From: Greg Kroah-Hartman Date: Fri, 15 May 2026 07:48:16 +0000 (+0200) Subject: 7.0-stable patches X-Git-Tag: v5.10.256~18 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3ad50c9410080c6267fe0f2b52404f15bdd267ee;p=thirdparty%2Fkernel%2Fstable-queue.git 7.0-stable patches added patches: drm-xe-hdcp-add-null-check-for-media_gt-in-intel_hdcp_gsc_check_status.patch media-dib8000-avoid-division-by-0-in-dib8000_set_dds.patch media-i2c-imx412-assert-reset-gpio-during-probe.patch media-i2c-ov08d10-fix-image-vertical-start-setting.patch media-i2c-ov08d10-fix-runtime-pm-handling-in-probe.patch media-iris-fix-dma_free_attrs-size-in-iris_hfi_queues_init.patch media-iris-fix-qcom_mdt_loader-dependency.patch media-iris-fix-use-after-free-in-iris_release_internal_buffers.patch media-iris-fix-use-after-free-of-fmt_src-during-mbpf-check.patch media-iris-switch-to-hardware-mode-after-firmware-boot.patch media-omap3isp-drop-the-use-count-of-v4l2-pipeline.patch media-pci-zoran-fix-potential-memory-leak-in-zoran_probe.patch media-qcom-camss-add-missing-clocks-for-vfe-lite-on-sa8775p.patch media-qcom-camss-fix-csid-clock-configuration-for-sa8775p.patch media-qcom-camss-fix-csid-irq-offset-for-sa8775p.patch media-qcom-iris-increase-h265d_max_slice-to-fix-h.265-decoding-on-sc7280.patch media-staging-imx-request-mbus_config-in-csi_start.patch media-venus-fix-qcom_mdt_loader-dependency.patch spi-dln2-fix-controller-deregistration.patch spi-ep93xx-fix-controller-deregistration.patch spi-fsl-espi-fix-controller-deregistration.patch spi-mt65xx-fix-controller-deregistration.patch spi-mtk-nor-fix-controller-deregistration.patch spi-mxs-fix-controller-deregistration.patch spi-omap2-mcspi-fix-controller-deregistration.patch spi-pic32-fix-controller-deregistration.patch spi-pl022-fix-controller-deregistration.patch spi-s3c64xx-fix-controller-deregistration.patch --- diff --git a/queue-7.0/drm-xe-hdcp-add-null-check-for-media_gt-in-intel_hdcp_gsc_check_status.patch b/queue-7.0/drm-xe-hdcp-add-null-check-for-media_gt-in-intel_hdcp_gsc_check_status.patch new file mode 100644 index 0000000000..615b443ba0 --- /dev/null +++ b/queue-7.0/drm-xe-hdcp-add-null-check-for-media_gt-in-intel_hdcp_gsc_check_status.patch @@ -0,0 +1,62 @@ +From 60a1e131a811b68703da58fd805ab359b704ab03 Mon Sep 17 00:00:00 2001 +From: Gustavo Sousa +Date: Thu, 16 Apr 2026 15:17:19 -0300 +Subject: drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status() + +From: Gustavo Sousa + +commit 60a1e131a811b68703da58fd805ab359b704ab03 upstream. + +When media GT is disabled via configfs, there is no allocation for +media_gt, which is kept as NULL. In such scenario, +intel_hdcp_gsc_check_status() results in a kernel pagefault error due to +>->uc.gsc being evaluated as an invalid memory address. + +Fix that by introducing a NULL check on media_gt and bailing out early +if so. + +While at it, also drop the NULL check for gsc, since it can't be NULL if +media_gt is not NULL. + +v2: + - Get address for gsc only after checking that gt is not NULL. + (Shuicheng) + - Drop the NULL check for gsc. (Shuicheng) +v3: + - Add "Fixes" and "Cc: " tags. (Matt) + +Fixes: 4af50beb4e0f ("drm/xe: Use gsc_proxy_init_done to check proxy status") +Cc: # v6.10+ +Reviewed-by: Matt Roper +Reviewed-by: Shuicheng Lin +Link: https://patch.msgid.link/20260416-check-for-null-media_gt-in-intel_hdcp_gsc_check_status-v2-1-9adb9fd3b621@intel.com +Signed-off-by: Gustavo Sousa +(cherry picked from commit bfaf87e84ca3ca3f6e275f9ae56da47a8b55ffd1) +Signed-off-by: Matthew Brost +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/xe/display/xe_hdcp_gsc.c ++++ b/drivers/gpu/drm/xe/display/xe_hdcp_gsc.c +@@ -37,9 +37,17 @@ static bool intel_hdcp_gsc_check_status( + struct xe_device *xe = to_xe_device(drm); + struct xe_tile *tile = xe_device_get_root_tile(xe); + struct xe_gt *gt = tile->media_gt; +- struct xe_gsc *gsc = >->uc.gsc; ++ struct xe_gsc *gsc; + +- if (!gsc || !xe_uc_fw_is_available(&gsc->fw)) { ++ if (!gt) { ++ drm_dbg_kms(&xe->drm, ++ "not checking GSC status for HDCP2.x: media GT not present or disabled\n"); ++ return false; ++ } ++ ++ gsc = >->uc.gsc; ++ ++ if (!xe_uc_fw_is_available(&gsc->fw)) { + drm_dbg_kms(&xe->drm, + "GSC Components not ready for HDCP2.x\n"); + return false; diff --git a/queue-7.0/media-dib8000-avoid-division-by-0-in-dib8000_set_dds.patch b/queue-7.0/media-dib8000-avoid-division-by-0-in-dib8000_set_dds.patch new file mode 100644 index 0000000000..08273759a9 --- /dev/null +++ b/queue-7.0/media-dib8000-avoid-division-by-0-in-dib8000_set_dds.patch @@ -0,0 +1,47 @@ +From dde3c37af95cd6fa301c4906f33d627bc9dd874c Mon Sep 17 00:00:00 2001 +From: Sergey Shtylyov +Date: Fri, 6 Feb 2026 17:22:26 +0300 +Subject: media: dib8000: avoid division by 0 in dib8000_set_dds() + +From: Sergey Shtylyov + +commit dde3c37af95cd6fa301c4906f33d627bc9dd874c upstream. + +In dib8000_set_dds(), 1 << 26 (67108864) divided by e.g. 1 apparently can't +fit into 16-bit variable unit_khz_dds_val, being truncated to 0; this will +cause division by 0 while calling dprintk() with debugging enabled (via the +module parameter). Use s32 instead of s16 to declare the variable, getting +rid of the cast to u16 in the *else* branch as well... + +Found by Linux Verification Center (linuxtesting.org) with the Svace static +analysis tool. + +Fixes: 173a64cb3fcf ("[media] dib8000: enhancement") +Cc: stable@vger.kernel.org +Signed-off-by: Sergey Shtylyov +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/dvb-frontends/dib8000.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/dvb-frontends/dib8000.c ++++ b/drivers/media/dvb-frontends/dib8000.c +@@ -2695,7 +2695,7 @@ static void dib8000_viterbi_state(struct + + static void dib8000_set_dds(struct dib8000_state *state, s32 offset_khz) + { +- s16 unit_khz_dds_val; ++ s32 unit_khz_dds_val; + u32 abs_offset_khz = abs(offset_khz); + u32 dds = state->cfg.pll->ifreq & 0x1ffffff; + u8 invert = !!(state->cfg.pll->ifreq & (1 << 25)); +@@ -2716,7 +2716,7 @@ static void dib8000_set_dds(struct dib80 + dds = (1<<26) - dds; + } else { + ratio = 2; +- unit_khz_dds_val = (u16) (67108864 / state->cfg.pll->internal); ++ unit_khz_dds_val = 67108864 / state->cfg.pll->internal; + + if (offset_khz < 0) + unit_khz_dds_val *= -1; diff --git a/queue-7.0/media-i2c-imx412-assert-reset-gpio-during-probe.patch b/queue-7.0/media-i2c-imx412-assert-reset-gpio-during-probe.patch new file mode 100644 index 0000000000..c36932c88d --- /dev/null +++ b/queue-7.0/media-i2c-imx412-assert-reset-gpio-during-probe.patch @@ -0,0 +1,34 @@ +From 8467c5ff5acae28513bc1e0af535e06b41b04344 Mon Sep 17 00:00:00 2001 +From: Wenmeng Liu +Date: Fri, 23 Jan 2026 17:19:55 +0800 +Subject: media: i2c: imx412: Assert reset GPIO during probe + +From: Wenmeng Liu + +commit 8467c5ff5acae28513bc1e0af535e06b41b04344 upstream. + +Assert the reset GPIO before first power up. This avoids a mismatch where +the first power up (when the reset GPIO defaults deasserted) differs from +subsequent cycles. + +Signed-off-by: Wenmeng Liu +Fixes: 9214e86c0cc1 ("media: i2c: Add imx412 camera sensor driver") +Cc: stable@vger.kernel.org +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/imx412.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/i2c/imx412.c ++++ b/drivers/media/i2c/imx412.c +@@ -925,7 +925,7 @@ static int imx412_parse_hw_config(struct + + /* Request optional reset pin */ + imx412->reset_gpio = devm_gpiod_get_optional(imx412->dev, "reset", +- GPIOD_OUT_LOW); ++ GPIOD_OUT_HIGH); + if (IS_ERR(imx412->reset_gpio)) { + dev_err(imx412->dev, "failed to get reset gpio %pe\n", + imx412->reset_gpio); diff --git a/queue-7.0/media-i2c-ov08d10-fix-image-vertical-start-setting.patch b/queue-7.0/media-i2c-ov08d10-fix-image-vertical-start-setting.patch new file mode 100644 index 0000000000..ce38ac37fe --- /dev/null +++ b/queue-7.0/media-i2c-ov08d10-fix-image-vertical-start-setting.patch @@ -0,0 +1,67 @@ +From 5d150fa0f16096d736bd24d13e04495da5116fab Mon Sep 17 00:00:00 2001 +From: Matthias Fend +Date: Tue, 24 Mar 2026 11:41:36 +0100 +Subject: media: i2c: ov08d10: fix image vertical start setting + +From: Matthias Fend + +commit 5d150fa0f16096d736bd24d13e04495da5116fab upstream. + +The current settings for the "image vertical start" register appear to be +incorrect. While this only results in an incorrect start line for native +modes, this faulty setting causes actual problems in binning mode. At least +on an i.MX8MP test system, only corrupted frames could be received. +To correct this, the recommended settings from the reference register sets +are used for all modes. Since this shifts the start by one line, the Bayer +pattern also changes, which has also been corrected. + +Fixes: 7be91e02ed57 ("media: i2c: Add ov08d10 camera sensor driver") +Cc: stable@vger.kernel.org +Signed-off-by: Matthias Fend +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/ov08d10.