--- /dev/null
+From c254815b02673cc77a84103c4c0d6197bd90c0ef Mon Sep 17 00:00:00 2001
+From: Michael Riesch <michael.riesch@collabora.com>
+Date: Wed, 3 Sep 2025 19:04:50 +0200
+Subject: dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
+
+From: Michael Riesch <michael.riesch@collabora.com>
+
+commit c254815b02673cc77a84103c4c0d6197bd90c0ef upstream.
+
+There are variants of the Rockchip Innosilicon CSI DPHY (e.g., the RK3568
+variant) that are powered on by default as they are part of the ALIVE power
+domain.
+Remove 'power-domains' from the required properties in order to avoid false
+positives.
+
+Fixes: 22c8e0a69b7f ("dt-bindings: phy: add compatible for rk356x to rockchip-inno-csi-dphy")
+Cc: stable@kernel.org
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Michael Riesch <michael.riesch@collabora.com>
+Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-2-a4f340a7f0cf@collabora.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml | 15 +++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml
++++ b/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml
+@@ -57,11 +57,24 @@ required:
+ - clocks
+ - clock-names
+ - '#phy-cells'
+- - power-domains
+ - resets
+ - reset-names
+ - rockchip,grf
+
++allOf:
++ - if:
++ properties:
++ compatible:
++ contains:
++ enum:
++ - rockchip,px30-csi-dphy
++ - rockchip,rk1808-csi-dphy
++ - rockchip,rk3326-csi-dphy
++ - rockchip,rk3368-csi-dphy
++ then:
++ required:
++ - power-domains
++
+ additionalProperties: false
+
+ examples:
--- /dev/null
+From 8ece3173f87df03935906d0c612c2aeda9db92ca Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 25 Jul 2025 09:40:19 +0200
+Subject: firmware: meson_sm: fix device leak at probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 8ece3173f87df03935906d0c612c2aeda9db92ca upstream.
+
+Make sure to drop the reference to the secure monitor device taken by
+of_find_device_by_node() when looking up its driver data on behalf of
+other drivers (e.g. during probe).
+
+Note that holding a reference to the platform device does not prevent
+its driver data from going away so there is no point in keeping the
+reference after the helper returns.
+
+Fixes: 8cde3c2153e8 ("firmware: meson_sm: Rework driver as a proper platform driver")
+Cc: stable@vger.kernel.org # 5.5
+Cc: Carlo Caione <ccaione@baylibre.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20250725074019.8765-1-johan@kernel.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/meson/meson_sm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/firmware/meson/meson_sm.c
++++ b/drivers/firmware/meson/meson_sm.c
+@@ -232,11 +232,16 @@ EXPORT_SYMBOL(meson_sm_call_write);
+ struct meson_sm_firmware *meson_sm_get(struct device_node *sm_node)
+ {
+ struct platform_device *pdev = of_find_device_by_node(sm_node);
++ struct meson_sm_firmware *fw;
+
+ if (!pdev)
+ return NULL;
+
+- return platform_get_drvdata(pdev);
++ fw = platform_get_drvdata(pdev);
++
++ put_device(&pdev->dev);
++
++ return fw;
+ }
+ EXPORT_SYMBOL_GPL(meson_sm_get);
+
--- /dev/null
+From d5d12cc03e501c38925e544abe44d5bfe23dc930 Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Tue, 22 Jul 2025 17:12:00 -0700
+Subject: media: cec: extron-da-hd-4k-plus: drop external-module make commands
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+commit d5d12cc03e501c38925e544abe44d5bfe23dc930 upstream.
+
+Delete the external-module style Makefile commands. They are not needed
+for in-tree modules.
+
+This is the only Makefile in the kernel tree (aside from tools/ and
+samples/) that uses this Makefile style.
+
+The same files are built with or without this patch.
+
+Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA HD 4K Plus CEC driver")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/cec/usb/extron-da-hd-4k-plus/Makefile | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/media/cec/usb/extron-da-hd-4k-plus/Makefile b/drivers/media/cec/usb/extron-da-hd-4k-plus/Makefile
+index 2e8f7f60263f..08d58524419f 100644
+--- a/drivers/media/cec/usb/extron-da-hd-4k-plus/Makefile
++++ b/drivers/media/cec/usb/extron-da-hd-4k-plus/Makefile
+@@ -1,8 +1,2 @@
+ extron-da-hd-4k-plus-cec-objs := extron-da-hd-4k-plus.o cec-splitter.o
+ obj-$(CONFIG_USB_EXTRON_DA_HD_4K_PLUS_CEC) := extron-da-hd-4k-plus-cec.o
+-
+-all:
+- $(MAKE) -C $(KDIR) M=$(shell pwd) modules
+-
+-install:
+- $(MAKE) -C $(KDIR) M=$(shell pwd) modules_install
+--
+2.51.0
+
--- /dev/null
+From 23b53639a793477326fd57ed103823a8ab63084f Mon Sep 17 00:00:00 2001
+From: Thomas Fourier <fourier.thomas@gmail.com>
+Date: Wed, 9 Jul 2025 13:35:40 +0200
+Subject: media: cx18: Add missing check after DMA map
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+commit 23b53639a793477326fd57ed103823a8ab63084f upstream.
+
+The DMA map functions can fail and should be tested for errors.
