--- /dev/null
+From c6cb8bf79466ae66bd0d07338c7c505ce758e9d7 Mon Sep 17 00:00:00 2001
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Date: Thu, 10 Apr 2025 14:46:32 -0400
+Subject: Input: cyttsp5 - ensure minimum reset pulse width
+
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+
+commit c6cb8bf79466ae66bd0d07338c7c505ce758e9d7 upstream.
+
+The current reset pulse width is measured to be 5us on a
+Renesas RZ/G2L SOM. The manufacturer's minimum reset pulse width is
+specified as 10us.
+
+Extend reset pulse width to make sure it is long enough on all platforms.
+
+Also reword confusing comments about reset pin assertion.
+
+Fixes: 5b0c03e24a06 ("Input: Add driver for Cypress Generation 5 touchscreen")
+Cc: stable@vger.kernel.org
+Acked-by: Alistair Francis <alistair@alistair23.me>
+Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Link: https://lore.kernel.org/r/20250410184633.1164837-1-hugo@hugovil.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/touchscreen/cyttsp5.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/touchscreen/cyttsp5.c
++++ b/drivers/input/touchscreen/cyttsp5.c
+@@ -870,13 +870,16 @@ static int cyttsp5_probe(struct device *
+ ts->input->phys = ts->phys;
+ input_set_drvdata(ts->input, ts);
+
+- /* Reset the gpio to be in a reset state */
++ /* Assert gpio to be in a reset state */
+ ts->reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
+ if (IS_ERR(ts->reset_gpio)) {
+ error = PTR_ERR(ts->reset_gpio);
+ dev_err(dev, "Failed to request reset gpio, error %d\n", error);
+ return error;
+ }
++
++ fsleep(10); /* Ensure long-enough reset pulse (minimum 10us). */
++
+ gpiod_set_value_cansleep(ts->reset_gpio, 0);
+
+ /* Need a delay to have device up */
--- /dev/null
+From 7675b5efd81fe6d524e29d5a541f43201e98afa8 Mon Sep 17 00:00:00 2001
+From: Mikael Gonella-Bolduc <mgonellabolduc@dimonoff.com>
+Date: Wed, 23 Apr 2025 09:52:43 -0400
+Subject: Input: cyttsp5 - fix power control issue on wakeup
+
+From: Mikael Gonella-Bolduc <mgonellabolduc@dimonoff.com>
+
+commit 7675b5efd81fe6d524e29d5a541f43201e98afa8 upstream.
+
+The power control function ignores the "on" argument when setting the
+report ID, and thus is always sending HID_POWER_SLEEP. This causes a
+problem when trying to wakeup.
+
+Fix by sending the state variable, which contains the proper HID_POWER_ON or
+HID_POWER_SLEEP based on the "on" argument.
+
+Fixes: 3c98b8dbdced ("Input: cyttsp5 - implement proper sleep and wakeup procedures")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikael Gonella-Bolduc <mgonellabolduc@dimonoff.com>
+Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Reviewed-by: Alistair Francis <alistair@alistair23.me>
+Link: https://lore.kernel.org/r/20250423135243.1261460-1-hugo@hugovil.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/touchscreen/cyttsp5.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/touchscreen/cyttsp5.c
++++ b/drivers/input/touchscreen/cyttsp5.c
+@@ -580,7 +580,7 @@ static int cyttsp5_power_control(struct
+ int rc;
+
+ SET_CMD_REPORT_TYPE(cmd[0], 0);
+- SET_CMD_REPORT_ID(cmd[0], HID_POWER_SLEEP);
++ SET_CMD_REPORT_ID(cmd[0], state);
+ SET_CMD_OPCODE(cmd[1], HID_CMD_SET_POWER);
+
+ rc = cyttsp5_write(ts, HID_COMMAND_REG, cmd, sizeof(cmd));
--- /dev/null
+From 11cdb506d0fbf5ac05bf55f5afcb3a215c316490 Mon Sep 17 00:00:00 2001
+From: Gary Bisson <bisson.gary@gmail.com>
+Date: Tue, 29 Apr 2025 09:16:29 -0700
+Subject: Input: mtk-pmic-keys - fix possible null pointer dereference
+
+From: Gary Bisson <bisson.gary@gmail.com>
+
+commit 11cdb506d0fbf5ac05bf55f5afcb3a215c316490 upstream.
+
+In mtk_pmic_keys_probe, the regs parameter is only set if the button is
+parsed in the device tree. However, on hardware where the button is left
+floating, that node will most likely be removed not to enable that
+input. In that case the code will try to dereference a null pointer.
+
+Let's use the regs struct instead as it is defined for all supported
+platforms. Note that it is ok setting the key reg even if that latter is
+disabled as the interrupt won't be enabled anyway.
+
+Fixes: b581acb49aec ("Input: mtk-pmic-keys - transfer per-key bit in mtk_pmic_keys_regs")
+Signed-off-by: Gary Bisson <bisson.gary@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/keyboard/mtk-pmic-keys.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/input/keyboard/mtk-pmic-keys.c
++++ b/drivers/input/keyboard/mtk-pmic-keys.c
+@@ -147,8 +147,8 @@ static void mtk_pmic_keys_lp_reset_setup
+ u32 value, mask;
+ int error;
+
+- kregs_home = keys->keys[MTK_PMIC_HOMEKEY_INDEX].regs;
+- kregs_pwr = keys->keys[MTK_PMIC_PWRKEY_INDEX].regs;
++ kregs_home = ®s->keys_regs[MTK_PMIC_HOMEKEY_INDEX];
++ kregs_pwr = ®s->keys_regs[MTK_PMIC_PWRKEY_INDEX];
+
+ error = of_property_read_u32(keys->dev->of_node, "power-off-time-sec",
+ &long_press_debounce);
--- /dev/null
+From a609cb4cc07aa9ab8f50466622814356c06f2c17 Mon Sep 17 00:00:00 2001
+From: Aditya Garg <gargaditya08@live.com>
+Date: Wed, 7 May 2025 12:12:15 -0700
+Subject: Input: synaptics - enable InterTouch on Dell Precision M3800
+
+From: Aditya Garg <gargaditya08@live.com>
+
+commit a609cb4cc07aa9ab8f50466622814356c06f2c17 upstream.
+
+Enable InterTouch mode on Dell Precision M3800 by adding "DLL060d" to
+the list of SMBus-enabled variants.
+
+Reported-by: Markus Rathgeb <maggu2810@gmail.com>
+Signed-off-by: Aditya Garg <gargaditya08@live.com>
+Link: https://lore.kernel.org/r/PN3PR01MB959789DD6D574E16141E5DC4B888A@PN3PR01MB9597.INDPRD01.PROD.OUTLOOK.COM
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -163,6 +163,7 @@ static const char * const topbuttonpad_p
+
+ static const char * const smbus_pnp_ids[] = {
+ /* all of the topbuttonpad_pnp_ids are valid, we just add some extras */
++ "DLL060d", /* Dell Precision M3800 */
+ "LEN0048", /* X1 Carbon 3 */
+ "LEN0046", /* X250 */
+ "LEN0049", /* Yoga 11e */
--- /dev/null
+From 6d7ea0881000966607772451b789b5fb5766f11d Mon Sep 17 00:00:00 2001
+From: Manuel Fombuena <fombuena@outlook.com>
+Date: Wed, 7 May 2025 12:05:26 -0700
+Subject: Input: synaptics - enable InterTouch on Dynabook Portege X30-D
+
+From: Manuel Fombuena <fombuena@outlook.com>
+
+commit 6d7ea0881000966607772451b789b5fb5766f11d upstream.
