--- /dev/null
+From c254815b02673cc77a84103c4c0d6197bd90c0ef Mon Sep 17 00:00:00 2001
+From: Michael Riesch <michael.riesch@collabora.com>
+Date: Wed, 3 Sep 2025 19:04:50 +0200
+Subject: dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
+
+From: Michael Riesch <michael.riesch@collabora.com>
+
+commit c254815b02673cc77a84103c4c0d6197bd90c0ef upstream.
+
+There are variants of the Rockchip Innosilicon CSI DPHY (e.g., the RK3568
+variant) that are powered on by default as they are part of the ALIVE power
+domain.
+Remove 'power-domains' from the required properties in order to avoid false
+positives.
+
+Fixes: 22c8e0a69b7f ("dt-bindings: phy: add compatible for rk356x to rockchip-inno-csi-dphy")
+Cc: stable@kernel.org
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Michael Riesch <michael.riesch@collabora.com>
+Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-2-a4f340a7f0cf@collabora.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml | 15 +++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml
++++ b/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml
+@@ -57,11 +57,24 @@ required:
+ - clocks
+ - clock-names
+ - '#phy-cells'
+- - power-domains
+ - resets
+ - reset-names
+ - rockchip,grf
+
++allOf:
++ - if:
++ properties:
++ compatible:
++ contains:
++ enum:
++ - rockchip,px30-csi-dphy
++ - rockchip,rk1808-csi-dphy
++ - rockchip,rk3326-csi-dphy
++ - rockchip,rk3368-csi-dphy
++ then:
++ required:
++ - power-domains
++
+ additionalProperties: false
+
+ examples:
--- /dev/null
+From 8ece3173f87df03935906d0c612c2aeda9db92ca Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 25 Jul 2025 09:40:19 +0200
+Subject: firmware: meson_sm: fix device leak at probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 8ece3173f87df03935906d0c612c2aeda9db92ca upstream.
+
+Make sure to drop the reference to the secure monitor device taken by
+of_find_device_by_node() when looking up its driver data on behalf of
+other drivers (e.g. during probe).
+
+Note that holding a reference to the platform device does not prevent
+its driver data from going away so there is no point in keeping the
+reference after the helper returns.
+
+Fixes: 8cde3c2153e8 ("firmware: meson_sm: Rework driver as a proper platform driver")
+Cc: stable@vger.kernel.org # 5.5
+Cc: Carlo Caione <ccaione@baylibre.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20250725074019.8765-1-johan@kernel.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/meson/meson_sm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/firmware/meson/meson_sm.c
++++ b/drivers/firmware/meson/meson_sm.c
+@@ -225,11 +225,16 @@ EXPORT_SYMBOL(meson_sm_call_write);
+ struct meson_sm_firmware *meson_sm_get(struct device_node *sm_node)
+ {
+ struct platform_device *pdev = of_find_device_by_node(sm_node);
++ struct meson_sm_firmware *fw;
+
+ if (!pdev)
+ return NULL;
+
+- return platform_get_drvdata(pdev);
++ fw = platform_get_drvdata(pdev);
++
++ put_device(&pdev->dev);
++
++ return fw;
+ }
+ EXPORT_SYMBOL_GPL(meson_sm_get);
+
--- /dev/null
+From 23b53639a793477326fd57ed103823a8ab63084f Mon Sep 17 00:00:00 2001
+From: Thomas Fourier <fourier.thomas@gmail.com>
+Date: Wed, 9 Jul 2025 13:35:40 +0200
+Subject: media: cx18: Add missing check after DMA map
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+commit 23b53639a793477326fd57ed103823a8ab63084f upstream.
+
+The DMA map functions can fail and should be tested for errors.
+If the mapping fails, dealloc buffers, and return.
