5.10-stable patches

added patches:
	bus-mhi-host-fix-endianness-of-bhi-vector-table.patch
	cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch
	m68k-fix-lost-column-on-framebuffer-debug-console.patch
	usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch
	usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch
	usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch
	vt-defkeymap-map-keycodes-above-127-to-k_hole.patch
	vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch

diff --git a/queue-5.10/bus-mhi-host-fix-endianness-of-bhi-vector-table.patch b/queue-5.10/bus-mhi-host-fix-endianness-of-bhi-vector-table.patch
new file mode 100644 (file)
index 0000000..c3eca77
--- /dev/null
+++ b/queue-5.10/bus-mhi-host-fix-endianness-of-bhi-vector-table.patch
@@ -0,0 +1,79 @@
+From f471578e8b1a90623674433a01a8845110bc76ce Mon Sep 17 00:00:00 2001
+From: Alexander Wilhelm <alexander.wilhelm@westermo.com>
+Date: Mon, 19 May 2025 16:58:37 +0200
+Subject: bus: mhi: host: Fix endianness of BHI vector table
+
+From: Alexander Wilhelm <alexander.wilhelm@westermo.com>
+
+commit f471578e8b1a90623674433a01a8845110bc76ce upstream.
+
+On big endian platform like PowerPC, the MHI bus (which is little endian)
+does not start properly. The following example shows the error messages by
+using QCN9274 WLAN device with ath12k driver:
+
+    ath12k_pci 0001:01:00.0: BAR 0: assigned [mem 0xc00000000-0xc001fffff 64bit]
+    ath12k_pci 0001:01:00.0: MSI vectors: 1
+    ath12k_pci 0001:01:00.0: Hardware name: qcn9274 hw2.0
+    ath12k_pci 0001:01:00.0: failed to set mhi state: POWER_ON(2)
+    ath12k_pci 0001:01:00.0: failed to start mhi: -110
+    ath12k_pci 0001:01:00.0: failed to power up :-110
+    ath12k_pci 0001:01:00.0: failed to create soc core: -110
+    ath12k_pci 0001:01:00.0: failed to init core: -110
+    ath12k_pci: probe of 0001:01:00.0 failed with error -110
+
+The issue seems to be with the incorrect DMA address/size used for
+transferring the firmware image over BHI. So fix it by converting the DMA
+address and size of the BHI vector table to little endian format before
+sending them to the device.
+
+Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells")
+Signed-off-by: Alexander Wilhelm <alexander.wilhelm@westermo.com>
+[mani: added stable tag and reworded commit message]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250519145837.958153-1-alexander.wilhelm@westermo.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/mhi/host/boot.c     |    8 ++++----
+ drivers/bus/mhi/host/internal.h |    4 ++--
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/bus/mhi/host/boot.c
++++ b/drivers/bus/mhi/host/boot.c
+@@ -30,8 +30,8 @@ void mhi_rddm_prepare(struct mhi_control
+       unsigned int i;
+ 
+       for (i = 0; i < img_info->entries - 1; i++, mhi_buf++, bhi_vec++) {
+-              bhi_vec->dma_addr = mhi_buf->dma_addr;
+-              bhi_vec->size = mhi_buf->len;
++              bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr);
++              bhi_vec->size = cpu_to_le64(mhi_buf->len);
+       }
+ 
+       dev_dbg(dev, "BHIe programming for RDDM\n");
+@@ -372,8 +372,8 @@ static void mhi_firmware_copy(struct mhi
+       while (remainder) {
+               to_cpy = min(remainder, mhi_buf->len);
+               memcpy(mhi_buf->buf, buf, to_cpy);
+-              bhi_vec->dma_addr = mhi_buf->dma_addr;
+-              bhi_vec->size = to_cpy;
++              bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr);
++              bhi_vec->size = cpu_to_le64(to_cpy);
+ 
+               buf += to_cpy;
+               remainder -= to_cpy;
+--- a/drivers/bus/mhi/host/internal.h
++++ b/drivers/bus/mhi/host/internal.h
+@@ -263,8 +263,8 @@ struct mhi_tre {
+ };
+ 
+ struct bhi_vec_entry {
+-      u64 dma_addr;
+-      u64 size;
++      __le64 dma_addr;
++      __le64 size;
+ };
+ 
+ enum mhi_cmd_type {

diff --git a/queue-5.10/cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch b/queue-5.10/cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch
new file mode 100644 (file)
index 0000000..3f3e272
--- /dev/null
+++ b/queue-5.10/cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch
@@ -0,0 +1,34 @@
+From 4a26df233266a628157d7f0285451d8655defdfc Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Tue, 1 Jul 2025 17:30:01 -0500
+Subject: cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+commit 4a26df233266a628157d7f0285451d8655defdfc upstream.
