--- /dev/null
+From ed62a62a18bc144f73eadf866ae46842e8f6606e Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Wed, 18 Jun 2025 16:25:19 +0900
+Subject: ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+commit ed62a62a18bc144f73eadf866ae46842e8f6606e upstream.
+
+Improve the description of the possible default SATA link power
+management policies and add the missing description for policy 5.
+No functional changes.
+
+Fixes: a5ec5a7bfd1f ("ata: ahci: Support state with min power but Partial low power state")
+Cc: stable@vger.kernel.org
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/Kconfig | 32 ++++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+--- a/drivers/ata/Kconfig
++++ b/drivers/ata/Kconfig
+@@ -117,23 +117,39 @@ config SATA_AHCI
+
+ config SATA_MOBILE_LPM_POLICY
+ int "Default SATA Link Power Management policy"
+- range 0 4
++ range 0 5
+ default 3
+ depends on SATA_AHCI
+ help
+ Select the Default SATA Link Power Management (LPM) policy to use
+ for chipsets / "South Bridges" supporting low-power modes. Such
+ chipsets are ubiquitous across laptops, desktops and servers.
++ Each policy combines power saving states and features:
++ - Partial: The Phy logic is powered but is in a reduced power
++ state. The exit latency from this state is no longer than
++ 10us).
++ - Slumber: The Phy logic is powered but is in an even lower power
++ state. The exit latency from this state is potentially
++ longer, but no longer than 10ms.
++ - DevSleep: The Phy logic may be powered down. The exit latency from
++ this state is no longer than 20 ms, unless otherwise
++ specified by DETO in the device Identify Device Data log.
++ - HIPM: Host Initiated Power Management (host automatically
++ transitions to partial and slumber).
++ - DIPM: Device Initiated Power Management (device automatically
++ transitions to partial and slumber).
+
+- The value set has the following meanings:
++ The possible values for the default SATA link power management
++ policies are:
+ 0 => Keep firmware settings
+- 1 => Maximum performance
+- 2 => Medium power
+- 3 => Medium power with Device Initiated PM enabled
+- 4 => Minimum power
++ 1 => No power savings (maximum performance)
++ 2 => HIPM (Partial)
++ 3 => HIPM (Partial) and DIPM (Partial and Slumber)
++ 4 => HIPM (Partial and DevSleep) and DIPM (Partial and Slumber)
++ 5 => HIPM (Slumber and DevSleep) and DIPM (Partial and Slumber)
+
+- Note "Minimum power" is known to cause issues, including disk
+- corruption, with some disks and should not be used.
++ Excluding the value 0, higher values represent policies with higher
++ power savings.
+
+ config SATA_AHCI_PLATFORM
+ tristate "Platform AHCI SATA support"
--- /dev/null
+From 5bd398e20f0833ae8a1267d4f343591a2dd20185 Mon Sep 17 00:00:00 2001
+From: Youssef Samir <quic_yabdulra@quicinc.com>
+Date: Mon, 14 Jul 2025 18:30:39 +0200
+Subject: bus: mhi: host: Detect events pointing to unexpected TREs
+
+From: Youssef Samir <quic_yabdulra@quicinc.com>
+
+commit 5bd398e20f0833ae8a1267d4f343591a2dd20185 upstream.
+
+When a remote device sends a completion event to the host, it contains a
+pointer to the consumed TRE. The host uses this pointer to process all of
+the TREs between it and the host's local copy of the ring's read pointer.
+This works when processing completion for chained transactions, but can
+lead to nasty results if the device sends an event for a single-element
+transaction with a read pointer that is multiple elements ahead of the
+host's read pointer.
+
+For instance, if the host accesses an event ring while the device is
+updating it, the pointer inside of the event might still point to an old
+TRE. If the host uses the channel's xfer_cb() to directly free the buffer
+pointed to by the TRE, the buffer will be double-freed.
+
+This behavior was observed on an ep that used upstream EP stack without
+'commit 6f18d174b73d ("bus: mhi: ep: Update read pointer only after buffer
+is written")'. Where the device updated the events ring pointer before
+updating the event contents, so it left a window where the host was able to
+access the stale data the event pointed to, before the device had the
+chance to update them. The usual pattern was that the host received an
+event pointing to a TRE that is not immediately after the last processed
+one, so it got treated as if it was a chained transaction, processing all
+of the TREs in between the two read pointers.
+
+This commit aims to harden the host by ensuring transactions where the
+event points to a TRE that isn't local_rp + 1 are chained.
+
+Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device")
+Signed-off-by: Youssef Samir <quic_yabdulra@quicinc.com>
+[mani: added stable tag and reworded commit message]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250714163039.3438985-1-quic_yabdulra@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/mhi/host/main.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/bus/mhi/host/main.c
++++ b/drivers/bus/mhi/host/main.c
+@@ -602,7 +602,7 @@ static int parse_xfer_event(struct mhi_c
+ {
+ dma_addr_t ptr = MHI_TRE_GET_EV_PTR(event);
+ struct mhi_ring_element *local_rp, *ev_tre;
+- void *dev_rp;
++ void *dev_rp, *next_rp;
+ struct mhi_buf_info *buf_info;
+ u16 xfer_len;
+
+@@ -621,6 +621,16 @@ static int parse_xfer_event(struct mhi_c
+ result.dir = mhi_chan->dir;
+
+ local_rp = tre_ring->rp;
++
++ next_rp = local_rp + 1;
++ if (next_rp >= tre_ring->base + tre_ring->len)
++ next_rp = tre_ring->base;
++ if (dev_rp != next_rp && !MHI_TRE_DATA_GET_CHAIN(local_rp)) {
++ dev_err(&mhi_cntrl->mhi_dev->dev,
++ "Event element points to an unexpected TRE\n");
++ break;
++ }
++
+ while (local_rp != dev_rp) {
+ buf_info = buf_ring->rp;
+ /* If it's the last TRE, get length from the event */
--- /dev/null
+From f471578e8b1a90623674433a01a8845110bc76ce Mon Sep 17 00:00:00 2001
+From: Alexander Wilhelm <alexander.wilhelm@westermo.com>
+Date: Mon, 19 May 2025 16:58:37 +0200
+Subject: bus: mhi: host: Fix endianness of BHI vector table
+
+From: Alexander Wilhelm <alexander.wilhelm@westermo.com>
+
+commit f471578e8b1a90623674433a01a8845110bc76ce upstream.
+
+On big endian platform like PowerPC, the MHI bus (which is little endian)
+does not start properly. The following example shows the error messages by
+using QCN9274 WLAN device with ath12k driver:
+
+ ath12k_pci 0001:01:00.0: BAR 0: assigned [mem 0xc00000000-0xc001fffff 64bit]
+ ath12k_pci 0001:01:00.0: MSI vectors: 1
+ ath12k_pci 0001:01:00.0: Hardware name: qcn9274 hw2.0
+ ath12k_pci 0001:01:00.0: failed to set mhi state: POWER_ON(2)
+ ath12k_pci 0001:01:00.0: failed to start mhi: -110
+ ath12k_pci 0001:01:00.0: failed to power up :-110
+ ath12k_pci 0001:01:00.0: failed to create soc core: -110
+ ath12k_pci 0001:01:00.0: failed to init core: -110
+ ath12k_pci: probe of 0001:01:00.0 failed with error -110
+
+The issue seems to be with the incorrect DMA address/size used for
+transferring the firmware image over BHI. So fix it by converting the DMA
+address and size of the BHI vector table to little endian format before
+sending them to the device.