+
+Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/cx18/cx18-queue.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/pci/cx18/cx18-queue.c
++++ b/drivers/media/pci/cx18/cx18-queue.c
+@@ -379,15 +379,22 @@ int cx18_stream_alloc(struct cx18_stream
+ break;
+ }
+
++ buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev,
++ buf->buf, s->buf_size,
++ s->dma);
++ if (dma_mapping_error(&s->cx->pci_dev->dev, buf->dma_handle)) {
++ kfree(buf->buf);
++ kfree(mdl);
++ kfree(buf);
++ break;
++ }
++
+ INIT_LIST_HEAD(&mdl->list);
+ INIT_LIST_HEAD(&mdl->buf_list);
+ mdl->id = s->mdl_base_idx; /* a somewhat safe value */
+ cx18_enqueue(s, mdl, &s->q_idle);
+
+ INIT_LIST_HEAD(&buf->list);
+- buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev,
+- buf->buf, s->buf_size,
+- s->dma);
+ cx18_buf_sync_for_cpu(s, buf);
+ list_add_tail(&buf->list, &s->buf_pool);
+ }
--- /dev/null
+From bacd713145443dce7764bb2967d30832a95e5ec8 Mon Sep 17 00:00:00 2001
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+Date: Wed, 27 Aug 2025 20:39:10 +0800
+Subject: media: i2c: mt9v111: fix incorrect type for ret
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+commit bacd713145443dce7764bb2967d30832a95e5ec8 upstream.
+
+Change "ret" from unsigned int to int type in mt9v111_calc_frame_rate()
+to store negative error codes or zero returned by __mt9v111_hw_reset()
+and other functions.
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Fixes: aab7ed1c3927 ("media: i2c: Add driver for Aptina MT9V111")
+Cc: stable@vger.kernel.org
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/mt9v111.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/mt9v111.c
++++ b/drivers/media/i2c/mt9v111.c
+@@ -534,8 +534,8 @@ static int mt9v111_calc_frame_rate(struc
+ static int mt9v111_hw_config(struct mt9v111_dev *mt9v111)
+ {
+ struct i2c_client *c = mt9v111->client;
+- unsigned int ret;
+ u16 outfmtctrl2;
++ int ret;
+
+ /* Force device reset. */
+ ret = __mt9v111_hw_reset(mt9v111);
--- /dev/null
+From 4f4098c57e139ad972154077fb45c3e3141555dd Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Fri, 18 Jul 2025 17:50:54 +0800
+Subject: media: lirc: Fix error handling in lirc_register()
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit 4f4098c57e139ad972154077fb45c3e3141555dd upstream.
+
+When cdev_device_add() failed, calling put_device() to explicitly
+release dev->lirc_dev. Otherwise, it could cause the fault of the
+reference count.
+
+Found by code review.
+
+Cc: stable@vger.kernel.org
+Fixes: a6ddd4fecbb0 ("media: lirc: remove last remnants of lirc kapi")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/rc/lirc_dev.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/rc/lirc_dev.c
++++ b/drivers/media/rc/lirc_dev.c
+@@ -735,11 +735,11 @@ int lirc_register(struct rc_dev *dev)
+
+ cdev_init(&dev->lirc_cdev, &lirc_fops);
+
++ get_device(&dev->dev);
++
+ err = cdev_device_add(&dev->lirc_cdev, &dev->lirc_dev);
+ if (err)
+- goto out_ida;
+-
+- get_device(&dev->dev);
++ goto out_put_device;
+
+ switch (dev->driver_type) {
+ case RC_DRIVER_SCANCODE:
+@@ -763,7 +763,8 @@ int lirc_register(struct rc_dev *dev)
+
+ return 0;
+
+-out_ida:
++out_put_device:
++ put_device(&dev->lirc_dev);
+ ida_free(&lirc_ida, minor);
+ return err;
+ }
--- /dev/null
+From eec81250219a209b863f11d02128ec1dd8e20877 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Wed, 20 Aug 2025 17:00:20 +0300
+Subject: media: mc: Fix MUST_CONNECT handling for pads with no links
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+commit eec81250219a209b863f11d02128ec1dd8e20877 upstream.
+
+Commit b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always
+require an enabled link") expanded the meaning of the MUST_CONNECT flag
+to require an enabled link in all cases. To do so, the link exploration
+code was expanded to cover unconnected pads, in order to reject those
+that have the MUST_CONNECT flag set. The implementation was however
+incorrect, ignoring unconnected pads instead of ignoring connected pads.
+Fix it.
