--- /dev/null
+From d4234d131b0a3f9e65973f1cdc71bb3560f5d14b Mon Sep 17 00:00:00 2001
+From: Zhenhua Huang <quic_zhenhuah@quicinc.com>
+Date: Tue, 4 Mar 2025 15:27:00 +0800
+Subject: arm64: mm: Populate vmemmap at the page level if not section aligned
+
+From: Zhenhua Huang <quic_zhenhuah@quicinc.com>
+
+commit d4234d131b0a3f9e65973f1cdc71bb3560f5d14b upstream.
+
+On the arm64 platform with 4K base page config, SECTION_SIZE_BITS is set
+to 27, making one section 128M. The related page struct which vmemmap
+points to is 2M then.
+Commit c1cc1552616d ("arm64: MMU initialisation") optimizes the
+vmemmap to populate at the PMD section level which was suitable
+initially since hot plug granule is always one section(128M). However,
+commit ba72b4c8cf60 ("mm/sparsemem: support sub-section hotplug")
+introduced a 2M(SUBSECTION_SIZE) hot plug granule, which disrupted the
+existing arm64 assumptions.
+
+The first problem is that if start or end is not aligned to a section
+boundary, such as when a subsection is hot added, populating the entire
+section is wasteful.
+
+The next problem is if we hotplug something that spans part of 128 MiB
+section (subsections, let's call it memblock1), and then hotplug something
+that spans another part of a 128 MiB section(subsections, let's call it
+memblock2), and subsequently unplug memblock1, vmemmap_free() will clear
+the entire PMD entry which also supports memblock2 even though memblock2
+is still active.
+
+Assuming hotplug/unplug sizes are guaranteed to be symmetric. Do the
+fix similar to x86-64: populate to pages levels if start/end is not aligned
+with section boundary.
+
+Cc: stable@vger.kernel.org # v5.4+
+Fixes: ba72b4c8cf60 ("mm/sparsemem: support sub-section hotplug")
+Acked-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Zhenhua Huang <quic_zhenhuah@quicinc.com>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Link: https://lore.kernel.org/r/20250304072700.3405036-1-quic_zhenhuah@quicinc.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/mm/mmu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/mm/mmu.c
++++ b/arch/arm64/mm/mmu.c
+@@ -1150,8 +1150,11 @@ int __meminit vmemmap_populate(unsigned
+ struct vmem_altmap *altmap)
+ {
+ WARN_ON((start < VMEMMAP_START) || (end > VMEMMAP_END));
++ /* [start, end] should be within one section */
++ WARN_ON_ONCE(end - start > PAGES_PER_SECTION * sizeof(struct page));
+
+- if (!IS_ENABLED(CONFIG_ARM64_4K_PAGES))
++ if (!IS_ENABLED(CONFIG_ARM64_4K_PAGES) ||
++ (end - start < PAGES_PER_SECTION * sizeof(struct page)))
+ return vmemmap_populate_basepages(start, end, node, altmap);
+ else
+ return vmemmap_populate_hugepages(start, end, node, altmap);
--- /dev/null
+From 0704a15b930cf97073ce091a0cd7ad32f2304329 Mon Sep 17 00:00:00 2001
+From: Thomas Mizrahi <thomasmizra@gmail.com>
+Date: Sat, 8 Mar 2025 01:06:28 -0300
+Subject: ASoC: amd: yc: Support mic on another Lenovo ThinkPad E16 Gen 2 model
+
+From: Thomas Mizrahi <thomasmizra@gmail.com>
+
+commit 0704a15b930cf97073ce091a0cd7ad32f2304329 upstream.
+
+The internal microphone on the Lenovo ThinkPad E16 model requires a
+quirk entry to work properly. This was fixed in a previous patch (linked
+below), but depending on the specific variant of the model, the product
+name may be "21M5" or "21M6".
+
+The following patch fixed this issue for the 21M5 variant:
+ https://lore.kernel.org/all/20240725065442.9293-1-tiwai@suse.de/
+
+This patch adds support for the microphone on the 21M6 variant.
+
+Link: https://github.com/ramaureirac/thinkpad-e14-linux/issues/31
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Mizrahi <thomasmizra@gmail.com>
+Link: https://patch.msgid.link/20250308041303.198765-1-thomasmizra@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -252,6 +252,13 @@ static const struct dmi_system_id yc_acp
+ .driver_data = &acp6x_card,
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "21M6"),
++ }
++ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "21ME"),
+ }
+ },
--- /dev/null
+From 53517a70873c7a91675f7244768aad5006cc45de Mon Sep 17 00:00:00 2001
+From: Varada Pavani <v.pavani@samsung.com>
+Date: Tue, 25 Feb 2025 18:49:18 +0530
+Subject: clk: samsung: update PLL locktime for PLL142XX used on FSD platform
+
+From: Varada Pavani <v.pavani@samsung.com>
+
+commit 53517a70873c7a91675f7244768aad5006cc45de upstream.
+
+Currently PLL142XX locktime is 270. As per spec, it should be 150. Hence
+update PLL142XX controller locktime to 150.
+
+Cc: stable@vger.kernel.org
+Fixes: 4f346005aaed ("clk: samsung: fsd: Add initial clock support")
+Signed-off-by: Varada Pavani <v.pavani@samsung.com>
+Link: https://lore.kernel.org/r/20250225131918.50925-3-v.pavani@samsung.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/samsung/clk-pll.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/samsung/clk-pll.c
++++ b/drivers/clk/samsung/clk-pll.c
+@@ -206,6 +206,7 @@ static const struct clk_ops samsung_pll3
+ */
+ /* Maximum lock time can be 270 * PDIV cycles */
+ #define PLL35XX_LOCK_FACTOR (270)
++#define PLL142XX_LOCK_FACTOR (150)
+
+ #define PLL35XX_MDIV_MASK (0x3FF)
+ #define PLL35XX_PDIV_MASK (0x3F)
+@@ -272,7 +273,11 @@ static int samsung_pll35xx_set_rate(stru
+ }
+
+ /* Set PLL lock time. */
+- writel_relaxed(rate->pdiv * PLL35XX_LOCK_FACTOR,
++ if (pll->type == pll_142xx)
++ writel_relaxed(rate->pdiv * PLL142XX_LOCK_FACTOR,
++ pll->lock_reg);
++ else
++ writel_relaxed(rate->pdiv * PLL35XX_LOCK_FACTOR,
+ pll->lock_reg);
+
+ /* Change PLL PMS values */
--- /dev/null
+From 57e9417f69839cb10f7ffca684c38acd28ceb57b Mon Sep 17 00:00:00 2001
+From: Kent Overstreet <kent.overstreet@linux.dev>
+Date: Sat, 8 Mar 2025 10:50:08 -0500
+Subject: dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature
+
+From: Kent Overstreet <kent.overstreet@linux.dev>
+
+commit 57e9417f69839cb10f7ffca684c38acd28ceb57b upstream.
+
+Fix memory corruption due to incorrect parameter being passed to bio_init
+
+Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: stable@vger.kernel.org # v6.5+
+Fixes: 1d9a94389853 ("dm flakey: clone pages on write bio before corrupting them")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-flakey.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index 731467d4ed10..b690905ab89f 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -426,7 +426,7 @@ static struct bio *clone_bio(struct dm_target *ti, struct flakey_c *fc, struct b
+ if (!clone)
+ return NULL;
+
+- bio_init(clone, fc->dev->bdev, bio->bi_inline_vecs, nr_iovecs, bio->bi_opf);
++ bio_init(clone, fc->dev->bdev, clone->bi_inline_vecs, nr_iovecs, bio->bi_opf);
+
+ clone->bi_iter.bi_sector = flakey_map_sector(ti, bio->bi_iter.bi_sector);
+ clone->bi_private = bio;
+--
+2.48.1
+
--- /dev/null
+From 79e31396fdd7037c503e6add15af7cb00633ea92 Mon Sep 17 00:00:00 2001
+From: Alex Hung <alex.hung@amd.com>
+Date: Thu, 27 Feb 2025 16:36:25 -0700
+Subject: drm/amd/display: Assign normalized_pix_clk when color depth = 14
+
+From: Alex Hung <alex.hung@amd.com>
+
+commit 79e31396fdd7037c503e6add15af7cb00633ea92 upstream.
+
+[WHY & HOW]
+A warning message "WARNING: CPU: 4 PID: 459 at ... /dc_resource.c:3397
+calculate_phy_pix_clks+0xef/0x100 [amdgpu]" occurs because the
+display_color_depth == COLOR_DEPTH_141414 is not handled. This is
+observed in Radeon RX 6600 XT.
+
+It is fixed by assigning pix_clk * (14 * 3) / 24 - same as the rests.