+If the mapping fails, dealloc buffers, and return.
+
+Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/cx18/cx18-queue.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/pci/cx18/cx18-queue.c
++++ b/drivers/media/pci/cx18/cx18-queue.c
+@@ -379,15 +379,22 @@ int cx18_stream_alloc(struct cx18_stream
+ break;
+ }
+
++ buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev,
++ buf->buf, s->buf_size,
++ s->dma);
++ if (dma_mapping_error(&s->cx->pci_dev->dev, buf->dma_handle)) {
++ kfree(buf->buf);
++ kfree(mdl);
++ kfree(buf);
++ break;
++ }
++
+ INIT_LIST_HEAD(&mdl->list);
+ INIT_LIST_HEAD(&mdl->buf_list);
+ mdl->id = s->mdl_base_idx; /* a somewhat safe value */
+ cx18_enqueue(s, mdl, &s->q_idle);
+
+ INIT_LIST_HEAD(&buf->list);
+- buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev,
+- buf->buf, s->buf_size,
+- s->dma);
+ cx18_buf_sync_for_cpu(s, buf);
+ list_add_tail(&buf->list, &s->buf_pool);
+ }
--- /dev/null
+From bacd713145443dce7764bb2967d30832a95e5ec8 Mon Sep 17 00:00:00 2001
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+Date: Wed, 27 Aug 2025 20:39:10 +0800
+Subject: media: i2c: mt9v111: fix incorrect type for ret
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+commit bacd713145443dce7764bb2967d30832a95e5ec8 upstream.
+
+Change "ret" from unsigned int to int type in mt9v111_calc_frame_rate()
+to store negative error codes or zero returned by __mt9v111_hw_reset()
+and other functions.
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Fixes: aab7ed1c3927 ("media: i2c: Add driver for Aptina MT9V111")
+Cc: stable@vger.kernel.org
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/mt9v111.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/mt9v111.c
++++ b/drivers/media/i2c/mt9v111.c
+@@ -532,8 +532,8 @@ static int mt9v111_calc_frame_rate(struc
+ static int mt9v111_hw_config(struct mt9v111_dev *mt9v111)
+ {
+ struct i2c_client *c = mt9v111->client;
+- unsigned int ret;
+ u16 outfmtctrl2;
++ int ret;
+
+ /* Force device reset. */
+ ret = __mt9v111_hw_reset(mt9v111);
--- /dev/null
+From 4f4098c57e139ad972154077fb45c3e3141555dd Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Fri, 18 Jul 2025 17:50:54 +0800
+Subject: media: lirc: Fix error handling in lirc_register()
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit 4f4098c57e139ad972154077fb45c3e3141555dd upstream.
+
+When cdev_device_add() failed, calling put_device() to explicitly
+release dev->lirc_dev. Otherwise, it could cause the fault of the
+reference count.
+
+Found by code review.
+
+Cc: stable@vger.kernel.org
+Fixes: a6ddd4fecbb0 ("media: lirc: remove last remnants of lirc kapi")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/rc/lirc_dev.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/rc/lirc_dev.c
++++ b/drivers/media/rc/lirc_dev.c
+@@ -736,11 +736,11 @@ int lirc_register(struct rc_dev *dev)
+
+ cdev_init(&dev->lirc_cdev, &lirc_fops);
+
++ get_device(&dev->dev);
++
+ err = cdev_device_add(&dev->lirc_cdev, &dev->lirc_dev);
+ if (err)
+- goto out_ida;
+-
+- get_device(&dev->dev);
++ goto out_put_device;
+
+ switch (dev->driver_type) {
+ case RC_DRIVER_SCANCODE:
+@@ -764,7 +764,8 @@ int lirc_register(struct rc_dev *dev)
+
+ return 0;
+
+-out_ida:
++out_put_device:
++ put_device(&dev->lirc_dev);
+ ida_free(&lirc_ida, minor);
+ return err;
+ }
--- /dev/null
+From eec81250219a209b863f11d02128ec1dd8e20877 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Wed, 20 Aug 2025 17:00:20 +0300
+Subject: media: mc: Fix MUST_CONNECT handling for pads with no links
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+commit eec81250219a209b863f11d02128ec1dd8e20877 upstream.
+
+Commit b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always
+require an enabled link") expanded the meaning of the MUST_CONNECT flag
+to require an enabled link in all cases. To do so, the link exploration
+code was expanded to cover unconnected pads, in order to reject those
+that have the MUST_CONNECT flag set. The implementation was however
+incorrect, ignoring unconnected pads instead of ignoring connected pads.
+Fix it.
+
+Reported-by: Martin Kepplinger-Novaković <martink@posteo.de>
+Closes: https://lore.kernel.org/linux-media/20250205172957.182362-1-martink@posteo.de
+Reported-by: Maud Spierings <maudspierings@gocontroll.com>
+Closes: https://lore.kernel.org/linux-media/20250818-imx8_isi-v1-1-e9cfe994c435@gocontroll.com
+Fixes: b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always require an enabled link")
+Cc: stable@vger.kernel.org # 6.1
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Maud Spierings <maudspierings@gocontroll.com>
+Tested-by: Martin Kepplinger-Novaković <martink@posteo.de>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/mc/mc-entity.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/mc/mc-entity.c
++++ b/drivers/media/mc/mc-entity.c
+@@ -691,7 +691,7 @@ done:
+ * (already discovered through iterating over links) and pads
+ * not internally connected.