+
+Reported-by: Martin Kepplinger-Novaković <martink@posteo.de>
+Closes: https://lore.kernel.org/linux-media/20250205172957.182362-1-martink@posteo.de
+Reported-by: Maud Spierings <maudspierings@gocontroll.com>
+Closes: https://lore.kernel.org/linux-media/20250818-imx8_isi-v1-1-e9cfe994c435@gocontroll.com
+Fixes: b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always require an enabled link")
+Cc: stable@vger.kernel.org # 6.1
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Maud Spierings <maudspierings@gocontroll.com>
+Tested-by: Martin Kepplinger-Novaković <martink@posteo.de>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/mc/mc-entity.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/mc/mc-entity.c
++++ b/drivers/media/mc/mc-entity.c
+@@ -678,7 +678,7 @@ done:
+ * (already discovered through iterating over links) and pads
+ * not internally connected.
+ */
+- if (origin == local || !local->num_links ||
++ if (origin == local || local->num_links ||
+ !media_entity_has_pad_interdep(origin->entity, origin->index,
+ local->index))
+ continue;
--- /dev/null
+From 1069a4fe637d0e3e4c163e3f8df9be306cc299b4 Mon Sep 17 00:00:00 2001
+From: Thomas Fourier <fourier.thomas@gmail.com>
+Date: Wed, 16 Jul 2025 15:26:30 +0200
+Subject: media: pci: ivtv: Add missing check after DMA map
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+commit 1069a4fe637d0e3e4c163e3f8df9be306cc299b4 upstream.
+
+The DMA map functions can fail and should be tested for errors.
+If the mapping fails, free blanking_ptr and set it to 0. As 0 is a
+valid DMA address, use blanking_ptr to test if the DMA address
+is set.
+
+Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/ivtv/ivtv-irq.c | 2 +-
+ drivers/media/pci/ivtv/ivtv-yuv.c | 8 +++++++-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/pci/ivtv/ivtv-irq.c
++++ b/drivers/media/pci/ivtv/ivtv-irq.c
+@@ -351,7 +351,7 @@ void ivtv_dma_stream_dec_prepare(struct
+
+ /* Insert buffer block for YUV if needed */
+ if (s->type == IVTV_DEC_STREAM_TYPE_YUV && f->offset_y) {
+- if (yi->blanking_dmaptr) {
++ if (yi->blanking_ptr) {
+ s->sg_pending[idx].src = yi->blanking_dmaptr;
+ s->sg_pending[idx].dst = offset;
+ s->sg_pending[idx].size = 720 * 16;
+--- a/drivers/media/pci/ivtv/ivtv-yuv.c
++++ b/drivers/media/pci/ivtv/ivtv-yuv.c
+@@ -125,7 +125,7 @@ static int ivtv_yuv_prep_user_dma(struct
+ ivtv_udma_fill_sg_array(dma, y_buffer_offset, uv_buffer_offset, y_size);
+
+ /* If we've offset the y plane, ensure top area is blanked */
+- if (f->offset_y && yi->blanking_dmaptr) {
++ if (f->offset_y && yi->blanking_ptr) {
+ dma->SGarray[dma->SG_length].size = cpu_to_le32(720*16);
+ dma->SGarray[dma->SG_length].src = cpu_to_le32(yi->blanking_dmaptr);
+ dma->SGarray[dma->SG_length].dst = cpu_to_le32(IVTV_DECODER_OFFSET + yuv_offset[frame]);
+@@ -929,6 +929,12 @@ static void ivtv_yuv_init(struct ivtv *i
+ yi->blanking_dmaptr = dma_map_single(&itv->pdev->dev,
+ yi->blanking_ptr,
+ 720 * 16, DMA_TO_DEVICE);
++ if (dma_mapping_error(&itv->pdev->dev, yi->blanking_dmaptr)) {
++ kfree(yi->blanking_ptr);
++ yi->blanking_ptr = NULL;
++ yi->blanking_dmaptr = 0;
++ IVTV_DEBUG_WARN("Failed to dma_map yuv blanking buffer\n");
++ }
+ } else {
+ yi->blanking_dmaptr = 0;
+ IVTV_DEBUG_WARN("Failed to allocate yuv blanking buffer\n");
--- /dev/null
+From 93f213b444a40f1e7a4383b499b65e782dcb14b9 Mon Sep 17 00:00:00 2001
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+Date: Wed, 20 Aug 2025 17:16:39 +0200
+Subject: media: venus: firmware: Use correct reset sequence for IRIS2
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+commit 93f213b444a40f1e7a4383b499b65e782dcb14b9 upstream.