+
+Also fixes the indentation in get_norm_pix_clk.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 274a87eb389f58eddcbc5659ab0b180b37e92775)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -2567,10 +2567,13 @@ static int get_norm_pix_clk(const struct
+ break;
+ case COLOR_DEPTH_121212:
+ normalized_pix_clk = (pix_clk * 36) / 24;
+- break;
++ break;
++ case COLOR_DEPTH_141414:
++ normalized_pix_clk = (pix_clk * 42) / 24;
++ break;
+ case COLOR_DEPTH_161616:
+ normalized_pix_clk = (pix_clk * 48) / 24;
+- break;
++ break;
+ default:
+ ASSERT(0);
+ break;
--- /dev/null
+From 40b8c14936bd2726354c856251f6baed9869e760 Mon Sep 17 00:00:00 2001
+From: Leo Li <sunpeng.li@amd.com>
+Date: Thu, 20 Feb 2025 16:20:26 -0500
+Subject: drm/amd/display: Disable unneeded hpd interrupts during dm_init
+
+From: Leo Li <sunpeng.li@amd.com>
+
+commit 40b8c14936bd2726354c856251f6baed9869e760 upstream.
+
+[Why]
+
+It seems HPD interrupts are enabled by default for all connectors, even
+if the hpd source isn't valid. An eDP for example, does not have a valid
+hpd source (but does have a valid hpdrx source; see construct_phy()).
+Thus, eDPs should have their hpd interrupt disabled.
+
+In the past, this wasn't really an issue. Although the driver gets
+interrupted, then acks by writing to hw registers, there weren't any
+subscribed handlers that did anything meaningful (see
+register_hpd_handlers()).
+
+But things changed with the introduction of IPS. s2idle requires that
+the driver allows IPS for DMUB fw to put hw to sleep. Since register
+access requires hw to be awake, the driver will block IPS entry to do
+so. And no IPS means no hw sleep during s2idle.
+
+This was the observation on DCN35 systems with an eDP. During suspend,
+the eDP toggled its hpd pin as part of the panel power down sequence.
+The driver was then interrupted, and acked by writing to registers,
+blocking IPS entry.
+
+[How]
+
+Since DC marks eDP connections as having invalid hpd sources (see
+construct_phy()), DM should disable them at the hw level. Do so in
+amdgpu_dm_hpd_init() by disabling all hpd ints first, then selectively
+enabling ones for connectors that have valid hpd sources.
+
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 7b1ba19eb15f88e70782642ce2d934211269337b)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | 64 ++++++++++++------
+ 1 file changed, 45 insertions(+), 19 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
+@@ -891,8 +891,16 @@ void amdgpu_dm_hpd_init(struct amdgpu_de
+ struct drm_device *dev = adev_to_drm(adev);
+ struct drm_connector *connector;
+ struct drm_connector_list_iter iter;
++ int irq_type;
+ int i;
+
++ /* First, clear all hpd and hpdrx interrupts */
++ for (i = DC_IRQ_SOURCE_HPD1; i <= DC_IRQ_SOURCE_HPD6RX; i++) {
++ if (!dc_interrupt_set(adev->dm.dc, i, false))
++ drm_err(dev, "Failed to clear hpd(rx) source=%d on init\n",
++ i);
++ }
++
+ drm_connector_list_iter_begin(dev, &iter);
+ drm_for_each_connector_iter(connector, &iter) {
+ struct amdgpu_dm_connector *amdgpu_dm_connector =
+@@ -900,10 +908,31 @@ void amdgpu_dm_hpd_init(struct amdgpu_de
+
+ const struct dc_link *dc_link = amdgpu_dm_connector->dc_link;
+
++ /*
++ * Get a base driver irq reference for hpd ints for the lifetime
++ * of dm. Note that only hpd interrupt types are registered with
++ * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on
++ * hpd_rx isn't available. DM currently controls hpd_rx
++ * explicitly with dc_interrupt_set()
++ */
+ if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) {
+- dc_interrupt_set(adev->dm.dc,
+- dc_link->irq_source_hpd,
+- true);
++ irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1;
++ /*
++ * TODO: There's a mismatch between mode_info.num_hpd
++ * and what bios reports as the # of connectors with hpd
++ * sources. Since the # of hpd source types registered
++ * with base driver == mode_info.num_hpd, we have to
++ * fallback to dc_interrupt_set for the remaining types.
++ */
++ if (irq_type < adev->mode_info.num_hpd) {
++ if (amdgpu_irq_get(adev, &adev->hpd_irq, irq_type))
++ drm_err(dev, "DM_IRQ: Failed get HPD for source=%d)!\n",
++ dc_link->irq_source_hpd);
++ } else {
++ dc_interrupt_set(adev->dm.dc,
++ dc_link->irq_source_hpd,
++ true);
++ }
+ }
+
+ if (dc_link->irq_source_hpd_rx != DC_IRQ_SOURCE_INVALID) {
+@@ -913,12 +942,6 @@ void amdgpu_dm_hpd_init(struct amdgpu_de
+ }
+ }
+ drm_connector_list_iter_end(&iter);
+-
+- /* Update reference counts for HPDs */
+- for (i = DC_IRQ_SOURCE_HPD1; i <= adev->mode_info.num_hpd; i++) {
+- if (amdgpu_irq_get(adev, &adev->hpd_irq, i - DC_IRQ_SOURCE_HPD1))
+- drm_err(dev, "DM_IRQ: Failed get HPD for source=%d)!\n", i);
+- }
+ }
+
+ /**
+@@ -934,7 +957,7 @@ void amdgpu_dm_hpd_fini(struct amdgpu_de
+ struct drm_device *dev = adev_to_drm(adev);
+ struct drm_connector *connector;
+ struct drm_connector_list_iter iter;
+- int i;
++ int irq_type;
+
+ drm_connector_list_iter_begin(dev, &iter);
+ drm_for_each_connector_iter(connector, &iter) {
+@@ -943,9 +966,18 @@ void amdgpu_dm_hpd_fini(struct amdgpu_de
+ const struct dc_link *dc_link = amdgpu_dm_connector->dc_link;
+
+ if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) {
+- dc_interrupt_set(adev->dm.dc,
+- dc_link->irq_source_hpd,
+- false);
++ irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1;
++
++ /* TODO: See same TODO in amdgpu_dm_hpd_init() */
++ if (irq_type < adev->mode_info.num_hpd) {
++ if (amdgpu_irq_put(adev, &adev->hpd_irq, irq_type))
++ drm_err(dev, "DM_IRQ: Failed put HPD for source=%d!\n",
++ dc_link->irq_source_hpd);
++ } else {
++ dc_interrupt_set(adev->dm.dc,
++ dc_link->irq_source_hpd,
++ false);
++ }
+ }
+
+ if (dc_link->irq_source_hpd_rx != DC_IRQ_SOURCE_INVALID) {
+@@ -955,10 +987,4 @@ void amdgpu_dm_hpd_fini(struct amdgpu_de
+ }
+ }
+ drm_connector_list_iter_end(&iter);
+-
+- /* Update reference counts for HPDs */
+- for (i = DC_IRQ_SOURCE_HPD1; i <= adev->mode_info.num_hpd; i++) {
+- if (amdgpu_irq_put(adev, &adev->hpd_irq, i - DC_IRQ_SOURCE_HPD1))
+- drm_err(dev, "DM_IRQ: Failed put HPD for source=%d!\n", i);
+- }
+ }
--- /dev/null
+From e65e7bea220c3ce8c4c793b4ba35557f4994ab2b Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Fri, 28 Feb 2025 13:18:14 -0600
+Subject: drm/amd/display: Fix slab-use-after-free on hdcp_work
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit e65e7bea220c3ce8c4c793b4ba35557f4994ab2b upstream.
+
+[Why]
+A slab-use-after-free is reported when HDCP is destroyed but the
+property_validate_dwork queue is still running.
+
+[How]
+Cancel the delayed work when destroying workqueue.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4006
+Fixes: da3fd7ac0bcf ("drm/amd/display: Update CP property based on HW query")
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 725a04ba5a95e89c89633d4322430cfbca7ce128)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
+@@ -455,6 +455,7 @@ void hdcp_destroy(struct kobject *kobj,
+ for (i = 0; i < hdcp_work->max_link; i++) {
+ cancel_delayed_work_sync(&hdcp_work[i].callback_dwork);
+ cancel_delayed_work_sync(&hdcp_work[i].watchdog_timer_dwork);
++ cancel_delayed_work_sync(&hdcp_work[i].property_validate_dwork);
+ }
+
+ sysfs_remove_bin_file(kobj, &hdcp_work[0].attr);
--- /dev/null
+From 5760388d9681ac743038b846b9082b9023969551 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Sun, 23 Feb 2025 00:04:35 -0600
+Subject: drm/amd/display: Restore correct backlight brightness after a GPU reset
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit 5760388d9681ac743038b846b9082b9023969551 upstream.
+
+[Why]
+GPU reset will attempt to restore cached state, but brightness doesn't
+get restored. It will come back at 100% brightness, but userspace thinks
+it's the previous value.
+
+[How]
+When running resume sequence if GPU is in reset restore brightness
+to previous value.
