--- /dev/null
+From 60a1e131a811b68703da58fd805ab359b704ab03 Mon Sep 17 00:00:00 2001
+From: Gustavo Sousa <gustavo.sousa@intel.com>
+Date: Thu, 16 Apr 2026 15:17:19 -0300
+Subject: drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()
+
+From: Gustavo Sousa <gustavo.sousa@intel.com>
+
+commit 60a1e131a811b68703da58fd805ab359b704ab03 upstream.
+
+When media GT is disabled via configfs, there is no allocation for
+media_gt, which is kept as NULL. In such scenario,
+intel_hdcp_gsc_check_status() results in a kernel pagefault error due to
+>->uc.gsc being evaluated as an invalid memory address.
+
+Fix that by introducing a NULL check on media_gt and bailing out early
+if so.
+
+While at it, also drop the NULL check for gsc, since it can't be NULL if
+media_gt is not NULL.
+
+v2:
+ - Get address for gsc only after checking that gt is not NULL.
+ (Shuicheng)
+ - Drop the NULL check for gsc. (Shuicheng)
+v3:
+ - Add "Fixes" and "Cc: <stable...>" tags. (Matt)
+
+Fixes: 4af50beb4e0f ("drm/xe: Use gsc_proxy_init_done to check proxy status")
+Cc: <stable@vger.kernel.org> # v6.10+
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com>
+Link: https://patch.msgid.link/20260416-check-for-null-media_gt-in-intel_hdcp_gsc_check_status-v2-1-9adb9fd3b621@intel.com
+Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
+(cherry picked from commit bfaf87e84ca3ca3f6e275f9ae56da47a8b55ffd1)
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/xe/display/xe_hdcp_gsc.c
++++ b/drivers/gpu/drm/xe/display/xe_hdcp_gsc.c
+@@ -37,9 +37,17 @@ static bool intel_hdcp_gsc_check_status(
+ struct xe_device *xe = to_xe_device(drm);
+ struct xe_tile *tile = xe_device_get_root_tile(xe);
+ struct xe_gt *gt = tile->media_gt;
+- struct xe_gsc *gsc = >->uc.gsc;
++ struct xe_gsc *gsc;
+
+- if (!gsc || !xe_uc_fw_is_available(&gsc->fw)) {
++ if (!gt) {
++ drm_dbg_kms(&xe->drm,
++ "not checking GSC status for HDCP2.x: media GT not present or disabled\n");
++ return false;
++ }
++
++ gsc = >->uc.gsc;
++
++ if (!xe_uc_fw_is_available(&gsc->fw)) {
+ drm_dbg_kms(&xe->drm,
+ "GSC Components not ready for HDCP2.x\n");
+ return false;
--- /dev/null
+From dde3c37af95cd6fa301c4906f33d627bc9dd874c Mon Sep 17 00:00:00 2001
+From: Sergey Shtylyov <s.shtylyov@auroraos.dev>
+Date: Fri, 6 Feb 2026 17:22:26 +0300
+Subject: media: dib8000: avoid division by 0 in dib8000_set_dds()
+
+From: Sergey Shtylyov <s.shtylyov@auroraos.dev>
+
+commit dde3c37af95cd6fa301c4906f33d627bc9dd874c upstream.
+
+In dib8000_set_dds(), 1 << 26 (67108864) divided by e.g. 1 apparently can't
+fit into 16-bit variable unit_khz_dds_val, being truncated to 0; this will
+cause division by 0 while calling dprintk() with debugging enabled (via the
+module parameter). Use s32 instead of s16 to declare the variable, getting
+rid of the cast to u16 in the *else* branch as well...
+
+Found by Linux Verification Center (linuxtesting.org) with the Svace static
+analysis tool.
+
+Fixes: 173a64cb3fcf ("[media] dib8000: enhancement")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sergey Shtylyov <s.shtylyov@auroraos.dev>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/dvb-frontends/dib8000.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/dvb-frontends/dib8000.c
++++ b/drivers/media/dvb-frontends/dib8000.c
+@@ -2695,7 +2695,7 @@ static void dib8000_viterbi_state(struct
+
+ static void dib8000_set_dds(struct dib8000_state *state, s32 offset_khz)
+ {
+- s16 unit_khz_dds_val;
++ s32 unit_khz_dds_val;
+ u32 abs_offset_khz = abs(offset_khz);
+ u32 dds = state->cfg.pll->ifreq & 0x1ffffff;
+ u8 invert = !!(state->cfg.pll->ifreq & (1 << 25));
+@@ -2716,7 +2716,7 @@ static void dib8000_set_dds(struct dib80
+ dds = (1<<26) - dds;
+ } else {
+ ratio = 2;
+- unit_khz_dds_val = (u16) (67108864 / state->cfg.pll->internal);
++ unit_khz_dds_val = 67108864 / state->cfg.pll->internal;
+
+ if (offset_khz < 0)
+ unit_khz_dds_val *= -1;
--- /dev/null
+From 8467c5ff5acae28513bc1e0af535e06b41b04344 Mon Sep 17 00:00:00 2001
+From: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+Date: Fri, 23 Jan 2026 17:19:55 +0800
+Subject: media: i2c: imx412: Assert reset GPIO during probe
+
+From: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+
+commit 8467c5ff5acae28513bc1e0af535e06b41b04344 upstream.
+
+Assert the reset GPIO before first power up. This avoids a mismatch where
+the first power up (when the reset GPIO defaults deasserted) differs from
+subsequent cycles.
+
+Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+Fixes: 9214e86c0cc1 ("media: i2c: Add imx412 camera sensor driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/imx412.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx412.c
++++ b/drivers/media/i2c/imx412.c
+@@ -925,7 +925,7 @@ static int imx412_parse_hw_config(struct
+
+ /* Request optional reset pin */
+ imx412->reset_gpio = devm_gpiod_get_optional(imx412->dev, "reset",
+- GPIOD_OUT_LOW);
++ GPIOD_OUT_HIGH);
+ if (IS_ERR(imx412->reset_gpio)) {
+ dev_err(imx412->dev, "failed to get reset gpio %pe\n",
+ imx412->reset_gpio);
--- /dev/null
+From 5d150fa0f16096d736bd24d13e04495da5116fab Mon Sep 17 00:00:00 2001
+From: Matthias Fend <matthias.fend@emfend.at>
+Date: Tue, 24 Mar 2026 11:41:36 +0100
+Subject: media: i2c: ov08d10: fix image vertical start setting
+
+From: Matthias Fend <matthias.fend@emfend.at>
+
+commit 5d150fa0f16096d736bd24d13e04495da5116fab upstream.
+
+The current settings for the "image vertical start" register appear to be
+incorrect. While this only results in an incorrect start line for native
+modes, this faulty setting causes actual problems in binning mode. At least
+on an i.MX8MP test system, only corrupted frames could be received.
+To correct this, the recommended settings from the reference register sets
+are used for all modes. Since this shifts the start by one line, the Bayer
+pattern also changes, which has also been corrected.
+
+Fixes: 7be91e02ed57 ("media: i2c: Add ov08d10 camera sensor driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Matthias Fend <matthias.fend@emfend.at>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/ov08d10.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/i2c/ov08d10.c
++++ b/drivers/media/i2c/ov08d10.c
+@@ -217,7 +217,7 @@ static const struct ov08d10_reg lane_2_m
+ {0x9a, 0x30},
+ {0xa8, 0x02},
+ {0xfd, 0x02},
+- {0xa1, 0x01},
++ {0xa1, 0x00},
+ {0xa2, 0x09},
+ {0xa3, 0x9c},
+ {0xa5, 0x00},
+@@ -335,7 +335,7 @@ static const struct ov08d10_reg lane_2_m
+ {0x9a, 0x30},
+ {0xa8, 0x02},
+ {0xfd, 0x02},
+- {0xa1, 0x09},
++ {0xa1, 0x08},
+ {0xa2, 0x09},
+ {0xa3, 0x90},
+ {0xa5, 0x08},
+@@ -467,7 +467,7 @@ static const struct ov08d10_reg lane_2_m
+ {0xaa, 0xd0},
+ {0xab, 0x06},
+ {0xac, 0x68},
+- {0xa1, 0x09},
++ {0xa1, 0x04},
+ {0xa2, 0x04},
+ {0xa3, 0xc8},
+ {0xa5, 0x04},
+@@ -613,8 +613,8 @@ static const struct ov08d10_lane_cfg lan
+ static u32 ov08d10_get_format_code(struct ov08d10 *ov08d10)
+ {
+ static const u32 codes[2][2] = {
+- { MEDIA_BUS_FMT_SGRBG10_1X10, MEDIA_BUS_FMT_SRGGB10_1X10},
+- { MEDIA_BUS_FMT_SBGGR10_1X10, MEDIA_BUS_FMT_SGBRG10_1X10},
++ { MEDIA_BUS_FMT_SBGGR10_1X10, MEDIA_BUS_FMT_SGBRG10_1X10 },
++ { MEDIA_BUS_FMT_SGRBG10_1X10, MEDIA_BUS_FMT_SRGGB10_1X10 },
+ };
+
+ return codes[ov08d10->vflip->val][ov08d10->hflip->val];
--- /dev/null
+From 35c7046be2be5e60be8128facb359a47f39e99cd Mon Sep 17 00:00:00 2001
+From: Matthias Fend <matthias.fend@emfend.at>
+Date: Tue, 24 Mar 2026 11:41:35 +0100
+Subject: media: i2c: ov08d10: fix runtime PM handling in probe
+
+From: Matthias Fend <matthias.fend@emfend.at>
+
+commit 35c7046be2be5e60be8128facb359a47f39e99cd upstream.