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/media/i2c/ov08d10.c ++++ b/drivers/media/i2c/ov08d10.c +@@ -217,7 +217,7 @@ static const struct ov08d10_reg lane_2_m + {0x9a, 0x30}, + {0xa8, 0x02}, + {0xfd, 0x02}, +- {0xa1, 0x01}, ++ {0xa1, 0x00}, + {0xa2, 0x09}, + {0xa3, 0x9c}, + {0xa5, 0x00}, +@@ -335,7 +335,7 @@ static const struct ov08d10_reg lane_2_m + {0x9a, 0x30}, + {0xa8, 0x02}, + {0xfd, 0x02}, +- {0xa1, 0x09}, ++ {0xa1, 0x08}, + {0xa2, 0x09}, + {0xa3, 0x90}, + {0xa5, 0x08}, +@@ -467,7 +467,7 @@ static const struct ov08d10_reg lane_2_m + {0xaa, 0xd0}, + {0xab, 0x06}, + {0xac, 0x68}, +- {0xa1, 0x09}, ++ {0xa1, 0x04}, + {0xa2, 0x04}, + {0xa3, 0xc8}, + {0xa5, 0x04}, +@@ -613,8 +613,8 @@ static const struct ov08d10_lane_cfg lan + static u32 ov08d10_get_format_code(struct ov08d10 *ov08d10) + { + static const u32 codes[2][2] = { +- { MEDIA_BUS_FMT_SGRBG10_1X10, MEDIA_BUS_FMT_SRGGB10_1X10}, +- { MEDIA_BUS_FMT_SBGGR10_1X10, MEDIA_BUS_FMT_SGBRG10_1X10}, ++ { MEDIA_BUS_FMT_SBGGR10_1X10, MEDIA_BUS_FMT_SGBRG10_1X10 }, ++ { MEDIA_BUS_FMT_SGRBG10_1X10, MEDIA_BUS_FMT_SRGGB10_1X10 }, + }; + + return codes[ov08d10->vflip->val][ov08d10->hflip->val]; diff --git a/queue-7.0/media-i2c-ov08d10-fix-runtime-pm-handling-in-probe.patch b/queue-7.0/media-i2c-ov08d10-fix-runtime-pm-handling-in-probe.patch new file mode 100644 index 0000000000..0839d1a9e4 --- /dev/null +++ b/queue-7.0/media-i2c-ov08d10-fix-runtime-pm-handling-in-probe.patch @@ -0,0 +1,58 @@ +From 35c7046be2be5e60be8128facb359a47f39e99cd Mon Sep 17 00:00:00 2001 +From: Matthias Fend +Date: Tue, 24 Mar 2026 11:41:35 +0100 +Subject: media: i2c: ov08d10: fix runtime PM handling in probe + +From: Matthias Fend + +commit 35c7046be2be5e60be8128facb359a47f39e99cd upstream. + +Set the device's runtime PM status and enable runtime PM before registering +the async sub-device. This is needed to avoid the case where the device is +runtime PM resumed while runtime PM has not been enabled yet. + +Remove the related, non-driver-specific comment while at it. + +Fixes: 7be91e02ed57 ("media: i2c: Add ov08d10 camera sensor driver") +Cc: stable@vger.kernel.org +Reviewed-by: Philipp Zabel +Signed-off-by: Matthias Fend +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/ov08d10.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/media/i2c/ov08d10.c ++++ b/drivers/media/i2c/ov08d10.c +@@ -1430,6 +1430,9 @@ static int ov08d10_probe(struct i2c_clie + goto probe_error_v4l2_ctrl_handler_free; + } + ++ pm_runtime_set_active(ov08d10->dev); ++ pm_runtime_enable(ov08d10->dev); ++ + ret = v4l2_async_register_subdev_sensor(&ov08d10->sd); + if (ret < 0) { + dev_err(ov08d10->dev, "failed to register V4L2 subdev: %d", +@@ -1437,17 +1440,13 @@ static int ov08d10_probe(struct i2c_clie + goto probe_error_media_entity_cleanup; + } + +- /* +- * Device is already turned on by i2c-core with ACPI domain PM. +- * Enable runtime PM and turn off the device. +- */ +- pm_runtime_set_active(ov08d10->dev); +- pm_runtime_enable(ov08d10->dev); + pm_runtime_idle(ov08d10->dev); + + return 0; + + probe_error_media_entity_cleanup: ++ pm_runtime_disable(ov08d10->dev); ++ pm_runtime_set_suspended(ov08d10->dev); + media_entity_cleanup(&ov08d10->sd.entity); + + probe_error_v4l2_ctrl_handler_free: diff --git a/queue-7.0/media-iris-fix-dma_free_attrs-size-in-iris_hfi_queues_init.patch b/queue-7.0/media-iris-fix-dma_free_attrs-size-in-iris_hfi_queues_init.patch new file mode 100644 index 0000000000..c6a4641595 --- /dev/null +++ b/queue-7.0/media-iris-fix-dma_free_attrs-size-in-iris_hfi_queues_init.patch @@ -0,0 +1,36 @@ +From 4a49ae56b0e4268d48fd96babe0cc68596bc301a Mon Sep 17 00:00:00 2001 +From: Thomas Fourier +Date: Fri, 13 Feb 2026 10:13:27 +0100 +Subject: media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() + +From: Thomas Fourier + +commit 4a49ae56b0e4268d48fd96babe0cc68596bc301a upstream. + +The core->iface_q_table_vaddr buffer is alloc'd with size queue_size +but freed with sizeof(*q_tbl_hdr) which is different. + +Change the dma_free_attrs() size. + +Signed-off-by: Thomas Fourier +Reviewed-by: Dikshita Agarwal +Fixes: d7378f84e94e ("media: iris: introduce iris core state management with shared queues") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/qcom/iris/iris_hfi_queue.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_queue.c +@@ -263,7 +263,7 @@ int iris_hfi_queues_init(struct iris_cor + GFP_KERNEL, DMA_ATTR_WRITE_COMBINE); + if (!core->sfr_vaddr) { + dev_err(core->dev, "sfr alloc and map failed\n"); +- dma_free_attrs(core->dev, sizeof(*q_tbl_hdr), core->iface_q_table_vaddr, ++ dma_free_attrs(core->dev, queue_size, core->iface_q_table_vaddr, + core->iface_q_table_daddr, DMA_ATTR_WRITE_COMBINE); + return -ENOMEM; + } diff --git a/queue-7.0/media-iris-fix-qcom_mdt_loader-dependency.patch b/queue-7.0/media-iris-fix-qcom_mdt_loader-dependency.patch new file mode 100644 index 0000000000..988a8c029d --- /dev/null +++ b/queue-7.0/media-iris-fix-qcom_mdt_loader-dependency.patch @@ -0,0 +1,43 @@ +From a297c5165f91366cbc3490e630aabd1c0f70efb8 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 5 Feb 2026 15:56:19 +0100 +Subject: media: iris: fix QCOM_MDT_LOADER dependency + +From: Arnd Bergmann + +commit a297c5165f91366cbc3490e630aabd1c0f70efb8 upstream. + +When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_IRIS=y, +the kernel fails to link: + +x86_64-linux-ld: drivers/media/platform/qcom/iris/iris_firmware.o: in function `iris_fw_load': +iris_firmware.c:(.text+0xb0): undefined reference to `qcom_mdt_get_size' +iris_firmware.c:(.text+0xfd): undefined reference to `qcom_mdt_load' + +The problem is the conditional 'select' statement. Change this to +make the driver built-in here regardless of CONFIG_ARCH_QCOM. + +Signed-off-by: Arnd Bergmann +Reviewed-by: Konrad Dybcio +Reviewed-by: Dikshita Agarwal +Reviewed-by: Bryan O'Donoghue +Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/qcom/iris/Kconfig ++++ b/drivers/media/platform/qcom/iris/Kconfig +@@ -3,7 +3,7 @@ config VIDEO_QCOM_IRIS + depends on VIDEO_DEV + depends on ARCH_QCOM || COMPILE_TEST + select V4L2_MEM2MEM_DEV +- select QCOM_MDT_LOADER if ARCH_QCOM ++ select QCOM_MDT_LOADER + select QCOM_SCM + select VIDEOBUF2_DMA_CONTIG + help diff --git a/queue-7.0/media-iris-fix-use-after-free-in-iris_release_internal_buffers.patch b/queue-7.0/media-iris-fix-use-after-free-in-iris_release_internal_buffers.patch new file mode 100644 index 0000000000..e28e5596e0 --- /dev/null +++ b/queue-7.0/media-iris-fix-use-after-free-in-iris_release_internal_buffers.patch @@ -0,0 +1,49 @@ +From f27cfdcfc916bb59297825805f4c3499f89f9e76 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Mon, 16 Feb 2026 12:37:42 +0530 +Subject: media: iris: Fix use-after-free in iris_release_internal_buffers() + +From: Dikshita Agarwal + +commit f27cfdcfc916bb59297825805f4c3499f89f9e76 upstream. + +The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy +internal buffers after FW releases") introduced a regression where +session_release_buf() may free the buffer. The caller, +iris_release_internal_buffers(), continued to access `buffer` after the +call, leading to a potential use-after-free. + +Fix this by setting BUF_ATTR_PENDING_RELEASE before calling +session_release_buf(), and reverting the flag if the call fails. This +ensures no dereference occurs after potential freeing. + +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/lkml/aYXvKAX3Pg3sL37P@stanley.mountain/#r +Signed-off-by: Dikshita Agarwal +Reviewed-by: Vikash Garodia +Fixes: 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_buffer.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/media/platform/qcom/iris/iris_buffer.c ++++ b/drivers/media/platform/qcom/iris/iris_buffer.c +@@ -582,10 +582,12 @@ static int iris_release_internal_buffers + continue; + if (!