+
+Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells")
+Signed-off-by: Alexander Wilhelm <alexander.wilhelm@westermo.com>
+[mani: added stable tag and reworded commit message]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250519145837.958153-1-alexander.wilhelm@westermo.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/mhi/host/boot.c | 8 ++++----
+ drivers/bus/mhi/host/internal.h | 4 ++--
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/bus/mhi/host/boot.c
++++ b/drivers/bus/mhi/host/boot.c
+@@ -31,8 +31,8 @@ int mhi_rddm_prepare(struct mhi_controll
+ int ret;
+
+ for (i = 0; i < img_info->entries - 1; i++, mhi_buf++, bhi_vec++) {
+- bhi_vec->dma_addr = mhi_buf->dma_addr;
+- bhi_vec->size = mhi_buf->len;
++ bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr);
++ bhi_vec->size = cpu_to_le64(mhi_buf->len);
+ }
+
+ dev_dbg(dev, "BHIe programming for RDDM\n");
+@@ -431,8 +431,8 @@ static void mhi_firmware_copy_bhie(struc
+ while (remainder) {
+ to_cpy = min(remainder, mhi_buf->len);
+ memcpy(mhi_buf->buf, buf, to_cpy);
+- bhi_vec->dma_addr = mhi_buf->dma_addr;
+- bhi_vec->size = to_cpy;
++ bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr);
++ bhi_vec->size = cpu_to_le64(to_cpy);
+
+ buf += to_cpy;
+ remainder -= to_cpy;
+--- a/drivers/bus/mhi/host/internal.h
++++ b/drivers/bus/mhi/host/internal.h
+@@ -25,8 +25,8 @@ struct mhi_ctxt {
+ };
+
+ struct bhi_vec_entry {
+- u64 dma_addr;
+- u64 size;
++ __le64 dma_addr;
++ __le64 size;
+ };
+
+ enum mhi_fw_load_type {
--- /dev/null
+From 4a26df233266a628157d7f0285451d8655defdfc Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Tue, 1 Jul 2025 17:30:01 -0500
+Subject: cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+commit 4a26df233266a628157d7f0285451d8655defdfc upstream.
+
+The freq_tables[] array has num_possible_cpus() elements so, to avoid an
+out of bounds access, this loop should be capped at "< nb_cpus" instead
+of "<= nb_cpus". The freq_tables[] array is allocated in
+armada_8k_cpufreq_init().
+
+Cc: stable@vger.kernel.org
+Fixes: f525a670533d ("cpufreq: ap806: add cpufreq driver for Armada 8K")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/armada-8k-cpufreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/cpufreq/armada-8k-cpufreq.c
++++ b/drivers/cpufreq/armada-8k-cpufreq.c
+@@ -103,7 +103,7 @@ static void armada_8k_cpufreq_free_table
+ {
+ int opps_index, nb_cpus = num_possible_cpus();
+
+- for (opps_index = 0 ; opps_index <= nb_cpus; opps_index++) {
++ for (opps_index = 0 ; opps_index < nb_cpus; opps_index++) {
+ int i;
+
+ /* If cpu_dev is NULL then we reached the end of the array */
--- /dev/null
+From 409f9287dab3b53bffe8d28d883a529028aa6a42 Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Wed, 25 Jun 2025 18:33:27 +0900
+Subject: dm: Check for forbidden splitting of zone write operations
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+commit 409f9287dab3b53bffe8d28d883a529028aa6a42 upstream.
+
+DM targets must not split zone append and write operations using
+dm_accept_partial_bio() as doing so is forbidden for zone append BIOs,
+breaks zone append emulation using regular write BIOs and potentially
+creates deadlock situations with queue freeze operations.
+
+Modify dm_accept_partial_bio() to add missing BUG_ON() checks for all
+these cases, that is, check that the BIO is a write or write zeroes
+operation. This change packs all the zone related checks together under
+a static_branch_unlikely(&zoned_enabled) and done only if the target is
+a zoned device.
+
+Fixes: f211268ed1f9 ("dm: Use the block layer zone append emulation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
+Link: https://lore.kernel.org/r/20250625093327.548866-6-dlemoal@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1293,8 +1293,9 @@ out:
+ /*
+ * A target may call dm_accept_partial_bio only from the map routine. It is
+ * allowed for all bio types except REQ_PREFLUSH, REQ_OP_ZONE_* zone management
+- * operations, REQ_OP_ZONE_APPEND (zone append writes) and any bio serviced by
+- * __send_duplicate_bios().
++ * operations, zone append writes (native with REQ_OP_ZONE_APPEND or emulated
++ * with write BIOs flagged with BIO_EMULATES_ZONE_APPEND) and any bio serviced
++ * by __send_duplicate_bios().
+ *
+ * dm_accept_partial_bio informs the dm that the target only wants to process
+ * additional n_sectors sectors of the bio and the rest of the data should be
+@@ -1327,11 +1328,19 @@ void dm_accept_partial_bio(struct bio *b
+ unsigned int bio_sectors = bio_sectors(bio);
+
+ BUG_ON(dm_tio_flagged(tio, DM_TIO_IS_DUPLICATE_BIO));
+- BUG_ON(op_is_zone_mgmt(bio_op(bio)));
+- BUG_ON(bio_op(bio) == REQ_OP_ZONE_APPEND);
+ BUG_ON(bio_sectors > *tio->len_ptr);
+ BUG_ON(n_sectors > bio_sectors);
+
++ if (static_branch_unlikely(&zoned_enabled) &&
++ unlikely(bdev_is_zoned(bio->bi_bdev))) {
++ enum req_op op = bio_op(bio);
++
++ BUG_ON(op_is_zone_mgmt(op));
++ BUG_ON(op == REQ_OP_WRITE);
++ BUG_ON(op == REQ_OP_WRITE_ZEROES);
++ BUG_ON(op == REQ_OP_ZONE_APPEND);
++ }
++
+ *tio->len_ptr -= bio_sectors - n_sectors;
+ bio->bi_iter.bi_size = n_sectors << SECTOR_SHIFT;
+
--- /dev/null
+From e549663849e5bb3b985dc2d293069f0d9747ae72 Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Wed, 25 Jun 2025 18:33:26 +0900
+Subject: dm: dm-crypt: Do not partially accept write BIOs with zoned targets
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+commit e549663849e5bb3b985dc2d293069f0d9747ae72 upstream.
+
+Read and write operations issued to a dm-crypt target may be split
+according to the dm-crypt internal limits defined by the max_read_size
+and max_write_size module parameters (default is 128 KB). The intent is
+to improve processing time of large BIOs by splitting them into smaller
+operations that can be parallelized on different CPUs.
+
+For zoned dm-crypt targets, this BIO splitting is still done but without
+the parallel execution to ensure that the issuing order of write
+operations to the underlying devices remains sequential. However, the
+splitting itself causes other problems:
+
+1) Since dm-crypt relies on the block layer zone write plugging to
+ handle zone append emulation using regular write operations, the
+ reminder of a split write BIO will always be plugged into the target
+ zone write plugged. Once the on-going write BIO finishes, this
+ reminder BIO is unplugged and issued from the zone write plug work.
+ If this reminder BIO itself needs to be split, the reminder will be
+ re-issued and plugged again, but that causes a call to a
+ blk_queue_enter(), which may block if a queue freeze operation was
+ initiated. This results in a deadlock as DM submission still holds
+ BIOs that the queue freeze side is waiting for.
+
+2) dm-crypt relies on the emulation done by the block layer using
+ regular write operations for processing zone append operations. This
+ still requires to properly return the written sector as the BIO
+ sector of the original BIO. However, this can be done correctly only
+ and only if there is a single clone BIO used for processing the
+ original zone append operation issued by the user. If the size of a
+ zone append operation is larger than dm-crypt max_write_size, then
+ the orginal BIO will be split and processed as a chain of regular
+ write operations. Such chaining result in an incorrect written sector
+ being returned to the zone append issuer using the original BIO
+ sector. This in turn results in file system data corruptions using
+ xfs or btrfs.
+
+Fix this by modifying get_max_request_size() to always return the size
+of the BIO to avoid it being split with dm_accpet_partial_bio() in
+crypt_map(). get_max_request_size() is renamed to
+get_max_request_sectors() to clarify the unit of the value returned
+and its interface is changed to take a struct dm_target pointer and a
+pointer to the struct bio being processed. In addition to this change,
+to ensure that crypt_alloc_buffer() works correctly, set the dm-crypt
+device max_hw_sectors limit to be at most
+BIO_MAX_VECS << PAGE_SECTORS_SHIFT (1 MB with a 4KB page architecture).