+
+The freq_tables[] array has num_possible_cpus() elements so, to avoid an
+out of bounds access, this loop should be capped at "< nb_cpus" instead
+of "<= nb_cpus".  The freq_tables[] array is allocated in
+armada_8k_cpufreq_init().
+
+Cc: stable@vger.kernel.org
+Fixes: f525a670533d ("cpufreq: ap806: add cpufreq driver for Armada 8K")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/armada-8k-cpufreq.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/cpufreq/armada-8k-cpufreq.c
++++ b/drivers/cpufreq/armada-8k-cpufreq.c
+@@ -96,7 +96,7 @@ static void armada_8k_cpufreq_free_table
+ {
+       int opps_index, nb_cpus = num_possible_cpus();
+ 
+-      for (opps_index = 0 ; opps_index <= nb_cpus; opps_index++) {
++      for (opps_index = 0 ; opps_index < nb_cpus; opps_index++) {
+               int i;
+ 
+               /* If cpu_dev is NULL then we reached the end of the array */

diff --git a/queue-5.10/m68k-fix-lost-column-on-framebuffer-debug-console.patch b/queue-5.10/m68k-fix-lost-column-on-framebuffer-debug-console.patch
new file mode 100644 (file)
index 0000000..0543d2e
--- /dev/null
+++ b/queue-5.10/m68k-fix-lost-column-on-framebuffer-debug-console.patch
@@ -0,0 +1,97 @@
+From 210a1ce8ed4391b64a888b3fb4b5611a13f5ccc7 Mon Sep 17 00:00:00 2001
+From: Finn Thain <fthain@linux-m68k.org>
+Date: Fri, 28 Mar 2025 09:39:55 +1100
+Subject: m68k: Fix lost column on framebuffer debug console
+
+From: Finn Thain <fthain@linux-m68k.org>
+
+commit 210a1ce8ed4391b64a888b3fb4b5611a13f5ccc7 upstream.
+
+Move the cursor position rightward after rendering the character,
+not before. This avoids complications that arise when the recursive
+console_putc call has to wrap the line and/or scroll the display.
+This also fixes the linewrap bug that crops off the rightmost column.