+
+When starting venus with the "no_tz" code path, IRIS2 needs the same
+boot/reset sequence as IRIS2_1. This is because most of the registers were
+moved to the "wrapper_tz_base", which is already defined for both IRIS2 and
+IRIS2_1 inside core.c. Add IRIS2 to the checks inside firmware.c as well to
+make sure that it uses the correct reset sequence.
+
+Both IRIS2 and IRIS2_1 are HFI v6 variants, so the correct sequence was
+used before commit c38610f8981e ("media: venus: firmware: Sanitize
+per-VPU-version").
+
+Fixes: c38610f8981e ("media: venus: firmware: Sanitize per-VPU-version")
+Cc: stable@vger.kernel.org
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+[bod: Fixed commit log IRIS -> IRIS2]
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/firmware.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/platform/qcom/venus/firmware.c
++++ b/drivers/media/platform/qcom/venus/firmware.c
+@@ -30,7 +30,7 @@ static void venus_reset_cpu(struct venus
+ u32 fw_size = core->fw.mapped_mem_size;
+ void __iomem *wrapper_base;
+
+- if (IS_IRIS2_1(core))
++ if (IS_IRIS2(core) || IS_IRIS2_1(core))
+ wrapper_base = core->wrapper_tz_base;
+ else
+ wrapper_base = core->wrapper_base;
+@@ -42,7 +42,7 @@ static void venus_reset_cpu(struct venus
+ writel(fw_size, wrapper_base + WRAPPER_NONPIX_START_ADDR);
+ writel(fw_size, wrapper_base + WRAPPER_NONPIX_END_ADDR);
+
+- if (IS_IRIS2_1(core)) {
++ if (IS_IRIS2(core) || IS_IRIS2_1(core)) {
+ /* Bring XTSS out of reset */
+ writel(0, wrapper_base + WRAPPER_TZ_XTSS_SW_RESET);
+ } else {
+@@ -68,7 +68,7 @@ int venus_set_hw_state(struct venus_core
+ if (resume) {
+ venus_reset_cpu(core);
+ } else {
+- if (IS_IRIS2_1(core))
++ if (IS_IRIS2(core) || IS_IRIS2_1(core))
+ writel(WRAPPER_XTSS_SW_RESET_BIT,
+ core->wrapper_tz_base + WRAPPER_TZ_XTSS_SW_RESET);
+ else
+@@ -181,7 +181,7 @@ static int venus_shutdown_no_tz(struct v
+ void __iomem *wrapper_base = core->wrapper_base;
+ void __iomem *wrapper_tz_base = core->wrapper_tz_base;
+
+- if (IS_IRIS2_1(core)) {
++ if (IS_IRIS2(core) || IS_IRIS2_1(core)) {
+ /* Assert the reset to XTSS */
+ reg = readl(wrapper_tz_base + WRAPPER_TZ_XTSS_SW_RESET);
+ reg |= WRAPPER_XTSS_SW_RESET_BIT;
arm64-dts-ti-k3-am62a-main-fix-main-padcfg-length.patch
arm64-kprobes-call-set_memory_rox-for-kprobe-page.patch
arm-omap2-pm33xx-core-ix-device-node-reference-leaks-in-amx3_idle_init.patch
+dt-bindings-phy-rockchip-inno-csi-dphy-make-power-domains-non-required.patch
+xen-events-cleanup-find_virq-return-codes.patch
+xen-manage-fix-suspend-error-path.patch
+xen-events-return-eexist-for-bound-virqs.patch
+xen-events-update-virq_to_irq-on-migration.patch
+firmware-meson_sm-fix-device-leak-at-probe.patch
+media-cx18-add-missing-check-after-dma-map.patch
+media-i2c-mt9v111-fix-incorrect-type-for-ret.patch
+media-mc-fix-must_connect-handling-for-pads-with-no-links.patch
+media-pci-ivtv-add-missing-check-after-dma-map.patch
+media-venus-firmware-use-correct-reset-sequence-for-iris2.patch
+media-lirc-fix-error-handling-in-lirc_register.patch
--- /dev/null
+From 08df2d7dd4ab2db8a172d824cda7872d5eca460a Mon Sep 17 00:00:00 2001
+From: Jason Andryuk <jason.andryuk@amd.com>
+Date: Wed, 27 Aug 2025 20:36:01 -0400
+Subject: xen/events: Cleanup find_virq() return codes
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+commit 08df2d7dd4ab2db8a172d824cda7872d5eca460a upstream.
