From 916a2ed10f43a85dfa49c93708f22db0127cfc89 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 16 Oct 2025 11:09:29 +0200 Subject: [PATCH] 6.12-stable patches added patches: dt-bindings-phy-rockchip-inno-csi-dphy-make-power-domains-non-required.patch firmware-meson_sm-fix-device-leak-at-probe.patch media-cec-extron-da-hd-4k-plus-drop-external-module-make-commands.patch media-cx18-add-missing-check-after-dma-map.patch media-i2c-mt9v111-fix-incorrect-type-for-ret.patch media-lirc-fix-error-handling-in-lirc_register.patch media-mc-fix-must_connect-handling-for-pads-with-no-links.patch media-pci-ivtv-add-missing-check-after-dma-map.patch media-pci-mg4b-fix-uninitialized-iio-scan-data.patch media-s5p-mfc-remove-an-unused-uninitialized-variable.patch media-ti-j721e-csi2rx-fix-source-subdev-link-creation.patch media-ti-j721e-csi2rx-use-devm_of_platform_populate.patch media-venus-firmware-use-correct-reset-sequence-for-iris2.patch media-vivid-fix-disappearing-vendor-command-with-id-messages.patch xen-events-cleanup-find_virq-return-codes.patch xen-events-return-eexist-for-bound-virqs.patch xen-events-update-virq_to_irq-on-migration.patch xen-manage-fix-suspend-error-path.patch --- ...dphy-make-power-domains-non-required.patch | 54 ++++++++ ...re-meson_sm-fix-device-leak-at-probe.patch | 49 +++++++ ...s-drop-external-module-make-commands.patch | 42 ++++++ ...cx18-add-missing-check-after-dma-map.patch | 49 +++++++ ...c-mt9v111-fix-incorrect-type-for-ret.patch | 41 ++++++ ...-fix-error-handling-in-lirc_register.patch | 52 +++++++ ...nect-handling-for-pads-with-no-links.patch | 47 +++++++ ...ivtv-add-missing-check-after-dma-map.patch | 59 ++++++++ ...mg4b-fix-uninitialized-iio-scan-data.patch | 33 +++++ ...ove-an-unused-uninitialized-variable.patch | 130 ++++++++++++++++++ ...i2rx-fix-source-subdev-link-creation.patch | 56 ++++++++ ...csi2rx-use-devm_of_platform_populate.patch | 37 +++++ ...use-correct-reset-sequence-for-iris2.patch | 72 ++++++++++ ...ring-vendor-command-with-id-messages.patch | 84 +++++++++++ queue-6.12/series | 18 +++ ...vents-cleanup-find_virq-return-codes.patch | 55 ++++++++ ...events-return-eexist-for-bound-virqs.patch | 82 +++++++++++ ...ents-update-virq_to_irq-on-migration.patch | 59 ++++++++ .../xen-manage-fix-suspend-error-path.patch | 54 ++++++++ 19 files changed, 1073 insertions(+) create mode 100644 queue-6.12/dt-bindings-phy-rockchip-inno-csi-dphy-make-power-domains-non-required.patch create mode 100644 queue-6.12/firmware-meson_sm-fix-device-leak-at-probe.patch create mode 100644 queue-6.12/media-cec-extron-da-hd-4k-plus-drop-external-module-make-commands.patch create mode 100644 queue-6.12/media-cx18-add-missing-check-after-dma-map.patch create mode 100644 queue-6.12/media-i2c-mt9v111-fix-incorrect-type-for-ret.patch create mode 100644 queue-6.12/media-lirc-fix-error-handling-in-lirc_register.patch create mode 100644 queue-6.12/media-mc-fix-must_connect-handling-for-pads-with-no-links.patch create mode 100644 queue-6.12/media-pci-ivtv-add-missing-check-after-dma-map.patch create mode 100644 queue-6.12/media-pci-mg4b-fix-uninitialized-iio-scan-data.patch create mode 100644 queue-6.12/media-s5p-mfc-remove-an-unused-uninitialized-variable.patch create mode 100644 queue-6.12/media-ti-j721e-csi2rx-fix-source-subdev-link-creation.patch create mode 100644 queue-6.12/media-ti-j721e-csi2rx-use-devm_of_platform_populate.patch create mode 100644 queue-6.12/media-venus-firmware-use-correct-reset-sequence-for-iris2.patch create mode 100644 queue-6.12/media-vivid-fix-disappearing-vendor-command-with-id-messages.patch create mode 100644 queue-6.12/xen-events-cleanup-find_virq-return-codes.patch create mode 100644 queue-6.12/xen-events-return-eexist-for-bound-virqs.patch create mode 100644 queue-6.12/xen-events-update-virq_to_irq-on-migration.patch create mode 100644 queue-6.12/xen-manage-fix-suspend-error-path.patch diff --git a/queue-6.12/dt-bindings-phy-rockchip-inno-csi-dphy-make-power-domains-non-required.patch b/queue-6.12/dt-bindings-phy-rockchip-inno-csi-dphy-make-power-domains-non-required.patch new file mode 100644 index 0000000000..0b09373ac7 --- /dev/null +++ b/queue-6.12/dt-bindings-phy-rockchip-inno-csi-dphy-make-power-domains-non-required.patch @@ -0,0 +1,54 @@ +From c254815b02673cc77a84103c4c0d6197bd90c0ef Mon Sep 17 00:00:00 2001 +From: Michael Riesch +Date: Wed, 3 Sep 2025 19:04:50 +0200 +Subject: dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required + +From: Michael Riesch + +commit c254815b02673cc77a84103c4c0d6197bd90c0ef upstream. + +There are variants of the Rockchip Innosilicon CSI DPHY (e.g., the RK3568 +variant) that are powered on by default as they are part of the ALIVE power +domain. +Remove 'power-domains' from the required properties in order to avoid false +positives. + +Fixes: 22c8e0a69b7f ("dt-bindings: phy: add compatible for rk356x to rockchip-inno-csi-dphy") +Cc: stable@kernel.org +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Michael Riesch +Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-2-a4f340a7f0cf@collabora.