+ */
+- if (origin == local || !local->num_links ||
++ if (origin == local || local->num_links ||
+ !media_entity_has_pad_interdep(origin->entity, origin->index,
+ local->index))
+ continue;
--- /dev/null
+From 1069a4fe637d0e3e4c163e3f8df9be306cc299b4 Mon Sep 17 00:00:00 2001
+From: Thomas Fourier <fourier.thomas@gmail.com>
+Date: Wed, 16 Jul 2025 15:26:30 +0200
+Subject: media: pci: ivtv: Add missing check after DMA map
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+commit 1069a4fe637d0e3e4c163e3f8df9be306cc299b4 upstream.
+
+The DMA map functions can fail and should be tested for errors.
+If the mapping fails, free blanking_ptr and set it to 0. As 0 is a
+valid DMA address, use blanking_ptr to test if the DMA address
+is set.
+
+Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/ivtv/ivtv-irq.c | 2 +-
+ drivers/media/pci/ivtv/ivtv-yuv.c | 8 +++++++-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/pci/ivtv/ivtv-irq.c
++++ b/drivers/media/pci/ivtv/ivtv-irq.c
+@@ -351,7 +351,7 @@ void ivtv_dma_stream_dec_prepare(struct
+
+ /* Insert buffer block for YUV if needed */
+ if (s->type == IVTV_DEC_STREAM_TYPE_YUV && f->offset_y) {
+- if (yi->blanking_dmaptr) {
++ if (yi->blanking_ptr) {
+ s->sg_pending[idx].src = yi->blanking_dmaptr;
+ s->sg_pending[idx].dst = offset;
+ s->sg_pending[idx].size = 720 * 16;
+--- a/drivers/media/pci/ivtv/ivtv-yuv.c
++++ b/drivers/media/pci/ivtv/ivtv-yuv.c
+@@ -125,7 +125,7 @@ static int ivtv_yuv_prep_user_dma(struct
+ ivtv_udma_fill_sg_array(dma, y_buffer_offset, uv_buffer_offset, y_size);
+
+ /* If we've offset the y plane, ensure top area is blanked */
+- if (f->offset_y && yi->blanking_dmaptr) {
++ if (f->offset_y && yi->blanking_ptr) {
+ dma->SGarray[dma->SG_length].size = cpu_to_le32(720*16);
+ dma->SGarray[dma->SG_length].src = cpu_to_le32(yi->blanking_dmaptr);
+ dma->SGarray[dma->SG_length].dst = cpu_to_le32(IVTV_DECODER_OFFSET + yuv_offset[frame]);
+@@ -929,6 +929,12 @@ static void ivtv_yuv_init(struct ivtv *i
+ yi->blanking_dmaptr = dma_map_single(&itv->pdev->dev,
+ yi->blanking_ptr,
+ 720 * 16, DMA_TO_DEVICE);
++ if (dma_mapping_error(&itv->pdev->dev, yi->blanking_dmaptr)) {
++ kfree(yi->blanking_ptr);
++ yi->blanking_ptr = NULL;
++ yi->blanking_dmaptr = 0;
++ IVTV_DEBUG_WARN("Failed to dma_map yuv blanking buffer\n");
++ }
+ } else {
+ yi->blanking_dmaptr = 0;
+ IVTV_DEBUG_WARN("Failed to allocate yuv blanking buffer\n");
--- /dev/null
+From c0d3f6969bb4d72476cfe7ea9263831f1c283704 Mon Sep 17 00:00:00 2001
+From: David Lechner <dlechner@baylibre.com>
+Date: Tue, 22 Jul 2025 17:05:46 -0500
+Subject: media: pci: mg4b: fix uninitialized iio scan data
+
+From: David Lechner <dlechner@baylibre.com>
+
+commit c0d3f6969bb4d72476cfe7ea9263831f1c283704 upstream.
+
+Fix potential leak of uninitialized stack data to userspace by ensuring
+that the `scan` structure is zeroed before use.
+
+Fixes: 0ab13674a9bd ("media: pci: mgb4: Added Digiteq Automotive MGB4 driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/mgb4/mgb4_trigger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/pci/mgb4/mgb4_trigger.c
++++ b/drivers/media/pci/mgb4/mgb4_trigger.c
+@@ -91,7 +91,7 @@ static irqreturn_t trigger_handler(int i
+ struct {
+ u32 data;
+ s64 ts __aligned(8);
+- } scan;
++ } scan = { };
+
+ scan.data = mgb4_read_reg(&st->mgbdev->video, 0xA0);
+ mgb4_write_reg(&st->mgbdev->video, 0xA0, scan.data);
--- /dev/null
+From 7fa37ba25a1dfc084e24ea9acc14bf1fad8af14c Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 7 Aug 2025 22:54:15 +0200
+Subject: media: s5p-mfc: remove an unused/uninitialized variable
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 7fa37ba25a1dfc084e24ea9acc14bf1fad8af14c upstream.
