[PATCH v7 0/2] pci: AMD: Add Versal2 CPM6 PCIe host controller support

[PATCH v7 0/2] pci: AMD: Add Versal2 CPM6 PCIe host controller support

[Sai Krishna Musham]

Add support for the AMD Versal2 CPM6 PCIe host controller to the
AMD MDB PCIe driver.

Sai Krishna Musham (2):
  dt-bindings: PCI: amd-mdb: Add CPM6 support
  PCI: amd-mdb: Add CPM6 host controller support

 .../bindings/pci/amd,versal2-mdb-host.yaml    |  41 +-
 .../devicetree/bindings/pci/snps,dw-pcie.yaml |   2 +
 drivers/pci/controller/dwc/pcie-amd-mdb.c     | 419 +++++++++++++++---
 3 files changed, 389 insertions(+), 73 deletions(-)


base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
-- 
2.44.4

[PATCH v7 1/2] dt-bindings: PCI: amd-mdb: Add CPM6 support

[Sai Krishna Musham]

The AMD CPM6 PCIe controller is based on the Synopsys DesignWare PCIe
IP and integrates two PCIe host controller instances. Add the
"amd,versal2-cpm6-host" and "amd,versal2-cpm6-host1" compatible strings
to describe the HOST0 and HOST1 controller instances.

Add "intr" to the vendor-specific reg-names in snps,dw-pcie.yaml for
the per-controller interrupt register region used by CPM6.

Update amd,versal2-mdb-host.yaml with separate register definitions:
- MDB5: 4 regions (slcr, config, dbi, atu)
- CPM6: 5 regions (slcr, config, dbi, atu, intr)

Signed-off-by: Sai Krishna Musham <sai.krishna.musham@amd.com>
---
Changes in v6, v7:
- None

Changes in v5:
- Explain host vs host1 in the commit message.
- Drop redundant minItems for MDB5 (4 is already min).
- Drop redundant maxItems for CPM6 (5 is already max).

Changes in v4:
- None

Changes in v3:
- Update subject to match history.
- Move allOf to the end, after required block.
- Drop the CPM6 example.

Changes in v2:
- Update the CPM6 device tree binding and example.

v1 https://lore.kernel.org/all/20260402180006.486229-2-sai.krishna.musham@amd.com/
v2 https://lore.kernel.org/all/20260728202044.1785986-2-sai.krishna.musham@amd.com/
v3 https://lore.kernel.org/all/20260803144412.713639-2-sai.krishna.musham@amd.com/
v4 https://lore.kernel.org/all/20260808105256.3705889-2-sai.krishna.musham@amd.com/
v5 https://lore.kernel.org/all/20260817023932.1743100-2-sai.krishna.musham@amd.com/
v6 https://lore.kernel.org/all/20260819172057.3636214-2-sai.krishna.musham@amd.com/
---
 .../bindings/pci/amd,versal2-mdb-host.yaml    | 41 ++++++++++++++++---
 .../devicetree/bindings/pci/snps,dw-pcie.yaml |  2 +
 2 files changed, 38 insertions(+), 5 deletions(-)

diff --git a/Documentation/devicetree/bindings/pci/amd,versal2-mdb-host.yaml b/Documentation/devicetree/bindings/pci/amd,versal2-mdb-host.yaml
index 406c15e1dee1..cd207b346313 100644
--- a/Documentation/devicetree/bindings/pci/amd,versal2-mdb-host.yaml
+++ b/Documentation/devicetree/bindings/pci/amd,versal2-mdb-host.yaml
@@ -9,27 +9,30 @@ title: AMD Versal2 MDB(Multimedia DMA Bridge) Host Controller
 maintainers:
   - Thippeswamy Havalige <thippeswamy.havalige@amd.com>
 
-allOf:
-  - $ref: /schemas/pci/pci-host-bridge.yaml#
-  - $ref: /schemas/pci/snps,dw-pcie.yaml#
-
 properties:
   compatible:
-    const: amd,versal2-mdb-host
+    enum:
+      - amd,versal2-mdb-host
+      - amd,versal2-cpm6-host
+      - amd,versal2-cpm6-host1
 
   reg:
+    minItems: 4
     items:
       - description: MDB System Level Control and Status Register (SLCR) Base
       - description: configuration region
       - description: data bus interface
       - description: address translation unit register
+      - description: CPM6 PCIe error and event interrupt registers
 
   reg-names:
+    minItems: 4
     items:
       - const: slcr
       - const: config
       - const: dbi
       - const: atu
+      - const: intr
 
   ranges:
     maxItems: 2
@@ -92,6 +95,34 @@ required:
   - "#interrupt-cells"
   - interrupt-controller
 
+allOf:
+  - $ref: /schemas/pci/pci-host-bridge.yaml#
+  - $ref: /schemas/pci/snps,dw-pcie.yaml#
+  - if:
+      properties:
+        compatible:
+          contains:
+            const: amd,versal2-mdb-host
+    then:
+      properties:
+        reg:
+          maxItems: 4
+        reg-names:
+          maxItems: 4
+  - if:
+      properties:
+        compatible:
+          contains:
+            enum:
+              - amd,versal2-cpm6-host
+              - amd,versal2-cpm6-host1
+    then:
+      properties:
+        reg:
+          minItems: 5
+        reg-names:
+          minItems: 5
+
 unevaluatedProperties: false
 
 examples:
diff --git a/Documentation/devicetree/bindings/pci/snps,dw-pcie.yaml b/Documentation/devicetree/bindings/pci/snps,dw-pcie.yaml
index b3216141881c..21f86609ddb6 100644
--- a/Documentation/devicetree/bindings/pci/snps,dw-pcie.yaml
+++ b/Documentation/devicetree/bindings/pci/snps,dw-pcie.yaml
@@ -117,6 +117,8 @@ properties:
               enum: [ ecam ]
             - description: AMD MDB PCIe SLCR region
               const: slcr
+            - description: AMD CPM6 PCIe error and event interrupt registers
+              const: intr
     allOf:
       - contains:
           enum: [ dbi, ctrl ]
-- 
2.44.4

[PATCH v7 2/2] PCI: amd-mdb: Add CPM6 host controller support

[Sai Krishna Musham]

Add support for the AMD Versal2 CPM6 host controller variants
(amd,versal2-cpm6-host and amd,versal2-cpm6-host1).