+
+rc is overwritten by the evtchn_status hypercall in each iteration, so
+the return value will be whatever the last iteration is. This could
+incorrectly return success even if the event channel was not found.
+Change to an explicit -ENOENT for an un-found virq and return 0 on a
+successful match.
+
+Fixes: 62cc5fc7b2e0 ("xen/pv-on-hvm kexec: rebind virqs to existing eventchannel ports")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20250828003604.8949-2-jason.andryuk@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/events/events_base.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -1330,10 +1330,11 @@ static int find_virq(unsigned int virq,
+ {
+ struct evtchn_status status;
+ evtchn_port_t port;
+- int rc = -ENOENT;
+
+ memset(&status, 0, sizeof(status));
+ for (port = 0; port < xen_evtchn_max_channels(); port++) {
++ int rc;
++
+ status.dom = DOMID_SELF;
+ status.port = port;
+ rc = HYPERVISOR_event_channel_op(EVTCHNOP_status, &status);
+@@ -1343,10 +1344,10 @@ static int find_virq(unsigned int virq,
+ continue;
+ if (status.u.virq == virq && status.vcpu == xen_vcpu_nr(cpu)) {
+ *evtchn = port;
+- break;
++ return 0;
+ }
+ }
+- return rc;
++ return -ENOENT;
+ }
+
+ /**
--- /dev/null
+From 07ce121d93a5e5fb2440a24da3dbf408fcee978e Mon Sep 17 00:00:00 2001
+From: Jason Andryuk <jason.andryuk@amd.com>
+Date: Wed, 27 Aug 2025 20:36:02 -0400
+Subject: xen/events: Return -EEXIST for bound VIRQs
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+commit 07ce121d93a5e5fb2440a24da3dbf408fcee978e upstream.
+
+Change find_virq() to return -EEXIST when a VIRQ is bound to a
+different CPU than the one passed in. With that, remove the BUG_ON()
+from bind_virq_to_irq() to propogate the error upwards.
+
+Some VIRQs are per-cpu, but others are per-domain or global. Those must
+be bound to CPU0 and can then migrate elsewhere. The lookup for
+per-domain and global will probably fail when migrated off CPU 0,
+especially when the current CPU is tracked. This now returns -EEXIST
+instead of BUG_ON().
+
+A second call to bind a per-domain or global VIRQ is not expected, but
+make it non-fatal to avoid trying to look up the irq, since we don't
+know which per_cpu(virq_to_irq) it will be in.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20250828003604.8949-3-jason.andryuk@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/events/events_base.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -1326,10 +1326,12 @@ int bind_interdomain_evtchn_to_irq_latee
+ }
+ EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq_lateeoi);
+
+-static int find_virq(unsigned int virq, unsigned int cpu, evtchn_port_t *evtchn)
++static int find_virq(unsigned int virq, unsigned int cpu, evtchn_port_t *evtchn,
++ bool percpu)
+ {
+ struct evtchn_status status;
+ evtchn_port_t port;
++ bool exists = false;
+
+ memset(&status, 0, sizeof(status));
+ for (port = 0; port < xen_evtchn_max_channels(); port++) {
+@@ -1342,12 +1344,16 @@ static int find_virq(unsigned int virq,
+ continue;
+ if (status.status != EVTCHNSTAT_virq)
+ continue;
+- if (status.u.virq == virq && status.vcpu == xen_vcpu_nr(cpu)) {
++ if (status.u.virq != virq)
++ continue;
++ if (status.vcpu == xen_vcpu_nr(cpu)) {
+ *evtchn = port;
+ return 0;
++ } else if (!percpu) {
++ exists = true;
+ }
+ }
+- return -ENOENT;
++ return exists ? -EEXIST : -ENOENT;
+ }
+
+ /**
+@@ -1394,8 +1400,11 @@ int bind_virq_to_irq(unsigned int virq,
+ evtchn = bind_virq.port;
+ else {
+ if (ret == -EEXIST)
+- ret = find_virq(virq, cpu, &evtchn);
+- BUG_ON(ret < 0);
++ ret = find_virq(virq, cpu, &evtchn, percpu);
++ if (ret) {
++ __unbind_from_irq(info, info->irq);
++ goto out;
++ }
+ }
+
+ ret = xen_irq_info_virq_setup(info, cpu, evtchn, virq);
--- /dev/null
+From 3fcc8e146935415d69ffabb5df40ecf50e106131 Mon Sep 17 00:00:00 2001
+From: Jason Andryuk <jason.andryuk@amd.com>
+Date: Wed, 27 Aug 2025 20:36:03 -0400
+Subject: xen/events: Update virq_to_irq on migration
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+commit 3fcc8e146935415d69ffabb5df40ecf50e106131 upstream.