+
+When the cursor is at the bottom of the display, a linefeed will not
+move the cursor position further downward. Instead, the display scrolls
+upward. Avoid the repeated add/subtract sequence by way of a single
+subtraction at the initialization of console_struct_num_rows.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Finn Thain <fthain@linux-m68k.org>
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Link: https://lore.kernel.org/9d4e8c68a456d5f2bc254ac6f87a472d066ebd5e.1743115195.git.fthain@linux-m68k.org
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/m68k/kernel/head.S |   31 +++++++++++++++++++++----------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+--- a/arch/m68k/kernel/head.S
++++ b/arch/m68k/kernel/head.S
+@@ -3379,6 +3379,7 @@ L(console_clear_loop):
+ 
+       movel   %d4,%d1                         /* screen height in pixels */
+       divul   %a0@(FONT_DESC_HEIGHT),%d1      /* d1 = max num rows */
++      subql   #1,%d1                          /* row range is 0 to num - 1 */
+ 
+       movel   %d0,%a2@(Lconsole_struct_num_columns)
+       movel   %d1,%a2@(Lconsole_struct_num_rows)
+@@ -3525,15 +3526,14 @@ func_start     console_putc,%a0/%a1/%d0-%d7
+       cmpib   #10,%d7
+       jne     L(console_not_lf)
+       movel   %a0@(Lconsole_struct_cur_row),%d0
+-      addil   #1,%d0
+-      movel   %d0,%a0@(Lconsole_struct_cur_row)
+       movel   %a0@(Lconsole_struct_num_rows),%d1
+       cmpl    %d1,%d0
+       jcs     1f
+-      subil   #1,%d0
+-      movel   %d0,%a0@(Lconsole_struct_cur_row)
+       console_scroll
++      jra     L(console_exit)
+ 1:
++      addql   #1,%d0
++      movel   %d0,%a0@(Lconsole_struct_cur_row)
+       jra     L(console_exit)
+ 
+ L(console_not_lf):
+@@ -3560,12 +3560,6 @@ L(console_not_cr):
+  */
+ L(console_not_home):
+       movel   %a0@(Lconsole_struct_cur_column),%d0
+-      addql   #1,%a0@(Lconsole_struct_cur_column)
+-      movel   %a0@(Lconsole_struct_num_columns),%d1
+-      cmpl    %d1,%d0
+-      jcs     1f
+-      console_putc    #'\n'   /* recursion is OK! */
+-1:
+       movel   %a0@(Lconsole_struct_cur_row),%d1
+ 
+       /*
+@@ -3612,6 +3606,23 @@ L(console_do_font_scanline):
+       addq    #1,%d1
+       dbra    %d7,L(console_read_char_scanline)
+ 
++      /*
++       *      Register usage in the code below:
++       *      a0 = pointer to console globals
++       *      d0 = cursor column
++       *      d1 = cursor column limit
++       */
++
++      lea     %pc@(L(console_globals)),%a0
++
++      movel   %a0@(Lconsole_struct_cur_column),%d0
++      addql   #1,%d0
++      movel   %d0,%a0@(Lconsole_struct_cur_column)    /* Update cursor pos */
++      movel   %a0@(Lconsole_struct_num_columns),%d1
++      cmpl    %d1,%d0
++      jcs     L(console_exit)
++      console_putc    #'\n'           /* Line wrap using tail recursion */
++
+ L(console_exit):
+ func_return   console_putc
+ 

diff --git a/queue-5.10/series b/queue-5.10/series
index 8cd478a54d0a3b164b2e6d74a12336cafe12c03a..7988a62c998bdfc7778e1f43e585e5a3807067b3 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -352,3 +352,11 @@ mm-kmemleak-avoid-deadlock-by-moving-pr_warn-outside-kmemleak_lock.patch
 media-uvcvideo-fix-1-byte-out-of-bounds-read-in-uvc_parse_format.patch
 media-uvcvideo-do-not-mark-valid-metadata-as-invalid.patch
 serial-8250-fix-panic-due-to-pslverr.patch
+cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch
+m68k-fix-lost-column-on-framebuffer-debug-console.patch
+usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch
+usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch
+usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch
+bus-mhi-host-fix-endianness-of-bhi-vector-table.patch
+vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch
+vt-defkeymap-map-keycodes-above-127-to-k_hole.patch

diff --git a/queue-5.10/usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch b/queue-5.10/usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch
new file mode 100644 (file)
index 0000000..ff217c0
--- /dev/null
+++ b/queue-5.10/usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch
@@ -0,0 +1,231 @@
+From 8d1b02e5d7e3a6d2acffb1f4c094678fda9e3456 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Tue, 22 Jul 2025 12:11:18 -0700
+Subject: usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 8d1b02e5d7e3a6d2acffb1f4c094678fda9e3456 upstream.