CPM6 is based on the Synopsys DesignWare PCIe controller and shares
most of the MDB5 host controller implementation. The main difference is
the interrupt register layout.

Unlike MDB5, the per-controller MISC_EVENT registers reside in a
dedicated "intr" region rather than the shared SLCR block. The
MERGED/PS_MISC interrupt aggregators are shared by both host
controllers and remain asserted until their status is cleared.

Since both controllers share the same event interrupt line, request the
IRQ with IRQF_SHARED and clear this controller's aggregator contribution
after each interrupt handling pass. The CPM6 event interrupt handler
processes only INTx-related events, while PCIe errors are handled
through the standard PCIe AER framework.

Signed-off-by: Sai Krishna Musham <sai.krishna.musham@amd.com>
---
Changes in v7:
- Free the IRQ domains via devres so the device-managed IRQs are
  released before the domains they map into, fixing probe-failure
  teardown ordering.
- Leave the CPM6 INTx leaf owned solely by the INTx irqchip refcount.
- Mask interrupts on the early init_irq_domains() failure path too.

Changes in v6:
- Drop the platform error-event handling on CPM6 and leave error
  reporting to the native PCIe AER service.

Changes in v5:
- Return IRQ_NONE when this host has nothing pending, so the shared
  IRQ line keeps spurious-interrupt detection and does not clear the
  peer host's aggregator.
- Add amd_mdb_pcie_disable_interrupts() and call it on the probe error
  path to avoid an IRQ storm on the shared line.
- Mask interrupts during setup and arm them only after all handlers
  are registered.

Changes in v4:
- Use IRQF_SHARED for the CPM6 event IRQ since the misc/error GIC line
  is shared between both host controllers.
- Read PCIE_ERR before servicing MISC_EVENT to snapshot the error state
  before it is cleared.

Changes in v3:
- Add missing completion-timeout handling via PCIE_ERR.
- Add CPM6 INTx shared-enable refcount handling (mask/unmask via intx_refmask).
- Fix probe-failure cleanup to avoid double-free/use-after-free risk.
- Fix CPM6 slcr mapping to use non-exclusive ioremap for shared SLCR.
- Clear unhandled asserted bits in AMD_CPM6_PCIE_ERR_STATUS.

Changes in v2:
- Add CPM6 host controller interrupt support.

v1 https://lore.kernel.org/all/20260402180006.486229-3-sai.krishna.musham@amd.com/
v2 https://lore.kernel.org/all/20260728202044.1785986-3-sai.krishna.musham@amd.com/
v3 https://lore.kernel.org/all/20260803144412.713639-3-sai.krishna.musham@amd.com/
v4 https://lore.kernel.org/all/20260808105256.3705889-3-sai.krishna.musham@amd.com/
v5 https://lore.kernel.org/all/20260817023932.1743100-3-sai.krishna.musham@amd.com/
v6 https://lore.kernel.org/all/20260819172057.3636214-3-sai.krishna.musham@amd.com/
---
 drivers/pci/controller/dwc/pcie-amd-mdb.c | 367 ++++++++++++++++++----
 1 file changed, 305 insertions(+), 62 deletions(-)

diff --git a/drivers/pci/controller/dwc/pcie-amd-mdb.c b/drivers/pci/controller/dwc/pcie-amd-mdb.c
index dee295f281a3..5a83c9e58850 100644
--- a/drivers/pci/controller/dwc/pcie-amd-mdb.c
+++ b/drivers/pci/controller/dwc/pcie-amd-mdb.c
@@ -21,6 +21,17 @@
 #include "../../pci.h"
 #include "pcie-designware.h"
 
+/*
+ * On CPM6 the per-controller PCIe MISC_EVENT registers live in a dedicated
+ * region ("intr"), separate from the CPM SLCR region ("slcr") that holds the
+ * MERGED and PS severity registers they feed into. Each has a sticky W1C
+ * STATUS, a read-only MASK, and write-1 ENABLE/DISABLE register.
+ */
+#define AMD_CPM6_MISC_EVENT_STATUS		0x514
+#define AMD_CPM6_MISC_EVENT_MASK		0x518
+#define AMD_CPM6_MISC_EVENT_ENABLE		0x51C
+#define AMD_CPM6_MISC_EVENT_DISABLE		0x520
+
 #define AMD_MDB_TLP_IR_STATUS_MISC		0x4C0
 #define AMD_MDB_TLP_IR_MASK_MISC		0x4C4
 #define AMD_MDB_TLP_IR_ENABLE_MISC		0x4C8
@@ -30,7 +41,22 @@
 
 #define AMD_MDB_PCIE_INTR_INTX_ASSERT(x)	BIT((x) * 2)
 