+
+Set the device's runtime PM status and enable runtime PM before registering
+the async sub-device. This is needed to avoid the case where the device is
+runtime PM resumed while runtime PM has not been enabled yet.
+
+Remove the related, non-driver-specific comment while at it.
+
+Fixes: 7be91e02ed57 ("media: i2c: Add ov08d10 camera sensor driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Matthias Fend <matthias.fend@emfend.at>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/ov08d10.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/i2c/ov08d10.c
++++ b/drivers/media/i2c/ov08d10.c
+@@ -1430,6 +1430,9 @@ static int ov08d10_probe(struct i2c_clie
+ goto probe_error_v4l2_ctrl_handler_free;
+ }
+
++ pm_runtime_set_active(ov08d10->dev);
++ pm_runtime_enable(ov08d10->dev);
++
+ ret = v4l2_async_register_subdev_sensor(&ov08d10->sd);
+ if (ret < 0) {
+ dev_err(ov08d10->dev, "failed to register V4L2 subdev: %d",
+@@ -1437,17 +1440,13 @@ static int ov08d10_probe(struct i2c_clie
+ goto probe_error_media_entity_cleanup;
+ }
+
+- /*
+- * Device is already turned on by i2c-core with ACPI domain PM.
+- * Enable runtime PM and turn off the device.
+- */
+- pm_runtime_set_active(ov08d10->dev);
+- pm_runtime_enable(ov08d10->dev);
+ pm_runtime_idle(ov08d10->dev);
+
+ return 0;
+
+ probe_error_media_entity_cleanup:
++ pm_runtime_disable(ov08d10->dev);
++ pm_runtime_set_suspended(ov08d10->dev);
+ media_entity_cleanup(&ov08d10->sd.entity);
+
+ probe_error_v4l2_ctrl_handler_free:
--- /dev/null
+From 4a49ae56b0e4268d48fd96babe0cc68596bc301a Mon Sep 17 00:00:00 2001
+From: Thomas Fourier <fourier.thomas@gmail.com>
+Date: Fri, 13 Feb 2026 10:13:27 +0100
+Subject: media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init()
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+commit 4a49ae56b0e4268d48fd96babe0cc68596bc301a upstream.
+
+The core->iface_q_table_vaddr buffer is alloc'd with size queue_size
+but freed with sizeof(*q_tbl_hdr) which is different.
+
+Change the dma_free_attrs() size.
+
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
+Fixes: d7378f84e94e ("media: iris: introduce iris core state management with shared queues")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_hfi_queue.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_queue.c
+@@ -263,7 +263,7 @@ int iris_hfi_queues_init(struct iris_cor
+ GFP_KERNEL, DMA_ATTR_WRITE_COMBINE);
+ if (!core->sfr_vaddr) {
+ dev_err(core->dev, "sfr alloc and map failed\n");
+- dma_free_attrs(core->dev, sizeof(*q_tbl_hdr), core->iface_q_table_vaddr,
++ dma_free_attrs(core->dev, queue_size, core->iface_q_table_vaddr,
+ core->iface_q_table_daddr, DMA_ATTR_WRITE_COMBINE);
+ return -ENOMEM;
+ }
--- /dev/null
+From a297c5165f91366cbc3490e630aabd1c0f70efb8 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 5 Feb 2026 15:56:19 +0100
+Subject: media: iris: fix QCOM_MDT_LOADER dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit a297c5165f91366cbc3490e630aabd1c0f70efb8 upstream.
+
+When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_IRIS=y,
+the kernel fails to link:
+
+x86_64-linux-ld: drivers/media/platform/qcom/iris/iris_firmware.o: in function `iris_fw_load':
+iris_firmware.c:(.text+0xb0): undefined reference to `qcom_mdt_get_size'
+iris_firmware.c:(.text+0xfd): undefined reference to `qcom_mdt_load'
+
+The problem is the conditional 'select' statement. Change this to
+make the driver built-in here regardless of CONFIG_ARCH_QCOM.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/qcom/iris/Kconfig
++++ b/drivers/media/platform/qcom/iris/Kconfig
+@@ -3,7 +3,7 @@ config VIDEO_QCOM_IRIS
+ depends on VIDEO_DEV
+ depends on ARCH_QCOM || COMPILE_TEST
+ select V4L2_MEM2MEM_DEV
+- select QCOM_MDT_LOADER if ARCH_QCOM
++ select QCOM_MDT_LOADER
+ select QCOM_SCM
+ select VIDEOBUF2_DMA_CONTIG
+ help
--- /dev/null
+From f27cfdcfc916bb59297825805f4c3499f89f9e76 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
+Date: Mon, 16 Feb 2026 12:37:42 +0530
+Subject: media: iris: Fix use-after-free in iris_release_internal_buffers()
+
+From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
+
+commit f27cfdcfc916bb59297825805f4c3499f89f9e76 upstream.
+
+The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy
+internal buffers after FW releases") introduced a regression where
+session_release_buf() may free the buffer. The caller,
+iris_release_internal_buffers(), continued to access `buffer` after the
+call, leading to a potential use-after-free.
+
+Fix this by setting BUF_ATTR_PENDING_RELEASE before calling
+session_release_buf(), and reverting the flag if the call fails. This
+ensures no dereference occurs after potential freeing.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Closes: https://lore.kernel.org/lkml/aYXvKAX3Pg3sL37P@stanley.mountain/#r
+Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
+Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
+Fixes: 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_buffer.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_buffer.c
++++ b/drivers/media/platform/qcom/iris/iris_buffer.c
+@@ -582,10 +582,12 @@ static int iris_release_internal_buffers
+ continue;
+ if (!(buffer->attr & BUF_ATTR_QUEUED))
+ continue;
++ buffer->attr |= BUF_ATTR_PENDING_RELEASE;
+ ret = hfi_ops->session_release_buf(inst, buffer);
+- if (ret)
++ if (ret) {
++ buffer->attr &= ~BUF_ATTR_PENDING_RELEASE;
+ return ret;
+- buffer->attr |= BUF_ATTR_PENDING_RELEASE;
++ }
+ }
+
+ return 0;
--- /dev/null
+From 3d9593ad1a58c5acc3e5fa2a48222bb7632e6812 Mon Sep 17 00:00:00 2001
+From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
+Date: Thu, 5 Mar 2026 18:58:31 +0530
+Subject: media: iris: fix use-after-free of fmt_src during MBPF check
+
+From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
+
+commit 3d9593ad1a58c5acc3e5fa2a48222bb7632e6812 upstream.
+
+During concurrency testing, multiple instances can run in parallel, and
+each instance uses its own inst->lock while the core->lock protects the
+list of active instances. The race happens because these locks cover
+different scopes, inst->lock protects only the internals of a single
+instance, while the Macro Blocks Per Frame (MBPF) checker walks the
+core list under core->lock and reads fields like fmt_src->width and
+fmt_src->height. At the same time, iris_close() may free fmt_src and
+fmt_dst under inst->lock while the instance is still present in the core
+list. This allows a situation where the MBPF checker, still iterating
+through the core list, reaches an instance whose fmt_src was already
+freed by another thread and ends up dereferencing a dangling pointer,
+resulting in a use-after-free. This happens because the MBPF checker
+assumes that any instance in the core list is fully valid, but the
+freeing of fmt_src and fmt_dst without removing the instance from the
+core list is not correct.
+
+The correct ordering is to defer freeing fmt_src and fmt_dst until after
+the instance has been removed from the core list and all teardown under
+the core lock has completed, ensuring that no dangling pointers are ever
+exposed during MBPF checks.
