOBARRIER)) + fio.op_flags |= REQ_PREFLUSH | REQ_FUA; + + /* should add to global list before clearing PAGECACHE status */ diff --git a/queue-6.11/revert-media-tuners-fix-error-return-code-of-hybrid_tuner_request_state.patch b/queue-6.11/revert-media-tuners-fix-error-return-code-of-hybrid_tuner_request_state.patch new file mode 100644 index 00000000000..f1e4450d831 --- /dev/null +++ b/queue-6.11/revert-media-tuners-fix-error-return-code-of-hybrid_tuner_request_state.patch @@ -0,0 +1,39 @@ +From e25cc4be4616fcf5689622b3226d648aab253cdb Mon Sep 17 00:00:00 2001 +From: Roman Smirnov +Date: Tue, 16 Jul 2024 12:10:40 +0300 +Subject: Revert "media: tuners: fix error return code of hybrid_tuner_request_state()" + +From: Roman Smirnov + +commit e25cc4be4616fcf5689622b3226d648aab253cdb upstream. + +This reverts commit b9302fa7ed979e84b454e4ca92192cf485a4ed41. + +As Fedor Pchelkin pointed out, this commit violates the +convention of using the macro return value, which causes errors. +For example, in functions tda18271_attach(), xc5000_attach(), +simple_tuner_attach(). + +Link: https://lore.kernel.org/linux-media/20240424202031.syigrtrtipbq5f2l@fpc/ +Suggested-by: Fedor Pchelkin +Signed-off-by: Roman Smirnov +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/tuners/tuner-i2c.h | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/media/tuners/tuner-i2c.h ++++ b/drivers/media/tuners/tuner-i2c.h +@@ -133,10 +133,8 @@ static inline int tuner_i2c_xfer_send_re + } \ + if (0 == __ret) { \ + state = kzalloc(sizeof(type), GFP_KERNEL); \ +- if (!state) { \ +- __ret = -ENOMEM; \ ++ if (NULL == state) \ + goto __fail; \ +- } \ + state->i2c_props.addr = i2caddr; \ + state->i2c_props.adap = i2cadap; \ + state->i2c_props.name = devname; \ diff --git a/queue-6.11/revert-soc-qcom-smd-rpm-match-rpmsg-channel-instead-of-compatible.patch b/queue-6.11/revert-soc-qcom-smd-rpm-match-rpmsg-channel-instead-of-compatible.patch new file mode 100644 index 00000000000..e8ccd241a77 --- /dev/null +++ b/queue-6.11/revert-soc-qcom-smd-rpm-match-rpmsg-channel-instead-of-compatible.patch @@ -0,0 +1,83 @@ +From b17155133391d7f6dd18d3fb94a7d492fdec18fa Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Mon, 29 Jul 2024 22:52:14 +0300 +Subject: Revert "soc: qcom: smd-rpm: Match rpmsg channel instead of compatible" + +From: Dmitry Baryshkov + +commit b17155133391d7f6dd18d3fb94a7d492fdec18fa upstream. + +The rpm_requests device nodes have the compatible node. As such the +rpmsg core uses OF modalias instead of a native rpmsg modalias. Thus if +smd-rpm is built as a module, it doesn't get autoloaded for the device. + +Revert the commit bcabe1e09135 ("soc: qcom: smd-rpm: Match rpmsg channel +instead of compatible") + +Fixes: bcabe1e09135 ("soc: qcom: smd-rpm: Match rpmsg channel instead of compatible") +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240729-fix-smd-rpm-v2-1-0776408a94c5@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/qcom/smd-rpm.c | 35 ++++++++++++++++++++++++++--------- + 1 file changed, 26 insertions(+), 9 deletions(-) + +--- a/drivers/soc/qcom/smd-rpm.c ++++ b/drivers/soc/qcom/smd-rpm.c +@@ -196,9 +196,6 @@ static int qcom_smd_rpm_probe(struct rpm + { + struct qcom_smd_rpm *rpm; + +- if (!rpdev->dev.of_node) +- return -EINVAL; +- + rpm = devm_kzalloc(&rpdev->dev, sizeof(*rpm), GFP_KERNEL); + if (!rpm) + return -ENOMEM; +@@ -218,18 +215,38 @@ static void qcom_smd_rpm_remove(struct r + of_platform_depopulate(&rpdev->dev); + } + +-static const struct rpmsg_device_id qcom_smd_rpm_id_table[] = { +- { .name = "rpm_requests", }, +- { /* sentinel */ } ++static const struct of_device_id qcom_smd_rpm_of_match[] = { ++ { .compatible = "qcom,rpm-apq8084" }, ++ { .compatible = "qcom,rpm-ipq6018" }, ++ { .compatible = "qcom,rpm-ipq9574" }, ++ { .compatible = "qcom,rpm-msm8226" }, ++ { .compatible = "qcom,rpm-msm8909" }, ++ { .compatible = "qcom,rpm-msm8916" }, ++ { .compatible = "qcom,rpm-msm8936" }, ++ { .compatible = "qcom,rpm-msm8953" }, ++ { .compatible = "qcom,rpm-msm8974" }, ++ { .compatible = "qcom,rpm-msm8976" }, ++ { .compatible = "qcom,rpm-msm8994" }, ++ { .compatible = "qcom,rpm-msm8996" }, ++ { .compatible = "qcom,rpm-msm8998" }, ++ { .compatible = "qcom,rpm-sdm660" }, ++ { .compatible = "qcom,rpm-sm6115" }, ++ { .compatible = "qcom,rpm-sm6125" }, ++ { .compatible = "qcom,rpm-sm6375" }, ++ { .compatible = "qcom,rpm-qcm2290" }, ++ { .compatible = "qcom,rpm-qcs404" }, ++ {} + }; +-MODULE_DEVICE_TABLE(rpmsg, qcom_smd_rpm_id_table); ++MODULE_DEVICE_TABLE(of, qcom_smd_rpm_of_match); + + static struct rpmsg_driver qcom_smd_rpm_driver = { + .probe = qcom_smd_rpm_probe, + .remove = qcom_smd_rpm_remove, + .callback = qcom_smd_rpm_callback, +- .id_table = qcom_smd_rpm_id_table, +- .drv.name = "qcom_smd_rpm", ++ .drv = { ++ .name = "qcom_smd_rpm", ++ .of_match_table = qcom_smd_rpm_of_match, ++ }, + }; + + static int __init qcom_smd_rpm_init(void) diff --git a/queue-6.11/series b/queue-6.11/series index 650b601fda5..f1d3d957dcc 100644 --- a/queue-6.11/series +++ b/queue-6.11/series @@ -522,3 +522,44 @@ drm-xe-fix-engine_class-bounds-check-again.patch io_uring-sqpoll-do-not-put-cpumask-on-stack.patch selftests-bpf-correctly-move-log-upon-successful-match.patch remove-.orig-pattern-from-.gitignore.patch +pci-revert-to-the-original-speed-after-pcie-failed-link-retraining.patch +pci-clear-the-lbms-bit-after-a-link-retrain.patch +pci-dra7xx-fix-threaded-irq-request-for-dra7xx-pcie-main-irq.patch +pci-imx6-fix-missing-call-to-phy_power_off-in-error-handling.patch +pci-imx6-fix-establish-link-failure-in-ep-mode-for-i.mx8mm-and-i.mx8mp.patch +pci-imx6-fix-i.mx8mp-pcie-ep-s-occasional-failure-to-trigger-msi.patch +pci-correct-error-reporting-with-pcie-failed-link-retraining.patch +pci-use-an-error-code-with-pcie-failed-link-retraining.patch +pci-xilinx-nwl-fix-off-by-one-in-intx-irq-handler.patch +pci-dra7xx-fix-error-handling-when-irq-request-fails-in-probe.patch +revert-soc-qcom-smd-rpm-match-rpmsg-channel-instead-of-compatible.patch +asoc-rt5682-return-devm_of_clk_add_hw_provider-to-transfer-the-error.patch +soc-fsl-cpm1-qmc-update-trnsync-only-in-transparent-mode.patch +soc-fsl-cpm1-tsa-fix-tsa_write8.patch +soc-versatile-integrator-fix-of-node-leak-in-probe-error-path.patch +revert-f2fs-use-flush-command-instead-of-fua-for-zoned-device.patch +revert-media-tuners-fix-error-return-code-of-hybrid_tuner_request_state.patch +iommu-amd-fix-argument-order-in-amd_iommu_dev_flush_pasid_all.patch +iommufd-protect-against-overflow-of-align-during-iova-allocation.patch +input-adp5588-keys-fix-check-on-return-code.patch +input-i8042-add-tuxedo-stellaris-16-gen5-amd-to-i8042-quirk-table.patch +input-i8042-add-tuxedo-stellaris-15-slim-gen6-amd-to-i8042-quirk-table.patch +input-i8042-add-another-board-name-for-tuxedo-stellaris-gen5-amd-line.patch +kvm-arm64-add-memory-length-checks-and-remove-inline-in-do_ffa_mem_xfer.patch +kvm-x86-enforce-x2apic-s-must-be-zero-reserved-icr-bits.patch +kvm-x86-move-x2apic-icr-helper-above-kvm_apic_write_nodecode.patch +kvm-x86-re-split-x2apic-icr-into-icr-icr2-for-amd-x2avic.patch +kvm-use-dedicated-mutex-to-protect-kvm_usage_count-to-avoid-deadlock.patch +drm-amd-display-skip-recompute-dsc-params-if-no-stream-on-link.patch +drm-amdgpu-mes12-reduce-timeout.patch +drm-amdgpu-mes11-reduce-timeout.patch +drm-amdkfd-add-sdma-queue-quantum-support-for-gfx12.patch +drm-amdgpu-update-golden-regs-for-gfx12.patch +drm-amdgpu-mes12-set-enable_level_process_quantum_check.patch +drm-amdgpu-vcn-enable-av1-on-both-instances.patch +drm-amd-pm-update-workload-mask-after-the-setting.patch +drm-amdgpu-fix-pte-copy-corruption-for-sdma-7.patch +drm-amdgpu-bump-driver-version-for-cleared-vram.patch +drm-amdgpu-mes12-switch-set_shader_debugger-pkt-to-mes-schq-pipe.patch +drm-amdgpu-fix-selfring-initialization-sequence-on-soc24.patch +drm-amd-display-add-hdmi-dsc-native-ycbcr422-support.patch diff --git a/queue-6.11/soc-fsl-cpm1-qmc-update-trnsync-only-in-transparent-mode.patch b/queue-6.11/soc-fsl-cpm1-qmc-update-trnsync-only-in-transparent-mode.patch new file mode 100644 index 00000000000..d65b9276a97 --- /dev/null +++ b/queue-6.11/soc-fsl-cpm1-qmc-update-trnsync-only-in-transparent-mode.patch @@ -0,0 +1,71 @@ +From c3cc3e69b33fee3d276895e0e2d1a8fb37ea5d0e Mon Sep 17 00:00:00 2001 +From: Herve Codina +Date: Thu, 8 Aug 2024 09:10:54 +0200 +Subject: soc: fsl: cpm1: qmc: Update TRNSYNC only in transparent mode + +From: Herve Codina + +commit c3cc3e69b33fee3d276895e0e2d1a8fb37ea5d0e upstream. + +The TRNSYNC feature is available (and enabled) only in transparent mode. + +Since commit 7cc9bda9c163 ("soc: fsl: cpm1: qmc: Handle timeslot entries +at channel start() and stop()") TRNSYNC register is updated in +transparent and hdlc mode. In hdlc mode, the address of the TRNSYNC +register is used by the QMC for other internal purpose. Even if no weird +results were observed in hdlc mode, touching this register in this mode +is wrong. + +Update TRNSYNC only in transparent mode. + +Fixes: 7cc9bda9c163 ("soc: fsl: cpm1: qmc: Handle timeslot entries at channel start() and stop()") +Cc: stable@vger.kernel.org +Signed-off-by: Herve Codina +Reviewed-by: Christophe Leroy +Link: https://lore.kernel.org/r/20240808071132.149251-2-herve.codina@bootlin.com +Signed-off-by: Christophe Leroy +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/fsl/qe/qmc.c | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +--- a/drivers/soc/fsl/qe/qmc.c ++++ b/drivers/soc/fsl/qe/qmc.c +@@ -940,11 +940,13 @@ static int qmc_chan_start_rx(struct qmc_ + goto end; + } + +- ret = qmc_setup_chan_trnsync(chan->qmc, chan); +- if (ret) { +- dev_err(chan->qmc->dev, "chan %u: setup TRNSYNC failed (%d)\n", +- chan->id, ret); +- goto end; ++ if (chan->mode == QMC_TRANSPARENT) { ++ ret = qmc_setup_chan_trnsync(chan->qmc, chan); ++ if (ret) { ++ dev_err(chan->qmc->dev, "chan %u: setup TRNSYNC failed (%d)\n", ++ chan->id, ret); ++ goto end; ++ } + } + + /* Restart the receiver */ +@@ -982,11 +984,13 @@ static int qmc_chan_start_tx(struct qmc_ + goto end; + } + +- ret = qmc_setup_chan_trnsync(chan->qmc, chan); +- if (ret) { +- dev_err(chan->qmc->dev, "chan %u: setup TRNSYNC failed (%d)\n", +- chan->id, ret); +- goto end; ++ if (chan->mode == QMC_TRANSPARENT) { ++ ret = qmc_setup_chan_trnsync(chan->qmc, chan); ++ if (ret) { ++ dev_err(chan->qmc->dev, "chan %u: setup TRNSYNC failed (%d)\n", ++ chan->id, ret); ++ goto end; ++ } + } + + /* diff --git a/queue-6.11/soc-fsl-cpm1-tsa-fix-tsa_write8.patch b/queue-6.11/soc-fsl-cpm1-tsa-fix-tsa_write8.patch new file mode 100644 index 00000000000..8c217e1dc55 --- /dev/null +++ b/queue-6.11/soc-fsl-cpm1-tsa-fix-tsa_write8.patch @@ -0,0 +1,36 @@ +From 47a347bae9a491b467ab3543e4725a3e4fbe30f5 Mon Sep 17 00:00:00 2001 +From: Herve Codina +Date: Thu, 8 Aug 2024 09:10:56 +0200 +Subject: soc: fsl: cpm1: tsa: Fix tsa_write8() + +From: Herve Codina + +commit 47a347bae9a491b467ab3543e4725a3e4fbe30f5 upstream. + +The tsa_write8() parameter is an u32 value. This is not consistent with +the function itself. Indeed, tsa_write8() writes an 8bits value. + +Be consistent and use an u8 parameter value. + +Fixes: 1d4ba0b81c1c ("soc: fsl: cpm1: Add support for TSA") +Cc: stable@vger.kernel.org +Signed-off-by: Herve Codina +Reviewed-by: Christophe Leroy +Link: https://lore.kernel.org/r/20240808071132.149251-4-herve.codina@bootlin.com +Signed-off-by: Christophe Leroy +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/fsl/qe/tsa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/soc/fsl/qe/tsa.c ++++ b/drivers/soc/fsl/qe/tsa.c +@@ -140,7 +140,7 @@ static inline void tsa_write32(void __io + iowrite32be(val, addr); + } + +-static inline void tsa_write8(void __iomem *addr, u32 val) ++static inline void tsa_write8(void __iomem *addr, u8 val) + { + iowrite8(val, addr); + } diff --git a/queue-6.11/soc-versatile-integrator-fix-of-node-leak-in-probe-error-path.patch b/queue-6.11/soc-versatile-integrator-fix-of-node-leak-in-probe-error-path.patch new file mode 100644 index 00000000000..2264ebe4234 --- /dev/null +++ b/queue-6.11/soc-versatile-integrator-fix-of-node-leak-in-probe-error-path.patch @@ -0,0 +1,32 @@ +From 874c5b601856adbfda10846b9770a6c66c41e229 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Sun, 25 Aug 2024 20:05:22 +0200 +Subject: soc: versatile: integrator: fix OF node leak in probe() error path + +From: Krzysztof Kozlowski + +commit 874c5b601856adbfda10846b9770a6c66c41e229 upstream. + +Driver is leaking OF node reference obtained from +of_find_matching_node(). + +Fixes: f956a785a282 ("soc: move SoC driver for the ARM Integrator") +Cc: stable@vger.kernel.org +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/20240825-soc-dev-fixes-v1-1-ff4b35abed83@linaro.org +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/versatile/soc-integrator.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/soc/versatile/soc-integrator.c ++++ b/drivers/soc/versatile/soc-integrator.c +@@ -113,6 +113,7 @@ static int __init integrator_soc_init(vo + return -ENODEV; + + syscon_regmap = syscon_node_to_regmap(np); ++ of_node_put(np); + if (IS_ERR(syscon_regmap)) + return PTR_ERR(syscon_regmap); +