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml | 15 +++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml ++++ b/Documentation/devicetree/bindings/phy/rockchip-inno-csi-dphy.yaml +@@ -57,11 +57,24 @@ required: + - clocks + - clock-names + - '#phy-cells' +- - power-domains + - resets + - reset-names + - rockchip,grf + ++allOf: ++ - if: ++ properties: ++ compatible: ++ contains: ++ enum: ++ - rockchip,px30-csi-dphy ++ - rockchip,rk1808-csi-dphy ++ - rockchip,rk3326-csi-dphy ++ - rockchip,rk3368-csi-dphy ++ then: ++ required: ++ - power-domains ++ + additionalProperties: false + + examples: diff --git a/queue-6.12/firmware-meson_sm-fix-device-leak-at-probe.patch b/queue-6.12/firmware-meson_sm-fix-device-leak-at-probe.patch new file mode 100644 index 0000000000..cdd15e6e11 --- /dev/null +++ b/queue-6.12/firmware-meson_sm-fix-device-leak-at-probe.patch @@ -0,0 +1,49 @@ +From 8ece3173f87df03935906d0c612c2aeda9db92ca Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 25 Jul 2025 09:40:19 +0200 +Subject: firmware: meson_sm: fix device leak at probe + +From: Johan Hovold + +commit 8ece3173f87df03935906d0c612c2aeda9db92ca upstream. + +Make sure to drop the reference to the secure monitor device taken by +of_find_device_by_node() when looking up its driver data on behalf of +other drivers (e.g. during probe). + +Note that holding a reference to the platform device does not prevent +its driver data from going away so there is no point in keeping the +reference after the helper returns. + +Fixes: 8cde3c2153e8 ("firmware: meson_sm: Rework driver as a proper platform driver") +Cc: stable@vger.kernel.org # 5.5 +Cc: Carlo Caione +Signed-off-by: Johan Hovold +Acked-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250725074019.8765-1-johan@kernel.org +Signed-off-by: Neil Armstrong +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/meson/meson_sm.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/firmware/meson/meson_sm.c ++++ b/drivers/firmware/meson/meson_sm.c +@@ -232,11 +232,16 @@ EXPORT_SYMBOL(meson_sm_call_write); + struct meson_sm_firmware *meson_sm_get(struct device_node *sm_node) + { + struct platform_device *pdev = of_find_device_by_node(sm_node); ++ struct meson_sm_firmware *fw; + + if (!pdev) + return NULL; + +- return platform_get_drvdata(pdev); ++ fw = platform_get_drvdata(pdev); ++ ++ put_device(&pdev->dev); ++ ++ return fw; + } + EXPORT_SYMBOL_GPL(meson_sm_get); + diff --git a/queue-6.12/media-cec-extron-da-hd-4k-plus-drop-external-module-make-commands.patch b/queue-6.12/media-cec-extron-da-hd-4k-plus-drop-external-module-make-commands.patch new file mode 100644 index 0000000000..758d2fc7e6 --- /dev/null +++ b/queue-6.12/media-cec-extron-da-hd-4k-plus-drop-external-module-make-commands.patch @@ -0,0 +1,42 @@ +From d5d12cc03e501c38925e544abe44d5bfe23dc930 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Tue, 22 Jul 2025 17:12:00 -0700 +Subject: media: cec: extron-da-hd-4k-plus: drop external-module make commands + +From: Randy Dunlap + +commit d5d12cc03e501c38925e544abe44d5bfe23dc930 upstream. + +Delete the external-module style Makefile commands. They are not needed +for in-tree modules. + +This is the only Makefile in the kernel tree (aside from tools/ and +samples/) that uses this Makefile style. + +The same files are built with or without this patch. + +Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA HD 4K Plus CEC driver") +Signed-off-by: Randy Dunlap +Cc: stable@vger.kernel.org +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/cec/usb/extron-da-hd-4k-plus/Makefile | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/media/cec/usb/extron-da-hd-4k-plus/Makefile b/drivers/media/cec/usb/extron-da-hd-4k-plus/Makefile +index 2e8f7f60263f..08d58524419f 100644 +--- a/drivers/media/cec/usb/extron-da-hd-4k-plus/Makefile ++++ b/drivers/media/cec/usb/extron-da-hd-4k-plus/Makefile +@@ -1,8 +1,2 @@ + extron-da-hd-4k-plus-cec-objs := extron-da-hd-4k-plus.o cec-splitter.o + obj-$(CONFIG_USB_EXTRON_DA_HD_4K_PLUS_CEC) := extron-da-hd-4k-plus-cec.o +- +-all: +- $(MAKE) -C $(KDIR) M=$(shell pwd) modules +- +-install: +- $(MAKE) -C $(KDIR) M=$(shell pwd) modules_install +-- +2.51.0 + diff --git a/queue-6.12/media-cx18-add-missing-check-after-dma-map.patch b/queue-6.12/media-cx18-add-missing-check-after-dma-map.patch new file mode 100644 index 0000000000..fbd3e96cae --- /dev/null +++ b/queue-6.12/media-cx18-add-missing-check-after-dma-map.patch @@ -0,0 +1,49 @@ +From 23b53639a793477326fd57ed103823a8ab63084f Mon Sep 17 00:00:00 2001 +From: Thomas Fourier +Date: Wed, 9 Jul 2025 13:35:40 +0200 +Subject: media: cx18: Add missing check after DMA map + +From: Thomas Fourier + +commit 23b53639a793477326fd57ed103823a8ab63084f upstream. + +The DMA map functions can fail and should be tested for errors. +If the mapping fails, dealloc buffers, and return. + +Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Fourier +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/cx18/cx18-queue.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/drivers/media/pci/cx18/cx18-queue.c ++++ b/drivers/media/pci/cx18/cx18-queue.c +@@ -379,15 +379,22 @@ int cx18_stream_alloc(struct cx18_stream + break; + } + ++ buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev, ++ buf->buf, s->buf_size, ++ s->dma); ++ if (dma_mapping_error(&s->cx->pci_dev->dev, buf->dma_handle)) { ++ kfree(buf->buf); ++ kfree(mdl); ++ kfree(buf); ++ break; ++ } ++ + INIT_LIST_HEAD(&mdl->list); + INIT_LIST_HEAD(&mdl->buf_list); + mdl->id = s->mdl_base_idx; /* a somewhat safe value */ + cx18_enqueue(s, mdl, &s->q_idle); + + INIT_LIST_HEAD(&buf->list); +- buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev, +- buf->buf, s->buf_size, +- s->dma); + cx18_buf_sync_for_cpu(s, buf); + list_add_tail(&buf->list, &s->buf_pool); + } diff --git a/queue-6.12/media-i2c-mt9v111-fix-incorrect-type-for-ret.patch b/queue-6.12/media-i2c-mt9v111-fix-incorrect-type-for-ret.patch new file mode 100644 index 0000000000..f5743393d6 --- /dev/null +++ b/queue-6.12/media-i2c-mt9v111-fix-incorrect-type-for-ret.patch @@ -0,0 +1,41 @@ +From bacd713145443dce7764bb2967d30832a95e5ec8 Mon Sep 17 00:00:00 2001 +From: Qianfeng Rong +Date: Wed, 27 Aug 2025 20:39:10 +0800 +Subject: media: i2c: mt9v111: fix incorrect type for ret + +From: Qianfeng Rong + +commit bacd713145443dce7764bb2967d30832a95e5ec8 upstream. + +Change "ret" from unsigned int to int type in mt9v111_calc_frame_rate() +to store negative error codes or zero returned by __mt9v111_hw_reset() +and other functions. + +Storing the negative error codes in unsigned type, doesn't cause an issue +at runtime but it's ugly as pants. + +No effect on runtime. + +Signed-off-by: Qianfeng Rong +Fixes: aab7ed1c3927 ("media: i2c: Add driver for Aptina MT9V111") +Cc: stable@vger.kernel.org +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/mt9v111.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/i2c/mt9v111.c ++++ b/drivers/media/i2c/mt9v111.c +@@ -532,8 +532,8 @@ static int mt9v111_calc_frame_rate(struc + static int mt9v111_hw_config(struct mt9v111_dev *mt9v111) + { + struct i2c_client *c = mt9v111->client; +- unsigned int ret; + u16 outfmtctrl2; ++ int ret; + + /* Force device reset. */ + ret = __mt9v111_hw_reset(mt9v111); diff --git a/queue-6.12/media-lirc-fix-error-handling-in-lirc_register.patch b/queue-6.12/media-lirc-fix-error-handling-in-lirc_register.patch new file mode 100644 index 0000000000..9bf41ef92b --- /dev/null +++ b/queue-6.12/media-lirc-fix-error-handling-in-lirc_register.patch @@ -0,0 +1,52 @@ +From 4f4098c57e139ad972154077fb45c3e3141555dd Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Fri, 18 Jul 2025 17:50:54 +0800 +Subject: media: lirc: Fix error handling in lirc_register() + +From: Ma Ke + +commit 4f4098c57e139ad972154077fb45c3e3141555dd upstream. + +When cdev_device_add() failed, calling put_device() to explicitly +release dev->lirc_dev. Otherwise, it could cause the fault of the +reference count. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: a6ddd4fecbb0 ("media: lirc: remove last remnants of lirc kapi") +Signed-off-by: Ma Ke +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/lirc_dev.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/media/rc/lirc_dev.c ++++ b/drivers/media/rc/lirc_dev.c +@@ -736,11 +736,11 @@ int lirc_register(struct rc_dev *dev) + + cdev_init(&dev->lirc_cdev, &lirc_fops); + ++ get_device(&dev->dev); ++ + err = cdev_device_add(&dev->lirc_cdev, &dev->lirc_dev); + if (err) +- goto out_ida; +- +- get_device(&dev->dev); ++ goto out_put_device; + + switch (dev->driver_type) { + case RC_DRIVER_SCANCODE: +@@ -764,7 +764,8 @@ int lirc_register(struct rc_dev *dev) + + return 0; + +-out_ida: ++out_put_device: ++ put_device(&dev->lirc_dev); + ida_free(&lirc_ida, minor); + return err; + } diff --git a/queue-6.12/media-mc-fix-must_connect-handling-for-pads-with-no-links.patch b/queue-6.12/media-mc-fix-must_connect-handling-for-pads-with-no-links.patch new file mode 100644 index 0000000000..d575a88a70 --- /dev/null +++ b/queue-6.12/media-mc-fix-must_connect-handling-for-pads-with-no-links.patch @@ -0,0 +1,47 @@ +From eec81250219a209b863f11d02128ec1dd8e20877 Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Wed, 20 Aug 2025 17:00:20 +0300 +Subject: media: mc: Fix MUST_CONNECT handling for pads with no links +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Laurent Pinchart + +commit eec81250219a209b863f11d02128ec1dd8e20877 upstream. + +Commit b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always +require an enabled link") expanded the meaning of the MUST_CONNECT flag +to require an enabled link in all cases. To do so, the link exploration +code was expanded to cover unconnected pads, in order to reject those +that have the MUST_CONNECT flag set. The implementation was however +incorrect, ignoring unconnected pads instead of ignoring connected pads. +Fix it. + +Reported-by: Martin Kepplinger-Novaković +Closes: https://lore.kernel.org/linux-media/20250205172957.182362-1-martink@posteo.de +Reported-by: Maud Spierings +Closes: https://lore.kernel.org/linux-media/20250818-imx8_isi-v1-1-e9cfe994c435@gocontroll.com +Fixes: b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always require an enabled link") +Cc: stable@vger.kernel.org # 6.1 +Signed-off-by: Laurent Pinchart +Tested-by: Maud Spierings +Tested-by: Martin Kepplinger-Novaković +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/mc/mc-entity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/mc/mc-entity.c ++++ b/drivers/media/mc/mc-entity.c +@@ -691,7 +691,7 @@ done: + * (already discovered through iterating over links) and pads + * not internally connected. + */ +- if (origin == local || !local->num_links || ++ if (origin == local || local->num_links || + !media_entity_has_pad_interdep(origin->entity, origin->index, + local->index)) + continue; diff --git a/queue-6.12/media-pci-ivtv-add-missing-check-after-dma-map.patch b/queue-6.12/media-pci-ivtv-add-missing-check-after-dma-map.patch new file mode 100644 index 0000000000..d24a60d872 --- /dev/null +++ b/queue-6.12/media-pci-ivtv-add-missing-check-after-dma-map.patch @@ -0,0 +1,59 @@ +From 1069a4fe637d0e3e4c163e3f8df9be306cc299b4 Mon Sep 17 00:00:00 2001 +From: Thomas Fourier +Date: Wed, 16 Jul 2025 15:26:30 +0200 +Subject: media: pci: ivtv: Add missing check after DMA map + +From: Thomas Fourier + +commit 1069a4fe637d0e3e4c163e3f8df9be306cc299b4 upstream. + +The DMA map functions can fail and should be tested for errors. +If the mapping fails, free