+
+Acked-by: Wayne Lin <Wayne.Lin@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 5e19e2b57b6bb640d68dfc7991e1e182922cf867)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -227,6 +227,10 @@ static int amdgpu_dm_atomic_check(struct
+ static void handle_hpd_irq_helper(struct amdgpu_dm_connector *aconnector);
+ static void handle_hpd_rx_irq(void *param);
+
++static void amdgpu_dm_backlight_set_level(struct amdgpu_display_manager *dm,
++ int bl_idx,
++ u32 user_brightness);
++
+ static bool
+ is_timing_unchanged_for_freesync(struct drm_crtc_state *old_crtc_state,
+ struct drm_crtc_state *new_crtc_state);
+@@ -2879,6 +2883,12 @@ static int dm_resume(void *handle)
+
+ mutex_unlock(&dm->dc_lock);
+
++ /* set the backlight after a reset */
++ for (i = 0; i < dm->num_of_edps; i++) {
++ if (dm->backlight_dev[i])
++ amdgpu_dm_backlight_set_level(dm, i, dm->brightness[i]);
++ }
++
+ return 0;
+ }
+ /* Recreate dc_state - DC invalidates it when setting power state to S3. */
--- /dev/null
+From de93ddf88088f7624b589d0ff3af9effb87e8f3b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 19 Feb 2025 18:02:39 +0200
+Subject: drm/atomic: Filter out redundant DPMS calls
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit de93ddf88088f7624b589d0ff3af9effb87e8f3b upstream.
+
+Video players (eg. mpv) do periodic XResetScreenSaver() calls to
+keep the screen on while the video playing. The modesetting ddx
+plumbs these straight through into the kernel as DPMS setproperty
+ioctls, without any filtering whatsoever. When implemented via
+atomic these end up as empty commits on the crtc (which will
+nonetheless take one full frame), which leads to a dropped
+frame every time XResetScreenSaver() is called.
+
+Let's just filter out redundant DPMS property changes in the
+kernel to avoid this issue.
+
+v2: Explain the resulting commits a bit better (Sima)
+ Document the behaviour in uapi docs (Sima)
+
+Cc: stable@vger.kernel.org
+Testcase: igt/kms_flip/flip-vs-dpms-on-nop
+Reviewed-by: Simona Vetter <simona.vetter@ffwll.ch>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250219160239.17502-1-ville.syrjala@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_atomic_uapi.c | 4 ++++
+ drivers/gpu/drm/drm_connector.c | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -974,6 +974,10 @@ int drm_atomic_connector_commit_dpms(str
+
+ if (mode != DRM_MODE_DPMS_ON)
+ mode = DRM_MODE_DPMS_OFF;
++
++ if (connector->dpms == mode)
++ goto out;
++
+ connector->dpms = mode;
+
+ crtc = connector->state->crtc;
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -1162,6 +1162,10 @@ static const u32 dp_colorspaces =
+ * callback. For atomic drivers the remapping to the "ACTIVE" property is
+ * implemented in the DRM core.
+ *
++ * On atomic drivers any DPMS setproperty ioctl where the value does not
++ * change is completely skipped, otherwise a full atomic commit will occur.
++ * On legacy drivers the exact behavior is driver specific.
++ *
+ * Note that this property cannot be set through the MODE_ATOMIC ioctl,
+ * userspace must use "ACTIVE" on the CRTC instead.
+ *
--- /dev/null
+From 12d8f318347b1d4feac48e8ac351d3786af39599 Mon Sep 17 00:00:00 2001
+From: Imre Deak <imre.deak@intel.com>
+Date: Fri, 7 Mar 2025 20:31:52 +0200
+Subject: drm/dp_mst: Fix locking when skipping CSN before topology probing
+
+From: Imre Deak <imre.deak@intel.com>
+
+commit 12d8f318347b1d4feac48e8ac351d3786af39599 upstream.
+
+The handling of the MST Connection Status Notify message is skipped if
+the probing of the topology is still pending. Acquiring the
+drm_dp_mst_topology_mgr::probe_lock for this in
+drm_dp_mst_handle_up_req() is problematic: the task/work this function
+is called from is also responsible for handling MST down-request replies
+(in drm_dp_mst_handle_down_rep()). Thus drm_dp_mst_link_probe_work() -
+holding already probe_lock - could be blocked waiting for an MST
+down-request reply while drm_dp_mst_handle_up_req() is waiting for
+probe_lock while processing a CSN message. This leads to the probe
+work's down-request message timing out.
+
+A scenario similar to the above leading to a down-request timeout is
+handling a CSN message in drm_dp_mst_handle_conn_stat(), holding the
+probe_lock and sending down-request messages while a second CSN message
+sent by the sink subsequently is handled by drm_dp_mst_handle_up_req().
+
+Fix the above by moving the logic to skip the CSN handling to
+drm_dp_mst_process_up_req(). This function is called from a work
+(separate from the task/work handling new up/down messages), already
+holding probe_lock. This solves the above timeout issue, since handling
+of down-request replies won't be blocked by probe_lock.
+
+Fixes: ddf983488c3e ("drm/dp_mst: Skip CSN if topology probing is not done yet")
+Cc: Wayne Lin <Wayne.Lin@amd.com>
+Cc: Lyude Paul <lyude@redhat.com>
+Cc: stable@vger.kernel.org # v6.6+
+Reviewed-by: Wayne Lin <Wayne.Lin@amd.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250307183152.3822170-1-imre.deak@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 40 +++++++++++++++-----------
+ 1 file changed, 24 insertions(+), 16 deletions(-)
+
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -3959,6 +3959,22 @@ out:
+ return 0;
+ }
+
++static bool primary_mstb_probing_is_done(struct drm_dp_mst_topology_mgr *mgr)
++{
++ bool probing_done = false;
++
++ mutex_lock(&mgr->lock);
++
++ if (mgr->mst_primary && drm_dp_mst_topology_try_get_mstb(mgr->mst_primary)) {
++ probing_done = mgr->mst_primary->link_address_sent;
++ drm_dp_mst_topology_put_mstb(mgr->mst_primary);
++ }
++
++ mutex_unlock(&mgr->lock);
++
++ return probing_done;
++}
++
+ static inline bool
+ drm_dp_mst_process_up_req(struct drm_dp_mst_topology_mgr *mgr,
+ struct drm_dp_pending_up_req *up_req)
+@@ -3989,8 +4005,12 @@ drm_dp_mst_process_up_req(struct drm_dp_
+
+ /* TODO: Add missing handler for DP_RESOURCE_STATUS_NOTIFY events */
+ if (msg->req_type == DP_CONNECTION_STATUS_NOTIFY) {
+- dowork = drm_dp_mst_handle_conn_stat(mstb, &msg->u.conn_stat);
+- hotplug = true;
++ if (!primary_mstb_probing_is_done(mgr)) {
++ drm_dbg_kms(mgr->dev, "Got CSN before finish topology probing. Skip it.\n");
++ } else {
++ dowork = drm_dp_mst_handle_conn_stat(mstb, &msg->u.conn_stat);
++ hotplug = true;
++ }
+ }
+
+ drm_dp_mst_topology_put_mstb(mstb);
+@@ -4069,10 +4089,11 @@ static int drm_dp_mst_handle_up_req(stru
+ drm_dp_send_up_ack_reply(mgr, mst_primary, up_req->msg.req_type,
+ false);
+
++ drm_dp_mst_topology_put_mstb(mst_primary);
++
+ if (up_req->msg.req_type == DP_CONNECTION_STATUS_NOTIFY) {
+ const struct drm_dp_connection_status_notify *conn_stat =
+ &up_req->msg.u.conn_stat;
+- bool handle_csn;
+
+ drm_dbg_kms(mgr->dev, "Got CSN: pn: %d ldps:%d ddps: %d mcs: %d ip: %d pdt: %d\n",
+ conn_stat->port_number,
+@@ -4081,16 +4102,6 @@ static int drm_dp_mst_handle_up_req(stru
+ conn_stat->message_capability_status,
+ conn_stat->input_port,
+ conn_stat->peer_device_type);
+-
+- mutex_lock(&mgr->probe_lock);
+- handle_csn = mst_primary->link_address_sent;
+- mutex_unlock(&mgr->probe_lock);
+-
+- if (!handle_csn) {
+- drm_dbg_kms(mgr->dev, "Got CSN before finish topology probing. Skip it.");
+- kfree(up_req);
+- goto out_put_primary;
+- }
+ } else if (up_req->msg.req_type == DP_RESOURCE_STATUS_NOTIFY) {
+ const struct drm_dp_resource_status_notify *res_stat =
+ &up_req->msg.u.resource_stat;
+@@ -4105,9 +4116,6 @@ static int drm_dp_mst_handle_up_req(stru
+ list_add_tail(&up_req->next, &mgr->up_req_list);
+ mutex_unlock(&mgr->up_req_lock);
+ queue_work(system_long_wq, &mgr->up_req_work);
+-
+-out_put_primary:
+- drm_dp_mst_topology_put_mstb(mst_primary);
+ out_clear_reply:
+ memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
+ return 0;
--- /dev/null
+From 6266f4a78131c795631440ea9c7b66cdfd399484 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Tue, 18 Feb 2025 23:18:55 +0200
+Subject: drm/i915/cdclk: Do cdclk post plane programming later
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 6266f4a78131c795631440ea9c7b66cdfd399484 upstream.