+
+The s5p_mfc_cmd_args structure in the v6 driver is never used, not
+initialized to anything other than zero, but as of clang-21 this
+causes a warning:
+
+drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c:45:7: error: variable 'h2r_args' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 45 | &h2r_args);
+ | ^~~~~~~~
+
+Just remove this for simplicity. Since the function is also called
+through a callback, this does require adding a trivial wrapper with
+the correct prototype.
+
+Fixes: f96f3cfa0bb8 ("[media] s5p-mfc: Update MFC v4l2 driver to support MFC6.x")
+Cc: stable@vger.kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c | 35 +++++-----------
+ 1 file changed, 13 insertions(+), 22 deletions(-)
+
+--- a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c
++++ b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c
+@@ -14,8 +14,7 @@
+ #include "s5p_mfc_opr.h"
+ #include "s5p_mfc_cmd_v6.h"
+
+-static int s5p_mfc_cmd_host2risc_v6(struct s5p_mfc_dev *dev, int cmd,
+- const struct s5p_mfc_cmd_args *args)
++static int s5p_mfc_cmd_host2risc_v6(struct s5p_mfc_dev *dev, int cmd)
+ {
+ mfc_debug(2, "Issue the command: %d\n", cmd);
+
+@@ -31,7 +30,6 @@ static int s5p_mfc_cmd_host2risc_v6(stru
+
+ static int s5p_mfc_sys_init_cmd_v6(struct s5p_mfc_dev *dev)
+ {
+- struct s5p_mfc_cmd_args h2r_args;
+ const struct s5p_mfc_buf_size_v6 *buf_size = dev->variant->buf_size->priv;
+ int ret;
+
+@@ -41,33 +39,23 @@ static int s5p_mfc_sys_init_cmd_v6(struc
+
+ mfc_write(dev, dev->ctx_buf.dma, S5P_FIMV_CONTEXT_MEM_ADDR_V6);
+ mfc_write(dev, buf_size->dev_ctx, S5P_FIMV_CONTEXT_MEM_SIZE_V6);
+- return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_SYS_INIT_V6,
+- &h2r_args);
++ return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_SYS_INIT_V6);
+ }
+
+ static int s5p_mfc_sleep_cmd_v6(struct s5p_mfc_dev *dev)
+ {
+- struct s5p_mfc_cmd_args h2r_args;
+-
+- memset(&h2r_args, 0, sizeof(struct s5p_mfc_cmd_args));
+- return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_SLEEP_V6,
+- &h2r_args);
++ return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_SLEEP_V6);
+ }
+
+ static int s5p_mfc_wakeup_cmd_v6(struct s5p_mfc_dev *dev)
+ {
+- struct s5p_mfc_cmd_args h2r_args;
+-
+- memset(&h2r_args, 0, sizeof(struct s5p_mfc_cmd_args));
+- return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_WAKEUP_V6,
+- &h2r_args);
++ return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_WAKEUP_V6);
+ }
+
+ /* Open a new instance and get its number */
+ static int s5p_mfc_open_inst_cmd_v6(struct s5p_mfc_ctx *ctx)
+ {
+ struct s5p_mfc_dev *dev = ctx->dev;
+- struct s5p_mfc_cmd_args h2r_args;
+ int codec_type;
+
+ mfc_debug(2, "Requested codec mode: %d\n", ctx->codec_mode);
+@@ -129,23 +117,20 @@ static int s5p_mfc_open_inst_cmd_v6(stru
+ mfc_write(dev, ctx->ctx.size, S5P_FIMV_CONTEXT_MEM_SIZE_V6);
+ mfc_write(dev, 0, S5P_FIMV_D_CRC_CTRL_V6); /* no crc */
+
+- return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_OPEN_INSTANCE_V6,
+- &h2r_args);
++ return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_OPEN_INSTANCE_V6);
+ }
+
+ /* Close instance */
+ static int s5p_mfc_close_inst_cmd_v6(struct s5p_mfc_ctx *ctx)
+ {
+ struct s5p_mfc_dev *dev = ctx->dev;
+- struct s5p_mfc_cmd_args h2r_args;
+ int ret = 0;
+
+ dev->curr_ctx = ctx->num;
+ if (ctx->state != MFCINST_FREE) {
+ mfc_write(dev, ctx->inst_no, S5P_FIMV_INSTANCE_ID_V6);
+ ret = s5p_mfc_cmd_host2risc_v6(dev,
+- S5P_FIMV_H2R_CMD_CLOSE_INSTANCE_V6,
+- &h2r_args);
++ S5P_FIMV_H2R_CMD_CLOSE_INSTANCE_V6);
+ } else {
+ ret = -EINVAL;
+ }
+@@ -153,9 +138,15 @@ static int s5p_mfc_close_inst_cmd_v6(str
+ return ret;
+ }
+
++static int s5p_mfc_cmd_host2risc_v6_args(struct s5p_mfc_dev *dev, int cmd,
++ const struct s5p_mfc_cmd_args *ignored)
++{
++ return s5p_mfc_cmd_host2risc_v6(dev, cmd);
++}
++
+ /* Initialize cmd function pointers for MFC v6 */
+ static const struct s5p_mfc_hw_cmds s5p_mfc_cmds_v6 = {
+- .cmd_host2risc = s5p_mfc_cmd_host2risc_v6,
++ .cmd_host2risc = s5p_mfc_cmd_host2risc_v6_args,
+ .sys_init_cmd = s5p_mfc_sys_init_cmd_v6,
+ .sleep_cmd = s5p_mfc_sleep_cmd_v6,
+ .wakeup_cmd = s5p_mfc_wakeup_cmd_v6,
--- /dev/null
+From 3e743cd0a73246219da117ee99061aad51c4748c Mon Sep 17 00:00:00 2001
+From: Jai Luthra <jai.luthra@ideasonboard.com>
+Date: Mon, 11 Aug 2025 13:50:15 +0530
+Subject: media: ti: j721e-csi2rx: Fix source subdev link creation
+
+From: Jai Luthra <jai.luthra@ideasonboard.com>
+
+commit 3e743cd0a73246219da117ee99061aad51c4748c upstream.