-/* Interrupt registers definitions. */
+#define AMD_CPM6_MERGED_STATUS			0x648
+#define AMD_CPM6_MERGED_ENABLE			0x650
+#define AMD_CPM6_MERGED_DISABLE			0x654
+
+/* MERGED input bits for the MISC_EVENT sources this driver handles. */
+#define AMD_CPM6_MERGED_MISC_EVENT_HOST0	14
+#define AMD_CPM6_MERGED_MISC_EVENT_HOST1	17
+
+/*
+ * The PS_MISC severity register feeds the misc/OR GIC line. The MERGED
+ * aggregator appears as bit 21 within it.
+ */
+#define AMD_CPM6_PS_MISC_IR_STATUS		0x340
+#define AMD_CPM6_PS_IR_MERGED			BIT(21)
+
+/* MDB5 interrupt register definitions. */
 #define AMD_MDB_PCIE_INTR_CMPL_TIMEOUT		15
 #define AMD_MDB_PCIE_INTR_INTX			16
 #define AMD_MDB_PCIE_INTR_PM_PME_RCVD		24
@@ -51,24 +77,77 @@
 		AMD_MDB_TLP_PCIE_INTX_MASK		\
 	)
 
+/* CPM6 hwirq mapping (hwirq == MISC_EVENT status bit). */
+#define AMD_CPM6_PCIE_INTR_INTX			22
+
+enum amd_mdb_pcie_version {
+	MDB5,
+	CPM6,
+	CPM6_HOST1,
+};
+
+struct amd_mdb_pcie_variant {
+	enum	amd_mdb_pcie_version version;
+	u32	misc_status_reg;
+	u32	misc_mask_reg;
+	u32	misc_enable_reg;
+	u32	misc_disable_reg;
+	u32	misc_mask_all;
+	u32	intx_hwirq;
+	u32	intx_mask;
+};
+
 /**
  * struct amd_mdb_pcie - PCIe port information
  * @pci: DesignWare PCIe controller structure
  * @slcr: MDB System Level Control and Status Register (SLCR) base
+ * @intr_base: Per-controller interrupt register base. On CPM6 this maps the
+ *             "intr" region holding the MISC_EVENT registers; on MDB5
+ *             the interrupt registers live in the SLCR block, so it aliases
+ *             @slcr.
+ * @variant: Interrupt layout data for the matched platform compatible
  * @intx_domain: INTx IRQ domain pointer
  * @mdb_domain: MDB IRQ domain pointer
  * @perst_gpio: GPIO descriptor for PERST# signal handling
  * @intx_irq: INTx IRQ interrupt number
+ * @intx_refmask: CPM6 mask of unmasked INTx lines; gates the shared aggregate
  */
 struct amd_mdb_pcie {
 	struct dw_pcie			pci;
 	void __iomem			*slcr;
+	void __iomem			*intr_base;
+	const struct amd_mdb_pcie_variant	*variant;
 	struct irq_domain		*intx_domain;
 	struct irq_domain		*mdb_domain;
 	struct gpio_desc		*perst_gpio;
 	int				intx_irq;
+	u32				intx_refmask;
 };
 
+static u32 amd_mdb_pcie_merged_host_mask(struct amd_mdb_pcie *pcie)
+{
+	return pcie->variant->version == CPM6 ?
+	       BIT(AMD_CPM6_MERGED_MISC_EVENT_HOST0) :
+	       BIT(AMD_CPM6_MERGED_MISC_EVENT_HOST1);
+}
+
+static void amd_mdb_pcie_clear_aggregators(struct amd_mdb_pcie *pcie)
+{
+	if (pcie->variant->version == MDB5)
+		return;
+
+	/* Clear this host's serviced MISC_EVENT contribution from MERGED. */
+	writel_relaxed(amd_mdb_pcie_merged_host_mask(pcie),
+		       pcie->slcr + AMD_CPM6_MERGED_STATUS);
+
+	/*
+	 * Clear MERGED in the PS_MISC severity register so the misc GIC line
+	 * de-asserts.
+	 */
+	writel_relaxed(AMD_CPM6_PS_IR_MERGED,
+		       pcie->slcr + AMD_CPM6_PS_MISC_IR_STATUS);
+}
+
 static const struct dw_pcie_host_ops amd_mdb_pcie_host_ops = {
 };
 
@@ -81,14 +160,17 @@ static void amd_mdb_intx_irq_mask(struct irq_data *data)
 	u32 val;
 
 	raw_spin_lock_irqsave(&port->lock, flags);
-	val = FIELD_PREP(AMD_MDB_TLP_PCIE_INTX_MASK,
-			 AMD_MDB_PCIE_INTR_INTX_ASSERT(data->hwirq));
-
-	/*
-	 * Writing '1' to a bit in AMD_MDB_TLP_IR_DISABLE_MISC disables that
-	 * interrupt, writing '0' has no effect.
-	 */
-	writel_relaxed(val, pcie->slcr + AMD_MDB_TLP_IR_DISABLE_MISC);
+	if (pcie->variant->version == MDB5) {
+		val = FIELD_PREP(AMD_MDB_TLP_PCIE_INTX_MASK,
+				 AMD_MDB_PCIE_INTR_INTX_ASSERT(data->hwirq));
+	} else {
+		/* CPM6 shares one INTx enable; drop it on the last mask. */
+		pcie->intx_refmask &= ~BIT(data->hwirq);
+		val = pcie->intx_refmask ? 0 : pcie->variant->intx_mask;
+	}
+	/* Writing '1' disables the interrupt; writing '0' has no effect. */
+	if (val)
+		writel_relaxed(val, pcie->intr_base + pcie->variant->misc_disable_reg);
 	raw_spin_unlock_irqrestore(&port->lock, flags);
 }
 