(buffer->attr & BUF_ATTR_QUEUED)) + continue; ++ buffer->attr |= BUF_ATTR_PENDING_RELEASE; + ret = hfi_ops->session_release_buf(inst, buffer); +- if (ret) ++ if (ret) { ++ buffer->attr &= ~BUF_ATTR_PENDING_RELEASE; + return ret; +- buffer->attr |= BUF_ATTR_PENDING_RELEASE; ++ } + } + + return 0; diff --git a/queue-7.0/media-iris-fix-use-after-free-of-fmt_src-during-mbpf-check.patch b/queue-7.0/media-iris-fix-use-after-free-of-fmt_src-during-mbpf-check.patch new file mode 100644 index 0000000000..85e3503d80 --- /dev/null +++ b/queue-7.0/media-iris-fix-use-after-free-of-fmt_src-during-mbpf-check.patch @@ -0,0 +1,118 @@ +From 3d9593ad1a58c5acc3e5fa2a48222bb7632e6812 Mon Sep 17 00:00:00 2001 +From: Vishnu Reddy +Date: Thu, 5 Mar 2026 18:58:31 +0530 +Subject: media: iris: fix use-after-free of fmt_src during MBPF check + +From: Vishnu Reddy + +commit 3d9593ad1a58c5acc3e5fa2a48222bb7632e6812 upstream. + +During concurrency testing, multiple instances can run in parallel, and +each instance uses its own inst->lock while the core->lock protects the +list of active instances. The race happens because these locks cover +different scopes, inst->lock protects only the internals of a single +instance, while the Macro Blocks Per Frame (MBPF) checker walks the +core list under core->lock and reads fields like fmt_src->width and +fmt_src->height. At the same time, iris_close() may free fmt_src and +fmt_dst under inst->lock while the instance is still present in the core +list. This allows a situation where the MBPF checker, still iterating +through the core list, reaches an instance whose fmt_src was already +freed by another thread and ends up dereferencing a dangling pointer, +resulting in a use-after-free. This happens because the MBPF checker +assumes that any instance in the core list is fully valid, but the +freeing of fmt_src and fmt_dst without removing the instance from the +core list is not correct. + +The correct ordering is to defer freeing fmt_src and fmt_dst until after +the instance has been removed from the core list and all teardown under +the core lock has completed, ensuring that no dangling pointers are ever +exposed during MBPF checks. + +Reviewed-by: Vikash Garodia +Signed-off-by: Vishnu Reddy +Reviewed-by: Dikshita Agarwal +Fixes: 5ad964ad5656 ("media: iris: Initialize and deinitialize encoder instance structure") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_vdec.c | 6 ------ + drivers/media/platform/qcom/iris/iris_vdec.h | 1 - + drivers/media/platform/qcom/iris/iris_venc.c | 6 ------ + drivers/media/platform/qcom/iris/iris_venc.h | 1 - + drivers/media/platform/qcom/iris/iris_vidc.c | 6 ++---- + 5 files changed, 2 insertions(+), 18 deletions(-) + +--- a/drivers/media/platform/qcom/iris/iris_vdec.c ++++ b/drivers/media/platform/qcom/iris/iris_vdec.c +@@ -61,12 +61,6 @@ int iris_vdec_inst_init(struct iris_inst + return iris_ctrls_init(inst); + } + +-void iris_vdec_inst_deinit(struct iris_inst *inst) +-{ +- kfree(inst->fmt_dst); +- kfree(inst->fmt_src); +-} +- + static const struct iris_fmt iris_vdec_formats_cap[] = { + [IRIS_FMT_NV12] = { + .pixfmt = V4L2_PIX_FMT_NV12, +--- a/drivers/media/platform/qcom/iris/iris_vdec.h ++++ b/drivers/media/platform/qcom/iris/iris_vdec.h +@@ -9,7 +9,6 @@ + struct iris_inst; + + int iris_vdec_inst_init(struct iris_inst *inst); +-void iris_vdec_inst_deinit(struct iris_inst *inst); + int iris_vdec_enum_fmt(struct iris_inst *inst, struct v4l2_fmtdesc *f); + int iris_vdec_try_fmt(struct iris_inst *inst, struct v4l2_format *f); + int iris_vdec_s_fmt(struct iris_inst *inst, struct v4l2_format *f); +--- a/drivers/media/platform/qcom/iris/iris_venc.c ++++ b/drivers/media/platform/qcom/iris/iris_venc.c +@@ -79,12 +79,6 @@ int iris_venc_inst_init(struct iris_inst + return iris_ctrls_init(inst); + } + +-void iris_venc_inst_deinit(struct iris_inst *inst) +-{ +- kfree(inst->fmt_dst); +- kfree(inst->fmt_src); +-} +- + static const struct iris_fmt iris_venc_formats_cap[] = { + [IRIS_FMT_H264] = { + .pixfmt = V4L2_PIX_FMT_H264, +--- a/drivers/media/platform/qcom/iris/iris_venc.h ++++ b/drivers/media/platform/qcom/iris/iris_venc.h +@@ -9,7 +9,6 @@ + struct iris_inst; + + int iris_venc_inst_init(struct iris_inst *inst); +-void iris_venc_inst_deinit(struct iris_inst *inst); + int iris_venc_enum_fmt(struct iris_inst *inst, struct v4l2_fmtdesc *f); + int iris_venc_try_fmt(struct iris_inst *inst, struct v4l2_format *f); + int iris_venc_s_fmt(struct iris_inst *inst, struct v4l2_format *f); +--- a/drivers/media/platform/qcom/iris/iris_vidc.c ++++ b/drivers/media/platform/qcom/iris/iris_vidc.c +@@ -289,10 +289,6 @@ int iris_close(struct file *filp) + v4l2_m2m_ctx_release(inst->m2m_ctx); + v4l2_m2m_release(inst->m2m_dev); + mutex_lock(&inst->lock); +- if (inst->domain == DECODER) +- iris_vdec_inst_deinit(inst); +- else if (inst->domain == ENCODER) +- iris_venc_inst_deinit(inst); + iris_session_close(inst); + iris_inst_change_state(inst, IRIS_INST_DEINIT); + iris_v4l2_fh_deinit(inst, filp); +@@ -304,6 +300,8 @@ int iris_close(struct file *filp) + mutex_unlock(&inst->lock); + mutex_destroy(&inst->ctx_q_lock); + mutex_destroy(&inst->lock); ++ kfree(inst->fmt_src); ++ kfree(inst->fmt_dst); + kfree(inst); + + return 0; diff --git a/queue-7.0/media-iris-switch-to-hardware-mode-after-firmware-boot.patch b/queue-7.0/media-iris-switch-to-hardware-mode-after-firmware-boot.patch new file mode 100644 index 0000000000..22b6485076 --- /dev/null +++ b/queue-7.0/media-iris-switch-to-hardware-mode-after-firmware-boot.patch @@ -0,0 +1,220 @@ +From 95a337f92f0a602d4f935315bfbc8bf07f475e65 Mon Sep 17 00:00:00 2001 +From: Vikash Garodia +Date: Fri, 13 Mar 2026 18:49:36 +0530 +Subject: media: iris: switch to hardware mode after firmware boot + +From: Vikash Garodia + +commit 95a337f92f0a602d4f935315bfbc8bf07f475e65 upstream. + +Currently the driver switches the vcodec GDSC to hardware (HW) mode +before firmware load and boot sequence. GDSC can be powered off, keeping +in hw mode, thereby the vcodec registers programmed in TrustZone (TZ) +carry default (reset) values. +Move the transition to HW mode after firmware load and boot sequence. + +The bug was exposed with driver configuring different stream ids to +different devices via iommu-map. With registers carrying reset values, +VPU would not generate desired stream-id, thereby leading to SMMU fault. + +For vpu4, when GDSC is switched to HW mode, there is a need to perform +the reset operation. Without reset, there are occasional issues of +register corruption observed. Hence the vpu GDSC switch also involves +the reset. + +Co-developed-by: Vishnu Reddy +Signed-off-by: Vishnu Reddy +Signed-off-by: Vikash Garodia +Reviewed-by: Dikshita Agarwal +Reviewed-by: Dmitry Baryshkov +[bod: occassional => occasional] +Fixes: dde659d37036 ("media: iris: Introduce vpu ops for vpu4 with necessary hooks") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_core.c | 4 +++ + drivers/media/platform/qcom/iris/iris_hfi_common.c | 4 +++ + drivers/media/platform/qcom/iris/iris_vpu2.c | 1 + drivers/media/platform/qcom/iris/iris_vpu3x.c | 9 ++----- + drivers/media/platform/qcom/iris/iris_vpu4x.c | 24 +++++++++++---------- + drivers/media/platform/qcom/iris/iris_vpu_common.c | 16 ++++++++------ + drivers/media/platform/qcom/iris/iris_vpu_common.h | 3 ++ + 7 files changed, 38 insertions(+), 23 deletions(-) + +--- a/drivers/media/platform/qcom/iris/iris_core.c ++++ b/drivers/media/platform/qcom/iris/iris_core.c +@@ -75,6 +75,10 @@ int iris_core_init(struct iris_core *cor + if (ret) + goto error_unload_fw; + ++ ret = iris_vpu_switch_to_hwmode(core); ++ if (ret) ++ goto error_unload_fw; ++ + ret = iris_hfi_core_init(core); + if (ret) + goto error_unload_fw; +--- a/drivers/media/platform/qcom/iris/iris_hfi_common.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_common.c +@@ -159,6 +159,10 @@ int iris_hfi_pm_resume(struct iris_core + if (ret) + goto err_suspend_hw; + ++ ret = iris_vpu_switch_to_hwmode(core); ++ if (ret) ++ goto err_suspend_hw; ++ + ret = ops->sys_interframe_powercollapse(core); + if (ret) + goto err_suspend_hw; +--- a/drivers/media/platform/qcom/iris/iris_vpu2.c ++++ b/drivers/media/platform/qcom/iris/iris_vpu2.c +@@ -44,4 +44,5 @@ const struct vpu_ops iris_vpu2_ops = { + .power_off_controller = iris_vpu_power_off_controller, + .power_on_controller = iris_vpu_power_on_controller, + .calc_freq = iris_vpu2_calc_freq, ++ .set_hwmode = iris_vpu_set_hwmode, + }; +--- a/drivers/media/platform/qcom/iris/iris_vpu3x.c ++++ b/drivers/media/platform/qcom/iris/iris_vpu3x.c +@@ -234,14 +234,8 @@ static int iris_vpu35_power_on_hw(struct + if (ret) + goto err_disable_hw_free_clk; + +- ret = dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN], true); +- if (ret) +- goto err_disable_hw_clk; +- + return 0; + +-err_disable_hw_clk: +- iris_disable_unprepare_clock(core, IRIS_HW_CLK); + err_disable_hw_free_clk: + iris_disable_unprepare_clock(core, IRIS_HW_FREERUN_CLK); + err_disable_axi_clk: +@@ -266,6 +260,7 @@ const struct vpu_ops iris_vpu3_ops = { + .power_off_controller = iris_vpu_power_off_controller, + .power_on_controller = iris_vpu_power_on_controller, + .calc_freq = iris_vpu3x_vpu4x_calculate_frequency, ++ .set_hwmode = iris_vpu_set_hwmode, + }; + + const struct vpu_ops iris_vpu33_ops = { +@@ -274,6 +269,7 @@ const struct vpu_ops iris_vpu33_ops = { + .power_off_controller = iris_vpu33_power_off_controller, + .power_on_controller = iris_vpu_power_on_controller, + .calc_freq = iris_vpu3x_vpu4x_calculate_frequency, ++ .set_hwmode = iris_vpu_set_hwmode, + }; + + const struct vpu_ops iris_vpu35_ops = { +@@ -283,4 +279,5 @@ const struct vpu_ops iris_vpu35_ops = { + .power_on_controller = iris_vpu35_vpu4x_power_on_controller, + .program_bootup_registers = iris_vpu35_vpu4x_program_bootup_registers, + .calc_freq = iris_vpu3x_vpu4x_calculate_frequency, ++ .set_hwmode = iris_vpu_set_hwmode, + }; +--- a/drivers/media/platform/qcom/iris/iris_vpu4x.c ++++ b/drivers/media/platform/qcom/iris/iris_vpu4x.c +@@ -252,21 +252,10 @@ static int iris_vpu4x_power_on_hardware( + ret = iris_vpu4x_power_on_apv(core); + if (ret) + goto disable_hw_clocks; +- +- iris_vpu4x_ahb_sync_reset_apv(core); + } + +- iris_vpu4x_ahb_sync_reset_hardware(core); +- +- ret = iris_vpu4x_genpd_set_hwmode(core, true, efuse_value); +- if (ret) +- goto disable_apv_power_domain; +- + return 0; + +-disable_apv_power_domain: +- if (!