blanking_ptr and set it to 0. As 0 is a +valid DMA address, use blanking_ptr to test if the DMA address +is set. + +Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Fourier +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/ivtv/ivtv-irq.c | 2 +- + drivers/media/pci/ivtv/ivtv-yuv.c | 8 +++++++- + 2 files changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/media/pci/ivtv/ivtv-irq.c ++++ b/drivers/media/pci/ivtv/ivtv-irq.c +@@ -351,7 +351,7 @@ void ivtv_dma_stream_dec_prepare(struct + + /* Insert buffer block for YUV if needed */ + if (s->type == IVTV_DEC_STREAM_TYPE_YUV && f->offset_y) { +- if (yi->blanking_dmaptr) { ++ if (yi->blanking_ptr) { + s->sg_pending[idx].src = yi->blanking_dmaptr; + s->sg_pending[idx].dst = offset; + s->sg_pending[idx].size = 720 * 16; +--- a/drivers/media/pci/ivtv/ivtv-yuv.c ++++ b/drivers/media/pci/ivtv/ivtv-yuv.c +@@ -125,7 +125,7 @@ static int ivtv_yuv_prep_user_dma(struct + ivtv_udma_fill_sg_array(dma, y_buffer_offset, uv_buffer_offset, y_size); + + /* If we've offset the y plane, ensure top area is blanked */ +- if (f->offset_y && yi->blanking_dmaptr) { ++ if (f->offset_y && yi->blanking_ptr) { + dma->SGarray[dma->SG_length].size = cpu_to_le32(720*16); + dma->SGarray[dma->SG_length].src = cpu_to_le32(yi->blanking_dmaptr); + dma->SGarray[dma->SG_length].dst = cpu_to_le32(IVTV_DECODER_OFFSET + yuv_offset[frame]); +@@ -929,6 +929,12 @@ static void ivtv_yuv_init(struct ivtv *i + yi->blanking_dmaptr = dma_map_single(&itv->pdev->dev, + yi->blanking_ptr, + 720 * 16, DMA_TO_DEVICE); ++ if (dma_mapping_error(&itv->pdev->dev, yi->blanking_dmaptr)) { ++ kfree(yi->blanking_ptr); ++ yi->blanking_ptr = NULL; ++ yi->blanking_dmaptr = 0; ++ IVTV_DEBUG_WARN("Failed to dma_map yuv blanking buffer\n"); ++ } + } else { + yi->blanking_dmaptr = 0; + IVTV_DEBUG_WARN("Failed to allocate yuv blanking buffer\n"); diff --git a/queue-6.12/media-pci-mg4b-fix-uninitialized-iio-scan-data.patch b/queue-6.12/media-pci-mg4b-fix-uninitialized-iio-scan-data.patch new file mode 100644 index 0000000000..e6df2e7668 --- /dev/null +++ b/queue-6.12/media-pci-mg4b-fix-uninitialized-iio-scan-data.patch @@ -0,0 +1,33 @@ +From c0d3f6969bb4d72476cfe7ea9263831f1c283704 Mon Sep 17 00:00:00 2001 +From: David Lechner +Date: Tue, 22 Jul 2025 17:05:46 -0500 +Subject: media: pci: mg4b: fix uninitialized iio scan data + +From: David Lechner + +commit c0d3f6969bb4d72476cfe7ea9263831f1c283704 upstream. + +Fix potential leak of uninitialized stack data to userspace by ensuring +that the `scan` structure is zeroed before use. + +Fixes: 0ab13674a9bd ("media: pci: mgb4: Added Digiteq Automotive MGB4 driver") +Cc: stable@vger.kernel.org +Signed-off-by: David Lechner +Reviewed-by: Jonathan Cameron +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/mgb4/mgb4_trigger.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/pci/mgb4/mgb4_trigger.c ++++ b/drivers/media/pci/mgb4/mgb4_trigger.c +@@ -91,7 +91,7 @@ static irqreturn_t trigger_handler(int i + struct { + u32 data; + s64 ts __aligned(8); +- } scan; ++ } scan = { }; + + scan.data = mgb4_read_reg(&st->mgbdev->video, 0xA0); + mgb4_write_reg(&st->mgbdev->video, 0xA0, scan.data); diff --git a/queue-6.12/media-s5p-mfc-remove-an-unused-uninitialized-variable.patch b/queue-6.12/media-s5p-mfc-remove-an-unused-uninitialized-variable.patch new file mode 100644 index 0000000000..ebd87ecbc3 --- /dev/null +++ b/queue-6.12/media-s5p-mfc-remove-an-unused-uninitialized-variable.patch @@ -0,0 +1,130 @@ +From 7fa37ba25a1dfc084e24ea9acc14bf1fad8af14c Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 7 Aug 2025 22:54:15 +0200 +Subject: media: s5p-mfc: remove an unused/uninitialized variable + +From: Arnd Bergmann + +commit 7fa37ba25a1dfc084e24ea9acc14bf1fad8af14c upstream. + +The s5p_mfc_cmd_args structure in the v6 driver is never used, not +initialized to anything other than zero, but as of clang-21 this +causes a warning: + +drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c:45:7: error: variable 'h2r_args' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] + 45 | &h2r_args); + | ^~~~~~~~ + +Just remove this for simplicity. Since the function is also called +through a callback, this does require adding a trivial wrapper with +the correct prototype. + +Fixes: f96f3cfa0bb8 ("[media] s5p-mfc: Update MFC v4l2 driver to support MFC6.x") +Cc: stable@vger.kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c | 35 +++++----------- + 1 file changed, 13 insertions(+), 22 deletions(-) + +--- a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c ++++ b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_cmd_v6.c +@@ -14,8 +14,7 @@ + #include "s5p_mfc_opr.h" + #include "s5p_mfc_cmd_v6.h" + +-static int s5p_mfc_cmd_host2risc_v6(struct s5p_mfc_dev *dev, int cmd, +- const struct s5p_mfc_cmd_args *args) ++static int s5p_mfc_cmd_host2risc_v6(struct s5p_mfc_dev *dev, int cmd) + { + mfc_debug(2, "Issue the command: %d\n", cmd); + +@@ -31,7 +30,6 @@ static int s5p_mfc_cmd_host2risc_v6(stru + + static int s5p_mfc_sys_init_cmd_v6(struct s5p_mfc_dev *dev) + { +- struct s5p_mfc_cmd_args h2r_args; + const struct s5p_mfc_buf_size_v6 *buf_size = dev->variant->buf_size->priv; + int ret; + +@@ -41,33 +39,23 @@ static int s5p_mfc_sys_init_cmd_v6(struc + + mfc_write(dev, dev->ctx_buf.dma, S5P_FIMV_CONTEXT_MEM_ADDR_V6); + mfc_write(dev, buf_size->dev_ctx, S5P_FIMV_CONTEXT_MEM_SIZE_V6); +- return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_SYS_INIT_V6, +- &h2r_args); ++ return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_SYS_INIT_V6); + } + + static