@@ -101,14 +183,17 @@ static void amd_mdb_intx_irq_unmask(struct irq_data *data)
 	u32 val;
 
 	raw_spin_lock_irqsave(&port->lock, flags);
-	val = FIELD_PREP(AMD_MDB_TLP_PCIE_INTX_MASK,
-			 AMD_MDB_PCIE_INTR_INTX_ASSERT(data->hwirq));
-
-	/*
-	 * Writing '1' to a bit in AMD_MDB_TLP_IR_ENABLE_MISC enables that
-	 * interrupt, writing '0' has no effect.
-	 */
-	writel_relaxed(val, pcie->slcr + AMD_MDB_TLP_IR_ENABLE_MISC);
+	if (pcie->variant->version == MDB5) {
+		val = FIELD_PREP(AMD_MDB_TLP_PCIE_INTX_MASK,
+				 AMD_MDB_PCIE_INTR_INTX_ASSERT(data->hwirq));
+	} else {
+		/* CPM6 shares one INTx enable; raise it on the first unmask. */
+		val = pcie->intx_refmask ? 0 : pcie->variant->intx_mask;
+		pcie->intx_refmask |= BIT(data->hwirq);
+	}
+	/* Writing '1' enables the interrupt; writing '0' has no effect. */
+	if (val)
+		writel_relaxed(val, pcie->intr_base + pcie->variant->misc_enable_reg);
 	raw_spin_unlock_irqrestore(&port->lock, flags);
 }
 
@@ -148,11 +233,19 @@ static irqreturn_t dw_pcie_rp_intx(int irq, void *args)
 	unsigned long val;
 	int i, int_status;
 
-	val = readl_relaxed(pcie->slcr + AMD_MDB_TLP_IR_STATUS_MISC);
-	int_status = FIELD_GET(AMD_MDB_TLP_PCIE_INTX_MASK, val);
+	val = readl_relaxed(pcie->intr_base + pcie->variant->misc_status_reg);
 
-	for (i = 0; i < PCI_NUM_INTX; i++) {
-		if (int_status & AMD_MDB_PCIE_INTR_INTX_ASSERT(i))
+	if (pcie->variant->version == MDB5) {
+		int_status = FIELD_GET(AMD_MDB_TLP_PCIE_INTX_MASK, val);
+		for (i = 0; i < PCI_NUM_INTX; i++) {
+			if (int_status & AMD_MDB_PCIE_INTR_INTX_ASSERT(i))
+				generic_handle_domain_irq(pcie->intx_domain, i);
+		}
+	} else {
+		/* CPM6 exposes only an aggregate INTx indication */
+		if (!(val & pcie->variant->intx_mask))
+			return IRQ_NONE;
+		for (i = 0; i < PCI_NUM_INTX; i++)
 			generic_handle_domain_irq(pcie->intx_domain, i);
 	}
 
@@ -179,11 +272,17 @@ static void amd_mdb_event_irq_mask(struct irq_data *d)
 	struct dw_pcie *pci = &pcie->pci;
 	struct dw_pcie_rp *port = &pci->pp;
 	unsigned long flags;
-	u32 val;
+
+	/*
+	 * On CPM6 the INTx aggregate leaf is owned by the INTx irqchip
+	 * refcount (intx_refmask), so leave that bit to that path.
+	 */
+	if (pcie->variant->version != MDB5 && d->hwirq == pcie->variant->intx_hwirq)
+		return;
 
 	raw_spin_lock_irqsave(&port->lock, flags);
-	val = BIT(d->hwirq);
-	writel_relaxed(val, pcie->slcr + AMD_MDB_TLP_IR_DISABLE_MISC);
+	writel_relaxed(BIT(d->hwirq),
+		       pcie->intr_base + pcie->variant->misc_disable_reg);
 	raw_spin_unlock_irqrestore(&port->lock, flags);
 }
 
@@ -193,11 +292,17 @@ static void amd_mdb_event_irq_unmask(struct irq_data *d)
 	struct dw_pcie *pci = &pcie->pci;
 	struct dw_pcie_rp *port = &pci->pp;
 	unsigned long flags;
-	u32 val;
+
+	/*
+	 * On CPM6 the INTx aggregate leaf is owned by the INTx irqchip
+	 * refcount (intx_refmask), so leave that bit to that path.
+	 */
+	if (pcie->variant->version != MDB5 && d->hwirq == pcie->variant->intx_hwirq)
+		return;
 
 	raw_spin_lock_irqsave(&port->lock, flags);
-	val = BIT(d->hwirq);
-	writel_relaxed(val, pcie->slcr + AMD_MDB_TLP_IR_ENABLE_MISC);
+	writel_relaxed(BIT(d->hwirq),
+		       pcie->intr_base + pcie->variant->misc_enable_reg);
 	raw_spin_unlock_irqrestore(&port->lock, flags);
 }
 
@@ -226,19 +331,47 @@ static irqreturn_t amd_mdb_pcie_event(int irq, void *args)
 {
 	struct amd_mdb_pcie *pcie = args;
 	unsigned long val;
+	u32 ev_raw;
 	int i;
 
-	val = readl_relaxed(pcie->slcr + AMD_MDB_TLP_IR_STATUS_MISC);
-	val &= ~readl_relaxed(pcie->slcr + AMD_MDB_TLP_IR_MASK_MISC);
+	ev_raw = readl_relaxed(pcie->intr_base + pcie->variant->misc_status_reg);
+	val = ev_raw;
+	val &= ~readl_relaxed(pcie->intr_base + pcie->variant->misc_mask_reg);
+
+	if (pcie->variant->version == MDB5) {
+		for_each_set_bit(i, &val, 32)
+			generic_handle_domain_irq(pcie->mdb_domain, i);
+		writel_relaxed(val, pcie->intr_base + pcie->variant->misc_status_reg);
+		return IRQ_HANDLED;
+	}
+
+	val &= pcie->variant->misc_mask_all;
+
+	/*
+	 * The misc GIC line is shared with the peer host controller. If this
+	 * host has nothing pending, report the interrupt as not ours so the
+	 * shared line's spurious detection keeps working and the peer's sticky
+	 * aggregator state is left untouched.
+	 */
+	if (!ev_raw)
+		return IRQ_NONE;
+
 	for_each_set_bit(i, &val, 32)
 		generic_handle_domain_irq(pcie->mdb_domain, i);
-	writel_relaxed(val, pcie->slcr + AMD_MDB_TLP_IR_STATUS_MISC);
+
+	/* Clear this host's serviced leaf bits. */
+	writel_relaxed(ev_raw, pcie->intr_base + pcie->variant->misc_status_reg);
+
+	/* Clear only this host's sticky aggregator contribution. */
+	amd_mdb_pcie_clear_aggregators(pcie);
 