+
+After a recent change in clang to expose uninitialized warnings from
+const variables [1], there is a warning in cxacru_heavy_init():
+
+  drivers/usb/atm/cxacru.c:1104:6: error: variable 'bp' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized]
+   1104 |         if (instance->modem_type->boot_rom_patch) {
+        |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  drivers/usb/atm/cxacru.c:1113:39: note: uninitialized use occurs here
+   1113 |         cxacru_upload_firmware(instance, fw, bp);
+        |                                              ^~
+  drivers/usb/atm/cxacru.c:1104:2: note: remove the 'if' if its condition is always true
+   1104 |         if (instance->modem_type->boot_rom_patch) {
+        |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  drivers/usb/atm/cxacru.c:1095:32: note: initialize the variable 'bp' to silence this warning
+   1095 |         const struct firmware *fw, *bp;
+        |                                       ^
+        |                                        = NULL
+
+While the warning is technically correct that bp is conditionally passed
+uninitialized to cxacru_upload_firmware(), it is ultimately a false
+positive warning on the uninitialized use of bp because the same
+condition that initializes bp, instance->modem_type->boot_rom_patch, is
+the same one that gates the use of bp within cxacru_upload_firmware().
+As this warning occurs in clang's frontend before inlining occurs, it
+cannot know that these conditions are indentical to avoid the warning.
+
+Manually inline cxacru_upload_firmware() into cxacru_heavy_init(), as
+that is its only callsite, so that clang can see that bp is initialized
+and used under the same condition, clearing up the warning without any
+functional changes to the code (LLVM was already doing this inlining
+later).
+
+Cc: stable@vger.kernel.org
+Fixes: 1b0e61465234 ("[PATCH] USB ATM: driver for the Conexant AccessRunner chipset cxacru")
+Closes: https://github.com/ClangBuiltLinux/linux/issues/2102
+Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://lore.kernel.org/r/20250722-usb-cxacru-fix-clang-21-uninit-warning-v2-1-6708a18decd2@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/atm/cxacru.c |  106 +++++++++++++++++++++--------------------------
+ 1 file changed, 49 insertions(+), 57 deletions(-)
+
+--- a/drivers/usb/atm/cxacru.c
++++ b/drivers/usb/atm/cxacru.c
+@@ -983,25 +983,60 @@ cleanup:
+       return ret;
+ }
+ 
+-static void cxacru_upload_firmware(struct cxacru_data *instance,
+-                                 const struct firmware *fw,
+-                                 const struct firmware *bp)
++
++static int cxacru_find_firmware(struct cxacru_data *instance,
++                              char *phase, const struct firmware **fw_p)
+ {
+-      int ret;
++      struct usbatm_data *usbatm = instance->usbatm;
++      struct device *dev = &usbatm->usb_intf->dev;
++      char buf[16];
++
++      sprintf(buf, "cxacru-%s.bin", phase);
++      usb_dbg(usbatm, "cxacru_find_firmware: looking for %s\n", buf);
++
++      if (request_firmware(fw_p, buf, dev)) {
++              usb_dbg(usbatm, "no stage %s firmware found\n", phase);
++              return -ENOENT;
++      }
++
++      usb_info(usbatm, "found firmware %s\n", buf);
++
++      return 0;
++}
++
++static int cxacru_heavy_init(struct usbatm_data *usbatm_instance,
++                           struct usb_interface *usb_intf)
++{
++      const struct firmware *fw, *bp;
++      struct cxacru_data *instance = usbatm_instance->driver_data;
+       struct usbatm_data *usbatm = instance->usbatm;
+       struct usb_device *usb_dev = usbatm->usb_dev;
+       __le16 signature[] = { usb_dev->descriptor.idVendor,
+                              usb_dev->descriptor.idProduct };
+       __le32 val;
++      int ret;
++
++      ret = cxacru_find_firmware(instance, "fw", &fw);
++      if (ret) {
++              usb_warn(usbatm_instance, "firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n");
++              return ret;
++      }
+ 