+
+We currently call intel_set_cdclk_post_plane_update() far
+too early. When pipes are active during the reprogramming
+the current spot only works for the cd2x divider update
+case, as that is synchronize to the pipe's vblank. Squashing
+and crawling are not synchronized in any way, so doing the
+programming while the pipes/planes are potentially still using
+the old hardware state could lead to underruns.
+
+Move the post plane reprgramming to a spot where we know
+that the pipes/planes have switched over the new hardware
+state.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250218211913.27867-2-ville.syrjala@linux.intel.com
+Reviewed-by: Vinod Govindapillai <vinod.govindapillai@intel.com>
+(cherry picked from commit fb64f5568c0e0b5730733d70a012ae26b1a55815)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_display.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_display.c
++++ b/drivers/gpu/drm/i915/display/intel_display.c
+@@ -7097,9 +7097,6 @@ static void intel_atomic_commit_tail(str
+ /* Now enable the clocks, plane, pipe, and connectors that we set up. */
+ dev_priv->display.funcs.display->commit_modeset_enables(state);
+
+- if (state->modeset)
+- intel_set_cdclk_post_plane_update(state);
+-
+ intel_wait_for_vblank_workers(state);
+
+ /* FIXME: We should call drm_atomic_helper_commit_hw_done() here
+@@ -7178,6 +7175,8 @@ static void intel_atomic_commit_tail(str
+ intel_verify_planes(state);
+
+ intel_sagv_post_plane_update(state);
++ if (state->modeset)
++ intel_set_cdclk_post_plane_update(state);
+ intel_pmdemand_post_plane_update(state);
+
+ drm_atomic_helper_commit_hw_done(&state->base);
--- /dev/null
+From c9ccb88f534ca760d06590b67571c353a2f0cbcd Mon Sep 17 00:00:00 2001
+From: "H. Nikolaus Schaller" <hns@goldelico.com>
+Date: Sat, 1 Feb 2025 12:43:24 +0100
+Subject: Input: ads7846 - fix gpiod allocation
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+commit c9ccb88f534ca760d06590b67571c353a2f0cbcd upstream.
+
+commit 767d83361aaa ("Input: ads7846 - Convert to use software nodes")
+
+has simplified the code but accidentially converted a devm_gpiod_get()
+to gpiod_get(). This leaves the gpio reserved on module remove and the
+driver can no longer be loaded again.
+
+Fixes: 767d83361aaa ("Input: ads7846 - Convert to use software nodes")
+Cc: stable@vger.kernel.org
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Link: https://lore.kernel.org/r/6e9b143f19cdfda835711a8a7a3966e5a2494cff.1738410204.git.hns@goldelico.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/touchscreen/ads7846.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/touchscreen/ads7846.c
++++ b/drivers/input/touchscreen/ads7846.c
+@@ -995,7 +995,7 @@ static int ads7846_setup_pendown(struct
+ if (pdata->get_pendown_state) {
+ ts->get_pendown_state = pdata->get_pendown_state;
+ } else {
+- ts->gpio_pendown = gpiod_get(&spi->dev, "pendown", GPIOD_IN);
++ ts->gpio_pendown = devm_gpiod_get(&spi->dev, "pendown", GPIOD_IN);
+ if (IS_ERR(ts->gpio_pendown)) {
+ dev_err(&spi->dev, "failed to request pendown GPIO\n");
+ return PTR_ERR(ts->gpio_pendown);
--- /dev/null
+From 9ed468e17d5b80e7116fd35842df3648e808ae47 Mon Sep 17 00:00:00 2001
+From: Werner Sembach <wse@tuxedocomputers.com>
+Date: Sat, 22 Feb 2025 00:01:23 +0100
+Subject: Input: i8042 - add required quirks for missing old boardnames
+
+From: Werner Sembach <wse@tuxedocomputers.com>
+
+commit 9ed468e17d5b80e7116fd35842df3648e808ae47 upstream.
+
+Some older Clevo barebones have problems like no or laggy keyboard after
+resume or boot which can be fixed with the SERIO_QUIRK_FORCENORESTORE
+quirk.
+
+The PB71RD keyboard is sometimes laggy after resume and the PC70DR, PB51RF,
+P640RE, and PCX0DX_GN20 keyboard is sometimes unresponsive after resume.
+This quirk fixes that.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://lore.kernel.org/r/20250221230137.70292-2-wse@tuxedocomputers.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/serio/i8042-acpipnpio.h | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+--- a/drivers/input/serio/i8042-acpipnpio.h
++++ b/drivers/input/serio/i8042-acpipnpio.h
+@@ -1261,6 +1261,12 @@ static const struct dmi_system_id i8042_
+ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+ {
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "P640RE"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
++ },
++ {
+ /*
+ * This is only a partial board_name and might be followed by
+ * another letter or number. DMI_MATCH however does do partial
+@@ -1337,11 +1343,35 @@ static const struct dmi_system_id i8042_
+ },
+ {
+ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "PB51RF"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "PB71RD"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "PC70DR"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
++ },
++ {
++ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "PCX0DX"),
+ },
+ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "PCX0DX_GN20"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
++ },
+ /* See comment on TUXEDO InfinityBook S17 Gen6 / Clevo NS70MU above */
+ {
+ .matches = {
--- /dev/null
+From d85862ccca452eeb19329e9f4f9a6ce1d1e53561 Mon Sep 17 00:00:00 2001
+From: Werner Sembach <wse@tuxedocomputers.com>
+Date: Sat, 22 Feb 2025 00:01:25 +0100
+Subject: Input: i8042 - swap old quirk combination with new quirk for more devices
+
+From: Werner Sembach <wse@tuxedocomputers.com>
+
+commit d85862ccca452eeb19329e9f4f9a6ce1d1e53561 upstream.
+
+Some older Clevo barebones have problems like no or laggy keyboard after
+resume or boot which can be fixed with the SERIO_QUIRK_FORCENORESTORE
+quirk.
+
+We could not activly retest these devices because we no longer have them in
+our archive, but based on the other old Clevo barebones we tested where the
+new quirk had the same or a better behaviour I think it would be good to
+apply it on these too.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://lore.kernel.org/r/20250221230137.70292-4-wse@tuxedocomputers.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/serio/i8042-acpipnpio.h | 31 ++++++++++---------------------
+ 1 file changed, 10 insertions(+), 21 deletions(-)
+
+--- a/drivers/input/serio/i8042-acpipnpio.h
++++ b/drivers/input/serio/i8042-acpipnpio.h
+@@ -1157,9 +1157,7 @@ static const struct dmi_system_id i8042_
+ },
+ /*
+ * A lot of modern Clevo barebones have touchpad and/or keyboard issues
+- * after suspend fixable with nomux + reset + noloop + nopnp. Luckily,
+- * none of them have an external PS/2 port so this can safely be set for
+- * all of them.
++ * after suspend fixable with the forcenorestore quirk.
+ * Clevo barebones come with board_vendor and/or system_vendor set to
+ * either the very generic string "Notebook" and/or a different value
+ * for each individual reseller. The only somewhat universal way to
+@@ -1175,22 +1173,19 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "LAPQC71B"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "N140CU"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "N141CU"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
+@@ -1250,8 +1245,7 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "NJ50_70CU"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
+@@ -1268,16 +1262,14 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "P65xH"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ /* Clevo P650RS, 650RP6, Sager NP8152-S, and others */
+ .matches = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ /*
+@@ -1288,8 +1280,7 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "P65_P67H"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ /*
+@@ -1300,8 +1291,7 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "P65_67RP"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ /*
+@@ -1323,8 +1313,7 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "P67xRP"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
--- /dev/null
+From 729d163232971672d0f41b93c02092fb91f0e758 Mon Sep 17 00:00:00 2001
+From: Werner Sembach <wse@tuxedocomputers.com>
+Date: Sat, 22 Feb 2025 00:01:22 +0100
+Subject: Input: i8042 - swap old quirk combination with new quirk for NHxxRZQ
+
+From: Werner Sembach <wse@tuxedocomputers.com>
+
+commit 729d163232971672d0f41b93c02092fb91f0e758 upstream.
+
+Some older Clevo barebones have problems like no or laggy keyboard after
+resume or boot which can be fixed with the SERIO_QUIRK_FORCENORESTORE
+quirk.
+
+With the old i8042 quirks this devices keyboard is sometimes laggy after
+resume. With the new quirk this issue doesn't happen.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://lore.kernel.org/r/20250221230137.70292-1-wse@tuxedocomputers.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/serio/i8042-acpipnpio.h | 10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+--- a/drivers/input/serio/i8042-acpipnpio.h
++++ b/drivers/input/serio/i8042-acpipnpio.h
+@@ -1209,18 +1209,10 @@ static const struct dmi_system_id i8042_
+ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+ {
+- /*
+- * Setting SERIO_QUIRK_NOMUX or SERIO_QUIRK_RESET_ALWAYS makes
+- * the keyboard very laggy for ~5 seconds after boot and
+- * sometimes also after resume.