 	return IRQ_HANDLED;
 }
 
-static void amd_mdb_pcie_free_irq_domains(struct amd_mdb_pcie *pcie)
+static void amd_mdb_pcie_free_irq_domains(void *data)
 {
+	struct amd_mdb_pcie *pcie = data;
+
 	if (pcie->intx_domain) {
 		irq_domain_remove(pcie->intx_domain);
 		pcie->intx_domain = NULL;
@@ -250,24 +383,64 @@ static void amd_mdb_pcie_free_irq_domains(struct amd_mdb_pcie *pcie)
 	}
 }
 
-static int amd_mdb_pcie_init_port(struct amd_mdb_pcie *pcie)
+static void amd_mdb_pcie_disable_interrupts(struct amd_mdb_pcie *pcie)
 {
-	unsigned long val;
+	u32 misc_mask_all = pcie->variant->misc_mask_all;
+	u32 val;
+
+	/* Mask all leaf TLP interrupts. */
+	writel_relaxed(misc_mask_all,
+		       pcie->intr_base + pcie->variant->misc_disable_reg);
+
+	/* Clear any pending leaf TLP interrupts. */
+	val = readl_relaxed(pcie->intr_base + pcie->variant->misc_status_reg) &
+	      misc_mask_all;
+	writel_relaxed(val, pcie->intr_base + pcie->variant->misc_status_reg);
+
+	if (pcie->variant->version == MDB5)
+		return;
+
+	/*
+	 * Mask this host's MISC_EVENT input in the shared MERGED aggregator so
+	 * a stale source cannot drive the GIC line the peer host controller
+	 * also shares.
+	 */
+	writel_relaxed(amd_mdb_pcie_merged_host_mask(pcie),
+		       pcie->slcr + AMD_CPM6_MERGED_DISABLE);
+}
+
+static void amd_mdb_pcie_init_port(struct amd_mdb_pcie *pcie)
+{
+	u32 misc_mask_all;
+	u32 val;
+
+	misc_mask_all = pcie->variant->misc_mask_all;
 
 	/* Disable all TLP interrupts. */
-	writel_relaxed(AMD_MDB_PCIE_IMR_ALL_MASK,
-		       pcie->slcr + AMD_MDB_TLP_IR_DISABLE_MISC);
+	writel_relaxed(misc_mask_all,
+		       pcie->intr_base + pcie->variant->misc_disable_reg);
 
 	/* Clear pending TLP interrupts. */
-	val = readl_relaxed(pcie->slcr + AMD_MDB_TLP_IR_STATUS_MISC);
-	val &= AMD_MDB_PCIE_IMR_ALL_MASK;
-	writel_relaxed(val, pcie->slcr + AMD_MDB_TLP_IR_STATUS_MISC);
+	val = readl_relaxed(pcie->intr_base + pcie->variant->misc_status_reg) &
+	      misc_mask_all;
+	writel_relaxed(val, pcie->intr_base + pcie->variant->misc_status_reg);
 
-	/* Enable all TLP interrupts. */
-	writel_relaxed(AMD_MDB_PCIE_IMR_ALL_MASK,
-		       pcie->slcr + AMD_MDB_TLP_IR_ENABLE_MISC);
+	/*
+	 * Enable the leaf TLP interrupts. On CPM6 the only leaf source is the
+	 * INTx aggregate, which the INTx irqchip enables on demand through
+	 * intx_refmask, so it is left masked here.
+	 */
+	if (pcie->variant->version == MDB5)
+		writel_relaxed(misc_mask_all,
+			       pcie->intr_base + pcie->variant->misc_enable_reg);
 
-	return 0;
+	/*
+	 * On CPM6 unmask this host's MISC_EVENT input in the shared MERGED
+	 * aggregator so it reaches the GIC.
+	 */
+	if (pcie->variant->version != MDB5)
+		writel_relaxed(amd_mdb_pcie_merged_host_mask(pcie),
+			       pcie->slcr + AMD_CPM6_MERGED_ENABLE);
 }
 
 /**
@@ -316,9 +489,16 @@ static int amd_mdb_pcie_init_irq_domains(struct amd_mdb_pcie *pcie,
 
 	raw_spin_lock_init(&pp->lock);
 
-	return 0;
+	/*
+	 * Remove the IRQ domains through devres so that on a later probe
+	 * failure the device-managed IRQs requested in amd_mdb_setup_irq() are
+	 * freed before the domains they are mapped into are destroyed.
+	 */
+	return devm_add_action_or_reset(dev, amd_mdb_pcie_free_irq_domains, pcie);
+
 mdb_out:
-	amd_mdb_pcie_free_irq_domains(pcie);
+	irq_domain_remove(pcie->mdb_domain);
+	pcie->mdb_domain = NULL;
 out:
 	of_node_put(pcie_intc_node);
 	return err;
@@ -351,35 +531,48 @@ static int amd_mdb_setup_irq(struct amd_mdb_pcie *pcie,
 	struct dw_pcie *pci = &pcie->pci;
 	struct dw_pcie_rp *pp = &pci->pp;
 	struct device *dev = &pdev->dev;
+	unsigned long event_flags = IRQF_NO_THREAD;
 	int i, irq, err;
 