+This forces DM core to split write BIOs before passing them to
+crypt_map(), and thus guaranteeing that dm-crypt can always accept an
+entire write BIO without needing to split it.
+
+This change does not have any effect on the read path of dm-crypt. Read
+operations can still be split and the BIO fragments processed in
+parallel. There is also no impact on the performance of the write path
+given that all zone write BIOs were already processed inline instead of
+in parallel.
+
+This change also does not affect in any way regular dm-crypt block
+devices.
+
+Fixes: f211268ed1f9 ("dm: Use the block layer zone append emulation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
+Link: https://lore.kernel.org/r/20250625093327.548866-5-dlemoal@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-crypt.c | 47 ++++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 38 insertions(+), 9 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -253,17 +253,35 @@ MODULE_PARM_DESC(max_read_size, "Maximum
+ static unsigned int max_write_size = 0;
+ module_param(max_write_size, uint, 0644);
+ MODULE_PARM_DESC(max_write_size, "Maximum size of a write request");
+-static unsigned get_max_request_size(struct crypt_config *cc, bool wrt)
++
++static unsigned get_max_request_sectors(struct dm_target *ti, struct bio *bio)
+ {
++ struct crypt_config *cc = ti->private;
+ unsigned val, sector_align;
+- val = !wrt ? READ_ONCE(max_read_size) : READ_ONCE(max_write_size);
+- if (likely(!val))
+- val = !wrt ? DM_CRYPT_DEFAULT_MAX_READ_SIZE : DM_CRYPT_DEFAULT_MAX_WRITE_SIZE;
+- if (wrt || cc->used_tag_size) {
+- if (unlikely(val > BIO_MAX_VECS << PAGE_SHIFT))
+- val = BIO_MAX_VECS << PAGE_SHIFT;
++ bool wrt = op_is_write(bio_op(bio));
++
++ if (wrt) {
++ /*
++ * For zoned devices, splitting write operations creates the
++ * risk of deadlocking queue freeze operations with zone write
++ * plugging BIO work when the reminder of a split BIO is
++ * issued. So always allow the entire BIO to proceed.
++ */
++ if (ti->emulate_zone_append)
++ return bio_sectors(bio);
++
++ val = min_not_zero(READ_ONCE(max_write_size),
++ DM_CRYPT_DEFAULT_MAX_WRITE_SIZE);
++ } else {
++ val = min_not_zero(READ_ONCE(max_read_size),
++ DM_CRYPT_DEFAULT_MAX_READ_SIZE);
+ }
+- sector_align = max(bdev_logical_block_size(cc->dev->bdev), (unsigned)cc->sector_size);
++
++ if (wrt || cc->used_tag_size)
++ val = min(val, BIO_MAX_VECS << PAGE_SHIFT);
++
++ sector_align = max(bdev_logical_block_size(cc->dev->bdev),
++ (unsigned)cc->sector_size);
+ val = round_down(val, sector_align);
+ if (unlikely(!val))
+ val = sector_align;
+@@ -3496,7 +3514,7 @@ static int crypt_map(struct dm_target *t
+ /*
+ * Check if bio is too large, split as needed.
+ */
+- max_sectors = get_max_request_size(cc, bio_data_dir(bio) == WRITE);
++ max_sectors = get_max_request_sectors(ti, bio);
+ if (unlikely(bio_sectors(bio) > max_sectors))
+ dm_accept_partial_bio(bio, max_sectors);
+
+@@ -3733,6 +3751,17 @@ static void crypt_io_hints(struct dm_tar
+ max_t(unsigned int, limits->physical_block_size, cc->sector_size);
+ limits->io_min = max_t(unsigned int, limits->io_min, cc->sector_size);
+ limits->dma_alignment = limits->logical_block_size - 1;
++
++ /*
++ * For zoned dm-crypt targets, there will be no internal splitting of
++ * write BIOs to avoid exceeding BIO_MAX_VECS vectors per BIO. But
++ * without respecting this limit, crypt_alloc_buffer() will trigger a
++ * BUG(). Avoid this by forcing DM core to split write BIOs to this
++ * limit.
++ */
++ if (ti->emulate_zone_append)
++ limits->max_hw_sectors = min(limits->max_hw_sectors,
++ BIO_MAX_VECS << PAGE_SECTORS_SHIFT);
+ }
+
+ static struct target_type crypt_target = {
--- /dev/null
+From 92c247216918fcaa64244248ee38a0f1d342278c Mon Sep 17 00:00:00 2001
+From: David Lechner <dlechner@baylibre.com>
+Date: Sun, 6 Jul 2025 13:53:08 -0500
+Subject: iio: adc: ad7173: fix num_slots
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Lechner <dlechner@baylibre.com>
+
+commit 92c247216918fcaa64244248ee38a0f1d342278c upstream.
+
+Fix the num_slots value for most chips in the ad7173 driver. The correct
+value is the number of CHANNELx registers on the chip.
+
+In commit 4310e15b3140 ("iio: adc: ad7173: don't make copy of
+ad_sigma_delta_info struct"), we refactored struct ad_sigma_delta_info
+to be static const data instead of being dynamically populated during
+driver probe. However, there was an existing bug in commit 76a1e6a42802
+("iio: adc: ad7173: add AD7173 driver") where num_slots was incorrectly
+set to the number of CONFIGx registers instead of the number of
+CHANNELx registers. This bug was partially propagated to the refactored
+code in that the 16-channel chips were only given 8 slots instead of
+16 although we did managed to fix the 8-channel chips and one of the
+4-channel chips in that commit. However, we botched two of the 4-channel
+chips and ended up incorrectly giving them 8 slots during the
+refactoring.
+
+This patch fixes that mistake on the 4-channel chips and also
+corrects the 16-channel chips to have 16 slots.