+
+[ 5.989588] psmouse serio1: synaptics: Your touchpad (PNP: TOS0213 PNP0f03) says it can support a different bus. If i2c-hid and hid-rmi are not used, you might want to try setting psmouse.synaptics_intertouch to 1 and report this to linux-input@vger.kernel.org.
+[ 6.039923] psmouse serio1: synaptics: Touchpad model: 1, fw: 9.32, id: 0x1e2a1, caps: 0xf00223/0x840300/0x12e800/0x52d884, board id: 3322, fw id: 2658004
+
+The board is labelled TM3322.
+
+Present on the Toshiba / Dynabook Portege X30-D and possibly others.
+
+Confirmed working well with psmouse.synaptics_intertouch=1 and local build.
+
+Signed-off-by: Manuel Fombuena <fombuena@outlook.com>
+Signed-off-by: Aditya Garg <gargaditya08@live.com>
+Link: https://lore.kernel.org/r/PN3PR01MB9597711E7933A08389FEC31DB888A@PN3PR01MB9597.INDPRD01.PROD.OUTLOOK.COM
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -194,6 +194,7 @@ static const char * const smbus_pnp_ids[
+ "SYN3221", /* HP 15-ay000 */
+ "SYN323d", /* HP Spectre X360 13-w013dx */
+ "SYN3257", /* HP Envy 13-ad105ng */
++ "TOS0213", /* Dynabook Portege X30-D */
+ NULL
+ };
+
--- /dev/null
+From 47d768b32e644b56901bb4bbbdb1feb01ea86c85 Mon Sep 17 00:00:00 2001
+From: Aditya Garg <gargaditya08@live.com>
+Date: Wed, 7 May 2025 12:06:32 -0700
+Subject: Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
+
+From: Aditya Garg <gargaditya08@live.com>
+
+commit 47d768b32e644b56901bb4bbbdb1feb01ea86c85 upstream.
+
+Enable InterTouch mode on Dynabook Portege X30L-G by adding "TOS01f6" to
+the list of SMBus-enabled variants.
+
+Reported-by: Xuntao Chi <chotaotao1qaz2wsx@gmail.com>
+Tested-by: Xuntao Chi <chotaotao1qaz2wsx@gmail.com>
+Signed-off-by: Aditya Garg <gargaditya08@live.com>
+Link: https://lore.kernel.org/r/PN3PR01MB959786E4AC797160CDA93012B888A@PN3PR01MB9597.INDPRD01.PROD.OUTLOOK.COM
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -194,6 +194,7 @@ static const char * const smbus_pnp_ids[
+ "SYN3221", /* HP 15-ay000 */
+ "SYN323d", /* HP Spectre X360 13-w013dx */
+ "SYN3257", /* HP Envy 13-ad105ng */
++ "TOS01f6", /* Dynabook Portege X30L-G */
+ "TOS0213", /* Dynabook Portege X30-D */
+ NULL
+ };
--- /dev/null
+From 2abc698ac77314e0de5b33a6d96a39c5159d88e4 Mon Sep 17 00:00:00 2001
+From: Aditya Garg <gargaditya08@live.com>
+Date: Wed, 7 May 2025 12:09:00 -0700
+Subject: Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
+
+From: Aditya Garg <gargaditya08@live.com>
+
+commit 2abc698ac77314e0de5b33a6d96a39c5159d88e4 upstream.
+
+Enable InterTouch mode on TUXEDO InfinityBook Pro 14 v5 by adding
+"SYN1221" to the list of SMBus-enabled variants.
+
+Add support for InterTouch on SYN1221 by adding it to the list of
+SMBus-enabled variants.
+
+Reported-by: Matthias Eilert <kernel.hias@eilert.tech>
+Tested-by: Matthias Eilert <kernel.hias@eilert.tech>
+Signed-off-by: Aditya Garg <gargaditya08@live.com>
+Link: https://lore.kernel.org/r/PN3PR01MB9597C033C4BC20EE2A0C4543B888A@PN3PR01MB9597.INDPRD01.PROD.OUTLOOK.COM
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -190,6 +190,7 @@ static const char * const smbus_pnp_ids[
+ "LEN2054", /* E480 */
+ "LEN2055", /* E580 */
+ "LEN2068", /* T14 Gen 1 */
++ "SYN1221", /* TUXEDO InfinityBook Pro 14 v5 */
+ "SYN3003", /* HP EliteBook 850 G1 */
+ "SYN3015", /* HP EliteBook 840 G2 */
+ "SYN3052", /* HP EliteBook 840 G4 */
--- /dev/null
+From f04f03d3e99bc8f89b6af5debf07ff67d961bc23 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Wed, 7 May 2025 14:52:55 -0700
+Subject: Input: synaptics - enable SMBus for HP Elitebook 850 G1
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit f04f03d3e99bc8f89b6af5debf07ff67d961bc23 upstream.
+
+The kernel reports that the touchpad for this device can support
+SMBus mode.
+
+Reported-by: jt <enopatch@gmail.com>
+Link: https://lore.kernel.org/r/iys5dbv3ldddsgobfkxldazxyp54kay4bozzmagga6emy45jop@2ebvuxgaui4u
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -190,6 +190,7 @@ static const char * const smbus_pnp_ids[
+ "LEN2054", /* E480 */
+ "LEN2055", /* E580 */
+ "LEN2068", /* T14 Gen 1 */
++ "SYN3003", /* HP EliteBook 850 G1 */
+ "SYN3015", /* HP EliteBook 840 G2 */
+ "SYN3052", /* HP EliteBook 840 G4 */
+ "SYN3221", /* HP 15-ay000 */
--- /dev/null
+From 22cd66a5db56a07d9e621367cb4d16ff0f6baf56 Mon Sep 17 00:00:00 2001
+From: Lode Willems <me@lodewillems.com>
+Date: Tue, 22 Apr 2025 13:24:27 +0200
+Subject: Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller
+
+From: Lode Willems <me@lodewillems.com>
+
+commit 22cd66a5db56a07d9e621367cb4d16ff0f6baf56 upstream.
+
+This patch adds support for the 8BitDo Ultimate 2 Wireless Controller.
+Tested using the wireless dongle and plugged in.