-	amd_mdb_pcie_init_port(pcie);
+	/*
+	 * Keep the hardware interrupts masked until every handler is
+	 * registered below, so an early assertion cannot storm the shared
+	 * CPM6 GIC line before there is anything to service it.
+	 */
+	amd_mdb_pcie_disable_interrupts(pcie);
 
 	pp->irq = platform_get_irq(pdev, 0);
 	if (pp->irq < 0)
 		return pp->irq;
 
-	for (i = 0; i < ARRAY_SIZE(intr_cause); i++) {
-		if (!intr_cause[i].str)
-			continue;
-
-		irq = irq_create_mapping(pcie->mdb_domain, i);
-		if (!irq) {
-			dev_err(dev, "Failed to map MDB domain interrupt\n");
-			return -ENOMEM;
-		}
-
-		err = devm_request_irq(dev, irq, amd_mdb_pcie_intr_handler,
-				       IRQF_NO_THREAD, intr_cause[i].sym, pcie);
-		if (err) {
-			dev_err(dev, "Failed to request IRQ %d, err=%d\n",
-				irq, err);
-			return err;
+	/*
+	 * MDB5 reports the error messages on the event domain. On CPM6 those
+	 * are left to the native AER service, so only INTx is serviced on the
+	 * event domain there.
+	 */
+	if (pcie->variant->version == MDB5) {
+		for (i = 0; i < ARRAY_SIZE(intr_cause); i++) {
+			if (!intr_cause[i].str)
+				continue;
+
+			irq = irq_create_mapping(pcie->mdb_domain, i);
+			if (!irq) {
+				dev_err(dev, "Failed to map MDB domain interrupt\n");
+				return -ENOMEM;
+			}
+
+			err = devm_request_irq(dev, irq, amd_mdb_pcie_intr_handler,
+					       IRQF_NO_THREAD, intr_cause[i].sym, pcie);
+			if (err) {
+				dev_err(dev, "Failed to request IRQ %d, err=%d\n",
+					irq, err);
+				return err;
+			}
 		}
 	}
 
 	pcie->intx_irq = irq_create_mapping(pcie->mdb_domain,
-					    AMD_MDB_PCIE_INTR_INTX);
+				    pcie->variant->intx_hwirq);
 	if (!pcie->intx_irq) {
 		dev_err(dev, "Failed to map INTx interrupt\n");
 		return -ENXIO;
@@ -393,8 +586,15 @@ static int amd_mdb_setup_irq(struct amd_mdb_pcie *pcie,
 		return err;
 	}
 
+	/*
+	 * On CPM6 the misc GIC line is shared between both host controllers,
+	 * so the event IRQ must allow sharing.
+	 */
+	if (pcie->variant->version != MDB5)
+		event_flags |= IRQF_SHARED;
+
 	/* Plug the main event handler. */
-	err = devm_request_irq(dev, pp->irq, amd_mdb_pcie_event, IRQF_NO_THREAD,
+	err = devm_request_irq(dev, pp->irq, amd_mdb_pcie_event, event_flags,
 			       "amd_mdb pcie_irq", pcie);
 	if (err) {
 		dev_err(dev, "Failed to request event IRQ %d, err=%d\n",
@@ -402,6 +602,9 @@ static int amd_mdb_setup_irq(struct amd_mdb_pcie *pcie,
 		return err;
 	}
 
+	/* Arm the hardware only now that all handlers are in place. */
+	amd_mdb_pcie_init_port(pcie);
+
 	return 0;
 }
 
@@ -435,13 +638,42 @@ static int amd_mdb_add_pcie_port(struct amd_mdb_pcie *pcie,
 	struct device *dev = &pdev->dev;
 	int err;
 
-	pcie->slcr = devm_platform_ioremap_resource_byname(pdev, "slcr");
-	if (IS_ERR(pcie->slcr))
-		return PTR_ERR(pcie->slcr);
+	if (pcie->variant->version == MDB5) {
+		/*
+		 * On MDB5 all interrupt registers live in the SLCR block, so
+		 * the interrupt-register base simply aliases @slcr.
+		 */
+		pcie->slcr = devm_platform_ioremap_resource_byname(pdev, "slcr");
+		if (IS_ERR(pcie->slcr))
+			return PTR_ERR(pcie->slcr);
+		pcie->intr_base = pcie->slcr;
+	} else {
+		struct resource *res;
+
+		/*
+		 * CPM6 moves the per-controller MISC_EVENT registers
+		 * into a separate "intr" region. The SLCR block, which holds
+		 * the shared MERGED/PS_MISC aggregators, is shared by both CPM6
+		 * host controllers, so map it without requesting exclusive
+		 * ownership; otherwise the second controller fails to probe.
+		 */
+		res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "slcr");
+		if (!res)
+			return -EINVAL;
+		pcie->slcr = devm_ioremap(dev, res->start, resource_size(res));
+		if (!pcie->slcr)
+			return -ENOMEM;
+
+		pcie->intr_base = devm_platform_ioremap_resource_byname(pdev, "intr");
+		if (IS_ERR(pcie->intr_base))
+			return PTR_ERR(pcie->intr_base);
+	}
 
 	err = amd_mdb_pcie_init_irq_domains(pcie, pdev);
-	if (err)
+	if (err) {
+		amd_mdb_pcie_disable_interrupts(pcie);
 		return err;
+	}
 
 	err = amd_mdb_setup_irq(pcie, pdev);
 	if (err) {
@@ -466,7 +698,13 @@ static int amd_mdb_add_pcie_port(struct amd_mdb_pcie *pcie,
 	return 0;
 
 out:
-	amd_mdb_pcie_free_irq_domains(pcie);
+	/*
+	 * Mask the hardware interrupts before tearing down so a stale source
+	 * cannot storm the shared CPM6 GIC line once this host is unwound. The
+	 * IRQ domains are released by the devres action registered in
+	 * amd_mdb_pcie_init_irq_domains(), after the device-managed IRQs.
+	 */
+	amd_mdb_pcie_disable_interrupts(pcie);
 	return err;
 }
 