int s5p_mfc_sleep_cmd_v6(struct s5p_mfc_dev *dev) + { +- struct s5p_mfc_cmd_args h2r_args; +- +- memset(&h2r_args, 0, sizeof(struct s5p_mfc_cmd_args)); +- return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_SLEEP_V6, +- &h2r_args); ++ return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_SLEEP_V6); + } + + static int s5p_mfc_wakeup_cmd_v6(struct s5p_mfc_dev *dev) + { +- struct s5p_mfc_cmd_args h2r_args; +- +- memset(&h2r_args, 0, sizeof(struct s5p_mfc_cmd_args)); +- return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_WAKEUP_V6, +- &h2r_args); ++ return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_WAKEUP_V6); + } + + /* Open a new instance and get its number */ + static int s5p_mfc_open_inst_cmd_v6(struct s5p_mfc_ctx *ctx) + { + struct s5p_mfc_dev *dev = ctx->dev; +- struct s5p_mfc_cmd_args h2r_args; + int codec_type; + + mfc_debug(2, "Requested codec mode: %d\n", ctx->codec_mode); +@@ -129,23 +117,20 @@ static int s5p_mfc_open_inst_cmd_v6(stru + mfc_write(dev, ctx->ctx.size, S5P_FIMV_CONTEXT_MEM_SIZE_V6); + mfc_write(dev, 0, S5P_FIMV_D_CRC_CTRL_V6); /* no crc */ + +- return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_OPEN_INSTANCE_V6, +- &h2r_args); ++ return s5p_mfc_cmd_host2risc_v6(dev, S5P_FIMV_H2R_CMD_OPEN_INSTANCE_V6); + } + + /* Close instance */ + static int s5p_mfc_close_inst_cmd_v6(struct s5p_mfc_ctx *ctx) + { + struct s5p_mfc_dev *dev = ctx->dev; +- struct s5p_mfc_cmd_args h2r_args; + int ret = 0; + + dev->curr_ctx = ctx->num; + if (ctx->state != MFCINST_FREE) { + mfc_write(dev, ctx->inst_no, S5P_FIMV_INSTANCE_ID_V6); + ret = s5p_mfc_cmd_host2risc_v6(dev, +- S5P_FIMV_H2R_CMD_CLOSE_INSTANCE_V6, +- &h2r_args); ++ S5P_FIMV_H2R_CMD_CLOSE_INSTANCE_V6); + } else { + ret = -EINVAL; + } +@@ -153,9 +138,15 @@ static int s5p_mfc_close_inst_cmd_v6(str + return ret; + } + ++static int s5p_mfc_cmd_host2risc_v6_args(struct s5p_mfc_dev *dev, int cmd, ++ const struct s5p_mfc_cmd_args *ignored) ++{ ++ return s5p_mfc_cmd_host2risc_v6(dev, cmd); ++} ++ + /* Initialize cmd function pointers for MFC v6 */ + static const struct s5p_mfc_hw_cmds s5p_mfc_cmds_v6 = { +- .cmd_host2risc = s5p_mfc_cmd_host2risc_v6, ++ .cmd_host2risc = s5p_mfc_cmd_host2risc_v6_args, + .sys_init_cmd = s5p_mfc_sys_init_cmd_v6, + .sleep_cmd = s5p_mfc_sleep_cmd_v6, + .wakeup_cmd = s5p_mfc_wakeup_cmd_v6, diff --git a/queue-6.12/media-ti-j721e-csi2rx-fix-source-subdev-link-creation.patch b/queue-6.12/media-ti-j721e-csi2rx-fix-source-subdev-link-creation.patch new file mode 100644 index 0000000000..adc612eb59 --- /dev/null +++ b/queue-6.12/media-ti-j721e-csi2rx-fix-source-subdev-link-creation.patch @@ -0,0 +1,56 @@ +From 3e743cd0a73246219da117ee99061aad51c4748c Mon Sep 17 00:00:00 2001 +From: Jai Luthra +Date: Mon, 11 Aug 2025 13:50:15 +0530 +Subject: media: ti: j721e-csi2rx: Fix source subdev link creation + +From: Jai Luthra + +commit 3e743cd0a73246219da117ee99061aad51c4748c upstream. + +We don't use OF ports and remote-endpoints to connect the CSI2RX bridge +and this device in the device tree, thus it is wrong to use +v4l2_create_fwnode_links_to_pad() to create the media graph link between +the two. + +It works out on accident, as neither the source nor the sink implement +the .get_fwnode_pad() callback, and the framework helper falls back on +using the first source and sink pads to create the link between them. + +Instead, manually create the media link from the first source pad of the +bridge to the first sink pad of the J721E CSI2RX. + +Fixes: b4a3d877dc92 ("media: ti: Add CSI2RX support for J721E") +Cc: stable@vger.kernel.org +Reviewed-by: Devarsh Thakkar +Tested-by: Yemike Abhilash Chandra (on SK-AM68) +Signed-off-by: Jai Luthra +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c ++++ b/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c +@@ -52,6 +52,8 @@ + #define DRAIN_TIMEOUT_MS 50 + #define DRAIN_BUFFER_SIZE SZ_32K + ++#define CSI2RX_BRIDGE_SOURCE_PAD 1 ++ + struct ti_csi2rx_fmt { + u32 fourcc; /* Four character code. */ + u32 code; /* Mbus code. */ +@@ -426,8 +428,9 @@ static int csi_async_notifier_complete(s + if (ret) + return ret; + +- ret = v4l2_create_fwnode_links_to_pad(csi->source, &csi->pad, +- MEDIA_LNK_FL_IMMUTABLE | MEDIA_LNK_FL_ENABLED); ++ ret = media_create_pad_link(&csi->source->entity, CSI2RX_BRIDGE_SOURCE_PAD, ++ &vdev->entity, csi->pad.index, ++ MEDIA_LNK_FL_IMMUTABLE | MEDIA_LNK_FL_ENABLED); + + if (ret) { + video_unregister_device(vdev); diff --git a/queue-6.12/media-ti-j721e-csi2rx-use-devm_of_platform_populate.patch b/queue-6.12/media-ti-j721e-csi2rx-use-devm_of_platform_populate.patch new file mode 100644 index 0000000000..38f714b5d3 --- /dev/null +++ b/queue-6.12/media-ti-j721e-csi2rx-use-devm_of_platform_populate.patch @@ -0,0 +1,37 @@ +From 072799db233f9de90a62be54c1e59275c2db3969 Mon Sep 17 00:00:00 2001 +From: Jai Luthra +Date: Mon, 11 Aug 2025 13:50:13 +0530 +Subject: media: ti: j721e-csi2rx: Use devm_of_platform_populate + +From: Jai Luthra + +commit 072799db233f9de90a62be54c1e59275c2db3969 upstream. + +Ensure that we clean up the platform bus when we remove this driver. + +This fixes a crash seen when reloading the module for the child device +with the parent not yet reloaded. + +Fixes: b4a3d877dc92 ("media: ti: Add CSI2RX support for J721E") +Cc: stable@vger.kernel.org +Reviewed-by: Devarsh Thakkar +Tested-by: Yemike Abhilash Chandra (on SK-AM68) +Signed-off-by: Jai Luthra +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c ++++ b/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c +@@ -1121,7 +1121,7 @@ static int ti_csi2rx_probe(struct platfo + if (ret) + goto err_vb2q; + +- ret = of_platform_populate(csi->dev->of_node, NULL, NULL, csi->dev); ++ ret = devm_of_platform_populate(csi->dev); + if (ret) { + dev_err(csi->dev, "Failed to create children: %d\n", ret); + goto err_subdev; diff --git a/queue-6.12/media-venus-firmware-use-correct-reset-sequence-for-iris2.patch b/queue-6.12/media-venus-firmware-use-correct-reset-sequence-for-iris2.patch new file mode 100644 index 0000000000..47614c08d5 --- /dev/null +++ b/queue-6.12/media-venus-firmware-use-correct-reset-sequence-for-iris2.patch @@ -0,0 +1,72 @@ +From 93f213b444a40f1e7a4383b499b65e782dcb14b9 Mon Sep 17 00:00:00 2001 +From: Stephan Gerhold +Date: Wed, 20 Aug 2025 17:16:39 +0200 +Subject: media: venus: firmware: Use correct reset sequence for IRIS2 + +From: Stephan Gerhold + +commit 93f213b444a40f1e7a4383b499b65e782dcb14b9 upstream. + +When starting venus with the "no_tz" code path, IRIS2 needs the same +boot/reset sequence as IRIS2_1. This is because most of the registers were +moved to the "wrapper_tz_base", which is already defined for both IRIS2 and +IRIS2_1 inside core.c. Add IRIS2 to the checks inside firmware.c as well to +make sure that it uses the correct reset sequence. + +Both IRIS2 and IRIS2_1 are HFI v6 variants, so the correct sequence was +used before commit c38610f8981e ("media: venus: firmware: Sanitize +per-VPU-version"). + +Fixes: c38610f8981e ("media: venus: firmware: Sanitize per-VPU-version") +Cc: stable@vger.kernel.org +Signed-off-by: Stephan Gerhold +Reviewed-by: Vikash Garodia +Reviewed-by: Dikshita Agarwal +Reviewed-by: Bryan O'Donoghue +Reviewed-by: Dmitry Baryshkov +[bod: Fixed commit log IRIS -> IRIS2] +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/firmware.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/media/platform/qcom/venus/firmware.c ++++ b/drivers/media/platform/qcom/venus/firmware.c +@@ -30,7 +30,7 @@ static void venus_reset_cpu(struct venus + u32 fw_size = core->fw.mapped_mem_size; + void __iomem *wrapper_base; + +- if (IS_IRIS2_1(core)) ++ if (IS_IRIS2(core) || IS_IRIS2_1(core)) + wrapper_base = core->wrapper_tz_base; + else + wrapper_base = core->wrapper_base; +@@ -42,7 +42,7 @@ static void venus_reset_cpu(struct venus + writel(fw_size, wrapper_base + WRAPPER_NONPIX_START_ADDR); + writel(fw_size, wrapper_base + WRAPPER_NONPIX_END_ADDR); + +- if (IS_IRIS2_1(core)) { ++ if (IS_IRIS2(core) || IS_IRIS2_1(core)) { + /* Bring XTSS out of reset */ + writel(0, wrapper_base + WRAPPER_TZ_XTSS_SW_RESET); + } else { +@@ -68,7 +68,7 @@ int venus_set_hw_state(struct venus_core + if (resume) { + venus_reset_cpu(core); + } else { +- if (IS_IRIS2_1(core)) ++ if (IS_IRIS2(core) || IS_IRIS2_1(core)) + writel(WRAPPER_XTSS_SW_RESET_BIT, + core->wrapper_tz_base + WRAPPER_TZ_XTSS_SW_RESET); + else +@@ -181,7 +181,7 @@ static int venus_shutdown_no_tz(struct v + void __iomem *wrapper_base = core->wrapper_base; + void __iomem *wrapper_tz_base = core->wrapper_tz_base; + +- if (IS_IRIS2_1(core)) { ++ if (IS_IRIS2(core) || IS_IRIS2_1(core)) { + /* Assert the reset to XTSS */ + reg = readl(wrapper_tz_base + WRAPPER_TZ_XTSS_SW_RESET); + reg |= WRAPPER_XTSS_SW_RESET_BIT; diff --git a/queue-6.12/media-vivid-fix-disappearing-vendor-command-with-id-messages.patch b/queue-6.12/media-vivid-fix-disappearing-vendor-command-with-id-messages.patch new file mode 100644 index 0000000000..9b6d8bda3a --- /dev/null +++ b/queue-6.12/media-vivid-fix-disappearing-vendor-command-with-id-messages.patch @@ -0,0 +1,84 @@ +From 4bd8a6147645480d550242ff816b4c7ba160e5b7 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Sat, 6 Sep 2025 12:11:21 +0200 +Subject: media: vivid: fix disappearing messages + +From: Hans Verkuil + +commit 4bd8a6147645480d550242ff816b4c7ba160e5b7 upstream. + +The vivid driver supports the message, +but if the Vendor ID of the received message didn't match the Vendor ID +of the CEC Adapter, then it ignores it (good) and returns 0 (bad). + +It should return -ENOMSG to indicate that other followers should be +asked to handle it. Return code 0 means that the driver handled it, +which is wrong in this case. + +As a result, userspace followers never get the chance to process such a +message. + +Refactor the code a bit to have the function return -ENOMSG at the end, +drop the default case, and ensure that the message handlers return 0. + +That way 0 is only returned if the message is actually handled in the +vivid_received() function. + +Fixes: 812765cd6954 ("media: vivid: add support") +Cc: stable@vger.kernel.org +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/test-drivers/vivid/vivid-cec.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/media/test-drivers/vivid/vivid-cec.c b/drivers/media/test-drivers/vivid/vivid-cec.c +index 356a988dd6a1..2d15fdd5d999 100644 +--- a/drivers/media/test-drivers/vivid/vivid-cec.c ++++ b/drivers/media/test-drivers/vivid/vivid-cec.c +@@ -327,7 +327,7 @@ static int vivid_received(struct cec_adapter *adap, struct cec_msg *msg) + char osd[14]; + + if (!cec_is_sink(adap)) +- return -ENOMSG; ++ break; + cec_ops_set_osd_string(msg, &disp_ctl, osd); + switch (disp_ctl) { + case CEC_OP_DISP_CTL_DEFAULT: +@@ -348,7 +348,7 @@ static int vivid_received(struct cec_adapter *adap, struct cec_msg *msg) + cec_transmit_msg(adap, &reply, false); + break; + } +- break; ++ return 0; + } + case CEC_MSG_VENDOR_COMMAND_WITH_ID: { + u32 vendor_id; +@@ -379,7 +379,7 @@ static int vivid_received(struct cec_adapter *adap, struct cec_msg *msg) + if (size == 1) { + // Ignore even op values + if (!