+- * However both are required for the keyboard to not fail
+- * completely sometimes after boot or resume.
+- */
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "NHxxRZQ"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
--- /dev/null
+From 75ee4ebebbbe8dc4b55ba37f388924fa96bf1564 Mon Sep 17 00:00:00 2001
+From: Werner Sembach <wse@tuxedocomputers.com>
+Date: Sat, 22 Feb 2025 00:01:24 +0100
+Subject: Input: i8042 - swap old quirk combination with new quirk for several devices
+
+From: Werner Sembach <wse@tuxedocomputers.com>
+
+commit 75ee4ebebbbe8dc4b55ba37f388924fa96bf1564 upstream.
+
+Some older Clevo barebones have problems like no or laggy keyboard after
+resume or boot which can be fixed with the SERIO_QUIRK_FORCENORESTORE
+quirk.
+
+While the old quirk combination did not show negative effects on these
+devices specifically, the new quirk works just as well and seems more
+stable in general.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://lore.kernel.org/r/20250221230137.70292-3-wse@tuxedocomputers.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/serio/i8042-acpipnpio.h | 40 +++++++++++-----------------------
+ 1 file changed, 14 insertions(+), 26 deletions(-)
+
+--- a/drivers/input/serio/i8042-acpipnpio.h
++++ b/drivers/input/serio/i8042-acpipnpio.h
+@@ -1080,16 +1080,14 @@ static const struct dmi_system_id i8042_
+ DMI_MATCH(DMI_BOARD_VENDOR, "TUXEDO"),
+ DMI_MATCH(DMI_BOARD_NAME, "AURA1501"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "TUXEDO"),
+ DMI_MATCH(DMI_BOARD_NAME, "EDUBOOK1502"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ /* Mivvy M310 */
+@@ -1171,8 +1169,7 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "LAPQC71A"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
+@@ -1205,8 +1202,7 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "NH5xAx"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
+@@ -1218,8 +1214,7 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ /*
+ * At least one modern Clevo barebone has the touchpad connected both
+@@ -1235,17 +1230,15 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "NS50MU"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOAUX | SERIO_QUIRK_NOMUX |
+- SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP |
+- SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_NOAUX |
++ SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "NS50_70MU"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOAUX | SERIO_QUIRK_NOMUX |
+- SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP |
+- SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_NOAUX |
++ SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
+@@ -1319,8 +1312,7 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "P65_67RS"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ /*
+@@ -1338,8 +1330,7 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "PB50_70DFx,DDx"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
+@@ -1363,8 +1354,7 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "PCX0DX"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
+@@ -1383,15 +1373,13 @@ static const struct dmi_system_id i8042_
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "X170SM"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "X170KM-G"),
+ },
+- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE)
+ },
+ {
+ /*
--- /dev/null
+From a2add513311b48cc924a699a8174db2c61ed5e8a Mon Sep 17 00:00:00 2001
+From: Jeff LaBundy <jeff@labundy.com>
+Date: Sun, 9 Mar 2025 20:29:59 -0500
+Subject: Input: iqs7222 - preserve system status register
+
+From: Jeff LaBundy <jeff@labundy.com>
+
+commit a2add513311b48cc924a699a8174db2c61ed5e8a upstream.
+
+Some register groups reserve a byte at the end of their continuous
+address space. Depending on the variant of silicon, this field may
+share the same memory space as the lower byte of the system status
+register (0x10).
+
+In these cases, caching the reserved byte and writing it later may
+effectively reset the device depending on what happened in between
+the read and write operations.
+
+Solve this problem by avoiding any access to this last byte within
+offending register groups. This method replaces a workaround which
+attempted to write the reserved byte with up-to-date contents, but
+left a small window in which updates by the device could have been
+clobbered.
+
+Now that the driver does not touch these reserved bytes, the order
+in which the device's registers are written no longer matters, and
+they can be written in their natural order. The new method is also
+much more generic, and can be more easily extended to new variants
+of silicon with different register maps.
+
+As part of this change, the register read and write functions must
+be gently updated to support byte access instead of word access.
+
+Fixes: 2e70ef525b73 ("Input: iqs7222 - acknowledge reset before writing registers")
+Signed-off-by: Jeff LaBundy <jeff@labundy.com>
+Link: https://lore.kernel.org/r/Z85Alw+d9EHKXx2e@nixie71
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/misc/iqs7222.c | 50 ++++++++++++++++++-------------------------
+ 1 file changed, 22 insertions(+), 28 deletions(-)
+
+--- a/drivers/input/misc/iqs7222.c
++++ b/drivers/input/misc/iqs7222.c
+@@ -100,11 +100,11 @@ enum iqs7222_reg_key_id {
+
+ enum iqs7222_reg_grp_id {
+ IQS7222_REG_GRP_STAT,
+- IQS7222_REG_GRP_FILT,
+ IQS7222_REG_GRP_CYCLE,
+ IQS7222_REG_GRP_GLBL,
+ IQS7222_REG_GRP_BTN,
+ IQS7222_REG_GRP_CHAN,
++ IQS7222_REG_GRP_FILT,
+ IQS7222_REG_GRP_SLDR,
+ IQS7222_REG_GRP_TPAD,
+ IQS7222_REG_GRP_GPIO,
+@@ -286,6 +286,7 @@ static const struct iqs7222_event_desc i
+
+ struct iqs7222_reg_grp_desc {
+ u16 base;
++ u16 val_len;
+ int num_row;
+ int num_col;
+ };
+@@ -342,6 +343,7 @@ static const struct iqs7222_dev_desc iqs
+ },
+ [IQS7222_REG_GRP_FILT] = {
+ .base = 0xAC00,
++ .val_len = 3,
+ .num_row = 1,
+ .num_col = 2,
+ },
+@@ -400,6 +402,7 @@ static const struct iqs7222_dev_desc iqs
+ },
+ [IQS7222_REG_GRP_FILT] = {
+ .base = 0xAC00,
++ .val_len = 3,
+ .num_row = 1,
+ .num_col = 2,
+ },
+@@ -454,6 +457,7 @@ static const struct iqs7222_dev_desc iqs
+ },
+ [IQS7222_REG_GRP_FILT] = {
+ .base = 0xC400,
++ .val_len = 3,
+ .num_row = 1,
+ .num_col = 2,
+ },
+@@ -496,6 +500,7 @@ static const struct iqs7222_dev_desc iqs
+ },
+ [IQS7222_REG_GRP_FILT] = {
+ .base = 0xC400,
++ .val_len = 3,
+ .num_row = 1,
+ .num_col = 2,
+ },
+@@ -543,6 +548,7 @@ static const struct iqs7222_dev_desc iqs
+ },
+ [IQS7222_REG_GRP_FILT] = {
+ .base = 0xAA00,
++ .val_len = 3,
+ .num_row = 1,
+ .num_col = 2,
+ },
+@@ -600,6 +606,7 @@ static const struct iqs7222_dev_desc iqs
+ },
+ [IQS7222_REG_GRP_FILT] = {
+ .base = 0xAA00,
++ .val_len = 3,
+ .num_row = 1,
+ .num_col = 2,
+ },
+@@ -656,6 +663,7 @@ static const struct iqs7222_dev_desc iqs
+ },
+ [IQS7222_REG_GRP_FILT] = {
+ .base = 0xAE00,
++ .val_len = 3,
+ .num_row = 1,
+ .num_col = 2,
+ },
+@@ -712,6 +720,7 @@ static const struct iqs7222_dev_desc iqs
+ },
+ [IQS7222_REG_GRP_FILT] = {
+ .base = 0xAE00,
++ .val_len = 3,
+ .num_row = 1,
+ .num_col = 2,
+ },
+@@ -768,6 +777,7 @@ static const struct iqs7222_dev_desc iqs
+ },
+ [IQS7222_REG_GRP_FILT] = {
+ .base = 0xAE00,
++ .val_len = 3,
+ .num_row = 1,
+ .num_col = 2,
+ },
+@@ -1604,7 +1614,7 @@ static int iqs7222_force_comms(struct iq
+ }
+
+ static int iqs7222_read_burst(struct iqs7222_private *iqs7222,
+- u16 reg, void *val, u16 num_val)
++ u16 reg, void *val, u16 val_len)
+ {
+ u8 reg_buf[sizeof(__be16)];
+ int ret, i;
+@@ -1619,7 +1629,7 @@ static int iqs7222_read_burst(struct iqs
+ {
+ .addr = client->addr,
+ .flags = I2C_M_RD,
+- .len = num_val * sizeof(__le16),
++ .len = val_len,
+ .buf = (u8 *)val,
+ },
+ };
+@@ -1675,7 +1685,7 @@ static int iqs7222_read_word(struct iqs7
+ __le16 val_buf;
+ int error;
+
+- error = iqs7222_read_burst(iqs7222, reg, &val_buf, 1);
++ error = iqs7222_read_burst(iqs7222, reg, &val_buf, sizeof(val_buf));
+ if (error)
+ return error;
+
+@@ -1685,10 +1695,9 @@ static int iqs7222_read_word(struct iqs7
+ }
+
+ static int iqs7222_write_burst(struct iqs7222_private *iqs7222,
+- u16 reg, const void *val, u16 num_val)
++ u16 reg, const void *val, u16 val_len)
+ {
+ int reg_len = reg > U8_MAX ? sizeof(reg) : sizeof(u8);
+- int val_len = num_val * sizeof(__le16);
+ int msg_len = reg_len + val_len;
+ int ret, i;
+ struct i2c_client *client = iqs7222->client;
+@@ -1747,7 +1756,7 @@ static int iqs7222_write_word(struct iqs
+ {
+ __le16 val_buf = cpu_to_le16(val);
+
+- return iqs7222_write_burst(iqs7222, reg, &val_buf, 1);
++ return iqs7222_write_burst(iqs7222, reg, &val_buf, sizeof(val_buf));
+ }
+
+ static int iqs7222_ati_trigger(struct iqs7222_private *iqs7222)
+@@ -1831,30 +1840,14 @@ static int iqs7222_dev_init(struct iqs72
+
+ /*
+ * Acknowledge reset before writing any registers in case the device
+- * suffers a spurious reset during initialization. Because this step
+- * may change the reserved fields of the second filter beta register,
+- * its cache must be updated.