+
+Signed-off-by: Lode Willems <me@lodewillems.com>
+Link: https://lore.kernel.org/r/20250422112457.6728-1-me@lodewillems.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -388,6 +388,7 @@ static const struct xpad_device {
+ { 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 },
+ { 0x2dc8, 0x3109, "8BitDo Ultimate Wireless Bluetooth", 0, XTYPE_XBOX360 },
+ { 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 },
++ { 0x2dc8, 0x310b, "8BitDo Ultimate 2 Wireless Controller", 0, XTYPE_XBOX360 },
+ { 0x2dc8, 0x6001, "8BitDo SN30 Pro", 0, XTYPE_XBOX360 },
+ { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
+ { 0x2e24, 0x1688, "Hyperkin X91 X-Box One pad", 0, XTYPE_XBOXONE },
--- /dev/null
+From 4ef46367073b107ec22f46fe5f12176e87c238e8 Mon Sep 17 00:00:00 2001
+From: Vicki Pfau <vi@endrift.com>
+Date: Sat, 10 May 2025 22:59:25 -0700
+Subject: Input: xpad - fix Share button on Xbox One controllers
+
+From: Vicki Pfau <vi@endrift.com>
+
+commit 4ef46367073b107ec22f46fe5f12176e87c238e8 upstream.
+
+The Share button, if present, is always one of two offsets from the end of the
+file, depending on the presence of a specific interface. As we lack parsing for
+the identify packet we can't automatically determine the presence of that
+interface, but we can hardcode which of these offsets is correct for a given
+controller.
+
+More controllers are probably fixable by adding the MAP_SHARE_BUTTON in the
+future, but for now I only added the ones that I have the ability to test
+directly.
+
+Signed-off-by: Vicki Pfau <vi@endrift.com>
+Link: https://lore.kernel.org/r/20250328234345.989761-2-vi@endrift.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 35 ++++++++++++++++++++---------------
+ 1 file changed, 20 insertions(+), 15 deletions(-)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -77,12 +77,13 @@
+ * xbox d-pads should map to buttons, as is required for DDR pads
+ * but we map them to axes when possible to simplify things
+ */
+-#define MAP_DPAD_TO_BUTTONS (1 << 0)
+-#define MAP_TRIGGERS_TO_BUTTONS (1 << 1)
+-#define MAP_STICKS_TO_NULL (1 << 2)
+-#define MAP_SELECT_BUTTON (1 << 3)
+-#define MAP_PADDLES (1 << 4)
+-#define MAP_PROFILE_BUTTON (1 << 5)
++#define MAP_DPAD_TO_BUTTONS BIT(0)
++#define MAP_TRIGGERS_TO_BUTTONS BIT(1)
++#define MAP_STICKS_TO_NULL BIT(2)
++#define MAP_SHARE_BUTTON BIT(3)
++#define MAP_PADDLES BIT(4)
++#define MAP_PROFILE_BUTTON BIT(5)
++#define MAP_SHARE_OFFSET BIT(6)
+
+ #define DANCEPAD_MAP_CONFIG (MAP_DPAD_TO_BUTTONS | \
+ MAP_TRIGGERS_TO_BUTTONS | MAP_STICKS_TO_NULL)
+@@ -135,7 +136,7 @@ static const struct xpad_device {
+ { 0x03f0, 0x048D, "HyperX Clutch", 0, XTYPE_XBOX360 }, /* wireless */
+ { 0x03f0, 0x0495, "HyperX Clutch Gladiate", 0, XTYPE_XBOXONE },
+ { 0x03f0, 0x07A0, "HyperX Clutch Gladiate RGB", 0, XTYPE_XBOXONE },
+- { 0x03f0, 0x08B6, "HyperX Clutch Gladiate", 0, XTYPE_XBOXONE }, /* v2 */
++ { 0x03f0, 0x08B6, "HyperX Clutch Gladiate", MAP_SHARE_BUTTON, XTYPE_XBOXONE }, /* v2 */
+ { 0x03f0, 0x09B4, "HyperX Clutch Tanto", 0, XTYPE_XBOXONE },
+ { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX },
+ { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX },
+@@ -159,7 +160,7 @@ static const struct xpad_device {
+ { 0x045e, 0x0719, "Xbox 360 Wireless Receiver", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
+ { 0x045e, 0x0b00, "Microsoft X-Box One Elite 2 pad", MAP_PADDLES, XTYPE_XBOXONE },
+ { 0x045e, 0x0b0a, "Microsoft X-Box Adaptive Controller", MAP_PROFILE_BUTTON, XTYPE_XBOXONE },
+- { 0x045e, 0x0b12, "Microsoft Xbox Series S|X Controller", MAP_SELECT_BUTTON, XTYPE_XBOXONE },
++ { 0x045e, 0x0b12, "Microsoft Xbox Series S|X Controller", MAP_SHARE_BUTTON | MAP_SHARE_OFFSET, XTYPE_XBOXONE },
+ { 0x046d, 0xc21d, "Logitech Gamepad F310", 0, XTYPE_XBOX360 },
+ { 0x046d, 0xc21e, "Logitech Gamepad F510", 0, XTYPE_XBOX360 },
+ { 0x046d, 0xc21f, "Logitech Gamepad F710", 0, XTYPE_XBOX360 },
+@@ -211,7 +212,7 @@ static const struct xpad_device {
+ { 0x0738, 0xcb29, "Saitek Aviator Stick AV8R02", 0, XTYPE_XBOX360 },
+ { 0x0738, 0xf738, "Super SFIV FightStick TE S", 0, XTYPE_XBOX360 },
+ { 0x07ff, 0xffff, "Mad Catz GamePad", 0, XTYPE_XBOX360 },
+- { 0x0b05, 0x1a38, "ASUS ROG RAIKIRI", 0, XTYPE_XBOXONE },
++ { 0x0b05, 0x1a38, "ASUS ROG RAIKIRI", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
+ { 0x0b05, 0x1abb, "ASUS ROG RAIKIRI PRO", 0, XTYPE_XBOXONE },
+ { 0x0c12, 0x0005, "Intec wireless", 0, XTYPE_XBOX },
+ { 0x0c12, 0x8801, "Nyko Xbox Controller", 0, XTYPE_XBOX },
+@@ -390,7 +391,7 @@ static const struct xpad_device {
+ { 0x2dc8, 0x6001, "8BitDo SN30 Pro", 0, XTYPE_XBOX360 },
+ { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
+ { 0x2e24, 0x1688, "Hyperkin X91 X-Box One pad", 0, XTYPE_XBOXONE },
+- { 0x2e95, 0x0504, "SCUF Gaming Controller", MAP_SELECT_BUTTON, XTYPE_XBOXONE },
++ { 0x2e95, 0x0504, "SCUF Gaming Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
+ { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 },
+ { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 },
+ { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 },
+@@ -1027,7 +1028,7 @@ static void xpad360w_process_packet(stru
+ * The report format was gleaned from
+ * https://github.com/kylelemons/xbox/blob/master/xbox.go
+ */
+-static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *data)
++static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *data, u32 len)
+ {
+ struct input_dev *dev = xpad->dev;
+ bool do_sync = false;
+@@ -1068,8 +1069,12 @@ static void xpadone_process_packet(struc
+ /* menu/view buttons */
+ input_report_key(dev, BTN_START, data[4] & BIT(2));
+ input_report_key(dev, BTN_SELECT, data[4] & BIT(3));