+
+We don't use OF ports and remote-endpoints to connect the CSI2RX bridge
+and this device in the device tree, thus it is wrong to use
+v4l2_create_fwnode_links_to_pad() to create the media graph link between
+the two.
+
+It works out on accident, as neither the source nor the sink implement
+the .get_fwnode_pad() callback, and the framework helper falls back on
+using the first source and sink pads to create the link between them.
+
+Instead, manually create the media link from the first source pad of the
+bridge to the first sink pad of the J721E CSI2RX.
+
+Fixes: b4a3d877dc92 ("media: ti: Add CSI2RX support for J721E")
+Cc: stable@vger.kernel.org
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Tested-by: Yemike Abhilash Chandra <y-abhilashchandra@ti.com> (on SK-AM68)
+Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
++++ b/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
+@@ -52,6 +52,8 @@
+ #define DRAIN_TIMEOUT_MS 50
+ #define DRAIN_BUFFER_SIZE SZ_32K
+
++#define CSI2RX_BRIDGE_SOURCE_PAD 1
++
+ struct ti_csi2rx_fmt {
+ u32 fourcc; /* Four character code. */
+ u32 code; /* Mbus code. */
+@@ -426,8 +428,9 @@ static int csi_async_notifier_complete(s
+ if (ret)
+ return ret;
+
+- ret = v4l2_create_fwnode_links_to_pad(csi->source, &csi->pad,
+- MEDIA_LNK_FL_IMMUTABLE | MEDIA_LNK_FL_ENABLED);
++ ret = media_create_pad_link(&csi->source->entity, CSI2RX_BRIDGE_SOURCE_PAD,
++ &vdev->entity, csi->pad.index,
++ MEDIA_LNK_FL_IMMUTABLE | MEDIA_LNK_FL_ENABLED);
+
+ if (ret) {
+ video_unregister_device(vdev);
--- /dev/null
+From 072799db233f9de90a62be54c1e59275c2db3969 Mon Sep 17 00:00:00 2001
+From: Jai Luthra <jai.luthra@ideasonboard.com>
+Date: Mon, 11 Aug 2025 13:50:13 +0530
+Subject: media: ti: j721e-csi2rx: Use devm_of_platform_populate
+
+From: Jai Luthra <jai.luthra@ideasonboard.com>
+
+commit 072799db233f9de90a62be54c1e59275c2db3969 upstream.
+
+Ensure that we clean up the platform bus when we remove this driver.
+
+This fixes a crash seen when reloading the module for the child device
+with the parent not yet reloaded.
+
+Fixes: b4a3d877dc92 ("media: ti: Add CSI2RX support for J721E")
+Cc: stable@vger.kernel.org
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Tested-by: Yemike Abhilash Chandra <y-abhilashchandra@ti.com> (on SK-AM68)
+Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
++++ b/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
+@@ -1121,7 +1121,7 @@ static int ti_csi2rx_probe(struct platfo
+ if (ret)
+ goto err_vb2q;
+
+- ret = of_platform_populate(csi->dev->of_node, NULL, NULL, csi->dev);
++ ret = devm_of_platform_populate(csi->dev);
+ if (ret) {
+ dev_err(csi->dev, "Failed to create children: %d\n", ret);
+ goto err_subdev;
--- /dev/null
+From 93f213b444a40f1e7a4383b499b65e782dcb14b9 Mon Sep 17 00:00:00 2001
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+Date: Wed, 20 Aug 2025 17:16:39 +0200
+Subject: media: venus: firmware: Use correct reset sequence for IRIS2
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+commit 93f213b444a40f1e7a4383b499b65e782dcb14b9 upstream.
+
+When starting venus with the "no_tz" code path, IRIS2 needs the same
+boot/reset sequence as IRIS2_1. This is because most of the registers were
+moved to the "wrapper_tz_base", which is already defined for both IRIS2 and
+IRIS2_1 inside core.c. Add IRIS2 to the checks inside firmware.c as well to
+make sure that it uses the correct reset sequence.
+
+Both IRIS2 and IRIS2_1 are HFI v6 variants, so the correct sequence was
+used before commit c38610f8981e ("media: venus: firmware: Sanitize
+per-VPU-version").