+
+Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
+Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
+Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
+Fixes: 5ad964ad5656 ("media: iris: Initialize and deinitialize encoder instance structure")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_vdec.c | 6 ------
+ drivers/media/platform/qcom/iris/iris_vdec.h | 1 -
+ drivers/media/platform/qcom/iris/iris_venc.c | 6 ------
+ drivers/media/platform/qcom/iris/iris_venc.h | 1 -
+ drivers/media/platform/qcom/iris/iris_vidc.c | 6 ++----
+ 5 files changed, 2 insertions(+), 18 deletions(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_vdec.c
++++ b/drivers/media/platform/qcom/iris/iris_vdec.c
+@@ -61,12 +61,6 @@ int iris_vdec_inst_init(struct iris_inst
+ return iris_ctrls_init(inst);
+ }
+
+-void iris_vdec_inst_deinit(struct iris_inst *inst)
+-{
+- kfree(inst->fmt_dst);
+- kfree(inst->fmt_src);
+-}
+-
+ static const struct iris_fmt iris_vdec_formats_cap[] = {
+ [IRIS_FMT_NV12] = {
+ .pixfmt = V4L2_PIX_FMT_NV12,
+--- a/drivers/media/platform/qcom/iris/iris_vdec.h
++++ b/drivers/media/platform/qcom/iris/iris_vdec.h
+@@ -9,7 +9,6 @@
+ struct iris_inst;
+
+ int iris_vdec_inst_init(struct iris_inst *inst);
+-void iris_vdec_inst_deinit(struct iris_inst *inst);
+ int iris_vdec_enum_fmt(struct iris_inst *inst, struct v4l2_fmtdesc *f);
+ int iris_vdec_try_fmt(struct iris_inst *inst, struct v4l2_format *f);
+ int iris_vdec_s_fmt(struct iris_inst *inst, struct v4l2_format *f);
+--- a/drivers/media/platform/qcom/iris/iris_venc.c
++++ b/drivers/media/platform/qcom/iris/iris_venc.c
+@@ -79,12 +79,6 @@ int iris_venc_inst_init(struct iris_inst
+ return iris_ctrls_init(inst);
+ }
+
+-void iris_venc_inst_deinit(struct iris_inst *inst)
+-{
+- kfree(inst->fmt_dst);
+- kfree(inst->fmt_src);
+-}
+-
+ static const struct iris_fmt iris_venc_formats_cap[] = {
+ [IRIS_FMT_H264] = {
+ .pixfmt = V4L2_PIX_FMT_H264,
+--- a/drivers/media/platform/qcom/iris/iris_venc.h
++++ b/drivers/media/platform/qcom/iris/iris_venc.h
+@@ -9,7 +9,6 @@
+ struct iris_inst;
+
+ int iris_venc_inst_init(struct iris_inst *inst);
+-void iris_venc_inst_deinit(struct iris_inst *inst);
+ int iris_venc_enum_fmt(struct iris_inst *inst, struct v4l2_fmtdesc *f);
+ int iris_venc_try_fmt(struct iris_inst *inst, struct v4l2_format *f);
+ int iris_venc_s_fmt(struct iris_inst *inst, struct v4l2_format *f);
+--- a/drivers/media/platform/qcom/iris/iris_vidc.c
++++ b/drivers/media/platform/qcom/iris/iris_vidc.c
+@@ -289,10 +289,6 @@ int iris_close(struct file *filp)
+ v4l2_m2m_ctx_release(inst->m2m_ctx);
+ v4l2_m2m_release(inst->m2m_dev);
+ mutex_lock(&inst->lock);
+- if (inst->domain == DECODER)
+- iris_vdec_inst_deinit(inst);
+- else if (inst->domain == ENCODER)
+- iris_venc_inst_deinit(inst);
+ iris_session_close(inst);
+ iris_inst_change_state(inst, IRIS_INST_DEINIT);
+ iris_v4l2_fh_deinit(inst, filp);
+@@ -304,6 +300,8 @@ int iris_close(struct file *filp)
+ mutex_unlock(&inst->lock);
+ mutex_destroy(&inst->ctx_q_lock);
+ mutex_destroy(&inst->lock);
++ kfree(inst->fmt_src);
++ kfree(inst->fmt_dst);
+ kfree(inst);
+
+ return 0;
--- /dev/null
+From 95a337f92f0a602d4f935315bfbc8bf07f475e65 Mon Sep 17 00:00:00 2001
+From: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
+Date: Fri, 13 Mar 2026 18:49:36 +0530
+Subject: media: iris: switch to hardware mode after firmware boot
+
+From: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
+
+commit 95a337f92f0a602d4f935315bfbc8bf07f475e65 upstream.
+
+Currently the driver switches the vcodec GDSC to hardware (HW) mode
+before firmware load and boot sequence. GDSC can be powered off, keeping
+in hw mode, thereby the vcodec registers programmed in TrustZone (TZ)
+carry default (reset) values.
+Move the transition to HW mode after firmware load and boot sequence.
+
+The bug was exposed with driver configuring different stream ids to
+different devices via iommu-map. With registers carrying reset values,
+VPU would not generate desired stream-id, thereby leading to SMMU fault.
+
+For vpu4, when GDSC is switched to HW mode, there is a need to perform
+the reset operation. Without reset, there are occasional issues of
+register corruption observed. Hence the vpu GDSC switch also involves
+the reset.
+
+Co-developed-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
+Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
+Signed-off-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
+Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+[bod: occassional => occasional]
+Fixes: dde659d37036 ("media: iris: Introduce vpu ops for vpu4 with necessary hooks")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_core.c | 4 +++
+ drivers/media/platform/qcom/iris/iris_hfi_common.c | 4 +++
+ drivers/media/platform/qcom/iris/iris_vpu2.c | 1
+ drivers/media/platform/qcom/iris/iris_vpu3x.c | 9 ++-----
+ drivers/media/platform/qcom/iris/iris_vpu4x.c | 24 +++++++++++----------
+ drivers/media/platform/qcom/iris/iris_vpu_common.c | 16 ++++++++------
+ drivers/media/platform/qcom/iris/iris_vpu_common.h | 3 ++
+ 7 files changed, 38 insertions(+), 23 deletions(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_core.c
++++ b/drivers/media/platform/qcom/iris/iris_core.c
+@@ -75,6 +75,10 @@ int iris_core_init(struct iris_core *cor
+ if (ret)
+ goto error_unload_fw;
+
++ ret = iris_vpu_switch_to_hwmode(core);
++ if (ret)
++ goto error_unload_fw;
++
+ ret = iris_hfi_core_init(core);
+ if (ret)
+ goto error_unload_fw;
+--- a/drivers/media/platform/qcom/iris/iris_hfi_common.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_common.c
+@@ -159,6 +159,10 @@ int iris_hfi_pm_resume(struct iris_core
+ if (ret)
+ goto err_suspend_hw;
+
++ ret = iris_vpu_switch_to_hwmode(core);
++ if (ret)
++ goto err_suspend_hw;
++
+ ret = ops->sys_interframe_powercollapse(core);
+ if (ret)
+ goto err_suspend_hw;
+--- a/drivers/media/platform/qcom/iris/iris_vpu2.c
++++ b/drivers/media/platform/qcom/iris/iris_vpu2.c
+@@ -44,4 +44,5 @@ const struct vpu_ops iris_vpu2_ops = {
+ .power_off_controller = iris_vpu_power_off_controller,
+ .power_on_controller = iris_vpu_power_on_controller,
+ .calc_freq = iris_vpu2_calc_freq,
++ .set_hwmode = iris_vpu_set_hwmode,
+ };
+--- a/drivers/media/platform/qcom/iris/iris_vpu3x.c
++++ b/drivers/media/platform/qcom/iris/iris_vpu3x.c
+@@ -234,14 +234,8 @@ static int iris_vpu35_power_on_hw(struct
+ if (ret)
+ goto err_disable_hw_free_clk;
+
+- ret = dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN], true);
+- if (ret)
+- goto err_disable_hw_clk;
+-
+ return 0;
+
+-err_disable_hw_clk:
+- iris_disable_unprepare_clock(core, IRIS_HW_CLK);
+ err_disable_hw_free_clk:
+ iris_disable_unprepare_clock(core, IRIS_HW_FREERUN_CLK);
+ err_disable_axi_clk:
+@@ -266,6 +260,7 @@ const struct vpu_ops iris_vpu3_ops = {
+ .power_off_controller = iris_vpu_power_off_controller,
+ .power_on_controller = iris_vpu_power_on_controller,
+ .calc_freq = iris_vpu3x_vpu4x_calculate_frequency,
++ .set_hwmode = iris_vpu_set_hwmode,
+ };
+
+ const struct vpu_ops iris_vpu33_ops = {
+@@ -274,6 +269,7 @@ const struct vpu_ops iris_vpu33_ops = {
+ .power_off_controller = iris_vpu33_power_off_controller,
+ .power_on_controller = iris_vpu_power_on_controller,
+ .calc_freq = iris_vpu3x_vpu4x_calculate_frequency,
++ .set_hwmode = iris_vpu_set_hwmode,
+ };
+
+ const struct vpu_ops iris_vpu35_ops = {
+@@ -283,4 +279,5 @@ const struct vpu_ops iris_vpu35_ops = {
+ .power_on_controller = iris_vpu35_vpu4x_power_on_controller,
+ .program_bootup_registers = iris_vpu35_vpu4x_program_bootup_registers,
+ .calc_freq = iris_vpu3x_vpu4x_calculate_frequency,
++ .set_hwmode = iris_vpu_set_hwmode,
+ };
+--- a/drivers/media/platform/qcom/iris/iris_vpu4x.c
++++ b/drivers/media/platform/qcom/iris/iris_vpu4x.c
+@@ -252,21 +252,10 @@ static int iris_vpu4x_power_on_hardware(
+ ret = iris_vpu4x_power_on_apv(core);
+ if (ret)
+ goto disable_hw_clocks;
+-
+- iris_vpu4x_ahb_sync_reset_apv(core);
+ }
+
+- iris_vpu4x_ahb_sync_reset_hardware(core);
+-
+- ret = iris_vpu4x_genpd_set_hwmode(core, true, efuse_value);
+- if (ret)
+- goto disable_apv_power_domain;
+-
+ return 0;
+
+-disable_apv_power_domain:
+- if (!(efuse_value & DISABLE_VIDEO_APV_BIT))
+- iris_vpu4x_power_off_apv(core);
+ disable_hw_clocks:
+ iris_vpu4x_disable_hardware_clocks(core, efuse_value);
+ disable_vpp1_power_domain:
+@@ -359,6 +348,18 @@ disable_clocks_and_power:
+ iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN]);
+ }
+
++static int iris_vpu4x_set_hwmode(struct iris_core *core)
++{
++ u32 efuse_value = readl(core->reg_base + WRAPPER_EFUSE_MONITOR);
++
++ if (!(efuse_value & DISABLE_VIDEO_APV_BIT))
++ iris_vpu4x_ahb_sync_reset_apv(core);
++
++ iris_vpu4x_ahb_sync_reset_hardware(core);
++
++ return iris_vpu4x_genpd_set_hwmode(core, true, efuse_value);
++}
++
+ const struct vpu_ops iris_vpu4x_ops = {
+ .power_off_hw = iris_vpu4x_power_off_hardware,
+ .power_on_hw = iris_vpu4x_power_on_hardware,
+@@ -366,4 +367,5 @@ const struct vpu_ops iris_vpu4x_ops = {
+ .power_on_controller = iris_vpu35_vpu4x_power_on_controller,
+ .program_bootup_registers = iris_vpu35_vpu4x_program_bootup_registers,
+ .calc_freq = iris_vpu3x_vpu4x_calculate_frequency,
++ .set_hwmode = iris_vpu4x_set_hwmode,
+ };
+--- a/drivers/media/platform/qcom/iris/iris_vpu_common.c
++++ b/drivers/media/platform/qcom/iris/iris_vpu_common.c
+@@ -292,14 +292,8 @@ int iris_vpu_power_on_hw(struct iris_cor
+ if (ret && ret != -ENOENT)
+ goto err_disable_hw_clock;
+
+- ret = dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN], true);
+- if (ret)
+- goto err_disable_hw_ahb_clock;
+-
+ return 0;
+
+-err_disable_hw_ahb_clock:
+- iris_disable_unprepare_clock(core, IRIS_HW_AHB_CLK);
+ err_disable_hw_clock:
+ iris_disable_unprepare_clock(core, IRIS_HW_CLK);
+ err_disable_power:
+@@ -308,6 +302,16 @@ err_disable_power:
+ return ret;
+ }
+
++int iris_vpu_set_hwmode(struct iris_core *core)
++{
++ return dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN], true);
++}
++
++int iris_vpu_switch_to_hwmode(struct iris_core *core)
++{
++ return core->iris_platform_data->vpu_ops->set_hwmode(core);
++}
++
+ int iris_vpu35_vpu4x_power_off_controller(struct iris_core *core)
+ {
+ u32 clk_rst_tbl_size = core->iris_platform_data->clk_rst_tbl_size;
+--- a/drivers/media/platform/qcom/iris/iris_vpu_common.h
++++ b/drivers/media/platform/qcom/iris/iris_vpu_common.h
+@@ -21,6 +21,7 @@ struct vpu_ops {
+ int (*power_on_controller)(struct iris_core *core);
+ void (*program_bootup_registers)(struct iris_core *core);
+ u64 (*calc_freq)(struct iris_inst *inst, size_t data_size);
++ int (*set_hwmode)(struct iris_core *core);
+ };
+
+ int iris_vpu_boot_firmware(struct iris_core *core);
+@@ -30,6 +31,8 @@ int iris_vpu_watchdog(struct iris_core *
+ int iris_vpu_prepare_pc(struct iris_core *core);
+ int iris_vpu_power_on_controller(struct iris_core *core);
+ int iris_vpu_power_on_hw(struct iris_core *core);
++int iris_vpu_set_hwmode(struct iris_core *core);
++int iris_vpu_switch_to_hwmode(struct iris_core *core);
+ int iris_vpu_power_on(struct iris_core *core);
+ int iris_vpu_power_off_controller(struct iris_core *core);
+ void iris_vpu_power_off_hw(struct iris_core *core);
--- /dev/null
+From 9da49bd9d4224035cff39b40d7395310abb10201 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Mon, 26 Jan 2026 09:44:12 +0800
+Subject: media: omap3isp: drop the use count of v4l2 pipeline
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit 9da49bd9d4224035cff39b40d7395310abb10201 upstream.
+
+In isp_video_open(), drop the use count of v4l2
+pipeline if vb2_queue_init() fails.
+
+Fixes: 8fd390b89cc8 ("media: Split v4l2_pipeline_pm_use into v4l2_pipeline_pm_{get, put}")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/ti/omap3isp/ispvideo.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
+@@ -1403,6 +1403,7 @@ static int isp_video_open(struct file *f
+
+ ret = vb2_queue_init(&handle->queue);
+ if (ret < 0) {
++ v4l2_pipeline_pm_put(&video->video.entity);
+ omap3isp_put(video->isp);
+ goto done;
+ }
--- /dev/null
+From 8ea21435fe36fb853706f4935d78bc11beb63fb4 Mon Sep 17 00:00:00 2001
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Date: Thu, 12 Mar 2026 18:02:56 +0530
+Subject: media: pci: zoran: fix potential memory leak in zoran_probe()
+
+From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+
+commit 8ea21435fe36fb853706f4935d78bc11beb63fb4 upstream.
+
+The memory allocated for codec in videocodec_attach() is not freed in
+one of the error paths, due to an incorrect goto label. Fix the label
+to free it on error.
+
+Fixes: 8f7cc5c0b0eb ("media: staging: media: zoran: introduce zoran_i2c_init")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/zoran/zoran_card.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/pci/zoran/zoran_card.c
++++ b/drivers/media/pci/zoran/zoran_card.c
+@@ -1373,7 +1373,7 @@ static int zoran_probe(struct pci_dev *p
+ }
+ if (zr->codec->type != zr->card.video_codec) {
+ pci_err(pdev, "%s - wrong codec\n", __func__);
+- goto zr_unreg_videocodec;
++ goto zr_detach_codec;
+ }
+ }
+ if (zr->card.video_vfe != 0) {
--- /dev/null
+From d31fac47b39f5e1ed85a587688ca70b793e421b4 Mon Sep 17 00:00:00 2001
+From: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+Date: Fri, 13 Mar 2026 18:13:04 +0800
+Subject: media: qcom: camss: Add missing clocks for VFE lite on sa8775p
+
+From: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+
+commit d31fac47b39f5e1ed85a587688ca70b793e421b4 upstream.