+-      usb_dbg(usbatm, "%s\n", __func__);
++      if (instance->modem_type->boot_rom_patch) {
++              ret = cxacru_find_firmware(instance, "bp", &bp);
++              if (ret) {
++                      usb_warn(usbatm_instance, "boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n");
++                      release_firmware(fw);
++                      return ret;
++              }
++      }
+ 
+       /* FirmwarePllFClkValue */
+       val = cpu_to_le32(instance->modem_type->pll_f_clk);
+       ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLFCLK_ADDR, (u8 *) &val, 4);
+       if (ret) {
+               usb_err(usbatm, "FirmwarePllFClkValue failed: %d\n", ret);
+-              return;
++              goto done;
+       }
+ 
+       /* FirmwarePllBClkValue */
+@@ -1009,7 +1044,7 @@ static void cxacru_upload_firmware(struc
+       ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLBCLK_ADDR, (u8 *) &val, 4);
+       if (ret) {
+               usb_err(usbatm, "FirmwarePllBClkValue failed: %d\n", ret);
+-              return;
++              goto done;
+       }
+ 
+       /* Enable SDRAM */
+@@ -1017,7 +1052,7 @@ static void cxacru_upload_firmware(struc
+       ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SDRAMEN_ADDR, (u8 *) &val, 4);
+       if (ret) {
+               usb_err(usbatm, "Enable SDRAM failed: %d\n", ret);
+-              return;
++              goto done;
+       }
+ 
+       /* Firmware */
+@@ -1025,7 +1060,7 @@ static void cxacru_upload_firmware(struc
+       ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, FW_ADDR, fw->data, fw->size);
+       if (ret) {
+               usb_err(usbatm, "Firmware upload failed: %d\n", ret);
+-              return;
++              goto done;
+       }
+ 
+       /* Boot ROM patch */
+@@ -1034,7 +1069,7 @@ static void cxacru_upload_firmware(struc
+               ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, BR_ADDR, bp->data, bp->size);
+               if (ret) {
+                       usb_err(usbatm, "Boot ROM patching failed: %d\n", ret);
+-                      return;
++                      goto done;
+               }
+       }
+ 
+@@ -1042,7 +1077,7 @@ static void cxacru_upload_firmware(struc
+       ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SIG_ADDR, (u8 *) signature, 4);
+       if (ret) {
+               usb_err(usbatm, "Signature storing failed: %d\n", ret);
+-              return;
++              goto done;
+       }
+ 
+       usb_info(usbatm, "starting device\n");
+@@ -1054,7 +1089,7 @@ static void cxacru_upload_firmware(struc
+       }
+       if (ret) {
+               usb_err(usbatm, "Passing control to firmware failed: %d\n", ret);
+-              return;
++              goto done;
+       }
+ 
+       /* Delay to allow firmware to start up. */
+@@ -1068,53 +1103,10 @@ static void cxacru_upload_firmware(struc
+       ret = cxacru_cm(instance, CM_REQUEST_CARD_GET_STATUS, NULL, 0, NULL, 0);
+       if (ret < 0) {
+               usb_err(usbatm, "modem failed to initialize: %d\n", ret);
+-              return;
+-      }
+-}
+-
+-static int cxacru_find_firmware(struct cxacru_data *instance,
+-                              char *phase, const struct firmware **fw_p)
+-{
+-      struct usbatm_data *usbatm = instance->usbatm;
+-      struct device *dev = &usbatm->usb_intf->dev;
+-      char buf[16];
+-
+-      sprintf(buf, "cxacru-%s.bin", phase);
+-      usb_dbg(usbatm, "cxacru_find_firmware: looking for %s\n", buf);
+-
+-      if (request_firmware(fw_p, buf, dev)) {
+-              usb_dbg(usbatm, "no stage %s firmware found\n", phase);
+-              return -ENOENT;
++              goto done;
+       }
+ 
+-      usb_info(usbatm, "found firmware %s\n", buf);
+-
+-      return 0;
+-}
+-
+-static int cxacru_heavy_init(struct usbatm_data *usbatm_instance,
+-                           struct usb_interface *usb_intf)
+-{
+-      const struct firmware *fw, *bp;
+-      struct cxacru_data *instance = usbatm_instance->driver_data;
+-      int ret = cxacru_find_firmware(instance, "fw", &fw);
+-