+- if (xpad->mapping & MAP_SELECT_BUTTON)
+- input_report_key(dev, KEY_RECORD, data[22] & BIT(0));
++ if (xpad->mapping & MAP_SHARE_BUTTON) {
++ if (xpad->mapping & MAP_SHARE_OFFSET)
++ input_report_key(dev, KEY_RECORD, data[len - 26] & BIT(0));
++ else
++ input_report_key(dev, KEY_RECORD, data[len - 18] & BIT(0));
++ }
+
+ /* buttons A,B,X,Y */
+ input_report_key(dev, BTN_A, data[4] & BIT(4));
+@@ -1217,7 +1222,7 @@ static void xpad_irq_in(struct urb *urb)
+ xpad360w_process_packet(xpad, 0, xpad->idata);
+ break;
+ case XTYPE_XBOXONE:
+- xpadone_process_packet(xpad, 0, xpad->idata);
++ xpadone_process_packet(xpad, 0, xpad->idata, urb->actual_length);
+ break;
+ default:
+ xpad_process_packet(xpad, 0, xpad->idata);
+@@ -1944,7 +1949,7 @@ static int xpad_init_input(struct usb_xp
+ xpad->xtype == XTYPE_XBOXONE) {
+ for (i = 0; xpad360_btn[i] >= 0; i++)
+ input_set_capability(input_dev, EV_KEY, xpad360_btn[i]);
+- if (xpad->mapping & MAP_SELECT_BUTTON)
++ if (xpad->mapping & MAP_SHARE_BUTTON)
+ input_set_capability(input_dev, EV_KEY, KEY_RECORD);
+ } else {
+ for (i = 0; xpad_btn[i] >= 0; i++)
--- /dev/null
+From d05a424bea9aa3435009d5c462055008cc1545d8 Mon Sep 17 00:00:00 2001
+From: Vicki Pfau <vi@endrift.com>
+Date: Fri, 28 Mar 2025 16:43:36 -0700
+Subject: Input: xpad - fix two controller table values
+
+From: Vicki Pfau <vi@endrift.com>
+
+commit d05a424bea9aa3435009d5c462055008cc1545d8 upstream.
+
+Two controllers -- Mad Catz JOYTECH NEO SE Advanced and PDP Mirror's
+Edge Official -- were missing the value of the mapping field, and thus
+wouldn't detect properly.
+
+Signed-off-by: Vicki Pfau <vi@endrift.com>
+Link: https://lore.kernel.org/r/20250328234345.989761-1-vi@endrift.com
+Fixes: 540602a43ae5 ("Input: xpad - add a few new VID/PID combinations")
+Fixes: 3492321e2e60 ("Input: xpad - add multiple supported devices")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -206,7 +206,7 @@ static const struct xpad_device {
+ { 0x0738, 0x9871, "Mad Catz Portable Drum", 0, XTYPE_XBOX360 },
+ { 0x0738, 0xb726, "Mad Catz Xbox controller - MW2", 0, XTYPE_XBOX360 },
+ { 0x0738, 0xb738, "Mad Catz MVC2TE Stick 2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+- { 0x0738, 0xbeef, "Mad Catz JOYTECH NEO SE Advanced GamePad", XTYPE_XBOX360 },
++ { 0x0738, 0xbeef, "Mad Catz JOYTECH NEO SE Advanced GamePad", 0, XTYPE_XBOX360 },
+ { 0x0738, 0xcb02, "Saitek Cyborg Rumble Pad - PC/Xbox 360", 0, XTYPE_XBOX360 },
+ { 0x0738, 0xcb03, "Saitek P3200 Rumble Pad - PC/Xbox 360", 0, XTYPE_XBOX360 },
+ { 0x0738, 0xcb29, "Saitek Aviator Stick AV8R02", 0, XTYPE_XBOX360 },
+@@ -241,7 +241,7 @@ static const struct xpad_device {
+ { 0x0e6f, 0x0146, "Rock Candy Wired Controller for Xbox One", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x0147, "PDP Marvel Xbox One Controller", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x015c, "PDP Xbox One Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+- { 0x0e6f, 0x015d, "PDP Mirror's Edge Official Wired Controller for Xbox One", XTYPE_XBOXONE },
++ { 0x0e6f, 0x015d, "PDP Mirror's Edge Official Wired Controller for Xbox One", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x0161, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x0162, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x0163, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
--- /dev/null
+From 19f5ca461d5fc09bdf93a9f8e4bd78ed3a49dc71 Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Fri, 2 May 2025 16:02:33 +0200
+Subject: objtool/rust: add one more `noreturn` Rust function for Rust 1.87.0
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+commit 19f5ca461d5fc09bdf93a9f8e4bd78ed3a49dc71 upstream.
+
+Starting with Rust 1.87.0 (expected 2025-05-15), `objtool` may report:
+
+ rust/core.o: warning: objtool: _R..._4core9panicking9panic_fmt() falls
+ through to next function _R..._4core9panicking18panic_nounwind_fmt()
+
+ rust/core.o: warning: objtool: _R..._4core9panicking18panic_nounwind_fmt()
+ falls through to next function _R..._4core9panicking5panic()
+
+The reason is that `rust_begin_unwind` is now mangled:
+
+ _R..._7___rustc17rust_begin_unwind
+
+Thus add the mangled one to the list so that `objtool` knows it is
+actually `noreturn`.
+
+See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions")
+for more details.
+
+Alternatively, we could remove the fixed one in `noreturn.h` and relax
+this test to cover both, but it seems best to be strict as long as we can.
+
+Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
+Cc: Josh Poimboeuf <jpoimboe@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://lore.kernel.org/r/20250502140237.1659624-2-ojeda@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/objtool/check.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -228,6 +228,7 @@ static bool is_rust_noreturn(const struc
+ str_ends_with(func->name, "_4core9panicking19assert_failed_inner") ||
+ str_ends_with(func->name, "_4core9panicking30panic_null_pointer_dereference") ||
+ str_ends_with(func->name, "_4core9panicking36panic_misaligned_pointer_dereference") ||
++ str_ends_with(func->name, "_7___rustc17rust_begin_unwind") ||
+ strstr(func->name, "_4core9panicking13assert_failed") ||
+ strstr(func->name, "_4core9panicking11panic_const24panic_const_") ||
+ (strstr(func->name, "_4core5slice5index24slice_") &&
--- /dev/null
+From 7129ea6e242b00938532537da41ddf5fa3e21471 Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Fri, 2 May 2025 16:02:35 +0200
+Subject: rust: clean Rust 1.88.0's `unnecessary_transmutes` lint
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+commit 7129ea6e242b00938532537da41ddf5fa3e21471 upstream.