+
+Add missing required clocks (cpas_ahb and camnoc_axi) for VFE lite
+instances on sa8775p platform. These clocks are necessary for proper
+VFE lite operation:
+
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+Fixes: e7b59e1d06fb ("media: qcom: camss: Add support for VFE 690")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/camss/camss.c | 40 ++++++++++++++++++------------
+ 1 file changed, 25 insertions(+), 15 deletions(-)
+
+--- a/drivers/media/platform/qcom/camss/camss.c
++++ b/drivers/media/platform/qcom/camss/camss.c
+@@ -3742,15 +3742,17 @@ static const struct camss_subdev_resourc
+ /* VFE2 (lite) */
+ {
+ .regulators = {},
+- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
++ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
+ "vfe_lite_csid", "vfe_lite_cphy_rx",
+- "vfe_lite"},
++ "vfe_lite", "camnoc_axi"},
+ .clock_rate = {
+- { 0, 0, 0, 0 },
++ { 0 },
++ { 0 },
+ { 300000000, 400000000, 400000000, 400000000 },
+ { 400000000, 400000000, 400000000, 400000000 },
+ { 400000000, 400000000, 400000000, 400000000 },
+ { 480000000, 600000000, 600000000, 600000000 },
++ { 400000000 },
+ },
+ .reg = { "vfe_lite0" },
+ .interrupt = { "vfe_lite0" },
+@@ -3765,15 +3767,17 @@ static const struct camss_subdev_resourc
+ /* VFE3 (lite) */
+ {
+ .regulators = {},
+- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
++ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
+ "vfe_lite_csid", "vfe_lite_cphy_rx",
+- "vfe_lite"},
++ "vfe_lite", "camnoc_axi"},
+ .clock_rate = {
+- { 0, 0, 0, 0 },
++ { 0 },
++ { 0 },
+ { 300000000, 400000000, 400000000, 400000000 },
+ { 400000000, 400000000, 400000000, 400000000 },
+ { 400000000, 400000000, 400000000, 400000000 },
+ { 480000000, 600000000, 600000000, 600000000 },
++ { 400000000 },
+ },
+ .reg = { "vfe_lite1" },
+ .interrupt = { "vfe_lite1" },
+@@ -3788,15 +3792,17 @@ static const struct camss_subdev_resourc
+ /* VFE4 (lite) */
+ {
+ .regulators = {},
+- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
++ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
+ "vfe_lite_csid", "vfe_lite_cphy_rx",
+- "vfe_lite"},
++ "vfe_lite", "camnoc_axi"},
+ .clock_rate = {
+- { 0, 0, 0, 0 },
++ { 0 },
++ { 0 },
+ { 300000000, 400000000, 400000000, 400000000 },
+ { 400000000, 400000000, 400000000, 400000000 },
+ { 400000000, 400000000, 400000000, 400000000 },
+ { 480000000, 600000000, 600000000, 600000000 },
++ { 400000000 },
+ },
+ .reg = { "vfe_lite2" },
+ .interrupt = { "vfe_lite2" },
+@@ -3811,15 +3817,17 @@ static const struct camss_subdev_resourc
+ /* VFE5 (lite) */
+ {
+ .regulators = {},
+- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
++ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
+ "vfe_lite_csid", "vfe_lite_cphy_rx",
+- "vfe_lite"},
++ "vfe_lite", "camnoc_axi"},
+ .clock_rate = {
+- { 0, 0, 0, 0 },
++ { 0 },
++ { 0 },
+ { 300000000, 400000000, 400000000, 400000000 },
+ { 400000000, 400000000, 400000000, 400000000 },
+ { 400000000, 400000000, 400000000, 400000000 },
+ { 480000000, 600000000, 600000000, 600000000 },
++ { 400000000 },
+ },
+ .reg = { "vfe_lite3" },
+ .interrupt = { "vfe_lite3" },
+@@ -3834,15 +3842,17 @@ static const struct camss_subdev_resourc
+ /* VFE6 (lite) */
+ {
+ .regulators = {},
+- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
++ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
+ "vfe_lite_csid", "vfe_lite_cphy_rx",
+- "vfe_lite"},
++ "vfe_lite", "camnoc_axi"},
+ .clock_rate = {
+- { 0, 0, 0, 0 },
++ { 0 },
++ { 0 },
+ { 300000000, 400000000, 400000000, 400000000 },
+ { 400000000, 400000000, 400000000, 400000000 },
+ { 400000000, 400000000, 400000000, 400000000 },
+ { 480000000, 600000000, 600000000, 600000000 },
++ { 400000000 },
+ },
+ .reg = { "vfe_lite4" },
+ .interrupt = { "vfe_lite4" },
--- /dev/null
+From fe56c674118aa46da1a3e65aa22ca709ebd7d812 Mon Sep 17 00:00:00 2001
+From: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+Date: Fri, 13 Mar 2026 18:13:03 +0800
+Subject: media: qcom: camss: Fix csid clock configuration for sa8775p
+
+From: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+
+commit fe56c674118aa46da1a3e65aa22ca709ebd7d812 upstream.
+
+Fix the mismatch between clock list and clock rate table for CSID lite
+instances. The current implementation has 5 clocks defined but only 2
+are actually needed (vfe_lite_csid and vfe_lite_cphy_rx), while the
+clock rate table doesn't match this configuration.
+
+Update both clock list and rate table to maintain consistency:
+- Remove unused clocks: cpas_vfe_lite, vfe_lite_ahb, vfe_lite
+- Update clock rate table to match the remaining two clocks
+
+Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/camss/camss.c | 40 +++++++++++-------------------
+ 1 file changed, 15 insertions(+), 25 deletions(-)
+
+--- a/drivers/media/platform/qcom/camss/camss.c
++++ b/drivers/media/platform/qcom/camss/camss.c
+@@ -3598,12 +3598,10 @@ static const struct camss_subdev_resourc
+ /* CSID2 (lite) */
+ {
+ .regulators = {},
+- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+- "vfe_lite_csid", "vfe_lite_cphy_rx",
+- "vfe_lite"},
++ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" },
+ .clock_rate = {
+- { 0, 0, 400000000, 400000000, 0},
+- { 0, 0, 400000000, 480000000, 0}
++ { 400000000, 480000000 },
++ { 400000000, 480000000 }
+ },
+ .reg = { "csid_lite0" },
+ .interrupt = { "csid_lite0" },
+@@ -3617,12 +3615,10 @@ static const struct camss_subdev_resourc
+ /* CSID3 (lite) */
+ {
+ .regulators = {},
+- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+- "vfe_lite_csid", "vfe_lite_cphy_rx",
+- "vfe_lite"},
++ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" },
+ .clock_rate = {
+- { 0, 0, 400000000, 400000000, 0},
+- { 0, 0, 400000000, 480000000, 0}
++ { 400000000, 480000000 },
++ { 400000000, 480000000 }
+ },
+ .reg = { "csid_lite1" },
+ .interrupt = { "csid_lite1" },
+@@ -3636,12 +3632,10 @@ static const struct camss_subdev_resourc
+ /* CSID4 (lite) */
+ {
+ .regulators = {},
+- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+- "vfe_lite_csid", "vfe_lite_cphy_rx",
+- "vfe_lite"},
++ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" },
+ .clock_rate = {
+- { 0, 0, 400000000, 400000000, 0},
+- { 0, 0, 400000000, 480000000, 0}
++ { 400000000, 480000000 },
++ { 400000000, 480000000 }
+ },
+ .reg = { "csid_lite2" },
+ .interrupt = { "csid_lite2" },
+@@ -3655,12 +3649,10 @@ static const struct camss_subdev_resourc
+ /* CSID5 (lite) */
+ {
+ .regulators = {},
+- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+- "vfe_lite_csid", "vfe_lite_cphy_rx",
+- "vfe_lite"},
++ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" },
+ .clock_rate = {
+- { 0, 0, 400000000, 400000000, 0},
+- { 0, 0, 400000000, 480000000, 0}
++ { 400000000, 480000000 },
++ { 400000000, 480000000 }
+ },
+ .reg = { "csid_lite3" },
+ .interrupt = { "csid_lite3" },
+@@ -3674,12 +3666,10 @@ static const struct camss_subdev_resourc
+ /* CSID6 (lite) */
+ {
+ .regulators = {},
+- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+- "vfe_lite_csid", "vfe_lite_cphy_rx",
+- "vfe_lite"},
++ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" },
+ .clock_rate = {
+- { 0, 0, 400000000, 400000000, 0},
+- { 0, 0, 400000000, 480000000, 0}
++ { 400000000, 480000000 },
++ { 400000000, 480000000 }
+ },
+ .reg = { "csid_lite4" },
+ .interrupt = { "csid_lite4" },
--- /dev/null
+From dd1b373941079cc102cc18bc68884e18245f5912 Mon Sep 17 00:00:00 2001
+From: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+Date: Fri, 13 Mar 2026 18:13:02 +0800
+Subject: media: qcom: camss: Fix csid IRQ offset for sa8775p
+
+From: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+
+commit dd1b373941079cc102cc18bc68884e18245f5912 upstream.
+
+Fix BUF_DONE_IRQ_STATUS_RDI_OFFSET calculation for csid lite on
+sa8775p platform. The offset should be 0 for csid lite on sa8775p,
+
+Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/camss/camss-csid-gen3.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/platform/qcom/camss/camss-csid-gen3.c
++++ b/drivers/media/platform/qcom/camss/camss-csid-gen3.c
+@@ -48,9 +48,9 @@
+ #define IS_CSID_690(csid) ((csid->camss->res->version == CAMSS_8775P) \
+ || (csid->camss->res->version == CAMSS_8300))
+ #define CSID_BUF_DONE_IRQ_STATUS 0x8C
+-#define BUF_DONE_IRQ_STATUS_RDI_OFFSET (csid_is_lite(csid) ?\
+- 1 : (IS_CSID_690(csid) ?\
+- 13 : 14))
++#define BUF_DONE_IRQ_STATUS_RDI_OFFSET (csid_is_lite(csid) ? \
++ ((IS_CSID_690(csid) ? 0 : 1)) : \
++ ((IS_CSID_690(csid) ? 13 : 14)))
+ #define CSID_BUF_DONE_IRQ_MASK 0x90
+ #define CSID_BUF_DONE_IRQ_CLEAR 0x94
+ #define CSID_BUF_DONE_IRQ_SET 0x98
--- /dev/null
+From 3e0b2053751657ed2924adfe3ff25b1450231e33 Mon Sep 17 00:00:00 2001
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Date: Fri, 27 Mar 2026 22:19:55 +0200
+Subject: media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+commit 3e0b2053751657ed2924adfe3ff25b1450231e33 upstream.
+
+Follow the commit bfe1326573ff ("venus: Fix for H265 decoding failure.")