+-      if (ret) {
+-              usb_warn(usbatm_instance, "firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n");
+-              return ret;
+-      }
+-
+-      if (instance->modem_type->boot_rom_patch) {
+-              ret = cxacru_find_firmware(instance, "bp", &bp);
+-              if (ret) {
+-                      usb_warn(usbatm_instance, "boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n");
+-                      release_firmware(fw);
+-                      return ret;
+-              }
+-      }
+-
+-      cxacru_upload_firmware(instance, fw, bp);
+-
++done:
+       if (instance->modem_type->boot_rom_patch)
+               release_firmware(bp);
+       release_firmware(fw);

diff --git a/queue-5.10/usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch b/queue-5.10/usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch
new file mode 100644 (file)
index 0000000..2461d20
--- /dev/null
+++ b/queue-5.10/usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch
@@ -0,0 +1,35 @@
+From 93b400f4951404d040197943a25d6fef9f8ccabb Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 24 Jul 2025 11:19:07 +0200
+Subject: usb: dwc3: meson-g12a: fix device leaks at unbind
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 93b400f4951404d040197943a25d6fef9f8ccabb upstream.
+
+Make sure to drop the references taken to the child devices by
+of_find_device_by_node() during probe on driver unbind.
+
+Fixes: c99993376f72 ("usb: dwc3: Add Amlogic G12A DWC3 glue")
+Cc: stable@vger.kernel.org     # 5.2
+Cc: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20250724091910.21092-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-meson-g12a.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
+@@ -844,6 +844,9 @@ static int dwc3_meson_g12a_remove(struct
+       if (priv->drvdata->otg_switch_supported)
+               usb_role_switch_unregister(priv->role_switch);
+ 
++      put_device(priv->switch_desc.udc);
++      put_device(priv->switch_desc.usb2_port);
++
+       of_platform_depopulate(dev);
+ 
+       for (i = 0 ; i < PHY_COUNT ; ++i) {

diff --git a/queue-5.10/usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch b/queue-5.10/usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch
new file mode 100644 (file)
index 0000000..8c5548c
--- /dev/null
+++ b/queue-5.10/usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch
@@ -0,0 +1,32 @@
+From 868837b0a94c6b1b1fdbc04d3ba218ca83432393 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 24 Jul 2025 11:19:08 +0200
+Subject: usb: gadget: udc: renesas_usb3: fix device leak at unbind
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 868837b0a94c6b1b1fdbc04d3ba218ca83432393 upstream.
+
+Make sure to drop the reference to the companion device taken during
+probe when the driver is unbound.
+
+Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch")
+Cc: stable@vger.kernel.org     # 4.19
+Cc: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20250724091910.21092-4-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/renesas_usb3.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -2566,6 +2566,7 @@ static int renesas_usb3_remove(struct pl
+       struct renesas_usb3 *usb3 = platform_get_drvdata(pdev);
+ 
+       debugfs_remove_recursive(usb3->dentry);
++      put_device(usb3->host_dev);
+       device_remove_file(&pdev->dev, &dev_attr_role);
+ 
+       cancel_work_sync(&usb3->role_work);

diff --git a/queue-5.10/vt-defkeymap-map-keycodes-above-127-to-k_hole.patch b/queue-5.10/vt-defkeymap-map-keycodes-above-127-to-k_hole.patch
new file mode 100644 (file)
index 0000000..bc0075a
--- /dev/null
+++ b/queue-5.10/vt-defkeymap-map-keycodes-above-127-to-k_hole.patch
@@ -0,0 +1,194 @@
+From b43cb4ff85da5cf29c4cd351ef1d7dd8210780f7 Mon Sep 17 00:00:00 2001
+From: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+Date: Wed, 2 Jul 2025 21:17:58 +0700
+Subject: vt: defkeymap: Map keycodes above 127 to K_HOLE
+
+From: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+
+commit b43cb4ff85da5cf29c4cd351ef1d7dd8210780f7 upstream.