@@ -483,6 +721,9 @@ static int amd_mdb_pcie_probe(struct platform_device *pdev)
 
 	pci = &pcie->pci;
 	pci->dev = dev;
+	pcie->variant = of_device_get_match_data(dev);
+	if (!pcie->variant)
+		return -EINVAL;
 
 	platform_set_drvdata(pdev, pcie);
 
@@ -514,9 +755,51 @@ static void amd_mdb_pcie_shutdown(struct platform_device *pdev)
 	gpiod_set_value_cansleep(pcie->perst_gpio, 1);
 }
 
+static const struct amd_mdb_pcie_variant cpm6_host = {
+	.version = CPM6,
+	.misc_status_reg = AMD_CPM6_MISC_EVENT_STATUS,
+	.misc_mask_reg = AMD_CPM6_MISC_EVENT_MASK,
+	.misc_enable_reg = AMD_CPM6_MISC_EVENT_ENABLE,
+	.misc_disable_reg = AMD_CPM6_MISC_EVENT_DISABLE,
+	.misc_mask_all = BIT(AMD_CPM6_PCIE_INTR_INTX),
+	.intx_hwirq = AMD_CPM6_PCIE_INTR_INTX,
+	.intx_mask = BIT(AMD_CPM6_PCIE_INTR_INTX),
+};
+
+static const struct amd_mdb_pcie_variant cpm6_host1 = {
+	.version = CPM6_HOST1,
+	.misc_status_reg = AMD_CPM6_MISC_EVENT_STATUS,
+	.misc_mask_reg = AMD_CPM6_MISC_EVENT_MASK,
+	.misc_enable_reg = AMD_CPM6_MISC_EVENT_ENABLE,
+	.misc_disable_reg = AMD_CPM6_MISC_EVENT_DISABLE,
+	.misc_mask_all = BIT(AMD_CPM6_PCIE_INTR_INTX),
+	.intx_hwirq = AMD_CPM6_PCIE_INTR_INTX,
+	.intx_mask = BIT(AMD_CPM6_PCIE_INTR_INTX),
+};
+
+static const struct amd_mdb_pcie_variant mdb5_host = {
+	.version = MDB5,
+	.misc_status_reg = AMD_MDB_TLP_IR_STATUS_MISC,
+	.misc_mask_reg = AMD_MDB_TLP_IR_MASK_MISC,
+	.misc_enable_reg = AMD_MDB_TLP_IR_ENABLE_MISC,
+	.misc_disable_reg = AMD_MDB_TLP_IR_DISABLE_MISC,
+	.misc_mask_all = AMD_MDB_PCIE_IMR_ALL_MASK,
+	.intx_hwirq = AMD_MDB_PCIE_INTR_INTX,
+	.intx_mask = AMD_MDB_TLP_PCIE_INTX_MASK,
+};
+
 static const struct of_device_id amd_mdb_pcie_of_match[] = {
 	{
 		.compatible = "amd,versal2-mdb-host",
+		.data = &mdb5_host,
+	},
+	{
+		.compatible = "amd,versal2-cpm6-host",
+		.data = &cpm6_host,
+	},
+	{
+		.compatible = "amd,versal2-cpm6-host1",
+		.data = &cpm6_host1,
 	},
 	{},
 };
-- 
2.44.4

Re: [PATCH v7 1/2] dt-bindings: PCI: amd-mdb: Add CPM6 support

[sashiko-bot]

> The AMD CPM6 PCIe controller is based on the Synopsys DesignWare PCIe
> IP and integrates two PCIe host controller instances. Add the
> "amd,versal2-cpm6-host" and "amd,versal2-cpm6-host1" compatible strings
> to describe the HOST0 and HOST1 controller instances.
> 
> Add "intr" to the vendor-specific reg-names in snps,dw-pcie.yaml for
> the per-controller interrupt register region used by CPM6.
> 
> Update amd,versal2-mdb-host.yaml with separate register definitions:
> - MDB5: 4 regions (slcr, config, dbi, atu)
> - CPM6: 5 regions (slcr, config, dbi, atu, intr)
> 
> Signed-off-by: Sai Krishna Musham <sai.krishna.musham@amd.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260823040715.204096-1-sai.krishna.musham@amd.com?part=1

Re: [PATCH v7 2/2] PCI: amd-mdb: Add CPM6 host controller support

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:

New issues:
- [High] Blindly clearing the shared `PS_MISC` severity register in a shared interrupt handler creates a race condition that can permanently drop the peer controller's interrupts.
- [High] The interrupt handler checks the raw status (`ev_raw`) instead of the masked status (`val`) for pending interrupts, breaking spurious IRQ detection and inappropriately clearing masked bits.
- [High] The driver fails to mask unhandled interrupt sources and leaves the sticky aggregator uncleared on boot, leading to an unrecoverable interrupt storm on CPM6.

Pre-existing issues:
- [High] On MDB5, INT B, C, and D interrupts are enabled in hardware but not mapped to the Linux IRQ domain, causing them to be silently dropped.
--

--- Patch [2]: [PATCH v7 2/2] PCI: amd-mdb: Add CPM6 host controller support ---
commit 23a947213bc9887ee94f4ea8b025fb7bc8ad21bd
Author: Sai Krishna Musham <sai.krishna.musham@amd.com>

PCI: amd-mdb: Add CPM6 host controller support

This patch adds support for AMD Versal2 CPM6 host controllers. It adapts
the driver to handle the differing interrupt register layout of CPM6 and
manages the shared event interrupt line.