(vendor_cmd[0] & 1)) +- break; ++ return 0; + reply.len = msg->len; + memcpy(reply.msg + 1, msg->msg + 1, msg->len - 1); + reply.msg[msg->len - 1]++; +@@ -388,12 +388,10 @@ static int vivid_received(struct cec_adapter *adap, struct cec_msg *msg) + CEC_OP_ABORT_INVALID_OP); + } + cec_transmit_msg(adap, &reply, false); +- break; ++ return 0; + } +- default: +- return -ENOMSG; + } +- return 0; ++ return -ENOMSG; + } + + static const struct cec_adap_ops vivid_cec_adap_ops = { +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 74a66a6a4e..7c7dbf64f8 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -94,3 +94,21 @@ arm64-kprobes-call-set_memory_rox-for-kprobe-page.patch arm-am33xx-implement-ti-advisory-1.0.36-emu0-emu1-pins-state-on-reset.patch arm-omap2-pm33xx-core-ix-device-node-reference-leaks-in-amx3_idle_init.patch perf-arm-cmn-fix-cmn-s3-dtm-offset.patch +dt-bindings-phy-rockchip-inno-csi-dphy-make-power-domains-non-required.patch +xen-events-cleanup-find_virq-return-codes.patch +xen-manage-fix-suspend-error-path.patch +xen-events-return-eexist-for-bound-virqs.patch +xen-events-update-virq_to_irq-on-migration.patch +firmware-meson_sm-fix-device-leak-at-probe.patch +media-cec-extron-da-hd-4k-plus-drop-external-module-make-commands.patch +media-cx18-add-missing-check-after-dma-map.patch +media-i2c-mt9v111-fix-incorrect-type-for-ret.patch +media-mc-fix-must_connect-handling-for-pads-with-no-links.patch +media-pci-ivtv-add-missing-check-after-dma-map.patch +media-pci-mg4b-fix-uninitialized-iio-scan-data.patch +media-s5p-mfc-remove-an-unused-uninitialized-variable.patch +media-venus-firmware-use-correct-reset-sequence-for-iris2.patch +media-vivid-fix-disappearing-vendor-command-with-id-messages.patch +media-ti-j721e-csi2rx-use-devm_of_platform_populate.patch +media-ti-j721e-csi2rx-fix-source-subdev-link-creation.patch +media-lirc-fix-error-handling-in-lirc_register.patch diff --git a/queue-6.12/xen-events-cleanup-find_virq-return-codes.patch b/queue-6.12/xen-events-cleanup-find_virq-return-codes.patch new file mode 100644 index 0000000000..4b5ade05ab --- /dev/null +++ b/queue-6.12/xen-events-cleanup-find_virq-return-codes.patch @@ -0,0 +1,55 @@ +From 08df2d7dd4ab2db8a172d824cda7872d5eca460a Mon Sep 17 00:00:00 2001 +From: Jason Andryuk +Date: Wed, 27 Aug 2025 20:36:01 -0400 +Subject: xen/events: Cleanup find_virq() return codes + +From: Jason Andryuk + +commit 08df2d7dd4ab2db8a172d824cda7872d5eca460a upstream. + +rc is overwritten by the evtchn_status hypercall in each iteration, so +the return value will be whatever the last iteration is. This could +incorrectly return success even if the event channel was not found. +Change to an explicit -ENOENT for an un-found virq and return 0 on a +successful match. + +Fixes: 62cc5fc7b2e0 ("xen/pv-on-hvm kexec: rebind virqs to existing eventchannel ports") +Cc: stable@vger.kernel.org +Signed-off-by: Jason Andryuk +Reviewed-by: Jan Beulich +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: <20250828003604.8949-2-jason.andryuk@amd.com> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/events/events_base.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -1324,10 +1324,11 @@ static int find_virq(unsigned int virq, + { + struct evtchn_status status; + evtchn_port_t port; +- int rc = -ENOENT; + + memset(&status, 0, sizeof(status)); + for (port = 0; port < xen_evtchn_max_channels(); port++) { ++ int rc; ++ + status.dom = DOMID_SELF; + status.port = port; + rc = HYPERVISOR_event_channel_op(EVTCHNOP_status, &status); +@@ -1337,10 +1338,10 @@ static int find_virq(unsigned int virq, + continue; + if (status.u.virq == virq && status.vcpu == xen_vcpu_nr(cpu)) { + *evtchn = port; +- break; ++ return 0; + } + } +- return rc; ++ return -ENOENT; + } + + /** diff --git a/queue-6.12/xen-events-return-eexist-for-bound-virqs.patch b/queue-6.12/xen-events-return-eexist-for-bound-virqs.patch new file mode 100644 index 0000000000..0cb52f02e9 --- /dev/null +++ b/queue-6.12/xen-events-return-eexist-for-bound-virqs.patch @@ -0,0 +1,82 @@ +From 07ce121d93a5e5fb2440a24da3dbf408fcee978e Mon Sep 17 00:00:00 2001 +From: Jason Andryuk +Date: Wed, 27 Aug 2025 20:36:02 -0400 +Subject: xen/events: Return -EEXIST for bound VIRQs + +From: Jason Andryuk + +commit 07ce121d93a5e5fb2440a24da3dbf408fcee978e upstream. + +Change find_virq() to return -EEXIST when a VIRQ is bound to a +different CPU than the one passed in. With that, remove the BUG_ON() +from bind_virq_to_irq() to propogate the error upwards. + +Some VIRQs are per-cpu, but others are per-domain or global. Those must +be bound to CPU0 and can then migrate elsewhere. The lookup for +per-domain and global will probably fail when migrated off CPU 0, +especially when the current CPU is tracked. This now returns -EEXIST +instead of BUG_ON(). + +A second call to bind a per-domain or global VIRQ is not expected, but +make it non-fatal to avoid trying to look up the irq, since we don't +know which per_cpu(virq_to_irq) it will be in. + +Cc: stable@vger.kernel.org +Signed-off-by: Jason Andryuk +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: <20250828003604.8949-3-jason.andryuk@amd.com> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/events/events_base.