+
+Fixes: c38610f8981e ("media: venus: firmware: Sanitize per-VPU-version")
+Cc: stable@vger.kernel.org
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+[bod: Fixed commit log IRIS -> IRIS2]
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/firmware.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/firmware.c
++++ b/drivers/media/platform/qcom/venus/firmware.c
+@@ -30,7 +30,7 @@ static void venus_reset_cpu(struct venus
+ u32 fw_size = core->fw.mapped_mem_size;
+ void __iomem *wrapper_base;
+
+- if (IS_IRIS2_1(core))
++ if (IS_IRIS2(core) || IS_IRIS2_1(core))
+ wrapper_base = core->wrapper_tz_base;
+ else
+ wrapper_base = core->wrapper_base;
+@@ -42,7 +42,7 @@ static void venus_reset_cpu(struct venus
+ writel(fw_size, wrapper_base + WRAPPER_NONPIX_START_ADDR);
+ writel(fw_size, wrapper_base + WRAPPER_NONPIX_END_ADDR);
+
+- if (IS_IRIS2_1(core)) {
++ if (IS_IRIS2(core) || IS_IRIS2_1(core)) {
+ /* Bring XTSS out of reset */
+ writel(0, wrapper_base + WRAPPER_TZ_XTSS_SW_RESET);
+ } else {
+@@ -68,7 +68,7 @@ int venus_set_hw_state(struct venus_core
+ if (resume) {
+ venus_reset_cpu(core);
+ } else {
+- if (IS_IRIS2_1(core))
++ if (IS_IRIS2(core) || IS_IRIS2_1(core))
+ writel(WRAPPER_XTSS_SW_RESET_BIT,
+ core->wrapper_tz_base + WRAPPER_TZ_XTSS_SW_RESET);
+ else
+@@ -181,7 +181,7 @@ static int venus_shutdown_no_tz(struct v
+ void __iomem *wrapper_base = core->wrapper_base;
+ void __iomem *wrapper_tz_base = core->wrapper_tz_base;
+
+- if (IS_IRIS2_1(core)) {
++ if (IS_IRIS2(core) || IS_IRIS2_1(core)) {
+ /* Assert the reset to XTSS */
+ reg = readl(wrapper_tz_base + WRAPPER_TZ_XTSS_SW_RESET);
+ reg |= WRAPPER_XTSS_SW_RESET_BIT;
--- /dev/null
+From 4bd8a6147645480d550242ff816b4c7ba160e5b7 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+Date: Sat, 6 Sep 2025 12:11:21 +0200
+Subject: media: vivid: fix disappearing <Vendor Command With ID> messages
+
+From: Hans Verkuil <hverkuil+cisco@kernel.org>
+
+commit 4bd8a6147645480d550242ff816b4c7ba160e5b7 upstream.
+
+The vivid driver supports the <Vendor Command With ID> message,
+but if the Vendor ID of the received message didn't match the Vendor ID
+of the CEC Adapter, then it ignores it (good) and returns 0 (bad).
+
+It should return -ENOMSG to indicate that other followers should be
+asked to handle it. Return code 0 means that the driver handled it,
+which is wrong in this case.
+
+As a result, userspace followers never get the chance to process such a
+message.
+
+Refactor the code a bit to have the function return -ENOMSG at the end,
+drop the default case, and ensure that the message handlers return 0.
+
+That way 0 is only returned if the message is actually handled in the
+vivid_received() function.
+
+Fixes: 812765cd6954 ("media: vivid: add <Vendor Command With ID> support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/test-drivers/vivid/vivid-cec.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/test-drivers/vivid/vivid-cec.c b/drivers/media/test-drivers/vivid/vivid-cec.c
+index 356a988dd6a1..2d15fdd5d999 100644
+--- a/drivers/media/test-drivers/vivid/vivid-cec.c
++++ b/drivers/media/test-drivers/vivid/vivid-cec.c
+@@ -327,7 +327,7 @@ static int vivid_received(struct cec_adapter *adap, struct cec_msg *msg)
+ char osd[14];
+
+ if (!cec_is_sink(adap))
+- return -ENOMSG;
++ break;
+ cec_ops_set_osd_string(msg, &disp_ctl, osd);
+ switch (disp_ctl) {
+ case CEC_OP_DISP_CTL_DEFAULT:
+@@ -348,7 +348,7 @@ static int vivid_received(struct cec_adapter *adap, struct cec_msg *msg)
+ cec_transmit_msg(adap, &reply, false);
+ break;
+ }
+- break;
++ return 0;
+ }
+ case CEC_MSG_VENDOR_COMMAND_WITH_ID: {
+ u32 vendor_id;
+@@ -379,7 +379,7 @@ static int vivid_received(struct cec_adapter *adap, struct cec_msg *msg)
+ if (size == 1) {
+ // Ignore even op values
+ if (!(vendor_cmd[0] & 1))
+- break;
++ return 0;
+ reply.len = msg->len;
+ memcpy(reply.msg + 1, msg->msg + 1, msg->len - 1);
+ reply.msg[msg->len - 1]++;