+
+Fixes: 4310e15b3140 ("iio: adc: ad7173: don't make copy of ad_sigma_delta_info struct")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://patch.msgid.link/20250706-iio-adc-ad7173-fix-num_slots-on-most-chips-v3-1-d1f5453198a7@baylibre.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ad7173.c | 36 ++++++++++++++++++++++++++----------
+ 1 file changed, 26 insertions(+), 10 deletions(-)
+
+--- a/drivers/iio/adc/ad7173.c
++++ b/drivers/iio/adc/ad7173.c
+@@ -772,10 +772,26 @@ static const struct ad_sigma_delta_info
+ .num_slots = 8,
+ };
+
++static const struct ad_sigma_delta_info ad7173_sigma_delta_info_16_slots = {
++ .set_channel = ad7173_set_channel,
++ .append_status = ad7173_append_status,
++ .disable_all = ad7173_disable_all,
++ .disable_one = ad7173_disable_one,
++ .set_mode = ad7173_set_mode,
++ .has_registers = true,
++ .has_named_irqs = true,
++ .addr_shift = 0,
++ .read_mask = BIT(6),
++ .status_ch_mask = GENMASK(3, 0),
++ .data_reg = AD7173_REG_DATA,
++ .num_resetclks = 64,
++ .num_slots = 16,
++};
++
+ static const struct ad7173_device_info ad4111_device_info = {
+ .name = "ad4111",
+ .id = AD4111_ID,
+- .sd_info = &ad7173_sigma_delta_info_8_slots,
++ .sd_info = &ad7173_sigma_delta_info_16_slots,
+ .num_voltage_in_div = 8,
+ .num_channels = 16,
+ .num_configs = 8,
+@@ -797,7 +813,7 @@ static const struct ad7173_device_info a
+ static const struct ad7173_device_info ad4112_device_info = {
+ .name = "ad4112",
+ .id = AD4112_ID,
+- .sd_info = &ad7173_sigma_delta_info_8_slots,
++ .sd_info = &ad7173_sigma_delta_info_16_slots,
+ .num_voltage_in_div = 8,
+ .num_channels = 16,
+ .num_configs = 8,
+@@ -818,7 +834,7 @@ static const struct ad7173_device_info a
+ static const struct ad7173_device_info ad4113_device_info = {
+ .name = "ad4113",
+ .id = AD4113_ID,
+- .sd_info = &ad7173_sigma_delta_info_8_slots,
++ .sd_info = &ad7173_sigma_delta_info_16_slots,
+ .num_voltage_in_div = 8,
+ .num_channels = 16,
+ .num_configs = 8,
+@@ -837,7 +853,7 @@ static const struct ad7173_device_info a
+ static const struct ad7173_device_info ad4114_device_info = {
+ .name = "ad4114",
+ .id = AD4114_ID,
+- .sd_info = &ad7173_sigma_delta_info_8_slots,
++ .sd_info = &ad7173_sigma_delta_info_16_slots,
+ .num_voltage_in_div = 16,
+ .num_channels = 16,
+ .num_configs = 8,
+@@ -856,7 +872,7 @@ static const struct ad7173_device_info a
+ static const struct ad7173_device_info ad4115_device_info = {
+ .name = "ad4115",
+ .id = AD4115_ID,
+- .sd_info = &ad7173_sigma_delta_info_8_slots,
++ .sd_info = &ad7173_sigma_delta_info_16_slots,
+ .num_voltage_in_div = 16,
+ .num_channels = 16,
+ .num_configs = 8,
+@@ -875,7 +891,7 @@ static const struct ad7173_device_info a
+ static const struct ad7173_device_info ad4116_device_info = {
+ .name = "ad4116",
+ .id = AD4116_ID,
+- .sd_info = &ad7173_sigma_delta_info_8_slots,
++ .sd_info = &ad7173_sigma_delta_info_16_slots,
+ .num_voltage_in_div = 11,
+ .num_channels = 16,
+ .num_configs = 8,
+@@ -894,7 +910,7 @@ static const struct ad7173_device_info a
+ static const struct ad7173_device_info ad7172_2_device_info = {
+ .name = "ad7172-2",
+ .id = AD7172_2_ID,
+- .sd_info = &ad7173_sigma_delta_info_8_slots,
++ .sd_info = &ad7173_sigma_delta_info_4_slots,
+ .num_voltage_in = 5,
+ .num_channels = 4,
+ .num_configs = 4,
+@@ -927,7 +943,7 @@ static const struct ad7173_device_info a
+ static const struct ad7173_device_info ad7173_8_device_info = {
+ .name = "ad7173-8",
+ .id = AD7173_ID,
+- .sd_info = &ad7173_sigma_delta_info_8_slots,
++ .sd_info = &ad7173_sigma_delta_info_16_slots,
+ .num_voltage_in = 17,
+ .num_channels = 16,
+ .num_configs = 8,
+@@ -944,7 +960,7 @@ static const struct ad7173_device_info a
+ static const struct ad7173_device_info ad7175_2_device_info = {
+ .name = "ad7175-2",
+ .id = AD7175_2_ID,
+- .sd_info = &ad7173_sigma_delta_info_8_slots,
++ .sd_info = &ad7173_sigma_delta_info_4_slots,
+ .num_voltage_in = 5,
+ .num_channels = 4,
+ .num_configs = 4,
+@@ -961,7 +977,7 @@ static const struct ad7173_device_info a
+ static const struct ad7173_device_info ad7175_8_device_info = {
+ .name = "ad7175-8",
+ .id = AD7175_8_ID,
+- .sd_info = &ad7173_sigma_delta_info_8_slots,
++ .sd_info = &ad7173_sigma_delta_info_16_slots,
+ .num_voltage_in = 17,
+ .num_channels = 16,
+ .num_configs = 8,
--- /dev/null
+From 210a1ce8ed4391b64a888b3fb4b5611a13f5ccc7 Mon Sep 17 00:00:00 2001
+From: Finn Thain <fthain@linux-m68k.org>
+Date: Fri, 28 Mar 2025 09:39:55 +1100
+Subject: m68k: Fix lost column on framebuffer debug console
+
+From: Finn Thain <fthain@linux-m68k.org>
+
+commit 210a1ce8ed4391b64a888b3fb4b5611a13f5ccc7 upstream.
+
+Move the cursor position rightward after rendering the character,
+not before. This avoids complications that arise when the recursive
+console_putc call has to wrap the line and/or scroll the display.
+This also fixes the linewrap bug that crops off the rightmost column.
+
+When the cursor is at the bottom of the display, a linefeed will not
+move the cursor position further downward. Instead, the display scrolls
+upward. Avoid the repeated add/subtract sequence by way of a single
+subtraction at the initialization of console_struct_num_rows.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Finn Thain <fthain@linux-m68k.org>
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Link: https://lore.kernel.org/9d4e8c68a456d5f2bc254ac6f87a472d066ebd5e.1743115195.git.fthain@linux-m68k.org
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/m68k/kernel/head.S | 31 +++++++++++++++++++++----------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+--- a/arch/m68k/kernel/head.S
++++ b/arch/m68k/kernel/head.S
+@@ -3400,6 +3400,7 @@ L(console_clear_loop):
+
+ movel %d4,%d1 /* screen height in pixels */
+ divul %a0@(FONT_DESC_HEIGHT),%d1 /* d1 = max num rows */
++ subql #1,%d1 /* row range is 0 to num - 1 */
+
+ movel %d0,%a2@(Lconsole_struct_num_columns)
+ movel %d1,%a2@(Lconsole_struct_num_rows)
+@@ -3546,15 +3547,14 @@ func_start console_putc,%a0/%a1/%d0-%d7
+ cmpib #10,%d7
+ jne L(console_not_lf)
+ movel %a0@(Lconsole_struct_cur_row),%d0
+- addil #1,%d0
+- movel %d0,%a0@(Lconsole_struct_cur_row)
+ movel %a0@(Lconsole_struct_num_rows),%d1
+ cmpl %d1,%d0
+ jcs 1f
+- subil #1,%d0
+- movel %d0,%a0@(Lconsole_struct_cur_row)
+ console_scroll
++ jra L(console_exit)
+ 1:
++ addql #1,%d0
++ movel %d0,%a0@(Lconsole_struct_cur_row)
+ jra L(console_exit)
+
+ L(console_not_lf):
+@@ -3581,12 +3581,6 @@ L(console_not_cr):
+ */
+ L(console_not_home):
+ movel %a0@(Lconsole_struct_cur_column),%d0
+- addql #1,%a0@(Lconsole_struct_cur_column)
+- movel %a0@(Lconsole_struct_num_columns),%d1
+- cmpl %d1,%d0
+- jcs 1f
+- console_putc #'\n' /* recursion is OK! */
+-1:
+ movel %a0@(Lconsole_struct_cur_row),%d1
+
+ /*
+@@ -3633,6 +3627,23 @@ L(console_do_font_scanline):
+ addq #1,%d1
+ dbra %d7,L(console_read_char_scanline)
+
++ /*
++ * Register usage in the code below:
++ * a0 = pointer to console globals
++ * d0 = cursor column
++ * d1 = cursor column limit
++ */
++
++ lea %pc@(L(console_globals)),%a0
++
++ movel %a0@(Lconsole_struct_cur_column),%d0
++ addql #1,%d0
++ movel %d0,%a0@(Lconsole_struct_cur_column) /* Update cursor pos */
++ movel %a0@(Lconsole_struct_num_columns),%d1
++ cmpl %d1,%d0
++ jcs L(console_exit)
++ console_putc #'\n' /* Line wrap using tail recursion */
++
+ L(console_exit):
+ func_return console_putc
+
--- /dev/null
+From a3de58b12ce074ec05b8741fa28d62ccb1070468 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 14 Aug 2025 22:45:50 +0100
+Subject: netfs: Fix unbuffered write error handling
+
+From: David Howells <dhowells@redhat.com>
+
+commit a3de58b12ce074ec05b8741fa28d62ccb1070468 upstream.
+
+If all the subrequests in an unbuffered write stream fail, the subrequest
+collector doesn't update the stream->transferred value and it retains its
+initial LONG_MAX value. Unfortunately, if all active streams fail, then we
+take the smallest value of { LONG_MAX, LONG_MAX, ... } as the value to set
+in wreq->transferred - which is then returned from ->write_iter().