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -1320,10 +1320,12 @@ int bind_interdomain_evtchn_to_irq_latee + } + EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq_lateeoi); + +-static int find_virq(unsigned int virq, unsigned int cpu, evtchn_port_t *evtchn) ++static int find_virq(unsigned int virq, unsigned int cpu, evtchn_port_t *evtchn, ++ bool percpu) + { + struct evtchn_status status; + evtchn_port_t port; ++ bool exists = false; + + memset(&status, 0, sizeof(status)); + for (port = 0; port < xen_evtchn_max_channels(); port++) { +@@ -1336,12 +1338,16 @@ static int find_virq(unsigned int virq, + continue; + if (status.status != EVTCHNSTAT_virq) + continue; +- if (status.u.virq == virq && status.vcpu == xen_vcpu_nr(cpu)) { ++ if (status.u.virq != virq) ++ continue; ++ if (status.vcpu == xen_vcpu_nr(cpu)) { + *evtchn = port; + return 0; ++ } else if (!percpu) { ++ exists = true; + } + } +- return -ENOENT; ++ return exists ? -EEXIST : -ENOENT; + } + + /** +@@ -1388,8 +1394,11 @@ int bind_virq_to_irq(unsigned int virq, + evtchn = bind_virq.port; + else { + if (ret == -EEXIST) +- ret = find_virq(virq, cpu, &evtchn); +- BUG_ON(ret < 0); ++ ret = find_virq(virq, cpu, &evtchn, percpu); ++ if (ret) { ++ __unbind_from_irq(info, info->irq); ++ goto out; ++ } + } + + ret = xen_irq_info_virq_setup(info, cpu, evtchn, virq); diff --git a/queue-6.12/xen-events-update-virq_to_irq-on-migration.patch b/queue-6.12/xen-events-update-virq_to_irq-on-migration.patch new file mode 100644 index 0000000000..8ec9d10fb3 --- /dev/null +++ b/queue-6.12/xen-events-update-virq_to_irq-on-migration.patch @@ -0,0 +1,59 @@ +From 3fcc8e146935415d69ffabb5df40ecf50e106131 Mon Sep 17 00:00:00 2001 +From: Jason Andryuk +Date: Wed, 27 Aug 2025 20:36:03 -0400 +Subject: xen/events: Update virq_to_irq on migration + +From: Jason Andryuk + +commit 3fcc8e146935415d69ffabb5df40ecf50e106131 upstream. + +VIRQs come in 3 flavors, per-VPU, per-domain, and global, and the VIRQs +are tracked in per-cpu virq_to_irq arrays. + +Per-domain and global VIRQs must be bound on CPU 0, and +bind_virq_to_irq() sets the per_cpu virq_to_irq at registration time +Later, the interrupt can migrate, and info->cpu is updated. When +calling __unbind_from_irq(), the per-cpu virq_to_irq is cleared for a +different cpu. If bind_virq_to_irq() is called again with CPU 0, the +stale irq is returned. There won't be any irq_info for the irq, so +things break. + +Make xen_rebind_evtchn_to_cpu() update the per_cpu virq_to_irq mappings +to keep them update to date with the current cpu. This ensures the +correct virq_to_irq is cleared in __unbind_from_irq(). + +Fixes: e46cdb66c8fc ("xen: event channels") +Cc: stable@vger.kernel.org +Signed-off-by: Jason Andryuk +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Message-ID: <20250828003604.8949-4-jason.andryuk@amd.com> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/events/events_base.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -1803,9 +1803,20 @@ static int xen_rebind_evtchn_to_cpu(stru + * virq or IPI channel, which don't actually need to be rebound. Ignore + * it, but don't do the xenlinux-level rebind in that case. + */ +- if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0) ++ if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0) { ++ int old_cpu = info->cpu; ++ + bind_evtchn_to_cpu(info, tcpu, false); + ++ if (info->type == IRQT_VIRQ) { ++ int virq = info->u.virq; ++ int irq = per_cpu(virq_to_irq, old_cpu)[virq]; ++ ++ per_cpu(virq_to_irq, old_cpu)[virq] = -1; ++ per_cpu(virq_to_irq, tcpu)[virq] = irq; ++ } ++ } ++ + do_unmask(info, EVT_MASK_REASON_TEMPORARY); + + return 0; diff --git a/queue-6.12/xen-manage-fix-suspend-error-path.patch b/queue-6.12/xen-manage-fix-suspend-error-path.patch new file mode 100644 index 0000000000..a9eb44d08a --- /dev/null +++ b/queue-6.12/xen-manage-fix-suspend-error-path.patch @@ -0,0 +1,54 @@ +From f770c3d858687252f1270265ba152d5c622e793f Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Thu, 4 Sep 2025 15:11:09 +0200 +Subject: xen/manage: Fix suspend error path + +From: Lukas Wunner + +commit f770c3d858687252f1270265ba152d5c622e793f upstream. + +The device power management API has the following asymmetry: +* dpm_suspend_start() does not clean up on failure + (it requires a call to dpm_resume_end()) +* dpm_suspend_end() does clean up on failure + (it does not require a call to dpm_resume_start()) + +The asymmetry was introduced by commit d8f3de0d2412 ("Suspend-related +patches for 2.6.27") in June 2008: It removed a call to device_resume() +from device_suspend() (which was later renamed to dpm_suspend_start()). + +When Xen began using the device power management API in May 2008 with +commit 0e91398f2a5d ("xen: implement save/restore"), the asymmetry did +not yet exist. But since it was introduced, a call to dpm_resume_end() +is missing in the error path of dpm_suspend_start(). Fix it. + +Fixes: d8f3de0d2412 ("Suspend-related patches for 2.6.27") +Signed-off-by: Lukas Wunner +Cc: stable@vger.kernel.org # v2.6.27 +Reviewed-by: "Rafael J. Wysocki (Intel)" +Signed-off-by: Juergen Gross +Message-ID: <22453676d1ddcebbe81641bb68ddf587fee7e21e.1756990799.git.lukas@wunner.de> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/manage.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -116,7 +116,7 @@ static void do_suspend(void) + err = dpm_suspend_start(PMSG_FREEZE); + if (err) { + pr_err("%s: dpm_suspend_start %d\n", __func__, err); +- goto out_thaw; ++ goto out_resume_end; + } + + printk(KERN_DEBUG "suspending xenstore...\n"); +@@ -156,6 +156,7 @@ out_resume: + else + xs_suspend_cancel(); + ++out_resume_end: + dpm_resume_end(si.cancelled ? PMSG_THAW : PMSG_RESTORE); + + out_thaw: -- 2.47.3