+
+The maximum number of keycodes got bumped to 256 a very long time ago,
+but the default keymaps were never adjusted to match. This is causing
+the kernel to interpret keycodes above 127 as U+0000 if the shipped
+generated keymap is used.
+
+Fix this by mapping all keycodes above 127 to K_HOLE so the kernel
+ignores them.
+
+The contents of this patche were generated by rerunning `loadkeys
+--mktable --unicode` and only including the changes to map keycodes
+above 127 to K_HOLE.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+Cc: stable <stable@kernel.org>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-2-c27e143cc2eb@qtmlabs.xyz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/defkeymap.c_shipped |  112 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 112 insertions(+)
+
+--- a/drivers/tty/vt/defkeymap.c_shipped
++++ b/drivers/tty/vt/defkeymap.c_shipped
+@@ -23,6 +23,22 @@ u_short plain_map[NR_KEYS] = {
+       0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116,
+       0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+       0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+ 
+ u_short shift_map[NR_KEYS] = {
+@@ -42,6 +58,22 @@ u_short shift_map[NR_KEYS] = {
+       0xf20b, 0xf601, 0xf602, 0xf117, 0xf600, 0xf20a, 0xf115, 0xf116,
+       0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+       0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+ 
+ u_short altgr_map[NR_KEYS] = {
+@@ -61,6 +93,22 @@ u_short altgr_map[NR_KEYS] = {
+       0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116,
+       0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+       0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+ 
+ u_short ctrl_map[NR_KEYS] = {
+@@ -80,6 +128,22 @@ u_short ctrl_map[NR_KEYS] = {
+       0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116,
+       0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+       0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+ 
+ u_short shift_ctrl_map[NR_KEYS] = {
+@@ -99,6 +163,22 @@ u_short shift_ctrl_map[NR_KEYS] = {
+       0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116,
+       0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+       0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+ 
+ u_short alt_map[NR_KEYS] = {
+@@ -118,6 +198,22 @@ u_short alt_map[NR_KEYS] = {
+       0xf118, 0xf210, 0xf211, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116,
+       0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+       0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+ 
+ u_short ctrl_alt_map[NR_KEYS] = {
+@@ -137,6 +233,22 @@ u_short ctrl_alt_map[NR_KEYS] = {
+       0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf20c,
+       0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d,
+       0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
++      0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200,
+ };
+ 
+ ushort *key_maps[MAX_NR_KEYMAPS] = {

diff --git a/queue-5.10/vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch b/queue-5.10/vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch
new file mode 100644 (file)
index 0000000..80274a6
--- /dev/null
+++ b/queue-5.10/vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch
@@ -0,0 +1,35 @@
+From b1cc2092ea7a52e2c435aee6d2b1bcb773202663 Mon Sep 17 00:00:00 2001
+From: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+Date: Wed, 2 Jul 2025 21:17:57 +0700
+Subject: vt: keyboard: Don't process Unicode characters in K_OFF mode
+
+From: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+
+commit b1cc2092ea7a52e2c435aee6d2b1bcb773202663 upstream.
+
+We don't process Unicode characters if the virtual terminal is in raw
+mode, so there's no reason why we shouldn't do the same for K_OFF
+(especially since people would expect K_OFF to actually turn off all VT
+key processing).
+
+Fixes: 9fc3de9c8356 ("vt: Add virtual console keyboard mode OFF")
+Signed-off-by: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+Cc: stable <stable@kernel.org>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-1-c27e143cc2eb@qtmlabs.xyz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/keyboard.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -1461,7 +1461,7 @@ static void kbd_keycode(unsigned int key
+               rc = atomic_notifier_call_chain(&keyboard_notifier_list,
+                                               KBD_UNICODE, &param);
+               if (rc != NOTIFY_STOP)
+-                      if (down && !raw_mode)
++                      if (down && !(raw_mode || kbd->kbdmode == VC_OFF))
+                               k_unicode(vc, keysym, !down);
+               return;
+       }