(efuse_value & DISABLE_VIDEO_APV_BIT)) +- iris_vpu4x_power_off_apv(core); + disable_hw_clocks: + iris_vpu4x_disable_hardware_clocks(core, efuse_value); + disable_vpp1_power_domain: +@@ -359,6 +348,18 @@ disable_clocks_and_power: + iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN]); + } + ++static int iris_vpu4x_set_hwmode(struct iris_core *core) ++{ ++ u32 efuse_value = readl(core->reg_base + WRAPPER_EFUSE_MONITOR); ++ ++ if (!(efuse_value & DISABLE_VIDEO_APV_BIT)) ++ iris_vpu4x_ahb_sync_reset_apv(core); ++ ++ iris_vpu4x_ahb_sync_reset_hardware(core); ++ ++ return iris_vpu4x_genpd_set_hwmode(core, true, efuse_value); ++} ++ + const struct vpu_ops iris_vpu4x_ops = { + .power_off_hw = iris_vpu4x_power_off_hardware, + .power_on_hw = iris_vpu4x_power_on_hardware, +@@ -366,4 +367,5 @@ const struct vpu_ops iris_vpu4x_ops = { + .power_on_controller = iris_vpu35_vpu4x_power_on_controller, + .program_bootup_registers = iris_vpu35_vpu4x_program_bootup_registers, + .calc_freq = iris_vpu3x_vpu4x_calculate_frequency, ++ .set_hwmode = iris_vpu4x_set_hwmode, + }; +--- a/drivers/media/platform/qcom/iris/iris_vpu_common.c ++++ b/drivers/media/platform/qcom/iris/iris_vpu_common.c +@@ -292,14 +292,8 @@ int iris_vpu_power_on_hw(struct iris_cor + if (ret && ret != -ENOENT) + goto err_disable_hw_clock; + +- ret = dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN], true); +- if (ret) +- goto err_disable_hw_ahb_clock; +- + return 0; + +-err_disable_hw_ahb_clock: +- iris_disable_unprepare_clock(core, IRIS_HW_AHB_CLK); + err_disable_hw_clock: + iris_disable_unprepare_clock(core, IRIS_HW_CLK); + err_disable_power: +@@ -308,6 +302,16 @@ err_disable_power: + return ret; + } + ++int iris_vpu_set_hwmode(struct iris_core *core) ++{ ++ return dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN], true); ++} ++ ++int iris_vpu_switch_to_hwmode(struct iris_core *core) ++{ ++ return core->iris_platform_data->vpu_ops->set_hwmode(core); ++} ++ + int iris_vpu35_vpu4x_power_off_controller(struct iris_core *core) + { + u32 clk_rst_tbl_size = core->iris_platform_data->clk_rst_tbl_size; +--- a/drivers/media/platform/qcom/iris/iris_vpu_common.h ++++ b/drivers/media/platform/qcom/iris/iris_vpu_common.h +@@ -21,6 +21,7 @@ struct vpu_ops { + int (*power_on_controller)(struct iris_core *core); + void (*program_bootup_registers)(struct iris_core *core); + u64 (*calc_freq)(struct iris_inst *inst, size_t data_size); ++ int (*set_hwmode)(struct iris_core *core); + }; + + int iris_vpu_boot_firmware(struct iris_core *core); +@@ -30,6 +31,8 @@ int iris_vpu_watchdog(struct iris_core * + int iris_vpu_prepare_pc(struct iris_core *core); + int iris_vpu_power_on_controller(struct iris_core *core); + int iris_vpu_power_on_hw(struct iris_core *core); ++int iris_vpu_set_hwmode(struct iris_core *core); ++int iris_vpu_switch_to_hwmode(struct iris_core *core); + int iris_vpu_power_on(struct iris_core *core); + int iris_vpu_power_off_controller(struct iris_core *core); + void iris_vpu_power_off_hw(struct iris_core *core); diff --git a/queue-7.0/media-omap3isp-drop-the-use-count-of-v4l2-pipeline.patch b/queue-7.0/media-omap3isp-drop-the-use-count-of-v4l2-pipeline.patch new file mode 100644 index 0000000000..5610eaa7df --- /dev/null +++ b/queue-7.0/media-omap3isp-drop-the-use-count-of-v4l2-pipeline.patch @@ -0,0 +1,32 @@ +From 9da49bd9d4224035cff39b40d7395310abb10201 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Mon, 26 Jan 2026 09:44:12 +0800 +Subject: media: omap3isp: drop the use count of v4l2 pipeline + +From: Haoxiang Li + +commit 9da49bd9d4224035cff39b40d7395310abb10201 upstream. + +In isp_video_open(), drop the use count of v4l2 +pipeline if vb2_queue_init() fails. + +Fixes: 8fd390b89cc8 ("media: Split v4l2_pipeline_pm_use into v4l2_pipeline_pm_{get, put}") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/ti/omap3isp/ispvideo.c ++++ b/drivers/media/platform/ti/omap3isp/ispvideo.c +@@ -1403,6 +1403,7 @@ static int isp_video_open(struct file *f + + ret = vb2_queue_init(&handle->queue); + if (ret < 0) { ++ v4l2_pipeline_pm_put(&video->video.entity); + omap3isp_put(video->isp); + goto done; + } diff --git a/queue-7.0/media-pci-zoran-fix-potential-memory-leak-in-zoran_probe.patch b/queue-7.0/media-pci-zoran-fix-potential-memory-leak-in-zoran_probe.patch new file mode 100644 index 0000000000..be39cd5ff5 --- /dev/null +++ b/queue-7.0/media-pci-zoran-fix-potential-memory-leak-in-zoran_probe.patch @@ -0,0 +1,33 @@ +From 8ea21435fe36fb853706f4935d78bc11beb63fb4 Mon Sep 17 00:00:00 2001 +From: Abdun Nihaal +Date: Thu, 12 Mar 2026 18:02:56 +0530 +Subject: media: pci: zoran: fix potential memory leak in zoran_probe() + +From: Abdun Nihaal + +commit 8ea21435fe36fb853706f4935d78bc11beb63fb4 upstream. + +The memory allocated for codec in videocodec_attach() is not freed in +one of the error paths, due to an incorrect goto label. Fix the label +to free it on error. + +Fixes: 8f7cc5c0b0eb ("media: staging: media: zoran: introduce zoran_i2c_init") +Cc: stable@vger.kernel.org +Signed-off-by: Abdun Nihaal +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/zoran/zoran_card.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/pci/zoran/zoran_card.c ++++ b/drivers/media/pci/zoran/zoran_card.c +@@ -1373,7 +1373,7 @@ static int zoran_probe(struct pci_dev *p + } + if (zr->codec->type != zr->card.video_codec) { + pci_err(pdev, "%s - wrong codec\n", __func__); +- goto zr_unreg_videocodec; ++ goto zr_detach_codec; + } + } + if (zr->card.video_vfe != 0) { diff --git a/queue-7.0/media-qcom-camss-add-missing-clocks-for-vfe-lite-on-sa8775p.patch b/queue-7.0/media-qcom-camss-add-missing-clocks-for-vfe-lite-on-sa8775p.patch new file mode 100644 index 0000000000..2b97e007b6 --- /dev/null +++ b/queue-7.0/media-qcom-camss-add-missing-clocks-for-vfe-lite-on-sa8775p.patch @@ -0,0 +1,131 @@ +From d31fac47b39f5e1ed85a587688ca70b793e421b4 Mon Sep 17 00:00:00 2001 +From: Wenmeng Liu +Date: Fri, 13 Mar 2026 18:13:04 +0800 +Subject: media: qcom: camss: Add missing clocks for VFE lite on sa8775p + +From: Wenmeng Liu + +commit d31fac47b39f5e1ed85a587688ca70b793e421b4 upstream. + +Add missing required clocks (cpas_ahb and camnoc_axi) for VFE lite +instances on sa8775p platform. These clocks are necessary for proper +VFE lite operation: + +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Wenmeng Liu +Fixes: e7b59e1d06fb ("media: qcom: camss: Add support for VFE 690") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/camss/camss.c | 40 ++++++++++++++++++------------ + 1 file changed, 25 insertions(+), 15 deletions(-) + +--- a/drivers/media/platform/qcom/camss/camss.c ++++ b/drivers/media/platform/qcom/camss/camss.c +@@ -3742,15 +3742,17 @@ static const struct camss_subdev_resourc + /* VFE2 (lite) */ + { + .regulators = {}, +- .clock = { "cpas_vfe_lite", "vfe_lite_ahb", ++ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb", + "vfe_lite_csid", "vfe_lite_cphy_rx", +- "vfe_lite"}, ++ "vfe_lite", "camnoc_axi"}, + .clock_rate = { +- { 0, 0, 0, 0 }, ++ { 0 }, ++ { 0 }, + { 300000000, 400000000, 400000000, 400000000 }, + { 400000000, 400000000, 400000000, 400000000 }, + { 400000000, 400000000, 400000000, 400000000 }, + { 480000000, 600000000, 600000000, 600000000 }, ++ { 400000000 }, + }, + .reg = { "vfe_lite0" }, + .interrupt = { "vfe_lite0" }, +@@ -3765,15 +3767,17 @@ static const struct camss_subdev_resourc + /* VFE3 (lite) */ + { + .regulators = {}, +- .clock = { "cpas_vfe_lite", "vfe_lite_ahb", ++ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb", + "vfe_lite_csid", "vfe_lite_cphy_rx", +- "vfe_lite"}, ++ "vfe_lite", "camnoc_axi"}, + .clock_rate = { +- { 0, 0, 0, 0 }, ++ { 0 }, ++ { 0 }, + { 300000000, 400000000, 400000000, 400000000 }, + { 400000000, 400000000, 400000000, 400000000 }, + { 400000000, 400000000, 400000000, 400000000 }, + { 480000000, 600000000, 600000000, 600000000 }, ++ { 400000000 }, + }, + .reg = { "vfe_lite1" }, + .interrupt = { "vfe_lite1" }, +@@ -3788,15 +3792,17 @@ static const struct