+- *
+- * Writing the second filter beta register, in turn, may clobber the
+- * system status register. As such, the filter beta register pair is
+- * written first to protect against this hazard.
++ * suffers a spurious reset during initialization.
+ */
+ if (dir == WRITE) {
+- u16 reg = dev_desc->reg_grps[IQS7222_REG_GRP_FILT].base + 1;
+- u16 filt_setup;
+-
+ error = iqs7222_write_word(iqs7222, IQS7222_SYS_SETUP,
+ iqs7222->sys_setup[0] |
+ IQS7222_SYS_SETUP_ACK_RESET);
+ if (error)
+ return error;
+-
+- error = iqs7222_read_word(iqs7222, reg, &filt_setup);
+- if (error)
+- return error;
+-
+- iqs7222->filt_setup[1] &= GENMASK(7, 0);
+- iqs7222->filt_setup[1] |= (filt_setup & ~GENMASK(7, 0));
+ }
+
+ /*
+@@ -1883,6 +1876,7 @@ static int iqs7222_dev_init(struct iqs72
+ int num_col = dev_desc->reg_grps[i].num_col;
+ u16 reg = dev_desc->reg_grps[i].base;
+ __le16 *val_buf;
++ u16 val_len = dev_desc->reg_grps[i].val_len ? : num_col * sizeof(*val_buf);
+ u16 *val;
+
+ if (!num_col)
+@@ -1900,7 +1894,7 @@ static int iqs7222_dev_init(struct iqs72
+ switch (dir) {
+ case READ:
+ error = iqs7222_read_burst(iqs7222, reg,
+- val_buf, num_col);
++ val_buf, val_len);
+ for (k = 0; k < num_col; k++)
+ val[k] = le16_to_cpu(val_buf[k]);
+ break;
+@@ -1909,7 +1903,7 @@ static int iqs7222_dev_init(struct iqs72
+ for (k = 0; k < num_col; k++)
+ val_buf[k] = cpu_to_le16(val[k]);
+ error = iqs7222_write_burst(iqs7222, reg,
+- val_buf, num_col);
++ val_buf, val_len);
+ break;
+
+ default:
+@@ -1962,7 +1956,7 @@ static int iqs7222_dev_info(struct iqs72
+ int error, i;
+
+ error = iqs7222_read_burst(iqs7222, IQS7222_PROD_NUM, dev_id,
+- ARRAY_SIZE(dev_id));
++ sizeof(dev_id));
+ if (error)
+ return error;
+
+@@ -2917,7 +2911,7 @@ static int iqs7222_report(struct iqs7222
+ __le16 status[IQS7222_MAX_COLS_STAT];
+
+ error = iqs7222_read_burst(iqs7222, IQS7222_SYS_STATUS, status,
+- num_stat);
++ num_stat * sizeof(*status));
+ if (error)
+ return error;
+
--- /dev/null
+From 36e093c8dcc585d0a9e79a005f721f01f3365eba Mon Sep 17 00:00:00 2001
+From: Nilton Perim Neto <niltonperimneto@gmail.com>
+Date: Mon, 3 Feb 2025 07:13:09 -0800
+Subject: Input: xpad - add 8BitDo SN30 Pro, Hyperkin X91 and Gamesir G7 SE controllers
+
+From: Nilton Perim Neto <niltonperimneto@gmail.com>
+
+commit 36e093c8dcc585d0a9e79a005f721f01f3365eba upstream.
+
+Add 8BitDo SN30 Pro, Hyperkin X91 and Gamesir G7 SE to the list of
+recognized controllers, and update vendor comments to match.
+
+Signed-off-by: Nilton Perim Neto <niltonperimneto@gmail.com>
+Link: https://lore.kernel.org/r/20250122214814.102311-2-niltonperimneto@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -375,8 +375,10 @@ static const struct xpad_device {
+ { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE },
+ { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE },
+ { 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 },
++ { 0x2dc8, 0x6001, "8BitDo SN30 Pro", 0, XTYPE_XBOX360 },
+ { 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 },
+ { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
++ { 0x2e24, 0x1688, "Hyperkin X91 X-Box One pad", 0, XTYPE_XBOXONE },
+ { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 },
+ { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 },
+ { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 },
+@@ -388,6 +390,7 @@ static const struct xpad_device {
+ { 0x3285, 0x0646, "Nacon Pro Compact", 0, XTYPE_XBOXONE },
+ { 0x3285, 0x0663, "Nacon Evol-X", 0, XTYPE_XBOXONE },
+ { 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 },
++ { 0x3537, 0x1010, "GameSir G7 SE", 0, XTYPE_XBOXONE },
+ { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },
+ { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX },
+ { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN }
+@@ -526,12 +529,12 @@ static const struct usb_device_id xpad_t
+ XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA controllers */
+ XPAD_XBOX360_VENDOR(0x2563), /* OneXPlayer Gamepad */
+ XPAD_XBOX360_VENDOR(0x260d), /* Dareu H101 */
+- XPAD_XBOXONE_VENDOR(0x294b), /* Snakebyte */
++ XPAD_XBOXONE_VENDOR(0x294b), /* Snakebyte */
+ XPAD_XBOX360_VENDOR(0x2c22), /* Qanba Controllers */
+- XPAD_XBOX360_VENDOR(0x2dc8), /* 8BitDo Pro 2 Wired Controller */
+- XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Pro 2 Wired Controller for Xbox */
+- XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Duke Xbox One pad */
+- XPAD_XBOX360_VENDOR(0x2f24), /* GameSir controllers */
++ XPAD_XBOX360_VENDOR(0x2dc8), /* 8BitDo Controllers */
++ XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Controllers */
++ XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Controllers */
++ XPAD_XBOX360_VENDOR(0x2f24), /* GameSir Controllers */
+ XPAD_XBOX360_VENDOR(0x31e3), /* Wooting Keyboards */
+ XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */
+ XPAD_XBOXONE_VENDOR(0x3285), /* Nacon Evol-X */
--- /dev/null
+From 3492321e2e60ddfe91aa438bb9ac209016f48f7a Mon Sep 17 00:00:00 2001
+From: Pavel Rojtberg <rojtberg@gmail.com>
+Date: Mon, 3 Feb 2025 07:22:27 -0800
+Subject: Input: xpad - add multiple supported devices
+
+From: Pavel Rojtberg <rojtberg@gmail.com>
+
+commit 3492321e2e60ddfe91aa438bb9ac209016f48f7a upstream.
+
+This is based on multiple commits at https://github.com/paroj/xpad
+that had bouncing email addresses and were not signed off.