+and increase H265D_MAX_SLICE following firmware requirements on that
+platform. Otherwise decoding of the H.265 streams fails with the
+"insufficient scratch_1 buffer size" from the firmware.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
+Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+[bod: Fixed commit log withthe => with the]
+Fixes: e1f5d32608ec ("media: iris: Add internal buffer calculation for HEVC and VP9 decoders")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_vpu_buffer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_vpu_buffer.h
++++ b/drivers/media/platform/qcom/iris/iris_vpu_buffer.h
+@@ -67,7 +67,7 @@ struct iris_inst;
+ #define SIZE_DOLBY_RPU_METADATA (41 * 1024)
+ #define H264_CABAC_HDR_RATIO_HD_TOT 1
+ #define H264_CABAC_RES_RATIO_HD_TOT 3
+-#define H265D_MAX_SLICE 1200
++#define H265D_MAX_SLICE 3600
+ #define SIZE_H265D_HW_PIC_T SIZE_H264D_HW_PIC_T
+ #define H265_CABAC_HDR_RATIO_HD_TOT 2
+ #define H265_CABAC_RES_RATIO_HD_TOT 2
--- /dev/null
+From 9df2aaa64890c0b6226057eb6fcb6352bd2df432 Mon Sep 17 00:00:00 2001
+From: Michael Tretter <m.tretter@pengutronix.de>
+Date: Fri, 7 Nov 2025 11:34:33 +0100
+Subject: media: staging: imx: request mbus_config in csi_start
+
+From: Michael Tretter <m.tretter@pengutronix.de>
+
+commit 9df2aaa64890c0b6226057eb6fcb6352bd2df432 upstream.
+
+Request the upstream mbus_config in csi_start, which starts the stream,
+instead of caching it in link_validate.
+
+This allows to get rid of the mbus_cfg field in the struct csi_priv and
+avoids state in the driver.
+
+Fixes: 4a34ec8e470c ("[media] media: imx: Add CSI subdev driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/imx/imx-media-csi.c | 40 ++++++++++++++++++------------
+ 1 file changed, 24 insertions(+), 16 deletions(-)
+
+--- a/drivers/staging/media/imx/imx-media-csi.c
++++ b/drivers/staging/media/imx/imx-media-csi.c
+@@ -97,9 +97,6 @@ struct csi_priv {
+ /* the mipi virtual channel number at link validate */
+ int vc_num;
+
+- /* media bus config of the upstream subdevice CSI is receiving from */
+- struct v4l2_mbus_config mbus_cfg;
+-
+ spinlock_t irqlock; /* protect eof_irq handler */
+ struct timer_list eof_timeout_timer;
+ int eof_irq;
+@@ -403,7 +400,8 @@ static void csi_idmac_unsetup_vb2_buf(st
+ }
+
+ /* init the SMFC IDMAC channel */
+-static int csi_idmac_setup_channel(struct csi_priv *priv)
++static int csi_idmac_setup_channel(struct csi_priv *priv,
++ struct v4l2_mbus_config *mbus_cfg)
+ {
+ struct imx_media_video_dev *vdev = priv->vdev;
+ const struct imx_media_pixfmt *incc;
+@@ -432,7 +430,7 @@ static int csi_idmac_setup_channel(struc
+ image.phys0 = phys[0];
+ image.phys1 = phys[1];
+
+- passthrough = requires_passthrough(&priv->mbus_cfg, infmt, incc);
++ passthrough = requires_passthrough(mbus_cfg, infmt, incc);
+ passthrough_cycles = 1;
+
+ /*
+@@ -572,11 +570,12 @@ static void csi_idmac_unsetup(struct csi
+ csi_idmac_unsetup_vb2_buf(priv, state);
+ }
+
+-static int csi_idmac_setup(struct csi_priv *priv)
++static int csi_idmac_setup(struct csi_priv *priv,
++ struct v4l2_mbus_config *mbus_cfg)
+ {
+ int ret;
+
+- ret = csi_idmac_setup_channel(priv);
++ ret = csi_idmac_setup_channel(priv, mbus_cfg);
+ if (ret)
+ return ret;
+
+@@ -595,7 +594,8 @@ static int csi_idmac_setup(struct csi_pr
+ return 0;
+ }
+
+-static int csi_idmac_start(struct csi_priv *priv)
++static int csi_idmac_start(struct csi_priv *priv,
++ struct v4l2_mbus_config *mbus_cfg)
+ {
+ struct imx_media_video_dev *vdev = priv->vdev;
+ int ret;
+@@ -619,7 +619,7 @@ static int csi_idmac_start(struct csi_pr
+ priv->last_eof = false;
+ priv->nfb4eof = false;
+
+- ret = csi_idmac_setup(priv);
++ ret = csi_idmac_setup(priv, mbus_cfg);
+ if (ret) {
+ v4l2_err(&priv->sd, "csi_idmac_setup failed: %d\n", ret);
+ goto out_free_dma_buf;
+@@ -701,7 +701,8 @@ static void csi_idmac_stop(struct csi_pr
+ }
+
+ /* Update the CSI whole sensor and active windows */
+-static int csi_setup(struct csi_priv *priv)
++static int csi_setup(struct csi_priv *priv,
++ struct v4l2_mbus_config *mbus_cfg)
+ {
+ struct v4l2_mbus_framefmt *infmt, *outfmt;
+ const struct imx_media_pixfmt *incc;
+@@ -719,7 +720,7 @@ static int csi_setup(struct csi_priv *pr
+ * if cycles is set, we need to handle this over multiple cycles as
+ * generic/bayer data
+ */
+- if (is_parallel_bus(&priv->mbus_cfg) && incc->cycles) {
++ if (is_parallel_bus(mbus_cfg) && incc->cycles) {
+ if_fmt.width *= incc->cycles;
+ crop.width *= incc->cycles;
+ }
+@@ -730,7 +731,7 @@ static int csi_setup(struct csi_priv *pr
+ priv->crop.width == 2 * priv->compose.width,
+ priv->crop.height == 2 * priv->compose.height);
+
+- ipu_csi_init_interface(priv->csi, &priv->mbus_cfg, &if_fmt, outfmt);
++ ipu_csi_init_interface(priv->csi, mbus_cfg, &if_fmt, outfmt);
+
+ ipu_csi_set_dest(priv->csi, priv->dest);
+
+@@ -745,9 +746,17 @@ static int csi_setup(struct csi_priv *pr
+
+ static int csi_start(struct csi_priv *priv)
+ {
++ struct v4l2_mbus_config mbus_cfg = { .type = 0 };
+ struct v4l2_fract *input_fi, *output_fi;
+ int ret;
+
++ ret = csi_get_upstream_mbus_config(priv, &mbus_cfg);
++ if (ret) {
++ v4l2_err(&priv->sd,
++ "failed to get upstream media bus configuration\n");
++ return ret;
++ }
++
+ input_fi = &priv->frame_interval[CSI_SINK_PAD];
+ output_fi = &priv->frame_interval[priv->active_output_pad];
+
+@@ -758,7 +767,7 @@ static int csi_start(struct csi_priv *pr
+ return ret;
+
+ /* Skip first few frames from a BT.656 source */
+- if (priv->mbus_cfg.type == V4L2_MBUS_BT656) {
++ if (mbus_cfg.type == V4L2_MBUS_BT656) {
+ u32 delay_usec, bad_frames = 20;
+
+ delay_usec = DIV_ROUND_UP_ULL((u64)USEC_PER_SEC *
+@@ -769,12 +778,12 @@ static int csi_start(struct csi_priv *pr
+ }
+
+ if (priv->dest == IPU_CSI_DEST_IDMAC) {
+- ret = csi_idmac_start(priv);
++ ret = csi_idmac_start(priv, &mbus_cfg);
+ if (ret)
+ goto stop_upstream;
+ }
+
+- ret = csi_setup(priv);
++ ret = csi_setup(priv, &mbus_cfg);
+ if (ret)
+ goto idmac_stop;
+
+@@ -1138,7 +1147,6 @@ static int csi_link_validate(struct v4l2
+
+ mutex_lock(&priv->lock);
+
+- priv->mbus_cfg = mbus_cfg;
+ is_csi2 = !is_parallel_bus(&mbus_cfg);
+ if (is_csi2) {
+ /*
--- /dev/null
+From aa23c94cc433b145d1ce93820ecdfe16d8940e28 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 30 Mar 2026 12:08:21 +0100
+Subject: media: venus: fix QCOM_MDT_LOADER dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit aa23c94cc433b145d1ce93820ecdfe16d8940e28 upstream.