camss_subdev_resourc + /* VFE4 (lite) */ + { + .regulators = {}, +- .clock = { "cpas_vfe_lite", "vfe_lite_ahb", ++ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb", + "vfe_lite_csid", "vfe_lite_cphy_rx", +- "vfe_lite"}, ++ "vfe_lite", "camnoc_axi"}, + .clock_rate = { +- { 0, 0, 0, 0 }, ++ { 0 }, ++ { 0 }, + { 300000000, 400000000, 400000000, 400000000 }, + { 400000000, 400000000, 400000000, 400000000 }, + { 400000000, 400000000, 400000000, 400000000 }, + { 480000000, 600000000, 600000000, 600000000 }, ++ { 400000000 }, + }, + .reg = { "vfe_lite2" }, + .interrupt = { "vfe_lite2" }, +@@ -3811,15 +3817,17 @@ static const struct camss_subdev_resourc + /* VFE5 (lite) */ + { + .regulators = {}, +- .clock = { "cpas_vfe_lite", "vfe_lite_ahb", ++ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb", + "vfe_lite_csid", "vfe_lite_cphy_rx", +- "vfe_lite"}, ++ "vfe_lite", "camnoc_axi"}, + .clock_rate = { +- { 0, 0, 0, 0 }, ++ { 0 }, ++ { 0 }, + { 300000000, 400000000, 400000000, 400000000 }, + { 400000000, 400000000, 400000000, 400000000 }, + { 400000000, 400000000, 400000000, 400000000 }, + { 480000000, 600000000, 600000000, 600000000 }, ++ { 400000000 }, + }, + .reg = { "vfe_lite3" }, + .interrupt = { "vfe_lite3" }, +@@ -3834,15 +3842,17 @@ static const struct camss_subdev_resourc + /* VFE6 (lite) */ + { + .regulators = {}, +- .clock = { "cpas_vfe_lite", "vfe_lite_ahb", ++ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb", + "vfe_lite_csid", "vfe_lite_cphy_rx", +- "vfe_lite"}, ++ "vfe_lite", "camnoc_axi"}, + .clock_rate = { +- { 0, 0, 0, 0 }, ++ { 0 }, ++ { 0 }, + { 300000000, 400000000, 400000000, 400000000 }, + { 400000000, 400000000, 400000000, 400000000 }, + { 400000000, 400000000, 400000000, 400000000 }, + { 480000000, 600000000, 600000000, 600000000 }, ++ { 400000000 }, + }, + .reg = { "vfe_lite4" }, + .interrupt = { "vfe_lite4" }, diff --git a/queue-7.0/media-qcom-camss-fix-csid-clock-configuration-for-sa8775p.patch b/queue-7.0/media-qcom-camss-fix-csid-clock-configuration-for-sa8775p.patch new file mode 100644 index 0000000000..8b3642a784 --- /dev/null +++ b/queue-7.0/media-qcom-camss-fix-csid-clock-configuration-for-sa8775p.patch @@ -0,0 +1,111 @@ +From fe56c674118aa46da1a3e65aa22ca709ebd7d812 Mon Sep 17 00:00:00 2001 +From: Wenmeng Liu +Date: Fri, 13 Mar 2026 18:13:03 +0800 +Subject: media: qcom: camss: Fix csid clock configuration for sa8775p + +From: Wenmeng Liu + +commit fe56c674118aa46da1a3e65aa22ca709ebd7d812 upstream. + +Fix the mismatch between clock list and clock rate table for CSID lite +instances. The current implementation has 5 clocks defined but only 2 +are actually needed (vfe_lite_csid and vfe_lite_cphy_rx), while the +clock rate table doesn't match this configuration. + +Update both clock list and rate table to maintain consistency: +- Remove unused clocks: cpas_vfe_lite, vfe_lite_ahb, vfe_lite +- Update clock rate table to match the remaining two clocks + +Signed-off-by: Wenmeng Liu +Reviewed-by: Bryan O'Donoghue +Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/camss/camss.c | 40 +++++++++++------------------- + 1 file changed, 15 insertions(+), 25 deletions(-) + +--- a/drivers/media/platform/qcom/camss/camss.c ++++ b/drivers/media/platform/qcom/camss/camss.c +@@ -3598,12 +3598,10 @@ static const struct camss_subdev_resourc + /* CSID2 (lite) */ + { + .regulators = {}, +- .clock = { "cpas_vfe_lite", "vfe_lite_ahb", +- "vfe_lite_csid", "vfe_lite_cphy_rx", +- "vfe_lite"}, ++ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" }, + .clock_rate = { +- { 0, 0, 400000000, 400000000, 0}, +- { 0, 0, 400000000, 480000000, 0} ++ { 400000000, 480000000 }, ++ { 400000000, 480000000 } + }, + .reg = { "csid_lite0" }, + .interrupt = { "csid_lite0" }, +@@ -3617,12 +3615,10 @@ static const struct camss_subdev_resourc + /* CSID3 (lite) */ + { + .regulators = {}, +- .clock = { "cpas_vfe_lite", "vfe_lite_ahb", +- "vfe_lite_csid", "vfe_lite_cphy_rx", +- "vfe_lite"}, ++ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" }, + .clock_rate = { +- { 0, 0, 400000000, 400000000, 0}, +- { 0, 0, 400000000, 480000000, 0} ++ { 400000000, 480000000 }, ++ { 400000000, 480000000 } + }, + .reg = { "csid_lite1" }, + .interrupt = { "csid_lite1" }, +@@ -3636,12 +3632,10 @@ static const struct camss_subdev_resourc + /* CSID4 (lite) */ + { + .regulators = {}, +- .clock = { "cpas_vfe_lite", "vfe_lite_ahb", +- "vfe_lite_csid", "vfe_lite_cphy_rx", +- "vfe_lite"}, ++ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" }, + .clock_rate = { +- { 0, 0, 400000000, 400000000, 0}, +- { 0, 0, 400000000, 480000000, 0} ++ { 400000000, 480000000 }, ++ { 400000000, 480000000 } + }, + .reg = { "csid_lite2" }, + .interrupt = { "csid_lite2" }, +@@ -3655,12 +3649,10 @@ static const struct camss_subdev_resourc + /* CSID5 (lite) */ + { + .regulators = {}, +- .clock = { "cpas_vfe_lite", "vfe_lite_ahb", +- "vfe_lite_csid", "vfe_lite_cphy_rx", +- "vfe_lite"}, ++ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" }, + .clock_rate = { +- { 0, 0, 400000000, 400000000, 0}, +- { 0, 0, 400000000, 480000000, 0} ++ { 400000000, 480000000 }, ++ { 400000000, 480000000 } + }, + .reg = { "csid_lite3" }, + .interrupt = { "csid_lite3" }, +@@ -3674,12 +3666,10 @@ static const struct camss_subdev_resourc + /* CSID6 (lite) */ + { + .regulators = {}, +- .clock = { "cpas_vfe_lite", "vfe_lite_ahb", +- "vfe_lite_csid", "vfe_lite_cphy_rx", +- "vfe_lite"}, ++ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" }, + .clock_rate = { +- { 0, 0, 400000000, 400000000, 0}, +- { 0, 0, 400000000, 480000000, 0} ++ { 400000000, 480000000 }, ++ { 400000000, 480000000 } + }, + .reg = { "csid_lite4" }, + .interrupt = { "csid_lite4" }, diff --git a/queue-7.0/media-qcom-camss-fix-csid-irq-offset-for-sa8775p.patch b/queue-7.0/media-qcom-camss-fix-csid-irq-offset-for-sa8775p.patch new file mode 100644 index 0000000000..dbaa2bd254 --- /dev/null +++ b/queue-7.0/media-qcom-camss-fix-csid-irq-offset-for-sa8775p.patch @@ -0,0 +1,38 @@ +From dd1b373941079cc102cc18bc68884e18245f5912 Mon Sep 17 00:00:00 2001 +From: Wenmeng Liu +Date: Fri, 13 Mar 2026 18:13:02 +0800 +Subject: media: qcom: camss: Fix csid IRQ offset for sa8775p + +From: Wenmeng Liu + +commit dd1b373941079cc102cc18bc68884e18245f5912 upstream. + +Fix BUF_DONE_IRQ_STATUS_RDI_OFFSET calculation for csid lite on +sa8775p platform. The offset should be 0 for csid lite on sa8775p, + +Signed-off-by: Wenmeng Liu +Reviewed-by: Bryan O'Donoghue +Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/camss/camss-csid-gen3.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/media/platform/qcom/camss/camss-csid-gen3.c ++++ b/drivers/media/platform/qcom/camss/camss-csid-gen3.c +@@ -48,9 +48,9 @@ + #define IS_CSID_690(csid) ((csid->camss->res->version == CAMSS_8775P) \ + || (csid->camss->res->version == CAMSS_8300)) + #define CSID_BUF_DONE_IRQ_STATUS 0x8C +-#define BUF_DONE_IRQ_STATUS_RDI_OFFSET (csid_is_lite(csid) ?\ +- 1 : (IS_CSID_690(csid) ?\ +- 13 : 14)) ++#define BUF_DONE_IRQ_STATUS_RDI_OFFSET (csid_is_lite(csid) ? \ ++ ((IS_CSID_690(csid) ? 0 : 1)) : \ ++ ((IS_CSID_690(csid) ? 13 : 14))) + #define CSID_BUF_DONE_IRQ_MASK 0x90 + #define CSID_BUF_DONE_IRQ_CLEAR 0x94 + #define CSID_BUF_DONE_IRQ_SET 0x98 diff --git a/queue-7.0/media-qcom-iris-increase-h265d_max_slice-to-fix-h.265-decoding-on-sc7280.patch b/queue-7.0/media-qcom-iris-increase-h265d_max_slice-to-fix-h.265-decoding-on-sc7280.patch new file mode 100644 index 0000000000..53ac2d9a9c --- /dev/null +++ b/queue-7.0/media-qcom-iris-increase-h265d_max_slice-to-fix-h.265-decoding-on-sc7280.patch @@ -0,0 +1,39 @@ +From 3e0b2053751657ed2924adfe3ff25b1450231e33 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Fri, 27 Mar 2026 22:19:55 +0200 +Subject: media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 + +From: Dmitry Baryshkov + +commit 3e0b2053751657ed2924adfe3ff25b1450231e33 upstream. + +Follow the commit bfe1326573ff ("venus: Fix for H265 decoding failure.") +and increase H265D_MAX_SLICE following firmware requirements on that +platform. Otherwise decoding of the H.265 streams fails with the +"insufficient scratch_1 buffer size" from the firmware. + +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Dikshita Agarwal +Reviewed-by: Vikash Garodia +Reviewed-by: Konrad Dybcio +[bod: Fixed commit log withthe => with the] +Fixes: e1f5d32608ec ("media: iris: Add internal buffer calculation for HEVC and VP9 decoders") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_vpu_buffer.