+
+LONG_MAX was chosen as the initial value so that all the streams can be
+quickly assessed by taking the smallest value of all stream->transferred -
+but this only works if we've set any of them.
+
+Fix this by adding a flag to indicate whether the value in
+stream->transferred is valid and checking that when we integrate the
+values. stream->transferred can then be initialised to zero.
+
+This was found by running the generic/750 xfstest against cifs with
+cache=none. It splices data to the target file. Once (if) it has used up
+all the available scratch space, the writes start failing with ENOSPC.
+This causes ->write_iter() to fail. However, it was returning
+wreq->transferred, i.e. LONG_MAX, rather than an error (because it thought
+the amount transferred was non-zero) and iter_file_splice_write() would
+then try to clean up that amount of pipe bufferage - leading to an oops
+when it overran. The kernel log showed:
+
+ CIFS: VFS: Send error in write = -28
+
+followed by:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000008
+
+with:
+
+ RIP: 0010:iter_file_splice_write+0x3a4/0x520
+ do_splice+0x197/0x4e0
+
+or:
+
+ RIP: 0010:pipe_buf_release (include/linux/pipe_fs_i.h:282)
+ iter_file_splice_write (fs/splice.c:755)
+
+Also put a warning check into splice to announce if ->write_iter() returned
+that it had written more than it was asked to.
+
+Fixes: 288ace2f57c9 ("netfs: New writeback implementation")
+Reported-by: Xiaoli Feng <fengxiaoli0714@gmail.com>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220445
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/915443.1755207950@warthog.procyon.org.uk
+cc: Paulo Alcantara <pc@manguebit.org>
+cc: Steve French <sfrench@samba.org>
+cc: Shyam Prasad N <sprasad@microsoft.com>
+cc: netfs@lists.linux.dev
+cc: linux-cifs@vger.kernel.org
+cc: linux-fsdevel@vger.kernel.org
+cc: stable@vger.kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/netfs/read_collect.c | 4 +++-
+ fs/netfs/write_collect.c | 10 ++++++++--
+ fs/netfs/write_issue.c | 4 ++--
+ fs/splice.c | 3 +++
+ include/linux/netfs.h | 1 +
+ 5 files changed, 17 insertions(+), 5 deletions(-)
+
+--- a/fs/netfs/read_collect.c
++++ b/fs/netfs/read_collect.c
+@@ -281,8 +281,10 @@ reassess:
+ } else if (test_bit(NETFS_RREQ_SHORT_TRANSFER, &rreq->flags)) {
+ notes |= MADE_PROGRESS;
+ } else {
+- if (!stream->failed)
++ if (!stream->failed) {
+ stream->transferred += transferred;
++ stream->transferred_valid = true;
++ }
+ if (front->transferred < front->len)
+ set_bit(NETFS_RREQ_SHORT_TRANSFER, &rreq->flags);
+ notes |= MADE_PROGRESS;
+--- a/fs/netfs/write_collect.c
++++ b/fs/netfs/write_collect.c
+@@ -254,6 +254,7 @@ reassess_streams:
+ if (front->start + front->transferred > stream->collected_to) {
+ stream->collected_to = front->start + front->transferred;
+ stream->transferred = stream->collected_to - wreq->start;
++ stream->transferred_valid = true;
+ notes |= MADE_PROGRESS;
+ }
+ if (test_bit(NETFS_SREQ_FAILED, &front->flags)) {
+@@ -356,6 +357,7 @@ bool netfs_write_collection(struct netfs
+ {
+ struct netfs_inode *ictx = netfs_inode(wreq->inode);
+ size_t transferred;
++ bool transferred_valid = false;
+ int s;
+
+ _enter("R=%x", wreq->debug_id);
+@@ -376,12 +378,16 @@ bool netfs_write_collection(struct netfs
+ continue;
+ if (!list_empty(&stream->subrequests))
+ return false;
+- if (stream->transferred < transferred)
++ if (stream->transferred_valid &&
++ stream->transferred < transferred) {
+ transferred = stream->transferred;
++ transferred_valid = true;
++ }
+ }
+
+ /* Okay, declare that all I/O is complete. */
+- wreq->transferred = transferred;
++ if (transferred_valid)
++ wreq->transferred = transferred;
+ trace_netfs_rreq(wreq, netfs_rreq_trace_write_done);
+
+ if (wreq->io_streams[1].active &&
+--- a/fs/netfs/write_issue.c
++++ b/fs/netfs/write_issue.c
+@@ -118,12 +118,12 @@ struct netfs_io_request *netfs_create_wr
+ wreq->io_streams[0].prepare_write = ictx->ops->prepare_write;
+ wreq->io_streams[0].issue_write = ictx->ops->issue_write;
+ wreq->io_streams[0].collected_to = start;
+- wreq->io_streams[0].transferred = LONG_MAX;
++ wreq->io_streams[0].transferred = 0;
+
+ wreq->io_streams[1].stream_nr = 1;
+ wreq->io_streams[1].source = NETFS_WRITE_TO_CACHE;
+ wreq->io_streams[1].collected_to = start;
+- wreq->io_streams[1].transferred = LONG_MAX;
++ wreq->io_streams[1].transferred = 0;
+ if (fscache_resources_valid(&wreq->cache_resources)) {
+ wreq->io_streams[1].avail = true;
+ wreq->io_streams[1].active = true;
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -739,6 +739,9 @@ iter_file_splice_write(struct pipe_inode
+ sd.pos = kiocb.ki_pos;
+ if (ret <= 0)
+ break;
++ WARN_ONCE(ret > sd.total_len - left,
++ "Splice Exceeded! ret=%zd tot=%zu left=%zu\n",
++ ret, sd.total_len, left);
+
+ sd.num_spliced += ret;
+ sd.total_len -= ret;
+--- a/include/linux/netfs.h
++++ b/include/linux/netfs.h
+@@ -150,6 +150,7 @@ struct netfs_io_stream {
+ bool active; /* T if stream is active */
+ bool need_retry; /* T if this stream needs retrying */
+ bool failed; /* T if this stream failed */
++ bool transferred_valid; /* T is ->transferred is valid */
+ };
+
+ /*
--- /dev/null
+From e2374953461947eee49f69b3e3204ff080ef31b1 Mon Sep 17 00:00:00 2001
+From: Tzung-Bi Shih <tzungbi@kernel.org>
+Date: Tue, 22 Jul 2025 12:05:13 +0000
+Subject: platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
+
+From: Tzung-Bi Shih <tzungbi@kernel.org>
+
+commit e2374953461947eee49f69b3e3204ff080ef31b1 upstream.
+
+The blocking notifier is registered in cros_ec_register(); however, it
+isn't unregistered in cros_ec_unregister().
+
+Fix it.
+
+Fixes: 42cd0ab476e2 ("platform/chrome: cros_ec: Query EC protocol version if EC transitions between RO/RW")
+Cc: stable@vger.kernel.org
+Reviewed-by: Benson Leung <bleung@chromium.org>
+Link: https://lore.kernel.org/r/20250722120513.234031-1-tzungbi@kernel.org
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/chrome/cros_ec.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/platform/chrome/cros_ec.c
++++ b/drivers/platform/chrome/cros_ec.c
+@@ -318,6 +318,9 @@ EXPORT_SYMBOL(cros_ec_register);
+ */
+ void cros_ec_unregister(struct cros_ec_device *ec_dev)
+ {
++ if (ec_dev->mkbp_event_supported)
++ blocking_notifier_chain_unregister(&ec_dev->event_notifier,
++ &ec_dev->notifier_ready);
+ platform_device_unregister(ec_dev->pd);
+ platform_device_unregister(ec_dev->ec);
+ mutex_destroy(&ec_dev->lock);
--- /dev/null
+From 51888393cc64dd0462d0b96c13ab94873abbc030 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Wed, 9 Jul 2025 12:41:45 +0200
+Subject: PM: runtime: Take active children into account in pm_runtime_get_if_in_use()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 51888393cc64dd0462d0b96c13ab94873abbc030 upstream.