+@@ -388,12 +388,10 @@ static int vivid_received(struct cec_adapter *adap, struct cec_msg *msg)
+ CEC_OP_ABORT_INVALID_OP);
+ }
+ cec_transmit_msg(adap, &reply, false);
+- break;
++ return 0;
+ }
+- default:
+- return -ENOMSG;
+ }
+- return 0;
++ return -ENOMSG;
+ }
+
+ static const struct cec_adap_ops vivid_cec_adap_ops = {
+--
+2.51.0
+
arm-am33xx-implement-ti-advisory-1.0.36-emu0-emu1-pins-state-on-reset.patch
arm-omap2-pm33xx-core-ix-device-node-reference-leaks-in-amx3_idle_init.patch
perf-arm-cmn-fix-cmn-s3-dtm-offset.patch
+dt-bindings-phy-rockchip-inno-csi-dphy-make-power-domains-non-required.patch
+xen-events-cleanup-find_virq-return-codes.patch
+xen-manage-fix-suspend-error-path.patch
+xen-events-return-eexist-for-bound-virqs.patch
+xen-events-update-virq_to_irq-on-migration.patch
+firmware-meson_sm-fix-device-leak-at-probe.patch
+media-cec-extron-da-hd-4k-plus-drop-external-module-make-commands.patch
+media-cx18-add-missing-check-after-dma-map.patch
+media-i2c-mt9v111-fix-incorrect-type-for-ret.patch
+media-mc-fix-must_connect-handling-for-pads-with-no-links.patch
+media-pci-ivtv-add-missing-check-after-dma-map.patch
+media-pci-mg4b-fix-uninitialized-iio-scan-data.patch
+media-s5p-mfc-remove-an-unused-uninitialized-variable.patch
+media-venus-firmware-use-correct-reset-sequence-for-iris2.patch
+media-vivid-fix-disappearing-vendor-command-with-id-messages.patch
+media-ti-j721e-csi2rx-use-devm_of_platform_populate.patch
+media-ti-j721e-csi2rx-fix-source-subdev-link-creation.patch
+media-lirc-fix-error-handling-in-lirc_register.patch
--- /dev/null
+From 08df2d7dd4ab2db8a172d824cda7872d5eca460a Mon Sep 17 00:00:00 2001
+From: Jason Andryuk <jason.andryuk@amd.com>
+Date: Wed, 27 Aug 2025 20:36:01 -0400
+Subject: xen/events: Cleanup find_virq() return codes
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+commit 08df2d7dd4ab2db8a172d824cda7872d5eca460a upstream.
+
+rc is overwritten by the evtchn_status hypercall in each iteration, so
+the return value will be whatever the last iteration is. This could
+incorrectly return success even if the event channel was not found.
+Change to an explicit -ENOENT for an un-found virq and return 0 on a
+successful match.
+
+Fixes: 62cc5fc7b2e0 ("xen/pv-on-hvm kexec: rebind virqs to existing eventchannel ports")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20250828003604.8949-2-jason.andryuk@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/events/events_base.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -1324,10 +1324,11 @@ static int find_virq(unsigned int virq,
+ {
+ struct evtchn_status status;
+ evtchn_port_t port;
+- int rc = -ENOENT;
+
+ memset(&status, 0, sizeof(status));
+ for (port = 0; port < xen_evtchn_max_channels(); port++) {
++ int rc;
++
+ status.dom = DOMID_SELF;
+ status.port = port;
+ rc = HYPERVISOR_event_channel_op(EVTCHNOP_status, &status);
+@@ -1337,10 +1338,10 @@ static int find_virq(unsigned int virq,
+ continue;
+ if (status.u.virq == virq && status.vcpu == xen_vcpu_nr(cpu)) {
+ *evtchn = port;
+- break;
++ return 0;
+ }
+ }
+- return rc;
++ return -ENOENT;
+ }
+
+ /**
--- /dev/null
+From 07ce121d93a5e5fb2440a24da3dbf408fcee978e Mon Sep 17 00:00:00 2001
+From: Jason Andryuk <jason.andryuk@amd.com>
+Date: Wed, 27 Aug 2025 20:36:02 -0400
+Subject: xen/events: Return -EEXIST for bound VIRQs
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+commit 07ce121d93a5e5fb2440a24da3dbf408fcee978e upstream.
+
+Change find_virq() to return -EEXIST when a VIRQ is bound to a
+different CPU than the one passed in. With that, remove the BUG_ON()
+from bind_virq_to_irq() to propogate the error upwards.
+
+Some VIRQs are per-cpu, but others are per-domain or global. Those must
+be bound to CPU0 and can then migrate elsewhere. The lookup for
+per-domain and global will probably fail when migrated off CPU 0,
+especially when the current CPU is tracked. This now returns -EEXIST
+instead of BUG_ON().