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/qcom/iris/iris_vpu_buffer.h ++++ b/drivers/media/platform/qcom/iris/iris_vpu_buffer.h +@@ -67,7 +67,7 @@ struct iris_inst; + #define SIZE_DOLBY_RPU_METADATA (41 * 1024) + #define H264_CABAC_HDR_RATIO_HD_TOT 1 + #define H264_CABAC_RES_RATIO_HD_TOT 3 +-#define H265D_MAX_SLICE 1200 ++#define H265D_MAX_SLICE 3600 + #define SIZE_H265D_HW_PIC_T SIZE_H264D_HW_PIC_T + #define H265_CABAC_HDR_RATIO_HD_TOT 2 + #define H265_CABAC_RES_RATIO_HD_TOT 2 diff --git a/queue-7.0/media-staging-imx-request-mbus_config-in-csi_start.patch b/queue-7.0/media-staging-imx-request-mbus_config-in-csi_start.patch new file mode 100644 index 0000000000..5342eadb33 --- /dev/null +++ b/queue-7.0/media-staging-imx-request-mbus_config-in-csi_start.patch @@ -0,0 +1,170 @@ +From 9df2aaa64890c0b6226057eb6fcb6352bd2df432 Mon Sep 17 00:00:00 2001 +From: Michael Tretter +Date: Fri, 7 Nov 2025 11:34:33 +0100 +Subject: media: staging: imx: request mbus_config in csi_start + +From: Michael Tretter + +commit 9df2aaa64890c0b6226057eb6fcb6352bd2df432 upstream. + +Request the upstream mbus_config in csi_start, which starts the stream, +instead of caching it in link_validate. + +This allows to get rid of the mbus_cfg field in the struct csi_priv and +avoids state in the driver. + +Fixes: 4a34ec8e470c ("[media] media: imx: Add CSI subdev driver") +Cc: stable@vger.kernel.org +Reviewed-by: Frank Li +Signed-off-by: Michael Tretter +Reviewed-by: Philipp Zabel +Signed-off-by: Frank Li +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/imx/imx-media-csi.c | 40 ++++++++++++++++++------------ + 1 file changed, 24 insertions(+), 16 deletions(-) + +--- a/drivers/staging/media/imx/imx-media-csi.c ++++ b/drivers/staging/media/imx/imx-media-csi.c +@@ -97,9 +97,6 @@ struct csi_priv { + /* the mipi virtual channel number at link validate */ + int vc_num; + +- /* media bus config of the upstream subdevice CSI is receiving from */ +- struct v4l2_mbus_config mbus_cfg; +- + spinlock_t irqlock; /* protect eof_irq handler */ + struct timer_list eof_timeout_timer; + int eof_irq; +@@ -403,7 +400,8 @@ static void csi_idmac_unsetup_vb2_buf(st + } + + /* init the SMFC IDMAC channel */ +-static int csi_idmac_setup_channel(struct csi_priv *priv) ++static int csi_idmac_setup_channel(struct csi_priv *priv, ++ struct v4l2_mbus_config *mbus_cfg) + { + struct imx_media_video_dev *vdev = priv->vdev; + const struct imx_media_pixfmt *incc; +@@ -432,7 +430,7 @@ static int csi_idmac_setup_channel(struc + image.phys0 = phys[0]; + image.phys1 = phys[1]; + +- passthrough = requires_passthrough(&priv->mbus_cfg, infmt, incc); ++ passthrough = requires_passthrough(mbus_cfg, infmt, incc); + passthrough_cycles = 1; + + /* +@@ -572,11 +570,12 @@ static void csi_idmac_unsetup(struct csi + csi_idmac_unsetup_vb2_buf(priv, state); + } + +-static int csi_idmac_setup(struct csi_priv *priv) ++static int csi_idmac_setup(struct csi_priv *priv, ++ struct v4l2_mbus_config *mbus_cfg) + { + int ret; + +- ret = csi_idmac_setup_channel(priv); ++ ret = csi_idmac_setup_channel(priv, mbus_cfg); + if (ret) + return ret; + +@@ -595,7 +594,8 @@ static int csi_idmac_setup(struct csi_pr + return 0; + } + +-static int csi_idmac_start(struct csi_priv *priv) ++static int csi_idmac_start(struct csi_priv *priv, ++ struct v4l2_mbus_config *mbus_cfg) + { + struct imx_media_video_dev *vdev = priv->vdev; + int ret; +@@ -619,7 +619,7 @@ static int csi_idmac_start(struct csi_pr + priv->last_eof = false; + priv->nfb4eof = false; + +- ret = csi_idmac_setup(priv); ++ ret = csi_idmac_setup(priv, mbus_cfg); + if (ret) { + v4l2_err(&priv->sd, "csi_idmac_setup failed: %d\n", ret); + goto out_free_dma_buf; +@@ -701,7 +701,8 @@ static void csi_idmac_stop(struct csi_pr + } + + /* Update the CSI whole sensor and active windows */ +-static int csi_setup(struct csi_priv *priv) ++static int csi_setup(struct csi_priv *priv, ++ struct v4l2_mbus_config *mbus_cfg) + { + struct v4l2_mbus_framefmt *infmt, *outfmt; + const struct imx_media_pixfmt *incc; +@@ -719,7 +720,7 @@ static int csi_setup(struct csi_priv *pr + * if cycles is set, we need to handle this over multiple cycles as + * generic/bayer data + */ +- if (is_parallel_bus(&priv->mbus_cfg) && incc->cycles) { ++ if (is_parallel_bus(mbus_cfg) && incc->cycles) { + if_fmt.width *= incc->cycles; + crop.width *= incc->cycles; + } +@@ -730,7 +731,7 @@ static int csi_setup(struct csi_priv *pr + priv->crop.width == 2 * priv->compose.width, + priv->crop.height == 2 * priv->compose.height); + +- ipu_csi_init_interface(priv->csi, &priv->mbus_cfg, &if_fmt, outfmt); ++ ipu_csi_init_interface(priv->csi, mbus_cfg, &if_fmt, outfmt); + + ipu_csi_set_dest(priv->csi, priv->dest); + +@@ -745,9 +746,17 @@ static int csi_setup(struct csi_priv *pr + + static int csi_start(struct csi_priv *priv) + { ++ struct v4l2_mbus_config mbus_cfg = { .type = 0 }; + struct v4l2_fract *input_fi, *output_fi; + int ret; + ++ ret = csi_get_upstream_mbus_config(priv, &mbus_cfg); ++ if (ret) { ++ v4l2_err(&priv->sd, ++ "failed to get upstream media bus configuration\n"); ++ return ret; ++ } ++ + input_fi = &priv->frame_interval[CSI_SINK_PAD]; + output_fi = &priv->frame_interval[priv->active_output_pad]; + +@@ -758,7 +767,7 @@ static int csi_start(struct csi_priv *pr + return ret; + + /* Skip first few frames from a BT.656 source */ +- if (priv->mbus_cfg.type == V4L2_MBUS_BT656) { ++ if (mbus_cfg.type == V4L2_MBUS_BT656) { + u32 delay_usec, bad_frames = 20; + + delay_usec = DIV_ROUND_UP_ULL((u64)USEC_PER_SEC * +@@ -769,12 +778,12 @@ static int csi_start(struct csi_priv *pr + } + + if (priv->dest == IPU_CSI_DEST_IDMAC) { +- ret = csi_idmac_start(priv); ++ ret = csi_idmac_start(priv, &mbus_cfg); + if (ret) + goto stop_upstream; + } + +- ret = csi_setup(priv); ++ ret = csi_setup(priv, &mbus_cfg); + if (ret) + goto idmac_stop; + +@@ -1138,7 +1147,6 @@ static int csi_link_validate(struct v4l2 + + mutex_lock(&priv->lock); + +- priv->mbus_cfg = mbus_cfg; + is_csi2 = !is_parallel_bus(&mbus_cfg); + if (is_csi2) { + /* diff --git a/queue-7.0/media-venus-fix-qcom_mdt_loader-dependency.patch b/queue-7.0/media-venus-fix-qcom_mdt_loader-dependency.patch new file mode 100644 index 0000000000..a3432687dd --- /dev/null +++ b/queue-7.0/media-venus-fix-qcom_mdt_loader-dependency.patch @@ -0,0 +1,44 @@ +From aa23c94cc433b145d1ce93820ecdfe16d8940e28 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 30 Mar 2026 12:08:21 +0100 +Subject: media: venus: fix QCOM_MDT_LOADER dependency + +From: Arnd Bergmann + +commit aa23c94cc433b145d1ce93820ecdfe16d8940e28 upstream. + +When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_VENUS=y, +the kernel fails to link: + +x86_64-linux-ld: drivers/media/platform/qcom/venus/firmware.o: in function `venus_boot': +firmware.c:(.text+0x1e3): undefined reference to `qcom_mdt_get_size' +firmware.c:(.text+0x25a): undefined reference to `qcom_mdt_load' +firmware.c:(.text+0x272): undefined reference to `qcom_mdt_load_no_init' + +The problem is the conditional 'select' statement. Change this to +make the driver built-in here regardless of CONFIG_ARCH_QCOM, +same as for the similar IRIS driver. + +Signed-off-by: Arnd Bergmann +Reviewed-by: Konrad Dybcio +Reviewed-by: Dikshita Agarwal +Fixes: 0399b696f7f4 ("media: venus: fix compile-test build on non-qcom ARM platform") +Cc: stable@vger.kernel.org +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/qcom/venus/Kconfig ++++ b/drivers/media/platform/qcom/venus/Kconfig +@@ -4,7 +4,7 @@ config VIDEO_QCOM_VENUS + depends on VIDEO_DEV && QCOM_SMEM + depends on (ARCH_QCOM && ARM64 && IOMMU_API) || COMPILE_TEST + select OF_DYNAMIC if ARCH_QCOM +- select QCOM_MDT_LOADER if ARCH_QCOM ++ select QCOM_MDT_LOADER + select QCOM_SCM + select VIDEOBUF2_DMA_CONTIG + select V4L2_MEM2MEM_DEV diff --git a/queue-7.0/series b/queue-7.0/series index 5db08c0deb..aa338107ae 100644 --- a/queue-7.0/series +++ b/queue-7.0/series @@ -63,3 +63,31 @@ platform-x86-hp-wmi-ignore-backlight-and-fnlock-events.patch vsock-virtio-fix-msg_peek-ignoring-skb-offset-when-calculating-bytes-to-copy.patch arm64-dts-broadcom-bcm2712-d-rpi-5-b-add-fixes-for-pinctrl-pinctrl_aon.patch arm64-dts-broadcom-bcm2712-d-rpi-5-b-update-uart10-interrupt.patch +media-pci-zoran-fix-potential-memory-leak-in-zoran_probe.patch +media-dib8000-avoid-division-by-0-in-dib8000_set_dds.patch +media-i2c-imx412-assert-reset-gpio-during-probe.patch +media-staging-imx-request-mbus_config-in-csi_start.patch +media-i2c-ov08d10-fix-image-vertical-start-setting.patch +media-i2c-ov08d10-fix-runtime-pm-handling-in-probe.patch +media-omap3isp-drop-the-use-count-of-v4l2-pipeline.patch +media-iris-fix-qcom_mdt_loader-dependency.patch +media-iris-fix-use-after-free-in-iris_release_internal_buffers.patch +media-qcom-camss-fix-csid-clock-configuration-for-sa8775p.patch +media-qcom-camss-fix-csid-irq-offset-for-sa8775p.patch +media-qcom-iris-increase-h265d_max_slice-to-fix-h.265-decoding-on-sc7280.patch +media-venus-fix-qcom_mdt_loader-dependency.patch +media-iris-fix-dma_free_attrs-size-in-iris_hfi_queues_init.patch +media-iris-fix-use-after-free-of-fmt_src-during-mbpf-check.patch +media-iris-switch-to-hardware-mode-after-firmware-boot.patch +media-qcom-camss-add-missing-clocks-for-vfe-lite-on-sa8775p.patch +drm-xe-hdcp-add-null-check-for-media_gt-in-intel_hdcp_gsc_check_status.patch +spi-mxs-fix-controller-deregistration.patch +spi-mt65xx-fix-controller-deregistration.patch +spi-dln2-fix-controller-deregistration.patch +spi-s3c64xx-fix-controller-deregistration.patch +spi-fsl-espi-fix-controller-deregistration.patch +spi-omap2-mcspi-fix-controller-deregistration.patch +spi-pic32-fix-controller-deregistration.patch +spi-ep93xx-fix-controller-deregistration.patch +spi-mtk-nor-fix-controller-deregistration.patch +spi-pl022-fix-controller-deregistration.patch diff --git a/queue-7.0/spi-dln2-fix-controller-deregistration.patch b/queue-7.0/spi-dln2-fix-controller-deregistration.patch new file mode 100644 index 0000000000..37063726d0 --- /dev/null +++ b/queue-7.0/spi-dln2-fix-controller-deregistration.patch @@ -0,0 +1,51 @@ +From c353020fbfa8514ee91a6de2d88de4e5edca5803 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:10 +0200 +Subject: spi: dln2: fix controller deregistration + +From: Johan Hovold + +commit c353020fbfa8514ee91a6de2d88de4e5edca5803 upstream. + +Make sure to deregister the controller before disabling it to allow +SPI device drivers to do I/O during deregistration. + +Fixes: 3d8c0d749da3 ("spi: add support for DLN-2 USB-SPI adapter") +Cc: stable@vger.kernel.org # 4.0 +Cc: Laurentiu Palcu +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-12-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-dln2.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-dln2.c ++++ b/drivers/spi/spi-dln2.c +@@ -758,7 +758,7 @@ static int dln2_spi_probe(struct platfor + pm_runtime_set_active(&pdev->dev); + pm_runtime_enable(&pdev->dev); + +- ret = devm_spi_register_controller(&pdev->dev, host); ++ ret = spi_register_controller(host); + if (ret < 0) { + dev_err(&pdev->dev, "Failed to register host\n"); + goto exit_register; +@@ -783,10 +783,16 @@ static void dln2_spi_remove(struct platf + struct spi_controller *host = platform_get_drvdata(pdev); + struct dln2_spi *dln2 = spi_controller_get_devdata(host); + ++ spi_controller_get(host); ++ ++ spi_unregister_controller(host); ++ + pm_runtime_disable(&pdev->dev); + + if (dln2_spi_enable(dln2, false) < 0) + dev_err(&pdev->dev, "Failed to disable SPI module\n"); ++ ++ spi_controller_put(host); + } + + #ifdef CONFIG_PM_SLEEP diff --git a/queue-7.0/spi-ep93xx-fix-controller-deregistration.patch b/queue-7.0/spi-ep93xx-fix-controller-deregistration.patch new file mode 100644 index 0000000000..08ae450ad9 --- /dev/null +++ b/queue-7.0/spi-ep93xx-fix-controller-deregistration.patch @@ -0,0 +1,47 @@ +From f4838934b695a58eda0833583cb8028e73a19529 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:11 +0200 +Subject: spi: ep93xx: fix controller deregistration + +From: Johan Hovold + +commit f4838934b695a58eda0833583cb8028e73a19529 upstream. + +Make sure to deregister the controller before releasing underlying +resources like DMA during driver unbind. + +Fixes: 011f23a3c2f2 ("spi/ep93xx: implemented driver for Cirrus EP93xx SPI controller") +Cc: stable@vger.kernel.org # 2.6.35 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-13-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-ep93xx.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-ep93xx.c ++++ b/drivers/spi/spi-ep93xx.c +@@ -689,7 +689,7 @@ static int ep93xx_spi_probe(struct platf + /* make sure that the hardware is disabled */ + writel(0, espi->mmio + SSPCR1); + +- error = devm_spi_register_controller(&pdev->dev, host); ++ error = spi_register_controller(host); + if (error) { + dev_err(&pdev->dev, "failed to register SPI host\n"); + goto fail_free_dma; +@@ -713,7 +713,13 @@ static void ep93xx_spi_remove(struct pla + struct spi_controller *host = platform_get_drvdata(pdev); + struct ep93xx_spi *espi = spi_controller_get_devdata(host); + ++ spi_controller_get(host); ++ ++ spi_unregister_controller(host); ++ + ep93xx_spi_release_dma(espi); ++ ++ spi_controller_put(host); + } + + static const struct of_device_id ep93xx_spi_of_ids[] = { diff --git a/queue-7.0/spi-fsl-espi-fix-controller-deregistration.patch b/queue-7.0/spi-fsl-espi-fix-controller-deregistration.patch new file mode 100644 index 0000000000..91c31a4c3d --- /dev/null +++ b/queue-7.0/spi-fsl-espi-fix-controller-deregistration.patch @@ -0,0 +1,51 @@ +From e506a700a7ad229f5c8f01f4b8350119cccb4158 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 9 Apr 2026 14:04:12 +0200 +Subject: spi: fsl-espi: fix controller deregistration + +From: Johan Hovold + +commit e506a700a7ad229f5c8f01f4b8350119cccb4158 upstream. + +Make sure to deregister the controller before disabling runtime PM +(which can leave the controller disabled) to allow SPI device drivers to +do I/O during deregistration. + +Fixes: e9abb4db8d10 ("spi: fsl-espi: add runtime PM") +Cc: stable@vger.kernel.org # 4.3 +Cc: Heiner Kallweit +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260409120419.388546-14-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-fsl-espi.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-fsl-espi.c ++++ b/drivers/spi/spi-fsl-espi.c +@@ -718,7 +718,7 @@ static int fsl_espi_probe(struct device + pm_runtime_enable(dev); + pm_runtime_get_sync(dev); + +- ret = devm_spi_register_controller(dev, host); ++ ret = spi_register_controller(host); + if (ret < 0) + goto err_pm; + +@@ -782,7 +782,15 @@ static int of_fsl_espi_probe(struct plat + + static void of_fsl_espi_remove(struct platform_device *dev) + { ++ struct spi_controller *host = platform_get_drvdata(dev); ++ ++ spi_controller_get(host); ++ ++ spi_unregister_controller(host); ++ + pm_runtime_disable(&dev->dev); ++ ++ spi_controller_put(host); + } + + #ifdef CONFIG_PM_SLEEP diff --git a/queue-7.0/spi-mt65xx-fix-controller-deregistration.patch b/queue-7.0/spi-mt65xx-fix-controller-deregistration.patch new file mode 100644 index 0000000000..de4c10a7c8 --- /dev/null +++ b/queue-7.0/spi-mt65xx-fix-controller-deregistration.patch @@ -0,0 +1,44 @@ +From 2ad30599cccc572ba2fc11010670eb6e01ea6bfc Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Apr 2026 10:17:31 +0200 +Subject: spi: mt65xx: fix controller deregistration + +From: Johan Hovold + +commit 2ad30599cccc572ba2fc11010670eb6e01ea6bfc upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: a568231f4632 ("spi: mediatek: Add spi bus for Mediatek MT8173") +Cc: stable@vger.kernel.org # 4.3: ace145802350 +Cc: stable@vger.kernel.org # 4.3 +Cc: Leilk Liu +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260410081757.503099-2-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-mt65xx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-mt65xx.c ++++ b/drivers/spi/spi-mt65xx.c +@@ -1325,7 +1325,7 @@ static int mtk_spi_probe(struct platform + + pm_runtime_enable(dev); + +- ret = devm_spi_register_controller(dev, host); ++ ret = spi_register_controller(host); + if (ret) { + pm_runtime_disable(dev); + return dev_err_probe(dev, ret, "failed to register host\n"); +@@ -1340,6 +1340,8 @@ static void mtk_spi_remove(struct platfo + struct mtk_spi *mdata = spi_controller_get_devdata(host); + int ret; + ++ spi_unregister_controller(host); ++ + cpu_latency_qos_remove_request(&mdata->qos_request); + if (mdata->use_spimem && !completion_done(&mdata->spimem_done)) + complete(&mdata->spimem_done); diff --git a/queue-7.0/spi-mtk-nor-fix-controller-deregistration.patch b/queue-7.0/spi-mtk-nor-fix-controller-deregistration.patch new file mode 100644 index 0000000000..7480aa939e --- /dev/null +++ b/queue-7.0/spi-mtk-nor-fix-controller-deregistration.patch @@ -0,0 +1,43 @@ +From 76336f24934621db286cabb20b483773ee01dcaa Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Apr 2026 10:17:32 +0200 +Subject: spi: mtk-nor: fix controller deregistration + +From: Johan Hovold + +commit 76336f24934621db286cabb20b483773ee01dcaa upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: 881d1ee9fe81 ("spi: add support for mediatek spi-nor controller") +Cc: stable@vger.kernel.org # 5.7 +Cc: Chuanhong Guo +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260410081757.503099-3-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-mtk-nor.