+
+Signed-off-by: Pavel Rojtberg <rojtberg@gmail.com>
+Link: https://lore.kernel.org/r/20250123175404.23254-1-rojtberg@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -140,6 +140,7 @@ static const struct xpad_device {
+ { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX },
+ { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX },
+ { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
++ { 0x044f, 0xd01e, "ThrustMaster, Inc. ESWAP X 2 ELDEN RING EDITION", 0, XTYPE_XBOXONE },
+ { 0x044f, 0x0f10, "Thrustmaster Modena GT Wheel", 0, XTYPE_XBOX },
+ { 0x044f, 0xb326, "Thrustmaster Gamepad GP XID", 0, XTYPE_XBOX360 },
+ { 0x045e, 0x0202, "Microsoft X-Box pad v1 (US)", 0, XTYPE_XBOX },
+@@ -177,6 +178,7 @@ static const struct xpad_device {
+ { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX },
+ { 0x06a3, 0x0201, "Saitek Adrenalin", 0, XTYPE_XBOX },
+ { 0x06a3, 0xf51a, "Saitek P3600", 0, XTYPE_XBOX360 },
++ { 0x0738, 0x4503, "Mad Catz Racing Wheel", 0, XTYPE_XBOXONE },
+ { 0x0738, 0x4506, "Mad Catz 4506 Wireless Controller", 0, XTYPE_XBOX },
+ { 0x0738, 0x4516, "Mad Catz Control Pad", 0, XTYPE_XBOX },
+ { 0x0738, 0x4520, "Mad Catz Control Pad Pro", 0, XTYPE_XBOX },
+@@ -238,6 +240,7 @@ static const struct xpad_device {
+ { 0x0e6f, 0x0146, "Rock Candy Wired Controller for Xbox One", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x0147, "PDP Marvel Xbox One Controller", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x015c, "PDP Xbox One Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
++ { 0x0e6f, 0x015d, "PDP Mirror's Edge Official Wired Controller for Xbox One", XTYPE_XBOXONE },
+ { 0x0e6f, 0x0161, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x0162, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x0163, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
+@@ -276,12 +279,15 @@ static const struct xpad_device {
+ { 0x0f0d, 0x0078, "Hori Real Arcade Pro V Kai Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x0f0d, 0x00c5, "Hori Fighting Commander ONE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x0f0d, 0x00dc, "HORIPAD FPS for Nintendo Switch", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
++ { 0x0f0d, 0x0151, "Hori Racing Wheel Overdrive for Xbox Series X", 0, XTYPE_XBOXONE },
++ { 0x0f0d, 0x0152, "Hori Racing Wheel Overdrive for Xbox Series X", 0, XTYPE_XBOXONE },
+ { 0x0f30, 0x010b, "Philips Recoil", 0, XTYPE_XBOX },
+ { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX },
+ { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
+ { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX },
+ { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+ { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
++ { 0x10f5, 0x7005, "Turtle Beach Recon Controller", 0, XTYPE_XBOXONE },
+ { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
+ { 0x11ff, 0x0511, "PXN V900", 0, XTYPE_XBOX360 },
+ { 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 },
+@@ -365,6 +371,7 @@ static const struct xpad_device {
+ { 0x24c6, 0x5510, "Hori Fighting Commander ONE (Xbox 360/PC Mode)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x24c6, 0x551a, "PowerA FUSION Pro Controller", 0, XTYPE_XBOXONE },
+ { 0x24c6, 0x561a, "PowerA FUSION Controller", 0, XTYPE_XBOXONE },
++ { 0x24c6, 0x581a, "ThrustMaster XB1 Classic Controller", 0, XTYPE_XBOXONE },
+ { 0x24c6, 0x5b00, "ThrustMaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x5b02, "Thrustmaster, Inc. GPX Controller", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
+@@ -375,10 +382,12 @@ static const struct xpad_device {
+ { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE },
+ { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE },
+ { 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 },
+- { 0x2dc8, 0x6001, "8BitDo SN30 Pro", 0, XTYPE_XBOX360 },
++ { 0x2dc8, 0x3109, "8BitDo Ultimate Wireless Bluetooth", 0, XTYPE_XBOX360 },
+ { 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 },
++ { 0x2dc8, 0x6001, "8BitDo SN30 Pro", 0, XTYPE_XBOX360 },
+ { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
+ { 0x2e24, 0x1688, "Hyperkin X91 X-Box One pad", 0, XTYPE_XBOXONE },
++ { 0x2e95, 0x0504, "SCUF Gaming Controller", MAP_SELECT_BUTTON, XTYPE_XBOXONE },
+ { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 },
+ { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 },
+ { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 },
+@@ -386,12 +395,16 @@ static const struct xpad_device {
+ { 0x31e3, 0x1230, "Wooting Two HE (ARM)", 0, XTYPE_XBOX360 },
+ { 0x31e3, 0x1300, "Wooting 60HE (AVR)", 0, XTYPE_XBOX360 },
+ { 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 },
++ { 0x3285, 0x0603, "Nacon Pro Compact controller for Xbox", 0, XTYPE_XBOXONE },
+ { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 },
++ { 0x3285, 0x0614, "Nacon Pro Compact", 0, XTYPE_XBOXONE },
+ { 0x3285, 0x0646, "Nacon Pro Compact", 0, XTYPE_XBOXONE },
++ { 0x3285, 0x0662, "Nacon Revolution5 Pro", 0, XTYPE_XBOX360 },
+ { 0x3285, 0x0663, "Nacon Evol-X", 0, XTYPE_XBOXONE },
+ { 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 },
+ { 0x3537, 0x1010, "GameSir G7 SE", 0, XTYPE_XBOXONE },
+ { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },
++ { 0x413d, 0x2104, "Black Shark Green Ghost Gamepad", 0, XTYPE_XBOX360 },
+ { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX },
+ { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN }
+ };
+@@ -490,6 +503,7 @@ static const struct usb_device_id xpad_t
+ XPAD_XBOX360_VENDOR(0x03f0), /* HP HyperX Xbox 360 controllers */
+ XPAD_XBOXONE_VENDOR(0x03f0), /* HP HyperX Xbox One controllers */
+ XPAD_XBOX360_VENDOR(0x044f), /* Thrustmaster Xbox 360 controllers */
++ XPAD_XBOXONE_VENDOR(0x044f), /* Thrustmaster Xbox One controllers */
+ XPAD_XBOX360_VENDOR(0x045e), /* Microsoft Xbox 360 controllers */
+ XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft Xbox One controllers */
+ XPAD_XBOX360_VENDOR(0x046d), /* Logitech Xbox 360-style controllers */
+@@ -535,11 +549,13 @@ static const struct usb_device_id xpad_t
+ XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Controllers */
+ XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Controllers */
+ XPAD_XBOX360_VENDOR(0x2f24), /* GameSir Controllers */
++ XPAD_XBOXONE_VENDOR(0x2e95), /* SCUF Gaming Controller */
+ XPAD_XBOX360_VENDOR(0x31e3), /* Wooting Keyboards */
+ XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */
+ XPAD_XBOXONE_VENDOR(0x3285), /* Nacon Evol-X */
+ XPAD_XBOX360_VENDOR(0x3537), /* GameSir Controllers */
+ XPAD_XBOXONE_VENDOR(0x3537), /* GameSir Controllers */
++ XPAD_XBOX360_VENDOR(0x413d), /* Black Shark Green Ghost Controller */
+ { }
+ };
+
+@@ -692,7 +708,9 @@ static const struct xboxone_init_packet
+ XBOXONE_INIT_PKT(0x045e, 0x0b00, xboxone_s_init),
+ XBOXONE_INIT_PKT(0x045e, 0x0b00, extra_input_packet_init),
+ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_led_on),
++ XBOXONE_INIT_PKT(0x20d6, 0xa01a, xboxone_pdp_led_on),
+ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_auth),
++ XBOXONE_INIT_PKT(0x20d6, 0xa01a, xboxone_pdp_auth),
+ XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
+ XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init),
+ XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init),
--- /dev/null
+From 95a54a96f657fd069d2a9922b6c2d293a72a001f Mon Sep 17 00:00:00 2001
+From: Antheas Kapenekakis <lkml@antheas.dev>
+Date: Mon, 24 Feb 2025 23:00:29 -0800
+Subject: Input: xpad - add support for TECNO Pocket Go
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+commit 95a54a96f657fd069d2a9922b6c2d293a72a001f upstream.
+
+TECNO Pocket Go is a kickstarter handheld by manufacturer TECNO Mobile.
+It poses a unique feature: it does not have a display. Instead, the
+handheld is essentially a pc in a controller. As customary, it has an
+xpad endpoint, a keyboard endpoint, and a vendor endpoint for its
+vendor software.
+
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Link: https://lore.kernel.org/r/20250222170010.188761-3-lkml@antheas.dev
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -381,6 +381,7 @@ static const struct xpad_device {
+ { 0x2563, 0x058d, "OneXPlayer Gamepad", 0, XTYPE_XBOX360 },
+ { 0x294b, 0x3303, "Snakebyte GAMEPAD BASE X", 0, XTYPE_XBOXONE },
+ { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE },
++ { 0x2993, 0x2001, "TECNO Pocket Go", 0, XTYPE_XBOX360 },
+ { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE },
+ { 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 },
+ { 0x2dc8, 0x3109, "8BitDo Ultimate Wireless Bluetooth", 0, XTYPE_XBOX360 },
+@@ -546,6 +547,7 @@ static const struct usb_device_id xpad_t
+ XPAD_XBOX360_VENDOR(0x2563), /* OneXPlayer Gamepad */
+ XPAD_XBOX360_VENDOR(0x260d), /* Dareu H101 */
+ XPAD_XBOXONE_VENDOR(0x294b), /* Snakebyte */
++ XPAD_XBOX360_VENDOR(0x2993), /* TECNO Mobile */
+ XPAD_XBOX360_VENDOR(0x2c22), /* Qanba Controllers */
+ XPAD_XBOX360_VENDOR(0x2dc8), /* 8BitDo Controllers */
+ XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Controllers */
--- /dev/null
+From 709329c48214ad2acf12eed1b5c0eb798e40a64c Mon Sep 17 00:00:00 2001
+From: Antheas Kapenekakis <lkml@antheas.dev>
+Date: Mon, 24 Feb 2025 22:59:34 -0800
+Subject: Input: xpad - add support for ZOTAC Gaming Zone
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+commit 709329c48214ad2acf12eed1b5c0eb798e40a64c upstream.