+
+For all practical purposes, there is no difference between the situation
+in which a given device is not ignoring children and its active child
+count is nonzero and the situation in which its runtime PM usage counter
+is nonzero. However, pm_runtime_get_if_in_use() will only increment the
+device's usage counter and return 1 in the latter case.
+
+For consistency, make it do so in the former case either by adjusting
+pm_runtime_get_conditional() and update the related kerneldoc comments
+accordingly.
+
+Fixes: c111566bea7c ("PM: runtime: Add pm_runtime_get_if_active()")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Cc: 5.10+ <stable@vger.kernel.org> # 5.10+: c0ef3df8dbae: PM: runtime: Simplify pm_runtime_get_if_active() usage
+Cc: 5.10+ <stable@vger.kernel.org> # 5.10+
+Link: https://patch.msgid.link/12700973.O9o76ZdvQC@rjwysocki.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/power/runtime.c | 27 ++++++++++++++++++---------
+ 1 file changed, 18 insertions(+), 9 deletions(-)
+
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1191,10 +1191,12 @@ EXPORT_SYMBOL_GPL(__pm_runtime_resume);
+ *
+ * Return -EINVAL if runtime PM is disabled for @dev.
+ *
+- * Otherwise, if the runtime PM status of @dev is %RPM_ACTIVE and either
+- * @ign_usage_count is %true or the runtime PM usage counter of @dev is not
+- * zero, increment the usage counter of @dev and return 1. Otherwise, return 0
+- * without changing the usage counter.
++ * Otherwise, if its runtime PM status is %RPM_ACTIVE and (1) @ign_usage_count
++ * is set, or (2) @dev is not ignoring children and its active child count is
++ * nonero, or (3) the runtime PM usage counter of @dev is not zero, increment
++ * the usage counter of @dev and return 1.
++ *
++ * Otherwise, return 0 without changing the usage counter.
+ *
+ * If @ign_usage_count is %true, this function can be used to prevent suspending
+ * the device when its runtime PM status is %RPM_ACTIVE.
+@@ -1216,7 +1218,8 @@ static int pm_runtime_get_conditional(st
+ retval = -EINVAL;
+ } else if (dev->power.runtime_status != RPM_ACTIVE) {
+ retval = 0;
+- } else if (ign_usage_count) {
++ } else if (ign_usage_count || (!dev->power.ignore_children &&
++ atomic_read(&dev->power.child_count) > 0)) {
+ retval = 1;
+ atomic_inc(&dev->power.usage_count);
+ } else {
+@@ -1249,10 +1252,16 @@ EXPORT_SYMBOL_GPL(pm_runtime_get_if_acti
+ * @dev: Target device.
+ *
+ * Increment the runtime PM usage counter of @dev if its runtime PM status is
+- * %RPM_ACTIVE and its runtime PM usage counter is greater than 0, in which case
+- * it returns 1. If the device is in a different state or its usage_count is 0,
+- * 0 is returned. -EINVAL is returned if runtime PM is disabled for the device,
+- * in which case also the usage_count will remain unmodified.
++ * %RPM_ACTIVE and its runtime PM usage counter is greater than 0 or it is not
++ * ignoring children and its active child count is nonzero. 1 is returned in
++ * this case.
++ *
++ * If @dev is in a different state or it is not in use (that is, its usage
++ * counter is 0, or it is ignoring children, or its active child count is 0),
++ * 0 is returned.
++ *
++ * -EINVAL is returned if runtime PM is disabled for the device, in which case
++ * also the usage counter of @dev is not updated.
+ */
+ int pm_runtime_get_if_in_use(struct device *dev)
+ {
serial-8250-fix-panic-due-to-pslverr.patch
+ata-fix-sata_mobile_lpm_policy-description-in-kconfig.patch
+cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch
+platform-chrome-cros_ec-unregister-notifier-in-cros_ec_unregister.patch
+pm-runtime-take-active-children-into-account-in-pm_runtime_get_if_in_use.patch
+dm-dm-crypt-do-not-partially-accept-write-bios-with-zoned-targets.patch
+dm-check-for-forbidden-splitting-of-zone-write-operations.patch
+m68k-fix-lost-column-on-framebuffer-debug-console.patch
+iio-adc-ad7173-fix-num_slots.patch
+usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch
+usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch
+usb-musb-omap2430-fix-device-leak-at-unbind.patch
+usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch
+usb-dwc3-imx8mp-fix-device-leak-at-unbind.patch
+bus-mhi-host-fix-endianness-of-bhi-vector-table.patch
+bus-mhi-host-detect-events-pointing-to-unexpected-tres.patch
+vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch
+vt-defkeymap-map-keycodes-above-127-to-k_hole.patch
+netfs-fix-unbuffered-write-error-handling.patch
--- /dev/null
+From 8d1b02e5d7e3a6d2acffb1f4c094678fda9e3456 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Tue, 22 Jul 2025 12:11:18 -0700
+Subject: usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 8d1b02e5d7e3a6d2acffb1f4c094678fda9e3456 upstream.
+
+After a recent change in clang to expose uninitialized warnings from
+const variables [1], there is a warning in cxacru_heavy_init():
+
+ drivers/usb/atm/cxacru.c:1104:6: error: variable 'bp' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized]
+ 1104 | if (instance->modem_type->boot_rom_patch) {
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ drivers/usb/atm/cxacru.c:1113:39: note: uninitialized use occurs here
+ 1113 | cxacru_upload_firmware(instance, fw, bp);
+ | ^~
+ drivers/usb/atm/cxacru.c:1104:2: note: remove the 'if' if its condition is always true
+ 1104 | if (instance->modem_type->boot_rom_patch) {
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ drivers/usb/atm/cxacru.c:1095:32: note: initialize the variable 'bp' to silence this warning
+ 1095 | const struct firmware *fw, *bp;
+ | ^
+ | = NULL
+
+While the warning is technically correct that bp is conditionally passed
+uninitialized to cxacru_upload_firmware(), it is ultimately a false
+positive warning on the uninitialized use of bp because the same
+condition that initializes bp, instance->modem_type->boot_rom_patch, is
+the same one that gates the use of bp within cxacru_upload_firmware().
+As this warning occurs in clang's frontend before inlining occurs, it
+cannot know that these conditions are indentical to avoid the warning.
+
+Manually inline cxacru_upload_firmware() into cxacru_heavy_init(), as
+that is its only callsite, so that clang can see that bp is initialized
+and used under the same condition, clearing up the warning without any
+functional changes to the code (LLVM was already doing this inlining
+later).