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-mtk-nor.c ++++ b/drivers/spi/spi-mtk-nor.c +@@ -913,7 +913,7 @@ static int mtk_nor_probe(struct platform + pm_runtime_enable(&pdev->dev); + pm_runtime_get_noresume(&pdev->dev); + +- ret = devm_spi_register_controller(&pdev->dev, ctlr); ++ ret = spi_register_controller(ctlr); + if (ret < 0) + goto err_probe; + +@@ -938,6 +938,8 @@ static void mtk_nor_remove(struct platfo + struct spi_controller *ctlr = dev_get_drvdata(&pdev->dev); + struct mtk_nor *sp = spi_controller_get_devdata(ctlr); + ++ spi_unregister_controller(ctlr); ++ + pm_runtime_disable(&pdev->dev); + pm_runtime_set_suspended(&pdev->dev); + pm_runtime_dont_use_autosuspend(&pdev->dev); diff --git a/queue-7.0/spi-mxs-fix-controller-deregistration.patch b/queue-7.0/spi-mxs-fix-controller-deregistration.patch new file mode 100644 index 0000000000..b930e7163c --- /dev/null +++ b/queue-7.0/spi-mxs-fix-controller-deregistration.patch @@ -0,0 +1,52 @@ +From 8b0d0011af20fb547aa67a1cefbf320992fd5e92 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Apr 2026 10:17:33 +0200 +Subject: spi: mxs: fix controller deregistration + +From: Johan Hovold + +commit 8b0d0011af20fb547aa67a1cefbf320992fd5e92 upstream. + +Make sure to deregister the controller before releasing underlying +resources like DMA during driver unbind. + +Fixes: 33e195acf268 ("spi: mxs: use devm_spi_register_master()") +Cc: stable@vger.kernel.org # 3.13 +Cc: Jingoo Han +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260410081757.503099-4-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-mxs.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-mxs.c ++++ b/drivers/spi/spi-mxs.c +@@ -619,7 +619,7 @@ static int mxs_spi_probe(struct platform + if (ret) + goto out_pm_runtime_put; + +- ret = devm_spi_register_controller(&pdev->dev, host); ++ ret = spi_register_controller(host); + if (ret) { + dev_err(&pdev->dev, "Cannot register SPI host, %d\n", ret); + goto out_pm_runtime_put; +@@ -650,11 +650,17 @@ static void mxs_spi_remove(struct platfo + spi = spi_controller_get_devdata(host); + ssp = &spi->ssp; + ++ spi_controller_get(host); ++ ++ spi_unregister_controller(host); ++ + pm_runtime_disable(&pdev->dev); + if (!pm_runtime_status_suspended(&pdev->dev)) + mxs_spi_runtime_suspend(&pdev->dev); + + dma_release_channel(ssp->dmach); ++ ++ spi_controller_put(host); + } + + static struct platform_driver mxs_spi_driver = { diff --git a/queue-7.0/spi-omap2-mcspi-fix-controller-deregistration.patch b/queue-7.0/spi-omap2-mcspi-fix-controller-deregistration.patch new file mode 100644 index 0000000000..7bf3b10813 --- /dev/null +++ b/queue-7.0/spi-omap2-mcspi-fix-controller-deregistration.patch @@ -0,0 +1,51 @@ +From fb45f95c377e4a4bdece2c5e17643b459c9c13e7 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Apr 2026 10:17:35 +0200 +Subject: spi: omap2-mcspi: fix controller deregistration + +From: Johan Hovold + +commit fb45f95c377e4a4bdece2c5e17643b459c9c13e7 upstream. + +Make sure to deregister the controller before releasing underlying +resources like DMA during driver unbind. + +Fixes: ccdc7bf92573 ("SPI: omap2_mcspi driver") +Cc: stable@vger.kernel.org # 2.6.23 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260410081757.503099-6-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-omap2-mcspi.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -1585,7 +1585,7 @@ static int omap2_mcspi_probe(struct plat + if (status < 0) + goto disable_pm; + +- status = devm_spi_register_controller(&pdev->dev, ctlr); ++ status = spi_register_controller(ctlr); + if (status < 0) + goto disable_pm; + +@@ -1606,11 +1606,17 @@ static void omap2_mcspi_remove(struct pl + struct spi_controller *ctlr = platform_get_drvdata(pdev); + struct omap2_mcspi *mcspi = spi_controller_get_devdata(ctlr); + ++ spi_controller_get(ctlr); ++ ++ spi_unregister_controller(ctlr); ++ + omap2_mcspi_release_dma(ctlr); + + pm_runtime_dont_use_autosuspend(mcspi->dev); + pm_runtime_put_sync(mcspi->dev); + pm_runtime_disable(&pdev->dev); ++ ++ spi_controller_put(ctlr); + } + + /* work with hotplug and coldplug */ diff --git a/queue-7.0/spi-pic32-fix-controller-deregistration.patch b/queue-7.0/spi-pic32-fix-controller-deregistration.patch new file mode 100644 index 0000000000..c95ca26a61 --- /dev/null +++ b/queue-7.0/spi-pic32-fix-controller-deregistration.patch @@ -0,0 +1,53 @@ +From 6b627bfe0c44e064aba464839e430dc1ca2b0bb8 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Apr 2026 10:17:36 +0200 +Subject: spi: pic32: fix controller deregistration + +From: Johan Hovold + +commit 6b627bfe0c44e064aba464839e430dc1ca2b0bb8 upstream. + +Make sure to deregister the controller before releasing underlying +resources like DMA during driver unbind. + +Fixes: 1bcb9f8ceb67 ("spi: spi-pic32: Add PIC32 SPI master driver") +Cc: stable@vger.kernel.org # 4.7 +Cc: Purna Chandra Mandal +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260410081757.503099-7-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-pic32.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/spi/spi-pic32.c ++++ b/drivers/spi/spi-pic32.c +@@ -821,7 +821,7 @@ static int pic32_spi_probe(struct platfo + } + + /* register host */ +- ret = devm_spi_register_controller(&pdev->dev, host); ++ ret = spi_register_controller(host); + if (ret) { + dev_err(&host->dev, "failed registering spi host\n"); + goto err_bailout; +@@ -840,11 +840,16 @@ err_host: + + static void pic32_spi_remove(struct platform_device *pdev) + { +- struct pic32_spi *pic32s; ++ struct pic32_spi *pic32s = platform_get_drvdata(pdev); ++ ++ spi_controller_get(pic32s->host); ++ ++ spi_unregister_controller(pic32s->host); + +- pic32s = platform_get_drvdata(pdev); + pic32_spi_disable(pic32s); + pic32_spi_dma_unprep(pic32s); ++ ++ spi_controller_put(pic32s->host); + } + + static const struct of_device_id pic32_spi_of_match[] = { diff --git a/queue-7.0/spi-pl022-fix-controller-deregistration.patch b/queue-7.0/spi-pl022-fix-controller-deregistration.patch new file mode 100644 index 0000000000..ee67dc42eb --- /dev/null +++ b/queue-7.0/spi-pl022-fix-controller-deregistration.patch @@ -0,0 +1,54 @@ +From 994b33366be9148240690e3e94bffe17c4d89458 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Apr 2026 10:17:38 +0200 +Subject: spi: pl022: fix controller deregistration + +From: Johan Hovold + +commit 994b33366be9148240690e3e94bffe17c4d89458 upstream. + +Make sure to deregister the controller before releasing underlying +resources like DMA during driver unbind. + +Fixes: b43d65f7e818 ("[ARM] 5546/1: ARM PL022 SSP/SPI driver v3") +Cc: stable@vger.kernel.org # 2.6.31 +Cc: Linus Walleij +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260410081757.503099-9-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-pl022.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-pl022.c ++++ b/drivers/spi/spi-pl022.c +@@ -1956,7 +1956,7 @@ static int pl022_probe(struct amba_devic + + /* Register with the SPI framework */ + amba_set_drvdata(adev, pl022); +- status = devm_spi_register_controller(&adev->dev, host); ++ status = spi_register_controller(host); + if (status != 0) { + dev_err_probe(&adev->dev, status, + "problem registering spi host\n"); +@@ -1997,6 +1997,10 @@ pl022_remove(struct amba_device *adev) + if (!pl022) + return; + ++ spi_controller_get(pl022->host); ++ ++ spi_unregister_controller(pl022->host); ++ + /* + * undo pm_runtime_put() in probe. I assume that we're not + * accessing the primecell here. +@@ -2008,6 +2012,8 @@ pl022_remove(struct amba_device *adev) + pl022_dma_remove(pl022); + + amba_release_regions(adev); ++ ++ spi_controller_put(pl022->host); + } + + #ifdef CONFIG_PM_SLEEP diff --git a/queue-7.0/spi-s3c64xx-fix-controller-deregistration.patch b/queue-7.0/spi-s3c64xx-fix-controller-deregistration.patch new file mode 100644 index 0000000000..82240dfc78 --- /dev/null +++ b/queue-7.0/spi-s3c64xx-fix-controller-deregistration.patch @@ -0,0 +1,43 @@ +From c1446b61e472da24d1547525193467b4bea4a7cb Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Apr 2026 10:17:41 +0200 +Subject: spi: s3c64xx: fix controller deregistration + +From: Johan Hovold + +commit c1446b61e472da24d1547525193467b4bea4a7cb upstream. + +Make sure to deregister the controller before releasing underlying +resources like DMA during driver unbind. + +Fixes: 91800f0e9005 ("spi/s3c64xx: Use managed registration") +Cc: stable@vger.kernel.org # 3.13: 76fbad410c0f +Cc: stable@vger.kernel.org # 3.13 +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260410081757.503099-12-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-s3c64xx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -1369,7 +1369,7 @@ static int s3c64xx_spi_probe(struct plat + S3C64XX_SPI_INT_TX_OVERRUN_EN | S3C64XX_SPI_INT_TX_UNDERRUN_EN, + sdd->regs + S3C64XX_SPI_INT_EN); + +- ret = devm_spi_register_controller(&pdev->dev, host); ++ ret = spi_register_controller(host); + if (ret != 0) { + dev_err(&pdev->dev, "cannot register SPI host: %d\n", ret); + goto err_pm_put; +@@ -1399,6 +1399,8 @@ static void s3c64xx_spi_remove(struct pl + + pm_runtime_get_sync(&pdev->dev); + ++ spi_unregister_controller(host); ++ + writel(0, sdd->regs + S3C64XX_SPI_INT_EN); + + pm_runtime_put_noidle(&pdev->dev);