+
+When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_VENUS=y,
+the kernel fails to link:
+
+x86_64-linux-ld: drivers/media/platform/qcom/venus/firmware.o: in function `venus_boot':
+firmware.c:(.text+0x1e3): undefined reference to `qcom_mdt_get_size'
+firmware.c:(.text+0x25a): undefined reference to `qcom_mdt_load'
+firmware.c:(.text+0x272): undefined reference to `qcom_mdt_load_no_init'
+
+The problem is the conditional 'select' statement. Change this to
+make the driver built-in here regardless of CONFIG_ARCH_QCOM,
+same as for the similar IRIS driver.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
+Fixes: 0399b696f7f4 ("media: venus: fix compile-test build on non-qcom ARM platform")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/qcom/venus/Kconfig
++++ b/drivers/media/platform/qcom/venus/Kconfig
+@@ -4,7 +4,7 @@ config VIDEO_QCOM_VENUS
+ depends on VIDEO_DEV && QCOM_SMEM
+ depends on (ARCH_QCOM && ARM64 && IOMMU_API) || COMPILE_TEST
+ select OF_DYNAMIC if ARCH_QCOM
+- select QCOM_MDT_LOADER if ARCH_QCOM
++ select QCOM_MDT_LOADER
+ select QCOM_SCM
+ select VIDEOBUF2_DMA_CONTIG
+ select V4L2_MEM2MEM_DEV
vsock-virtio-fix-msg_peek-ignoring-skb-offset-when-calculating-bytes-to-copy.patch
arm64-dts-broadcom-bcm2712-d-rpi-5-b-add-fixes-for-pinctrl-pinctrl_aon.patch
arm64-dts-broadcom-bcm2712-d-rpi-5-b-update-uart10-interrupt.patch
+media-pci-zoran-fix-potential-memory-leak-in-zoran_probe.patch
+media-dib8000-avoid-division-by-0-in-dib8000_set_dds.patch
+media-i2c-imx412-assert-reset-gpio-during-probe.patch
+media-staging-imx-request-mbus_config-in-csi_start.patch
+media-i2c-ov08d10-fix-image-vertical-start-setting.patch
+media-i2c-ov08d10-fix-runtime-pm-handling-in-probe.patch
+media-omap3isp-drop-the-use-count-of-v4l2-pipeline.patch
+media-iris-fix-qcom_mdt_loader-dependency.patch
+media-iris-fix-use-after-free-in-iris_release_internal_buffers.patch
+media-qcom-camss-fix-csid-clock-configuration-for-sa8775p.patch
+media-qcom-camss-fix-csid-irq-offset-for-sa8775p.patch
+media-qcom-iris-increase-h265d_max_slice-to-fix-h.265-decoding-on-sc7280.patch
+media-venus-fix-qcom_mdt_loader-dependency.patch
+media-iris-fix-dma_free_attrs-size-in-iris_hfi_queues_init.patch
+media-iris-fix-use-after-free-of-fmt_src-during-mbpf-check.patch
+media-iris-switch-to-hardware-mode-after-firmware-boot.patch
+media-qcom-camss-add-missing-clocks-for-vfe-lite-on-sa8775p.patch
+drm-xe-hdcp-add-null-check-for-media_gt-in-intel_hdcp_gsc_check_status.patch
+spi-mxs-fix-controller-deregistration.patch
+spi-mt65xx-fix-controller-deregistration.patch
+spi-dln2-fix-controller-deregistration.patch
+spi-s3c64xx-fix-controller-deregistration.patch
+spi-fsl-espi-fix-controller-deregistration.patch
+spi-omap2-mcspi-fix-controller-deregistration.patch
+spi-pic32-fix-controller-deregistration.patch
+spi-ep93xx-fix-controller-deregistration.patch
+spi-mtk-nor-fix-controller-deregistration.patch
+spi-pl022-fix-controller-deregistration.patch
--- /dev/null
+From c353020fbfa8514ee91a6de2d88de4e5edca5803 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 9 Apr 2026 14:04:10 +0200
+Subject: spi: dln2: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit c353020fbfa8514ee91a6de2d88de4e5edca5803 upstream.
+
+Make sure to deregister the controller before disabling it to allow
+SPI device drivers to do I/O during deregistration.
+
+Fixes: 3d8c0d749da3 ("spi: add support for DLN-2 USB-SPI adapter")
+Cc: stable@vger.kernel.org # 4.0
+Cc: Laurentiu Palcu <laurentiu.palcu@intel.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260409120419.388546-12-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-dln2.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-dln2.c
++++ b/drivers/spi/spi-dln2.c
+@@ -758,7 +758,7 @@ static int dln2_spi_probe(struct platfor
+ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_enable(&pdev->dev);
+
+- ret = devm_spi_register_controller(&pdev->dev, host);
++ ret = spi_register_controller(host);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "Failed to register host\n");
+ goto exit_register;
+@@ -783,10 +783,16 @@ static void dln2_spi_remove(struct platf
+ struct spi_controller *host = platform_get_drvdata(pdev);
+ struct dln2_spi *dln2 = spi_controller_get_devdata(host);
+
++ spi_controller_get(host);
++
++ spi_unregister_controller(host);
++
+ pm_runtime_disable(&pdev->dev);
+
+ if (dln2_spi_enable(dln2, false) < 0)
+ dev_err(&pdev->dev, "Failed to disable SPI module\n");
++
++ spi_controller_put(host);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
--- /dev/null
+From f4838934b695a58eda0833583cb8028e73a19529 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 9 Apr 2026 14:04:11 +0200
+Subject: spi: ep93xx: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit f4838934b695a58eda0833583cb8028e73a19529 upstream.
+
+Make sure to deregister the controller before releasing underlying
+resources like DMA during driver unbind.
+
+Fixes: 011f23a3c2f2 ("spi/ep93xx: implemented driver for Cirrus EP93xx SPI controller")
+Cc: stable@vger.kernel.org # 2.6.35
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260409120419.388546-13-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-ep93xx.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-ep93xx.c
++++ b/drivers/spi/spi-ep93xx.c
+@@ -689,7 +689,7 @@ static int ep93xx_spi_probe(struct platf
+ /* make sure that the hardware is disabled */
+ writel(0, espi->mmio + SSPCR1);
+
+- error = devm_spi_register_controller(&pdev->dev, host);
++ error = spi_register_controller(host);
+ if (error) {
+ dev_err(&pdev->dev, "failed to register SPI host\n");
+ goto fail_free_dma;
+@@ -713,7 +713,13 @@ static void ep93xx_spi_remove(struct pla
+ struct spi_controller *host = platform_get_drvdata(pdev);
+ struct ep93xx_spi *espi = spi_controller_get_devdata(host);
+
++ spi_controller_get(host);
++
++ spi_unregister_controller(host);
++
+ ep93xx_spi_release_dma(espi);
++
++ spi_controller_put(host);
+ }
+
+ static const struct of_device_id ep93xx_spi_of_ids[] = {
--- /dev/null
+From e506a700a7ad229f5c8f01f4b8350119cccb4158 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 9 Apr 2026 14:04:12 +0200
+Subject: spi: fsl-espi: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit e506a700a7ad229f5c8f01f4b8350119cccb4158 upstream.
+
+Make sure to deregister the controller before disabling runtime PM
+(which can leave the controller disabled) to allow SPI device drivers to
+do I/O during deregistration.
+
+Fixes: e9abb4db8d10 ("spi: fsl-espi: add runtime PM")
+Cc: stable@vger.kernel.org # 4.3
+Cc: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260409120419.388546-14-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-fsl-espi.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-fsl-espi.c
++++ b/drivers/spi/spi-fsl-espi.c
+@@ -718,7 +718,7 @@ static int fsl_espi_probe(struct device
+ pm_runtime_enable(dev);
+ pm_runtime_get_sync(dev);
+
+- ret = devm_spi_register_controller(dev, host);
++ ret = spi_register_controller(host);
+ if (ret < 0)
+ goto err_pm;
+
+@@ -782,7 +782,15 @@ static int of_fsl_espi_probe(struct plat
+
+ static void of_fsl_espi_remove(struct platform_device *dev)
+ {
++ struct spi_controller *host = platform_get_drvdata(dev);
++
++ spi_controller_get(host);
++
++ spi_unregister_controller(host);
++
+ pm_runtime_disable(&dev->dev);
++
++ spi_controller_put(host);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
--- /dev/null
+From 2ad30599cccc572ba2fc11010670eb6e01ea6bfc Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 10 Apr 2026 10:17:31 +0200
+Subject: spi: mt65xx: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 2ad30599cccc572ba2fc11010670eb6e01ea6bfc upstream.
+
+Make sure to deregister the controller before disabling underlying
+resources like clocks during driver unbind.
+
+Fixes: a568231f4632 ("spi: mediatek: Add spi bus for Mediatek MT8173")
+Cc: stable@vger.kernel.org # 4.3: ace145802350
+Cc: stable@vger.kernel.org # 4.3
+Cc: Leilk Liu <leilk.liu@mediatek.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260410081757.503099-2-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-mt65xx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -1325,7 +1325,7 @@ static int mtk_spi_probe(struct platform
+
+ pm_runtime_enable(dev);
+
+- ret = devm_spi_register_controller(dev, host);
++ ret = spi_register_controller(host);
+ if (ret) {
+ pm_runtime_disable(dev);
+ return dev_err_probe(dev, ret, "failed to register host\n");
+@@ -1340,6 +1340,8 @@ static void mtk_spi_remove(struct platfo
+ struct mtk_spi *mdata = spi_controller_get_devdata(host);
+ int ret;
+
++ spi_unregister_controller(host);
++
+ cpu_latency_qos_remove_request(&mdata->qos_request);
+ if (mdata->use_spimem && !completion_done(&mdata->spimem_done))
+ complete(&mdata->spimem_done);
--- /dev/null
+From 76336f24934621db286cabb20b483773ee01dcaa Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 10 Apr 2026 10:17:32 +0200
+Subject: spi: mtk-nor: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 76336f24934621db286cabb20b483773ee01dcaa upstream.
+
+Make sure to deregister the controller before disabling underlying
+resources like clocks during driver unbind.