+
+Cc: stable@vger.kernel.org
+Fixes: 1b0e61465234 ("[PATCH] USB ATM: driver for the Conexant AccessRunner chipset cxacru")
+Closes: https://github.com/ClangBuiltLinux/linux/issues/2102
+Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://lore.kernel.org/r/20250722-usb-cxacru-fix-clang-21-uninit-warning-v2-1-6708a18decd2@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/atm/cxacru.c | 106 +++++++++++++++++++++--------------------------
+ 1 file changed, 49 insertions(+), 57 deletions(-)
+
+--- a/drivers/usb/atm/cxacru.c
++++ b/drivers/usb/atm/cxacru.c
+@@ -980,25 +980,60 @@ cleanup:
+ return ret;
+ }
+
+-static void cxacru_upload_firmware(struct cxacru_data *instance,
+- const struct firmware *fw,
+- const struct firmware *bp)
++
++static int cxacru_find_firmware(struct cxacru_data *instance,
++ char *phase, const struct firmware **fw_p)
+ {
+- int ret;
++ struct usbatm_data *usbatm = instance->usbatm;
++ struct device *dev = &usbatm->usb_intf->dev;
++ char buf[16];
++
++ sprintf(buf, "cxacru-%s.bin", phase);
++ usb_dbg(usbatm, "cxacru_find_firmware: looking for %s\n", buf);
++
++ if (request_firmware(fw_p, buf, dev)) {
++ usb_dbg(usbatm, "no stage %s firmware found\n", phase);
++ return -ENOENT;
++ }
++
++ usb_info(usbatm, "found firmware %s\n", buf);
++
++ return 0;
++}
++
++static int cxacru_heavy_init(struct usbatm_data *usbatm_instance,
++ struct usb_interface *usb_intf)
++{
++ const struct firmware *fw, *bp;
++ struct cxacru_data *instance = usbatm_instance->driver_data;
+ struct usbatm_data *usbatm = instance->usbatm;
+ struct usb_device *usb_dev = usbatm->usb_dev;
+ __le16 signature[] = { usb_dev->descriptor.idVendor,
+ usb_dev->descriptor.idProduct };
+ __le32 val;
++ int ret;
++
++ ret = cxacru_find_firmware(instance, "fw", &fw);
++ if (ret) {
++ usb_warn(usbatm_instance, "firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n");
++ return ret;
++ }
+
+- usb_dbg(usbatm, "%s\n", __func__);
++ if (instance->modem_type->boot_rom_patch) {
++ ret = cxacru_find_firmware(instance, "bp", &bp);
++ if (ret) {
++ usb_warn(usbatm_instance, "boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n");
++ release_firmware(fw);
++ return ret;
++ }
++ }
+
+ /* FirmwarePllFClkValue */
+ val = cpu_to_le32(instance->modem_type->pll_f_clk);
+ ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLFCLK_ADDR, (u8 *) &val, 4);
+ if (ret) {
+ usb_err(usbatm, "FirmwarePllFClkValue failed: %d\n", ret);
+- return;
++ goto done;
+ }
+
+ /* FirmwarePllBClkValue */
+@@ -1006,7 +1041,7 @@ static void cxacru_upload_firmware(struc
+ ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLBCLK_ADDR, (u8 *) &val, 4);
+ if (ret) {
+ usb_err(usbatm, "FirmwarePllBClkValue failed: %d\n", ret);
+- return;
++ goto done;
+ }
+
+ /* Enable SDRAM */
+@@ -1014,7 +1049,7 @@ static void cxacru_upload_firmware(struc
+ ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SDRAMEN_ADDR, (u8 *) &val, 4);
+ if (ret) {
+ usb_err(usbatm, "Enable SDRAM failed: %d\n", ret);
+- return;
++ goto done;
+ }
+
+ /* Firmware */
+@@ -1022,7 +1057,7 @@ static void cxacru_upload_firmware(struc
+ ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, FW_ADDR, fw->data, fw->size);
+ if (ret) {
+ usb_err(usbatm, "Firmware upload failed: %d\n", ret);
+- return;
++ goto done;
+ }
+
+ /* Boot ROM patch */
+@@ -1031,7 +1066,7 @@ static void cxacru_upload_firmware(struc
+ ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, BR_ADDR, bp->data, bp->size);
+ if (ret) {
+ usb_err(usbatm, "Boot ROM patching failed: %d\n", ret);
+- return;
++ goto done;
+ }
+ }
+
+@@ -1039,7 +1074,7 @@ static void cxacru_upload_firmware(struc
+ ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SIG_ADDR, (u8 *) signature, 4);
+ if (ret) {
+ usb_err(usbatm, "Signature storing failed: %d\n", ret);
+- return;
++ goto done;
+ }
+
+ usb_info(usbatm, "starting device\n");
+@@ -1051,7 +1086,7 @@ static void cxacru_upload_firmware(struc
+ }
+ if (ret) {
+ usb_err(usbatm, "Passing control to firmware failed: %d\n", ret);
+- return;
++ goto done;
+ }
+
+ /* Delay to allow firmware to start up. */
+@@ -1065,53 +1100,10 @@ static void cxacru_upload_firmware(struc
+ ret = cxacru_cm(instance, CM_REQUEST_CARD_GET_STATUS, NULL, 0, NULL, 0);
+ if (ret < 0) {
+ usb_err(usbatm, "modem failed to initialize: %d\n", ret);
+- return;
+- }
+-}
+-
+-static int cxacru_find_firmware(struct cxacru_data *instance,
+- char *phase, const struct firmware **fw_p)
+-{
+- struct usbatm_data *usbatm = instance->usbatm;
+- struct device *dev = &usbatm->usb_intf->dev;
+- char buf[16];
+-
+- sprintf(buf, "cxacru-%s.bin", phase);
+- usb_dbg(usbatm, "cxacru_find_firmware: looking for %s\n", buf);
+-
+- if (request_firmware(fw_p, buf, dev)) {
+- usb_dbg(usbatm, "no stage %s firmware found\n", phase);
+- return -ENOENT;
++ goto done;
+ }
+
+- usb_info(usbatm, "found firmware %s\n", buf);
+-
+- return 0;
+-}
+-
+-static int cxacru_heavy_init(struct usbatm_data *usbatm_instance,
+- struct usb_interface *usb_intf)
+-{
+- const struct firmware *fw, *bp;
+- struct cxacru_data *instance = usbatm_instance->driver_data;
+- int ret = cxacru_find_firmware(instance, "fw", &fw);
+-
+- if (ret) {
+- usb_warn(usbatm_instance, "firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n");
+- return ret;
+- }
+-
+- if (instance->modem_type->boot_rom_patch) {
+- ret = cxacru_find_firmware(instance, "bp", &bp);
+- if (ret) {
+- usb_warn(usbatm_instance, "boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n");
+- release_firmware(fw);
+- return ret;
+- }
+- }
+-
+- cxacru_upload_firmware(instance, fw, bp);
+-
++done:
+ if (instance->modem_type->boot_rom_patch)
+ release_firmware(bp);
+ release_firmware(fw);
--- /dev/null
+From 086a0e516f7b3844e6328a5c69e2708b66b0ce18 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 24 Jul 2025 11:19:06 +0200
+Subject: usb: dwc3: imx8mp: fix device leak at unbind
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 086a0e516f7b3844e6328a5c69e2708b66b0ce18 upstream.
+
+Make sure to drop the reference to the dwc3 device taken by
+of_find_device_by_node() on probe errors and on driver unbind.
+
+Fixes: 6dd2565989b4 ("usb: dwc3: add imx8mp dwc3 glue layer driver")
+Cc: stable@vger.kernel.org # 5.12
+Cc: Li Jun <jun.li@nxp.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20250724091910.21092-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-imx8mp.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/dwc3-imx8mp.c
++++ b/drivers/usb/dwc3/dwc3-imx8mp.c
+@@ -244,7 +244,7 @@ static int dwc3_imx8mp_probe(struct plat
+ IRQF_ONESHOT, dev_name(dev), dwc3_imx);
+ if (err) {
+ dev_err(dev, "failed to request IRQ #%d --> %d\n", irq, err);
+- goto depopulate;
++ goto put_dwc3;
+ }
+
+ device_set_wakeup_capable(dev, true);
+@@ -252,6 +252,8 @@ static int dwc3_imx8mp_probe(struct plat
+
+ return 0;
+
++put_dwc3:
++ put_device(&dwc3_imx->dwc3->dev);
+ depopulate:
+ of_platform_depopulate(dev);
+ remove_swnode:
+@@ -265,8 +267,11 @@ disable_rpm:
+
+ static void dwc3_imx8mp_remove(struct platform_device *pdev)
+ {
++ struct dwc3_imx8mp *dwc3_imx = platform_get_drvdata(pdev);
+ struct device *dev = &pdev->dev;
+
++ put_device(&dwc3_imx->dwc3->dev);
++
+ pm_runtime_get_sync(dev);
+ of_platform_depopulate(dev);
+ device_remove_software_node(dev);
--- /dev/null
+From 93b400f4951404d040197943a25d6fef9f8ccabb Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 24 Jul 2025 11:19:07 +0200
+Subject: usb: dwc3: meson-g12a: fix device leaks at unbind
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 93b400f4951404d040197943a25d6fef9f8ccabb upstream.
+
+Make sure to drop the references taken to the child devices by
+of_find_device_by_node() during probe on driver unbind.