+
+Starting with Rust 1.88.0 (expected 2025-06-26) [1][2], `rustc` may
+introduce a new lint that catches unnecessary transmutes, e.g.:
+
+ error: unnecessary transmute
+ --> rust/uapi/uapi_generated.rs:23242:18
+ |
+ 23242 | unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u8) }
+ | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: replace this with: `(self._bitfield_1.get(0usize, 1u8) as u8 == 1)`
+ |
+ = note: `-D unnecessary-transmutes` implied by `-D warnings`
+ = help: to override `-D warnings` add `#[allow(unnecessary_transmutes)]`
+
+There are a lot of them (at least 300), but luckily they are all in
+`bindgen`-generated code.
+
+Thus clean all up by allowing it there.
+
+Since unknown lints trigger a lint itself in older compilers, do it
+conditionally so that we can keep the `unknown_lints` lint enabled.
+
+Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
+Link: https://github.com/rust-lang/rust/pull/136083 [1]
+Link: https://github.com/rust-lang/rust/issues/136067 [2]
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://lore.kernel.org/r/20250502140237.1659624-4-ojeda@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ init/Kconfig | 3 +++
+ rust/bindings/lib.rs | 1 +
+ rust/uapi/lib.rs | 1 +
+ 3 files changed, 5 insertions(+)
+
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -137,6 +137,9 @@ config LD_CAN_USE_KEEP_IN_OVERLAY
+ config RUSTC_HAS_COERCE_POINTEE
+ def_bool RUSTC_VERSION >= 108400
+
++config RUSTC_HAS_UNNECESSARY_TRANSMUTES
++ def_bool RUSTC_VERSION >= 108800
++
+ config PAHOLE_VERSION
+ int
+ default $(shell,$(srctree)/scripts/pahole-version.sh $(PAHOLE))
+--- a/rust/bindings/lib.rs
++++ b/rust/bindings/lib.rs
+@@ -26,6 +26,7 @@
+
+ #[allow(dead_code)]
+ #[allow(clippy::undocumented_unsafe_blocks)]
++#[cfg_attr(CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES, allow(unnecessary_transmutes))]
+ mod bindings_raw {
+ // Manual definition for blocklisted types.
+ type __kernel_size_t = usize;
+--- a/rust/uapi/lib.rs
++++ b/rust/uapi/lib.rs
+@@ -24,6 +24,7 @@
+ unreachable_pub,
+ unsafe_op_in_unsafe_fn
+ )]
++#![cfg_attr(CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES, allow(unnecessary_transmutes))]
+
+ // Manual definition of blocklisted types.
+ type __kernel_size_t = usize;
--- /dev/null
+From c016722fd57551f8a6fcf472c9d2bcf2130ea0ec Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Fri, 2 May 2025 16:02:36 +0200
+Subject: rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+commit c016722fd57551f8a6fcf472c9d2bcf2130ea0ec upstream.
+
+Starting with Rust 1.88.0 (expected 2025-06-26) [1], Clippy may start
+warning about paths that do not resolve in the `disallowed_macros`
+configuration:
+
+ warning: `kernel::dbg` does not refer to an existing macro
+ --> .clippy.toml:10:5
+ |
+ 10 | { path = "kernel::dbg", reason = "the `dbg!` macro is intended as a debugging tool" },
+ | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+This is a lint we requested at [2], due to the trouble debugging
+the lint due to false negatives (e.g. [3]), which we use to emulate
+`clippy::dbg_macro` [4]. See commit 8577c9dca799 ("rust: replace
+`clippy::dbg_macro` with `disallowed_macros`") for more details.
+
+Given the false negatives are not resolved yet, it is expected that
+Clippy complains about not finding this macro.
+
+Thus, until the false negatives are fixed (and, even then, probably we
+will need to wait for the MSRV to raise enough), use the escape hatch
+to allow an invalid path.
+
+Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
+Link: https://github.com/rust-lang/rust-clippy/pull/14397 [1]
+Link: https://github.com/rust-lang/rust-clippy/issues/11432 [2]
+Link: https://github.com/rust-lang/rust-clippy/issues/11431 [3]
+Link: https://github.com/rust-lang/rust-clippy/issues/11303 [4]
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://lore.kernel.org/r/20250502140237.1659624-5-ojeda@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ .clippy.toml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/.clippy.toml
++++ b/.clippy.toml
+@@ -7,5 +7,5 @@ check-private-items = true
+ disallowed-macros = [
+ # The `clippy::dbg_macro` lint only works with `std::dbg!`, thus we simulate
+ # it here, see: https://github.com/rust-lang/rust-clippy/issues/11303.
+- { path = "kernel::dbg", reason = "the `dbg!` macro is intended as a debugging tool" },
++ { path = "kernel::dbg", reason = "the `dbg!` macro is intended as a debugging tool", allow-invalid = true },
+ ]
fbnic-do-not-allow-mailbox-to-toggle-to-ready-outsid.patch
net-export-a-helper-for-adding-up-queue-stats.patch
virtio-net-fix-total-qstat-values.patch
+input-cyttsp5-ensure-minimum-reset-pulse-width.patch
+input-cyttsp5-fix-power-control-issue-on-wakeup.patch
+input-mtk-pmic-keys-fix-possible-null-pointer-dereference.patch
+input-xpad-fix-share-button-on-xbox-one-controllers.patch
+input-xpad-add-support-for-8bitdo-ultimate-2-wireless-controller.patch
+input-xpad-fix-two-controller-table-values.patch
+input-synaptics-enable-intertouch-on-dynabook-portege-x30-d.patch
+input-synaptics-enable-intertouch-on-dynabook-portege-x30l-g.patch
+input-synaptics-enable-intertouch-on-dell-precision-m3800.patch
+input-synaptics-enable-smbus-for-hp-elitebook-850-g1.patch
+input-synaptics-enable-intertouch-on-tuxedo-infinitybook-pro-14-v5.patch
+rust-clean-rust-1.88.0-s-unnecessary_transmutes-lint.patch
+objtool-rust-add-one-more-noreturn-rust-function-for-rust-1.87.0.patch
+rust-clean-rust-1.88.0-s-warning-about-clippy-disallowed_macros-configuration.patch
+uio_hv_generic-fix-sysfs-creation-path-for-ring-buffer.patch
+staging-iio-adc-ad7816-correct-conditional-logic-for-store-mode.patch
+staging-bcm2835-camera-initialise-dev-in-v4l2_dev.patch
+staging-axis-fifo-remove-hardware-resets-for-user-errors.patch
+staging-axis-fifo-correct-handling-of-tx_fifo_depth-for-size-validation.patch
--- /dev/null
+From 2ca34b508774aaa590fc3698a54204706ecca4ba Mon Sep 17 00:00:00 2001
+From: Gabriel Shahrouzi <gshahrouzi@gmail.com>
+Date: Fri, 18 Apr 2025 21:29:37 -0400
+Subject: staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
+
+From: Gabriel Shahrouzi <gshahrouzi@gmail.com>
+
+commit 2ca34b508774aaa590fc3698a54204706ecca4ba upstream.
+
+Remove erroneous subtraction of 4 from the total FIFO depth read from
+device tree. The stored depth is for checking against total capacity,
+not initial vacancy. This prevented writes near the FIFO's full size.