+
+A second call to bind a per-domain or global VIRQ is not expected, but
+make it non-fatal to avoid trying to look up the irq, since we don't
+know which per_cpu(virq_to_irq) it will be in.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20250828003604.8949-3-jason.andryuk@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/events/events_base.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -1320,10 +1320,12 @@ int bind_interdomain_evtchn_to_irq_latee
+ }
+ EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq_lateeoi);
+
+-static int find_virq(unsigned int virq, unsigned int cpu, evtchn_port_t *evtchn)
++static int find_virq(unsigned int virq, unsigned int cpu, evtchn_port_t *evtchn,
++ bool percpu)
+ {
+ struct evtchn_status status;
+ evtchn_port_t port;
++ bool exists = false;
+
+ memset(&status, 0, sizeof(status));
+ for (port = 0; port < xen_evtchn_max_channels(); port++) {
+@@ -1336,12 +1338,16 @@ static int find_virq(unsigned int virq,
+ continue;
+ if (status.status != EVTCHNSTAT_virq)
+ continue;
+- if (status.u.virq == virq && status.vcpu == xen_vcpu_nr(cpu)) {
++ if (status.u.virq != virq)
++ continue;
++ if (status.vcpu == xen_vcpu_nr(cpu)) {
+ *evtchn = port;
+ return 0;
++ } else if (!percpu) {
++ exists = true;
+ }
+ }
+- return -ENOENT;
++ return exists ? -EEXIST : -ENOENT;
+ }
+
+ /**
+@@ -1388,8 +1394,11 @@ int bind_virq_to_irq(unsigned int virq,
+ evtchn = bind_virq.port;
+ else {
+ if (ret == -EEXIST)
+- ret = find_virq(virq, cpu, &evtchn);
+- BUG_ON(ret < 0);
++ ret = find_virq(virq, cpu, &evtchn, percpu);
++ if (ret) {
++ __unbind_from_irq(info, info->irq);
++ goto out;
++ }
+ }
+
+ ret = xen_irq_info_virq_setup(info, cpu, evtchn, virq);
--- /dev/null
+From 3fcc8e146935415d69ffabb5df40ecf50e106131 Mon Sep 17 00:00:00 2001
+From: Jason Andryuk <jason.andryuk@amd.com>
+Date: Wed, 27 Aug 2025 20:36:03 -0400
+Subject: xen/events: Update virq_to_irq on migration
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+commit 3fcc8e146935415d69ffabb5df40ecf50e106131 upstream.
+
+VIRQs come in 3 flavors, per-VPU, per-domain, and global, and the VIRQs
+are tracked in per-cpu virq_to_irq arrays.
+
+Per-domain and global VIRQs must be bound on CPU 0, and
+bind_virq_to_irq() sets the per_cpu virq_to_irq at registration time
+Later, the interrupt can migrate, and info->cpu is updated. When
+calling __unbind_from_irq(), the per-cpu virq_to_irq is cleared for a
+different cpu. If bind_virq_to_irq() is called again with CPU 0, the
+stale irq is returned. There won't be any irq_info for the irq, so
+things break.
+
+Make xen_rebind_evtchn_to_cpu() update the per_cpu virq_to_irq mappings
+to keep them update to date with the current cpu. This ensures the
+correct virq_to_irq is cleared in __unbind_from_irq().
+
+Fixes: e46cdb66c8fc ("xen: event channels")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20250828003604.8949-4-jason.andryuk@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/events/events_base.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -1803,9 +1803,20 @@ static int xen_rebind_evtchn_to_cpu(stru
+ * virq or IPI channel, which don't actually need to be rebound. Ignore
+ * it, but don't do the xenlinux-level rebind in that case.
+ */
+- if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0)
++ if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0) {
++ int old_cpu = info->cpu;
++
+ bind_evtchn_to_cpu(info, tcpu, false);
+
++ if (info->type == IRQT_VIRQ) {
++ int virq = info->u.virq;
++ int irq = per_cpu(virq_to_irq, old_cpu)[virq];
++
++ per_cpu(virq_to_irq, old_cpu)[virq] = -1;
++ per_cpu(virq_to_irq, tcpu)[virq] = irq;
++ }
++ }
++
+ do_unmask(info, EVT_MASK_REASON_TEMPORARY);
+
+ return 0;
--- /dev/null
+From f770c3d858687252f1270265ba152d5c622e793f Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Thu, 4 Sep 2025 15:11:09 +0200
+Subject: xen/manage: Fix suspend error path
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit f770c3d858687252f1270265ba152d5c622e793f upstream.
+
+The device power management API has the following asymmetry:
+* dpm_suspend_start() does not clean up on failure
+ (it requires a call to dpm_resume_end())
+* dpm_suspend_end() does clean up on failure
+ (it does not require a call to dpm_resume_start())
+
+The asymmetry was introduced by commit d8f3de0d2412 ("Suspend-related
+patches for 2.6.27") in June 2008: It removed a call to device_resume()
+from device_suspend() (which was later renamed to dpm_suspend_start()).
+
+When Xen began using the device power management API in May 2008 with
+commit 0e91398f2a5d ("xen: implement save/restore"), the asymmetry did
+not yet exist. But since it was introduced, a call to dpm_resume_end()
+is missing in the error path of dpm_suspend_start(). Fix it.
+
+Fixes: d8f3de0d2412 ("Suspend-related patches for 2.6.27")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: stable@vger.kernel.org # v2.6.27
+Reviewed-by: "Rafael J. Wysocki (Intel)" <rafael@kernel.org>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <22453676d1ddcebbe81641bb68ddf587fee7e21e.1756990799.git.lukas@wunner.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/manage.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -116,7 +116,7 @@ static void do_suspend(void)
+ err = dpm_suspend_start(PMSG_FREEZE);
+ if (err) {
+ pr_err("%s: dpm_suspend_start %d\n", __func__, err);
+- goto out_thaw;
++ goto out_resume_end;
+ }
+
+ printk(KERN_DEBUG "suspending xenstore...\n");
+@@ -156,6 +156,7 @@ out_resume:
+ else
+ xs_suspend_cancel();
+
++out_resume_end:
+ dpm_resume_end(si.cancelled ? PMSG_THAW : PMSG_RESTORE);
+
+ out_thaw:
projects / thirdparty / kernel / stable-queue.git / commitdiff