+
+Fixes: c99993376f72 ("usb: dwc3: Add Amlogic G12A DWC3 glue")
+Cc: stable@vger.kernel.org # 5.2
+Cc: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20250724091910.21092-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-meson-g12a.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
+@@ -837,6 +837,9 @@ static void dwc3_meson_g12a_remove(struc
+
+ usb_role_switch_unregister(priv->role_switch);
+
++ put_device(priv->switch_desc.udc);
++ put_device(priv->switch_desc.usb2_port);
++
+ of_platform_depopulate(dev);
+
+ for (i = 0 ; i < PHY_COUNT ; ++i) {
--- /dev/null
+From 868837b0a94c6b1b1fdbc04d3ba218ca83432393 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 24 Jul 2025 11:19:08 +0200
+Subject: usb: gadget: udc: renesas_usb3: fix device leak at unbind
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 868837b0a94c6b1b1fdbc04d3ba218ca83432393 upstream.
+
+Make sure to drop the reference to the companion device taken during
+probe when the driver is unbound.
+
+Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch")
+Cc: stable@vger.kernel.org # 4.19
+Cc: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20250724091910.21092-4-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/renesas_usb3.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -2657,6 +2657,7 @@ static void renesas_usb3_remove(struct p
+ struct renesas_usb3 *usb3 = platform_get_drvdata(pdev);
+
+ debugfs_remove_recursive(usb3->dentry);
++ put_device(usb3->host_dev);
+ device_remove_file(&pdev->dev, &dev_attr_role);
+
+ cancel_work_sync(&usb3->role_work);
--- /dev/null
+From 1473e9e7679bd4f5a62d1abccae894fb86de280f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 24 Jul 2025 11:19:09 +0200
+Subject: usb: musb: omap2430: fix device leak at unbind
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 1473e9e7679bd4f5a62d1abccae894fb86de280f upstream.
+
+Make sure to drop the reference to the control device taken by
+of_find_device_by_node() during probe when the driver is unbound.
+
+Fixes: 8934d3e4d0e7 ("usb: musb: omap2430: Don't use omap_get_control_dev()")
+Cc: stable@vger.kernel.org # 3.13
+Cc: Roger Quadros <rogerq@kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20250724091910.21092-5-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/musb/omap2430.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/musb/omap2430.c
++++ b/drivers/usb/musb/omap2430.c
+@@ -400,7 +400,7 @@ static int omap2430_probe(struct platfor
+ ret = platform_device_add_resources(musb, pdev->resource, pdev->num_resources);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to add resources\n");
+- goto err2;
++ goto err_put_control_otghs;
+ }
+
+ if (populate_irqs) {
+@@ -413,7 +413,7 @@ static int omap2430_probe(struct platfor
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!res) {
+ ret = -EINVAL;
+- goto err2;
++ goto err_put_control_otghs;
+ }
+
+ musb_res[i].start = res->start;
+@@ -441,14 +441,14 @@ static int omap2430_probe(struct platfor
+ ret = platform_device_add_resources(musb, musb_res, i);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to add IRQ resources\n");
+- goto err2;
++ goto err_put_control_otghs;
+ }
+ }
+
+ ret = platform_device_add_data(musb, pdata, sizeof(*pdata));
+ if (ret) {
+ dev_err(&pdev->dev, "failed to add platform_data\n");
+- goto err2;
++ goto err_put_control_otghs;
+ }
+
+ pm_runtime_enable(glue->dev);
+@@ -463,7 +463,9 @@ static int omap2430_probe(struct platfor
+
+ err3:
+ pm_runtime_disable(glue->dev);
+-
++err_put_control_otghs:
++ if (!IS_ERR(glue->control_otghs))
++ put_device(glue->control_otghs);
+ err2:
+ platform_device_put(musb);
+
+@@ -477,6 +479,8 @@ static void omap2430_remove(struct platf
+
+ platform_device_unregister(glue->musb);
+ pm_runtime_disable(glue->dev);
++ if (!IS_ERR(glue->control_otghs))
++ put_device(glue->control_otghs);
+ }
+
+ #ifdef CONFIG_PM
--- /dev/null
+From b43cb4ff85da5cf29c4cd351ef1d7dd8210780f7 Mon Sep 17 00:00:00 2001
+From: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+Date: Wed, 2 Jul 2025 21:17:58 +0700
+Subject: vt: defkeymap: Map keycodes above 127 to K_HOLE
+
+From: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+
+commit b43cb4ff85da5cf29c4cd351ef1d7dd8210780f7 upstream.
+
+The maximum number of keycodes got bumped to 256 a very long time ago,
+but the default keymaps were never adjusted to match. This is causing
+the kernel to interpret keycodes above 127 as U+0000 if the shipped
+generated keymap is used.
+
+Fix this by mapping all keycodes above 127 to K_HOLE so the kernel
+ignores them.
+
+The contents of this patche were generated by rerunning `loadkeys
+--mktable --unicode` and only including the changes to map keycodes
+above 127 to K_HOLE.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+Cc: stable <stable@kernel.org>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-2-c27e143cc2eb@qtmlabs.xyz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/defkeymap.c_shipped | 112 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 112 insertions(+)
+
+--- a/drivers/tty/vt/defkeymap.c_shipped
++++ b/drivers/tty/vt/defkeymap.c_shipped
+@@ -23,6 +23,22 @@ unsigned short plain_map[NR_KEYS] = {
+ 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116,
+ 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+
+ static unsigned short shift_map[NR_KEYS] = {
+@@ -42,6 +58,22 @@ static unsigned short shift_map[NR_KEYS]
+ 0xf20b, 0xf601, 0xf602, 0xf117, 0xf600, 0xf20a, 0xf115, 0xf116,
+ 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+
+ static unsigned short altgr_map[NR_KEYS] = {
+@@ -61,6 +93,22 @@ static unsigned short altgr_map[NR_KEYS]
+ 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116,
+ 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+
+ static unsigned short ctrl_map[NR_KEYS] = {
+@@ -80,6 +128,22 @@ static unsigned short ctrl_map[NR_KEYS]
+ 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116,
+ 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+
+ static unsigned short shift_ctrl_map[NR_KEYS] = {
+@@ -99,6 +163,22 @@ static unsigned short shift_ctrl_map[NR_
+ 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116,
+ 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+
+ static unsigned short alt_map[NR_KEYS] = {
+@@ -118,6 +198,22 @@ static unsigned short alt_map[NR_KEYS] =
+ 0xf118, 0xf210, 0xf211, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116,
+ 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+
+ static unsigned short ctrl_alt_map[NR_KEYS] = {
+@@ -137,6 +233,22 @@ static unsigned short ctrl_alt_map[NR_KE
+ 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf20c,
+ 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+
+ unsigned short *key_maps[MAX_NR_KEYMAPS] = {
--- /dev/null
+From b1cc2092ea7a52e2c435aee6d2b1bcb773202663 Mon Sep 17 00:00:00 2001
+From: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+Date: Wed, 2 Jul 2025 21:17:57 +0700
+Subject: vt: keyboard: Don't process Unicode characters in K_OFF mode
+
+From: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+
+commit b1cc2092ea7a52e2c435aee6d2b1bcb773202663 upstream.
+
+We don't process Unicode characters if the virtual terminal is in raw
+mode, so there's no reason why we shouldn't do the same for K_OFF
+(especially since people would expect K_OFF to actually turn off all VT
+key processing).
+
+Fixes: 9fc3de9c8356 ("vt: Add virtual console keyboard mode OFF")
+Signed-off-by: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+Cc: stable <stable@kernel.org>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-1-c27e143cc2eb@qtmlabs.xyz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/keyboard.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -1487,7 +1487,7 @@ static void kbd_keycode(unsigned int key
+ rc = atomic_notifier_call_chain(&keyboard_notifier_list,
+ KBD_UNICODE, ¶m);
+ if (rc != NOTIFY_STOP)
+- if (down && !raw_mode)
++ if (down && !(raw_mode || kbd->kbdmode == VC_OFF))
+ k_unicode(vc, keysym, !down);
+ return;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