+
+The check performed just before data transfer, which uses live reads of
+the TDFV register to determine current vacancy, correctly handles the
+initial Depth - 4 hardware state and subsequent FIFO fullness.
+
+Fixes: 4a965c5f89de ("staging: add driver for Xilinx AXI-Stream FIFO v4.1 IP core")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gabriel Shahrouzi <gshahrouzi@gmail.com>
+Link: https://lore.kernel.org/r/20250419012937.674924-1-gshahrouzi@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/axis-fifo/axis-fifo.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/staging/axis-fifo/axis-fifo.c
++++ b/drivers/staging/axis-fifo/axis-fifo.c
+@@ -770,9 +770,6 @@ static int axis_fifo_parse_dt(struct axi
+ goto end;
+ }
+
+- /* IP sets TDFV to fifo depth - 4 so we will do the same */
+- fifo->tx_fifo_depth -= 4;
+-
+ ret = get_dts_property(fifo, "xlnx,use-rx-data", &fifo->has_rx_fifo);
+ if (ret) {
+ dev_err(fifo->dt_device, "missing xlnx,use-rx-data property\n");
--- /dev/null
+From c6e8d85fafa7193613db37da29c0e8d6e2515b13 Mon Sep 17 00:00:00 2001
+From: Gabriel Shahrouzi <gshahrouzi@gmail.com>
+Date: Fri, 18 Apr 2025 20:43:06 -0400
+Subject: staging: axis-fifo: Remove hardware resets for user errors
+
+From: Gabriel Shahrouzi <gshahrouzi@gmail.com>
+
+commit c6e8d85fafa7193613db37da29c0e8d6e2515b13 upstream.
+
+The axis-fifo driver performs a full hardware reset (via
+reset_ip_core()) in several error paths within the read and write
+functions. This reset flushes both TX and RX FIFOs and resets the
+AXI-Stream links.
+
+Allow the user to handle the error without causing hardware disruption
+or data loss in other FIFO paths.
+
+Fixes: 4a965c5f89de ("staging: add driver for Xilinx AXI-Stream FIFO v4.1 IP core")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gabriel Shahrouzi <gshahrouzi@gmail.com>
+Link: https://lore.kernel.org/r/20250419004306.669605-1-gshahrouzi@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/axis-fifo/axis-fifo.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+--- a/drivers/staging/axis-fifo/axis-fifo.c
++++ b/drivers/staging/axis-fifo/axis-fifo.c
+@@ -393,16 +393,14 @@ static ssize_t axis_fifo_read(struct fil
+
+ bytes_available = ioread32(fifo->base_addr + XLLF_RLR_OFFSET);
+ if (!bytes_available) {
+- dev_err(fifo->dt_device, "received a packet of length 0 - fifo core will be reset\n");
+- reset_ip_core(fifo);
++ dev_err(fifo->dt_device, "received a packet of length 0\n");
+ ret = -EIO;
+ goto end_unlock;
+ }
+
+ if (bytes_available > len) {
+- dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu) - fifo core will be reset\n",
++ dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n",
+ bytes_available, len);
+- reset_ip_core(fifo);
+ ret = -EINVAL;
+ goto end_unlock;
+ }
+@@ -411,8 +409,7 @@ static ssize_t axis_fifo_read(struct fil
+ /* this probably can't happen unless IP
+ * registers were previously mishandled
+ */
+- dev_err(fifo->dt_device, "received a packet that isn't word-aligned - fifo core will be reset\n");
+- reset_ip_core(fifo);
++ dev_err(fifo->dt_device, "received a packet that isn't word-aligned\n");
+ ret = -EIO;
+ goto end_unlock;
+ }
+@@ -433,7 +430,6 @@ static ssize_t axis_fifo_read(struct fil
+
+ if (copy_to_user(buf + copied * sizeof(u32), tmp_buf,
+ copy * sizeof(u32))) {
+- reset_ip_core(fifo);
+ ret = -EFAULT;
+ goto end_unlock;
+ }
+@@ -542,7 +538,6 @@ static ssize_t axis_fifo_write(struct fi
+
+ if (copy_from_user(tmp_buf, buf + copied * sizeof(u32),
+ copy * sizeof(u32))) {
+- reset_ip_core(fifo);
+ ret = -EFAULT;
+ goto end_unlock;
+ }
--- /dev/null
+From 98698ca0e58734bc5c1c24e5bbc7429f981cd186 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 23 Apr 2025 11:47:15 +0100
+Subject: staging: bcm2835-camera: Initialise dev in v4l2_dev
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+commit 98698ca0e58734bc5c1c24e5bbc7429f981cd186 upstream.
+
+Commit 42a2f6664e18 ("staging: vc04_services: Move global g_state to
+vchiq_state") changed mmal_init to pass dev->v4l2_dev.dev to
+vchiq_mmal_init, however nothing iniitialised dev->v4l2_dev, so we got
+a NULL pointer dereference.
+
+Set dev->v4l2_dev.dev during bcm2835_mmal_probe. The device pointer
+could be passed into v4l2_device_register to set it, however that also
+has other effects that would need additional changes.
+
+Fixes: 42a2f6664e18 ("staging: vc04_services: Move global g_state to vchiq_state")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Stefan Wahren <wahrenst@gmx.net>
+Link: https://lore.kernel.org/r/20250423-staging-bcm2835-v4l2-fix-v2-1-3227f0ba4700@raspberrypi.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -1902,6 +1902,7 @@ static int bcm2835_mmal_probe(struct vch
+ __func__, ret);
+ goto free_dev;
+ }
++ dev->v4l2_dev.dev = &device->dev;
+
+ /* setup v4l controls */
+ ret = bcm2835_mmal_init_controls(dev, &dev->ctrl_handler);
--- /dev/null
+From 2e922956277187655ed9bedf7b5c28906e51708f Mon Sep 17 00:00:00 2001
+From: Gabriel Shahrouzi <gshahrouzi@gmail.com>
+Date: Mon, 14 Apr 2025 11:40:49 -0400
+Subject: staging: iio: adc: ad7816: Correct conditional logic for store mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gabriel Shahrouzi <gshahrouzi@gmail.com>
+
+commit 2e922956277187655ed9bedf7b5c28906e51708f upstream.
+
+The mode setting logic in ad7816_store_mode was reversed due to
+incorrect handling of the strcmp return value. strcmp returns 0 on
+match, so the `if (strcmp(buf, "full"))` block executed when the
+input was not "full".
+
+This resulted in "full" setting the mode to AD7816_PD (power-down) and
+other inputs setting it to AD7816_FULL.
+
+Fix this by checking it against 0 to correctly check for "full" and
+"power-down", mapping them to AD7816_FULL and AD7816_PD respectively.