+
+VIRQs come in 3 flavors, per-VPU, per-domain, and global, and the VIRQs
+are tracked in per-cpu virq_to_irq arrays.
+
+Per-domain and global VIRQs must be bound on CPU 0, and
+bind_virq_to_irq() sets the per_cpu virq_to_irq at registration time
+Later, the interrupt can migrate, and info->cpu is updated. When
+calling __unbind_from_irq(), the per-cpu virq_to_irq is cleared for a
+different cpu. If bind_virq_to_irq() is called again with CPU 0, the
+stale irq is returned. There won't be any irq_info for the irq, so
+things break.
+
+Make xen_rebind_evtchn_to_cpu() update the per_cpu virq_to_irq mappings
+to keep them update to date with the current cpu. This ensures the
+correct virq_to_irq is cleared in __unbind_from_irq().
+
+Fixes: e46cdb66c8fc ("xen: event channels")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20250828003604.8949-4-jason.andryuk@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/events/events_base.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -1809,9 +1809,20 @@ static int xen_rebind_evtchn_to_cpu(stru
+ * virq or IPI channel, which don't actually need to be rebound. Ignore
+ * it, but don't do the xenlinux-level rebind in that case.
+ */
+- if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0)
++ if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0) {
++ int old_cpu = info->cpu;
++
+ bind_evtchn_to_cpu(info, tcpu, false);
+
++ if (info->type == IRQT_VIRQ) {
++ int virq = info->u.virq;
++ int irq = per_cpu(virq_to_irq, old_cpu)[virq];
++
++ per_cpu(virq_to_irq, old_cpu)[virq] = -1;
++ per_cpu(virq_to_irq, tcpu)[virq] = irq;
++ }
++ }
++
+ do_unmask(info, EVT_MASK_REASON_TEMPORARY);
+
+ return 0;
--- /dev/null
+From f770c3d858687252f1270265ba152d5c622e793f Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Thu, 4 Sep 2025 15:11:09 +0200
+Subject: xen/manage: Fix suspend error path
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit f770c3d858687252f1270265ba152d5c622e793f upstream.
+
+The device power management API has the following asymmetry:
+* dpm_suspend_start() does not clean up on failure
+ (it requires a call to dpm_resume_end())
+* dpm_suspend_end() does clean up on failure
+ (it does not require a call to dpm_resume_start())
+
+The asymmetry was introduced by commit d8f3de0d2412 ("Suspend-related
+patches for 2.6.27") in June 2008: It removed a call to device_resume()
+from device_suspend() (which was later renamed to dpm_suspend_start()).
+
+When Xen began using the device power management API in May 2008 with
+commit 0e91398f2a5d ("xen: implement save/restore"), the asymmetry did
+not yet exist. But since it was introduced, a call to dpm_resume_end()
+is missing in the error path of dpm_suspend_start(). Fix it.
+
+Fixes: d8f3de0d2412 ("Suspend-related patches for 2.6.27")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: stable@vger.kernel.org # v2.6.27
+Reviewed-by: "Rafael J. Wysocki (Intel)" <rafael@kernel.org>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <22453676d1ddcebbe81641bb68ddf587fee7e21e.1756990799.git.lukas@wunner.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/manage.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -116,7 +116,7 @@ static void do_suspend(void)
+ err = dpm_suspend_start(PMSG_FREEZE);
+ if (err) {
+ pr_err("%s: dpm_suspend_start %d\n", __func__, err);
+- goto out_thaw;
++ goto out_resume_end;
+ }
+
+ printk(KERN_DEBUG "suspending xenstore...\n");
+@@ -156,6 +156,7 @@ out_resume:
+ else
+ xs_suspend_cancel();
+
++out_resume_end:
+ dpm_resume_end(si.cancelled ? PMSG_THAW : PMSG_RESTORE);
+
+ out_thaw:
projects / thirdparty / kernel / stable-queue.git / commitdiff