Link: https://lore.kernel.org/all/20260819172057.3636214-3-sai.krishna.musham@amd.com/

> diff --git a/drivers/pci/controller/dwc/pcie-amd-mdb.c b/drivers/pci/controller/dwc/pcie-amd-mdb.c
> --- a/drivers/pci/controller/dwc/pcie-amd-mdb.c
> +++ b/drivers/pci/controller/dwc/pcie-amd-mdb.c

[ ... ]

> +static void amd_mdb_pcie_clear_aggregators(struct amd_mdb_pcie *pcie)
> +{
> +	if (pcie->variant->version == MDB5)
> +		return;
> +
> +	/* Clear this host's serviced MISC_EVENT contribution from MERGED. */
> +	writel_relaxed(amd_mdb_pcie_merged_host_mask(pcie),
> +		       pcie->slcr + AMD_CPM6_MERGED_STATUS);
> +
> +	/*
> +	 * Clear MERGED in the PS_MISC severity register so the misc GIC line
> +	 * de-asserts.
> +	 */
> +	writel_relaxed(AMD_CPM6_PS_IR_MERGED,
> +		       pcie->slcr + AMD_CPM6_PS_MISC_IR_STATUS);
> +}

[Severity: High]
Does clearing this shared register unconditionally create a race condition
that drops interrupts for the peer controller?

If Host 1's interrupt arrives and sets its MERGED_STATUS bit just before
Host 0's interrupt handler executes this W1C write to the shared 
AMD_CPM6_PS_MISC_IR_STATUS register, the aggregator is cleared while Host 1's
event is still pending. Because the aggregator does not re-assert for
already-latched MERGED bits or loses the edge, does this mean the GIC line
drops and Host 1's interrupt is permanently lost?

[ ... ]

>  static irqreturn_t amd_mdb_pcie_event(int irq, void *args)
>  {
>  	struct amd_mdb_pcie *pcie = args;
>  	unsigned long val;
> +	u32 ev_raw;
>  	int i;
>  
> -	val = readl_relaxed(pcie->slcr + AMD_MDB_TLP_IR_STATUS_MISC);
> -	val &= ~readl_relaxed(pcie->slcr + AMD_MDB_TLP_IR_MASK_MISC);
> +	ev_raw = readl_relaxed(pcie->intr_base + pcie->variant->misc_status_reg);
> +	val = ev_raw;
> +	val &= ~readl_relaxed(pcie->intr_base + pcie->variant->misc_mask_reg);

[ ... ]

> +	val &= pcie->variant->misc_mask_all;
> +
> +	/*
> +	 * The misc GIC line is shared with the peer host controller. If this
> +	 * host has nothing pending, report the interrupt as not ours so the
> +	 * shared line's spurious detection keeps working and the peer's sticky
> +	 * aggregator state is left untouched.
> +	 */
> +	if (!ev_raw)
> +		return IRQ_NONE;

[Severity: High]
Should this check use the masked status (val) rather than the raw status
(ev_raw) to determine if the interrupt was spurious?

If this controller has a masked status bit active (such as an AER error left
to native AER), ev_raw will be non-zero even when the peer controller asserted
the shared GIC line. The check if (!ev_raw) will pass, proceeding to falsely
return IRQ_HANDLED while unconditionally clearing the masked status bit and
the shared aggregator. Could this break AER error reporting?

[ ... ]

> -static void amd_mdb_pcie_free_irq_domains(struct amd_mdb_pcie *pcie)
> +static void amd_mdb_pcie_disable_interrupts(struct amd_mdb_pcie *pcie)
>  {
> +	u32 misc_mask_all = pcie->variant->misc_mask_all;
> +	u32 val;
> +
> +	/* Mask all leaf TLP interrupts. */
> +	writel_relaxed(misc_mask_all,
> +		       pcie->intr_base + pcie->variant->misc_disable_reg);

[Severity: High]
Does this sequence leave unhandled interrupt sources unmasked and the sticky
aggregator uncleared?

For CPM6, misc_mask_all only includes the INTx bit, which leaves other
interrupt sources like PCIe errors unmasked. It also fails to clear the
sticky MERGED_STATUS aggregator. 

When amd_mdb_pcie_init_port() is called later and enables the shared
aggregator via AMD_CPM6_MERGED_ENABLE, any pending unhandled leaf interrupts
or stale aggregator state will immediately assert the GIC line. If the
handler then returns IRQ_NONE or clears the leaf without resolving the
underlying error, will this cause an unrecoverable interrupt storm on boot?

[ ... ]

>  static int amd_mdb_setup_irq(struct amd_mdb_pcie *pcie,
>  			     struct platform_device *pdev)
>  {
>  	struct dw_pcie *pci = &pcie->pci;
>  	struct dw_pcie_rp *pp = &pci->pp;
>  	struct device *dev = &pdev->dev;
> +	unsigned long event_flags = IRQF_NO_THREAD;
>  	int i, irq, err;

[ ... ]

>  	pcie->intx_irq = irq_create_mapping(pcie->mdb_domain,
> -					    AMD_MDB_PCIE_INTR_INTX);
> +				    pcie->variant->intx_hwirq);

[Severity: High]
This isn't a bug introduced by this patch, but are the INT B, C, and D
interrupts missing from the IRQ domain mapping on MDB5?

In amd_mdb_setup_irq(), only the intx_hwirq (which corresponds to INT A,
bit 16 on MDB5) is mapped into the mdb_domain. However, the hardware is
configured to unmask all four INTx sources (bits 16, 18, 20, 22) in
amd_mdb_intx_irq_unmask(). 

When INT B, C, or D fire, amd_mdb_pcie_event() will call
generic_handle_domain_irq() for an unmapped hwirq, which returns -EINVAL.
Does this mean legacy PCI devices using INT B, C, or D behind the MDB5
controller will have their interrupts silently dropped?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260823040715.204096-1-sai.krishna.musham@amd.com?part=2