+
+Fixes: 7924425db04a ("staging: iio: adc: new driver for AD7816 devices")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gabriel Shahrouzi <gshahrouzi@gmail.com>
+Acked-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://lore.kernel.org/stable/20250414152920.467505-1-gshahrouzi%40gmail.com
+Link: https://patch.msgid.link/20250414154050.469482-1-gshahrouzi@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/iio/adc/ad7816.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/iio/adc/ad7816.c
++++ b/drivers/staging/iio/adc/ad7816.c
+@@ -136,7 +136,7 @@ static ssize_t ad7816_store_mode(struct
+ struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+ struct ad7816_chip_info *chip = iio_priv(indio_dev);
+
+- if (strcmp(buf, "full")) {
++ if (strcmp(buf, "full") == 0) {
+ gpiod_set_value(chip->rdwr_pin, 1);
+ chip->mode = AD7816_FULL;
+ } else {
--- /dev/null
+From f31fe8165d365379d858c53bef43254c7d6d1cfd Mon Sep 17 00:00:00 2001
+From: Naman Jain <namjain@linux.microsoft.com>
+Date: Fri, 2 May 2025 13:18:10 +0530
+Subject: uio_hv_generic: Fix sysfs creation path for ring buffer
+
+From: Naman Jain <namjain@linux.microsoft.com>
+
+commit f31fe8165d365379d858c53bef43254c7d6d1cfd upstream.
+
+On regular bootup, devices get registered to VMBus first, so when
+uio_hv_generic driver for a particular device type is probed,
+the device is already initialized and added, so sysfs creation in
+hv_uio_probe() works fine. However, when the device is removed
+and brought back, the channel gets rescinded and the device again gets
+registered to VMBus. However this time, the uio_hv_generic driver is
+already registered to probe for that device and in this case sysfs
+creation is tried before the device's kobject gets initialized
+completely.
+
+Fix this by moving the core logic of sysfs creation of ring buffer,
+from uio_hv_generic to HyperV's VMBus driver, where the rest of the
+sysfs attributes for the channels are defined. While doing that, make
+use of attribute groups and macros, instead of creating sysfs
+directly, to ensure better error handling and code flow.
+
+Problematic path:
+vmbus_process_offer (A new offer comes for the VMBus device)
+ vmbus_add_channel_work
+ vmbus_device_register
+ |-> device_register
+ | |...
+ | |-> hv_uio_probe
+ | |...
+ | |-> sysfs_create_bin_file (leads to a warning as
+ | the primary channel's kobject, which is used to
+ | create the sysfs file, is not yet initialized)
+ |-> kset_create_and_add
+ |-> vmbus_add_channel_kobj (initialization of the primary
+ channel's kobject happens later)
+
+Above code flow is sequential and the warning is always reproducible in
+this path.
+
+Fixes: 9ab877a6ccf8 ("uio_hv_generic: make ring buffer attribute for primary channel")
+Cc: stable@kernel.org
+Suggested-by: Saurabh Sengar <ssengar@linux.microsoft.com>
+Suggested-by: Michael Kelley <mhklinux@outlook.com>
+Reviewed-by: Michael Kelley <mhklinux@outlook.com>
+Tested-by: Michael Kelley <mhklinux@outlook.com>
+Reviewed-by: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: Naman Jain <namjain@linux.microsoft.com>
+Link: https://lore.kernel.org/r/20250502074811.2022-2-namjain@linux.microsoft.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hv/hyperv_vmbus.h | 6 ++
+ drivers/hv/vmbus_drv.c | 100 ++++++++++++++++++++++++++++++++++++++++++-
+ drivers/uio/uio_hv_generic.c | 39 +++++++---------
+ include/linux/hyperv.h | 6 ++
+ 4 files changed, 128 insertions(+), 23 deletions(-)
+
+--- a/drivers/hv/hyperv_vmbus.h
++++ b/drivers/hv/hyperv_vmbus.h
+@@ -477,4 +477,10 @@ static inline int hv_debug_add_dev_dir(s
+
+ #endif /* CONFIG_HYPERV_TESTING */
+
++/* Create and remove sysfs entry for memory mapped ring buffers for a channel */
++int hv_create_ring_sysfs(struct vmbus_channel *channel,
++ int (*hv_mmap_ring_buffer)(struct vmbus_channel *channel,
++ struct vm_area_struct *vma));
++int hv_remove_ring_sysfs(struct vmbus_channel *channel);
++
+ #endif /* _HYPERV_VMBUS_H */
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -1792,6 +1792,27 @@ static ssize_t subchannel_id_show(struct
+ }
+ static VMBUS_CHAN_ATTR_RO(subchannel_id);
+
++static int hv_mmap_ring_buffer_wrapper(struct file *filp, struct kobject *kobj,
++ const struct bin_attribute *attr,
++ struct vm_area_struct *vma)
++{
++ struct vmbus_channel *channel = container_of(kobj, struct vmbus_channel, kobj);
++
++ /*
++ * hv_(create|remove)_ring_sysfs implementation ensures that mmap_ring_buffer
++ * is not NULL.
++ */
++ return channel->mmap_ring_buffer(channel, vma);
++}
++
++static struct bin_attribute chan_attr_ring_buffer = {
++ .attr = {
++ .name = "ring",
++ .mode = 0600,
++ },
++ .size = 2 * SZ_2M,
++ .mmap = hv_mmap_ring_buffer_wrapper,
++};
+ static struct attribute *vmbus_chan_attrs[] = {
+ &chan_attr_out_mask.attr,
+ &chan_attr_in_mask.attr,
+@@ -1811,6 +1832,11 @@ static struct attribute *vmbus_chan_attr
+ NULL
+ };
+
++static struct bin_attribute *vmbus_chan_bin_attrs[] = {
++ &chan_attr_ring_buffer,
++ NULL
++};
++
+ /*
+ * Channel-level attribute_group callback function. Returns the permission for
+ * each attribute, and returns 0 if an attribute is not visible.
+@@ -1831,9 +1857,24 @@ static umode_t vmbus_chan_attr_is_visibl
+ return attr->mode;
+ }
+
++static umode_t vmbus_chan_bin_attr_is_visible(struct kobject *kobj,
++ const struct bin_attribute *attr, int idx)
++{
++ const struct vmbus_channel *channel =
++ container_of(kobj, struct vmbus_channel, kobj);
++
++ /* Hide ring attribute if channel's ring_sysfs_visible is set to false */
++ if (attr == &chan_attr_ring_buffer && !channel->ring_sysfs_visible)
++ return 0;
++
++ return attr->attr.mode;
++}
++
+ static const struct attribute_group vmbus_chan_group = {
+ .attrs = vmbus_chan_attrs,
+- .is_visible = vmbus_chan_attr_is_visible
++ .bin_attrs = vmbus_chan_bin_attrs,
++ .is_visible = vmbus_chan_attr_is_visible,
++ .is_bin_visible = vmbus_chan_bin_attr_is_visible,
+ };
+
+ static const struct kobj_type vmbus_chan_ktype = {
+@@ -1841,6 +1882,63 @@ static const struct kobj_type vmbus_chan
+ .release = vmbus_chan_release,
+ };
+
++/**
++ * hv_create_ring_sysfs() - create "ring" sysfs entry corresponding to ring buffers for a channel.