+
+Fixes: 881d1ee9fe81 ("spi: add support for mediatek spi-nor controller")
+Cc: stable@vger.kernel.org # 5.7
+Cc: Chuanhong Guo <gch981213@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260410081757.503099-3-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-mtk-nor.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-mtk-nor.c
++++ b/drivers/spi/spi-mtk-nor.c
+@@ -913,7 +913,7 @@ static int mtk_nor_probe(struct platform
+ pm_runtime_enable(&pdev->dev);
+ pm_runtime_get_noresume(&pdev->dev);
+
+- ret = devm_spi_register_controller(&pdev->dev, ctlr);
++ ret = spi_register_controller(ctlr);
+ if (ret < 0)
+ goto err_probe;
+
+@@ -938,6 +938,8 @@ static void mtk_nor_remove(struct platfo
+ struct spi_controller *ctlr = dev_get_drvdata(&pdev->dev);
+ struct mtk_nor *sp = spi_controller_get_devdata(ctlr);
+
++ spi_unregister_controller(ctlr);
++
+ pm_runtime_disable(&pdev->dev);
+ pm_runtime_set_suspended(&pdev->dev);
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
--- /dev/null
+From 8b0d0011af20fb547aa67a1cefbf320992fd5e92 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 10 Apr 2026 10:17:33 +0200
+Subject: spi: mxs: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 8b0d0011af20fb547aa67a1cefbf320992fd5e92 upstream.
+
+Make sure to deregister the controller before releasing underlying
+resources like DMA during driver unbind.
+
+Fixes: 33e195acf268 ("spi: mxs: use devm_spi_register_master()")
+Cc: stable@vger.kernel.org # 3.13
+Cc: Jingoo Han <jg1.han@samsung.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260410081757.503099-4-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-mxs.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-mxs.c
++++ b/drivers/spi/spi-mxs.c
+@@ -619,7 +619,7 @@ static int mxs_spi_probe(struct platform
+ if (ret)
+ goto out_pm_runtime_put;
+
+- ret = devm_spi_register_controller(&pdev->dev, host);
++ ret = spi_register_controller(host);
+ if (ret) {
+ dev_err(&pdev->dev, "Cannot register SPI host, %d\n", ret);
+ goto out_pm_runtime_put;
+@@ -650,11 +650,17 @@ static void mxs_spi_remove(struct platfo
+ spi = spi_controller_get_devdata(host);
+ ssp = &spi->ssp;
+
++ spi_controller_get(host);
++
++ spi_unregister_controller(host);
++
+ pm_runtime_disable(&pdev->dev);
+ if (!pm_runtime_status_suspended(&pdev->dev))
+ mxs_spi_runtime_suspend(&pdev->dev);
+
+ dma_release_channel(ssp->dmach);
++
++ spi_controller_put(host);
+ }
+
+ static struct platform_driver mxs_spi_driver = {
--- /dev/null
+From fb45f95c377e4a4bdece2c5e17643b459c9c13e7 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 10 Apr 2026 10:17:35 +0200
+Subject: spi: omap2-mcspi: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit fb45f95c377e4a4bdece2c5e17643b459c9c13e7 upstream.
+
+Make sure to deregister the controller before releasing underlying
+resources like DMA during driver unbind.
+
+Fixes: ccdc7bf92573 ("SPI: omap2_mcspi driver")
+Cc: stable@vger.kernel.org # 2.6.23
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260410081757.503099-6-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-omap2-mcspi.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -1585,7 +1585,7 @@ static int omap2_mcspi_probe(struct plat
+ if (status < 0)
+ goto disable_pm;
+
+- status = devm_spi_register_controller(&pdev->dev, ctlr);
++ status = spi_register_controller(ctlr);
+ if (status < 0)
+ goto disable_pm;
+
+@@ -1606,11 +1606,17 @@ static void omap2_mcspi_remove(struct pl
+ struct spi_controller *ctlr = platform_get_drvdata(pdev);
+ struct omap2_mcspi *mcspi = spi_controller_get_devdata(ctlr);
+
++ spi_controller_get(ctlr);
++
++ spi_unregister_controller(ctlr);
++
+ omap2_mcspi_release_dma(ctlr);
+
+ pm_runtime_dont_use_autosuspend(mcspi->dev);
+ pm_runtime_put_sync(mcspi->dev);
+ pm_runtime_disable(&pdev->dev);
++
++ spi_controller_put(ctlr);
+ }
+
+ /* work with hotplug and coldplug */
--- /dev/null
+From 6b627bfe0c44e064aba464839e430dc1ca2b0bb8 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 10 Apr 2026 10:17:36 +0200
+Subject: spi: pic32: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 6b627bfe0c44e064aba464839e430dc1ca2b0bb8 upstream.
+
+Make sure to deregister the controller before releasing underlying
+resources like DMA during driver unbind.
+
+Fixes: 1bcb9f8ceb67 ("spi: spi-pic32: Add PIC32 SPI master driver")
+Cc: stable@vger.kernel.org # 4.7
+Cc: Purna Chandra Mandal <purna.mandal@microchip.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260410081757.503099-7-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-pic32.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/spi/spi-pic32.c
++++ b/drivers/spi/spi-pic32.c
+@@ -821,7 +821,7 @@ static int pic32_spi_probe(struct platfo
+ }
+
+ /* register host */
+- ret = devm_spi_register_controller(&pdev->dev, host);
++ ret = spi_register_controller(host);
+ if (ret) {
+ dev_err(&host->dev, "failed registering spi host\n");
+ goto err_bailout;
+@@ -840,11 +840,16 @@ err_host:
+
+ static void pic32_spi_remove(struct platform_device *pdev)
+ {
+- struct pic32_spi *pic32s;
++ struct pic32_spi *pic32s = platform_get_drvdata(pdev);
++
++ spi_controller_get(pic32s->host);
++
++ spi_unregister_controller(pic32s->host);
+
+- pic32s = platform_get_drvdata(pdev);
+ pic32_spi_disable(pic32s);
+ pic32_spi_dma_unprep(pic32s);
++
++ spi_controller_put(pic32s->host);
+ }
+
+ static const struct of_device_id pic32_spi_of_match[] = {
--- /dev/null
+From 994b33366be9148240690e3e94bffe17c4d89458 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 10 Apr 2026 10:17:38 +0200
+Subject: spi: pl022: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 994b33366be9148240690e3e94bffe17c4d89458 upstream.
+
+Make sure to deregister the controller before releasing underlying
+resources like DMA during driver unbind.
+
+Fixes: b43d65f7e818 ("[ARM] 5546/1: ARM PL022 SSP/SPI driver v3")
+Cc: stable@vger.kernel.org # 2.6.31
+Cc: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260410081757.503099-9-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-pl022.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-pl022.c
++++ b/drivers/spi/spi-pl022.c
+@@ -1956,7 +1956,7 @@ static int pl022_probe(struct amba_devic
+
+ /* Register with the SPI framework */
+ amba_set_drvdata(adev, pl022);
+- status = devm_spi_register_controller(&adev->dev, host);
++ status = spi_register_controller(host);
+ if (status != 0) {
+ dev_err_probe(&adev->dev, status,
+ "problem registering spi host\n");
+@@ -1997,6 +1997,10 @@ pl022_remove(struct amba_device *adev)
+ if (!pl022)
+ return;
+
++ spi_controller_get(pl022->host);
++
++ spi_unregister_controller(pl022->host);
++
+ /*
+ * undo pm_runtime_put() in probe. I assume that we're not
+ * accessing the primecell here.
+@@ -2008,6 +2012,8 @@ pl022_remove(struct amba_device *adev)
+ pl022_dma_remove(pl022);
+
+ amba_release_regions(adev);
++
++ spi_controller_put(pl022->host);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
--- /dev/null
+From c1446b61e472da24d1547525193467b4bea4a7cb Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 10 Apr 2026 10:17:41 +0200
+Subject: spi: s3c64xx: fix controller deregistration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit c1446b61e472da24d1547525193467b4bea4a7cb upstream.
+
+Make sure to deregister the controller before releasing underlying
+resources like DMA during driver unbind.
+
+Fixes: 91800f0e9005 ("spi/s3c64xx: Use managed registration")
+Cc: stable@vger.kernel.org # 3.13: 76fbad410c0f
+Cc: stable@vger.kernel.org # 3.13
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260410081757.503099-12-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-s3c64xx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-s3c64xx.c
++++ b/drivers/spi/spi-s3c64xx.c
+@@ -1369,7 +1369,7 @@ static int s3c64xx_spi_probe(struct plat
+ S3C64XX_SPI_INT_TX_OVERRUN_EN | S3C64XX_SPI_INT_TX_UNDERRUN_EN,
+ sdd->regs + S3C64XX_SPI_INT_EN);
+
+- ret = devm_spi_register_controller(&pdev->dev, host);
++ ret = spi_register_controller(host);
+ if (ret != 0) {
+ dev_err(&pdev->dev, "cannot register SPI host: %d\n", ret);
+ goto err_pm_put;
+@@ -1399,6 +1399,8 @@ static void s3c64xx_spi_remove(struct pl
+
+ pm_runtime_get_sync(&pdev->dev);
+
++ spi_unregister_controller(host);
++
+ writel(0, sdd->regs + S3C64XX_SPI_INT_EN);
+
+ pm_runtime_put_noidle(&pdev->dev);
projects / thirdparty / kernel / stable-queue.git / commitdiff