++ * @channel: Pointer to vmbus_channel structure
++ * @hv_mmap_ring_buffer: function pointer for initializing the function to be called on mmap of
++ * channel's "ring" sysfs node, which is for the ring buffer of that channel.
++ * Function pointer is of below type:
++ * int (*hv_mmap_ring_buffer)(struct vmbus_channel *channel,
++ * struct vm_area_struct *vma))
++ * This has a pointer to the channel and a pointer to vm_area_struct,
++ * used for mmap, as arguments.
++ *
++ * Sysfs node for ring buffer of a channel is created along with other fields, however its
++ * visibility is disabled by default. Sysfs creation needs to be controlled when the use-case
++ * is running.
++ * For example, HV_NIC device is used either by uio_hv_generic or hv_netvsc at any given point of
++ * time, and "ring" sysfs is needed only when uio_hv_generic is bound to that device. To avoid
++ * exposing the ring buffer by default, this function is reponsible to enable visibility of
++ * ring for userspace to use.
++ * Note: Race conditions can happen with userspace and it is not encouraged to create new
++ * use-cases for this. This was added to maintain backward compatibility, while solving
++ * one of the race conditions in uio_hv_generic while creating sysfs.
++ *
++ * Returns 0 on success or error code on failure.
++ */
++int hv_create_ring_sysfs(struct vmbus_channel *channel,
++ int (*hv_mmap_ring_buffer)(struct vmbus_channel *channel,
++ struct vm_area_struct *vma))
++{
++ struct kobject *kobj = &channel->kobj;
++
++ channel->mmap_ring_buffer = hv_mmap_ring_buffer;
++ channel->ring_sysfs_visible = true;
++
++ return sysfs_update_group(kobj, &vmbus_chan_group);
++}
++EXPORT_SYMBOL_GPL(hv_create_ring_sysfs);
++
++/**
++ * hv_remove_ring_sysfs() - remove ring sysfs entry corresponding to ring buffers for a channel.
++ * @channel: Pointer to vmbus_channel structure
++ *
++ * Hide "ring" sysfs for a channel by changing its is_visible attribute and updating sysfs group.
++ *
++ * Returns 0 on success or error code on failure.
++ */
++int hv_remove_ring_sysfs(struct vmbus_channel *channel)
++{
++ struct kobject *kobj = &channel->kobj;
++ int ret;
++
++ channel->ring_sysfs_visible = false;
++ ret = sysfs_update_group(kobj, &vmbus_chan_group);
++ channel->mmap_ring_buffer = NULL;
++ return ret;
++}
++EXPORT_SYMBOL_GPL(hv_remove_ring_sysfs);
++
+ /*
+ * vmbus_add_channel_kobj - setup a sub-directory under device/channels
+ */
+--- a/drivers/uio/uio_hv_generic.c
++++ b/drivers/uio/uio_hv_generic.c
+@@ -131,15 +131,12 @@ static void hv_uio_rescind(struct vmbus_
+ vmbus_device_unregister(channel->device_obj);
+ }
+
+-/* Sysfs API to allow mmap of the ring buffers
++/* Function used for mmap of ring buffer sysfs interface.
+ * The ring buffer is allocated as contiguous memory by vmbus_open
+ */
+-static int hv_uio_ring_mmap(struct file *filp, struct kobject *kobj,
+- const struct bin_attribute *attr,
+- struct vm_area_struct *vma)
++static int
++hv_uio_ring_mmap(struct vmbus_channel *channel, struct vm_area_struct *vma)
+ {
+- struct vmbus_channel *channel
+- = container_of(kobj, struct vmbus_channel, kobj);
+ void *ring_buffer = page_address(channel->ringbuffer_page);
+
+ if (channel->state != CHANNEL_OPENED_STATE)
+@@ -149,15 +146,6 @@ static int hv_uio_ring_mmap(struct file
+ channel->ringbuffer_pagecount << PAGE_SHIFT);
+ }
+
+-static const struct bin_attribute ring_buffer_bin_attr = {
+- .attr = {
+- .name = "ring",
+- .mode = 0600,
+- },
+- .size = 2 * SZ_2M,
+- .mmap = hv_uio_ring_mmap,
+-};
+-
+ /* Callback from VMBUS subsystem when new channel created. */
+ static void
+ hv_uio_new_channel(struct vmbus_channel *new_sc)
+@@ -178,8 +166,7 @@ hv_uio_new_channel(struct vmbus_channel
+ /* Disable interrupts on sub channel */
+ new_sc->inbound.ring_buffer->interrupt_mask = 1;
+ set_channel_read_mode(new_sc, HV_CALL_ISR);
+-
+- ret = sysfs_create_bin_file(&new_sc->kobj, &ring_buffer_bin_attr);
++ ret = hv_create_ring_sysfs(new_sc, hv_uio_ring_mmap);
+ if (ret) {
+ dev_err(device, "sysfs create ring bin file failed; %d\n", ret);
+ vmbus_close(new_sc);
+@@ -350,10 +337,18 @@ hv_uio_probe(struct hv_device *dev,
+ goto fail_close;
+ }
+
+- ret = sysfs_create_bin_file(&channel->kobj, &ring_buffer_bin_attr);
+- if (ret)
+- dev_notice(&dev->device,
+- "sysfs create ring bin file failed; %d\n", ret);
++ /*
++ * This internally calls sysfs_update_group, which returns a non-zero value if it executes
++ * before sysfs_create_group. This is expected as the 'ring' will be created later in
++ * vmbus_device_register() -> vmbus_add_channel_kobj(). Thus, no need to check the return
++ * value and print warning.
++ *
++ * Creating/exposing sysfs in driver probe is not encouraged as it can lead to race
++ * conditions with userspace. For backward compatibility, "ring" sysfs could not be removed
++ * or decoupled from uio_hv_generic probe. Userspace programs can make use of inotify
++ * APIs to make sure that ring is created.
++ */
++ hv_create_ring_sysfs(channel, hv_uio_ring_mmap);
+
+ hv_set_drvdata(dev, pdata);
+
+@@ -375,7 +370,7 @@ hv_uio_remove(struct hv_device *dev)
+ if (!pdata)
+ return;
+
+- sysfs_remove_bin_file(&dev->channel->kobj, &ring_buffer_bin_attr);
++ hv_remove_ring_sysfs(dev->channel);
+ uio_unregister_device(&pdata->info);
+ hv_uio_cleanup(dev, pdata);
+
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -1058,6 +1058,12 @@ struct vmbus_channel {
+
+ /* The max size of a packet on this channel */
+ u32 max_pkt_size;
++
++ /* function to mmap ring buffer memory to the channel's sysfs ring attribute */
++ int (*mmap_ring_buffer)(struct vmbus_channel *channel, struct vm_area_struct *vma);
++
++ /* boolean to control visibility of sysfs for ring buffer */
++ bool ring_sysfs_visible;
+ };
+
+ #define lock_requestor(channel, flags) \
projects / thirdparty / kernel / stable-queue.git / commitdiff