+
+ZOTAC Gaming Zone is ZOTAC's 2024 handheld release. As it is common
+with these handhelds, it uses a hybrid USB device with an xpad
+endpoint, a keyboard endpoint, and a vendor-specific endpoint for
+RGB control et al.
+
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Link: https://lore.kernel.org/r/20250222170010.188761-2-lkml@antheas.dev
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -349,6 +349,7 @@ static const struct xpad_device {
+ { 0x1bad, 0xfa01, "MadCatz GamePad", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 },
++ { 0x1ee9, 0x1590, "ZOTAC Gaming Zone", 0, XTYPE_XBOX360 },
+ { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE },
+ { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE },
+ { 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 },
+@@ -537,6 +538,7 @@ static const struct usb_device_id xpad_t
+ XPAD_XBOX360_VENDOR(0x1949), /* Amazon controllers */
+ XPAD_XBOX360_VENDOR(0x1a86), /* QH Electronics */
+ XPAD_XBOX360_VENDOR(0x1bad), /* Harmonix Rock Band guitar and drums */
++ XPAD_XBOX360_VENDOR(0x1ee9), /* ZOTAC Technology Limited */
+ XPAD_XBOX360_VENDOR(0x20d6), /* PowerA controllers */
+ XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA controllers */
+ XPAD_XBOX360_VENDOR(0x24c6), /* PowerA controllers */
--- /dev/null
+From 659a7614dd72e2835ac0b220c2fa68fabd8d1df9 Mon Sep 17 00:00:00 2001
+From: Antheas Kapenekakis <lkml@antheas.dev>
+Date: Mon, 24 Feb 2025 23:01:55 -0800
+Subject: Input: xpad - rename QH controller to Legion Go S
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+commit 659a7614dd72e2835ac0b220c2fa68fabd8d1df9 upstream.
+
+The QH controller is actually the controller of the Legion Go S, with
+the manufacturer string wch.cn and product name Legion Go S in its
+USB descriptor. A cursory lookup of the VID reveals the same.
+
+Therefore, rename the xpad entries to match.
+
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Link: https://lore.kernel.org/r/20250222170010.188761-4-lkml@antheas.dev
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -312,7 +312,7 @@ static const struct xpad_device {
+ { 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 },
+ { 0x17ef, 0x6182, "Lenovo Legion Controller for Windows", 0, XTYPE_XBOX360 },
+ { 0x1949, 0x041a, "Amazon Game Controller", 0, XTYPE_XBOX360 },
+- { 0x1a86, 0xe310, "QH Electronics Controller", 0, XTYPE_XBOX360 },
++ { 0x1a86, 0xe310, "Legion Go S", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x1bad, 0x0130, "Ion Drum Rocker", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+@@ -537,7 +537,7 @@ static const struct usb_device_id xpad_t
+ XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */
+ XPAD_XBOX360_VENDOR(0x17ef), /* Lenovo */
+ XPAD_XBOX360_VENDOR(0x1949), /* Amazon controllers */
+- XPAD_XBOX360_VENDOR(0x1a86), /* QH Electronics */
++ XPAD_XBOX360_VENDOR(0x1a86), /* Nanjing Qinheng Microelectronics (WCH) */
+ XPAD_XBOX360_VENDOR(0x1bad), /* Harmonix Rock Band guitar and drums */
+ XPAD_XBOX360_VENDOR(0x1ee9), /* ZOTAC Technology Limited */
+ XPAD_XBOX360_VENDOR(0x20d6), /* PowerA controllers */
--- /dev/null
+From bb39ed47065455604729404729d9116868638d31 Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Wed, 5 Mar 2025 21:21:43 +0900
+Subject: ksmbd: fix use-after-free in ksmbd_free_work_struct
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+commit bb39ed47065455604729404729d9116868638d31 upstream.
+
+->interim_entry of ksmbd_work could be deleted after oplock is freed.
+We don't need to manage it with linked list. The interim request could be
+immediately sent whenever a oplock break wait is needed.
+
+Cc: stable@vger.kernel.org
+Reported-by: Norbert Szetei <norbert@doyensec.com>
+Tested-by: Norbert Szetei <norbert@doyensec.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/server/ksmbd_work.c | 3 ---
+ fs/smb/server/ksmbd_work.h | 1 -
+ fs/smb/server/oplock.c | 37 +++++++++++++++----------------------
+ fs/smb/server/oplock.h | 1 -
+ 4 files changed, 15 insertions(+), 27 deletions(-)
+
+--- a/fs/smb/server/ksmbd_work.c
++++ b/fs/smb/server/ksmbd_work.c
+@@ -26,7 +26,6 @@ struct ksmbd_work *ksmbd_alloc_work_stru
+ INIT_LIST_HEAD(&work->request_entry);
+ INIT_LIST_HEAD(&work->async_request_entry);
+ INIT_LIST_HEAD(&work->fp_entry);
+- INIT_LIST_HEAD(&work->interim_entry);
+ INIT_LIST_HEAD(&work->aux_read_list);
+ work->iov_alloc_cnt = 4;
+ work->iov = kcalloc(work->iov_alloc_cnt, sizeof(struct kvec),
+@@ -56,8 +55,6 @@ void ksmbd_free_work_struct(struct ksmbd
+ kfree(work->tr_buf);
+ kvfree(work->request_buf);
+ kfree(work->iov);
+- if (!list_empty(&work->interim_entry))
+- list_del(&work->interim_entry);
+
+ if (work->async_id)
+ ksmbd_release_id(&work->conn->async_ida, work->async_id);
+--- a/fs/smb/server/ksmbd_work.h
++++ b/fs/smb/server/ksmbd_work.h
+@@ -89,7 +89,6 @@ struct ksmbd_work {
+ /* List head at conn->async_requests */
+ struct list_head async_request_entry;
+ struct list_head fp_entry;
+- struct list_head interim_entry;
+ };
+
+ /**
+--- a/fs/smb/server/oplock.c
++++ b/fs/smb/server/oplock.c
+@@ -46,7 +46,6 @@ static struct oplock_info *alloc_opinfo(
+ opinfo->fid = id;
+ opinfo->Tid = Tid;
+ INIT_LIST_HEAD(&opinfo->op_entry);
+- INIT_LIST_HEAD(&opinfo->interim_list);
+ init_waitqueue_head(&opinfo->oplock_q);
+ init_waitqueue_head(&opinfo->oplock_brk);
+ atomic_set(&opinfo->refcount, 1);
+@@ -803,7 +802,6 @@ out:
+ static int smb2_lease_break_noti(struct oplock_info *opinfo)
+ {
+ struct ksmbd_conn *conn = opinfo->conn;
+- struct list_head *tmp, *t;
+ struct ksmbd_work *work;
+ struct lease_break_info *br_info;
+ struct lease *lease = opinfo->o_lease;
+@@ -831,16 +829,6 @@ static int smb2_lease_break_noti(struct
+ work->sess = opinfo->sess;
+
+ if (opinfo->op_state == OPLOCK_ACK_WAIT) {
+- list_for_each_safe(tmp, t, &opinfo->interim_list) {
+- struct ksmbd_work *in_work;
+-
+- in_work = list_entry(tmp, struct ksmbd_work,
+- interim_entry);
+- setup_async_work(in_work, NULL, NULL);
+- smb2_send_interim_resp(in_work, STATUS_PENDING);
+- list_del_init(&in_work->interim_entry);
+- release_async_work(in_work);
+- }
+ INIT_WORK(&work->work, __smb2_lease_break_noti);
+ ksmbd_queue_work(work);
+ wait_for_break_ack(opinfo);
+@@ -871,7 +859,8 @@ static void wait_lease_breaking(struct o
+ }
+ }
+
+-static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level)
++static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level,
++ struct ksmbd_work *in_work)
+ {
+ int err = 0;
+
+@@ -914,9 +903,15 @@ static int oplock_break(struct oplock_in
+ }
+
+ if (lease->state & (SMB2_LEASE_WRITE_CACHING_LE |
+- SMB2_LEASE_HANDLE_CACHING_LE))
++ SMB2_LEASE_HANDLE_CACHING_LE)) {
++ if (in_work) {
++ setup_async_work(in_work, NULL, NULL);
++ smb2_send_interim_resp(in_work, STATUS_PENDING);
++ release_async_work(in_work);
++ }
++
+ brk_opinfo->op_state = OPLOCK_ACK_WAIT;
+- else
++ } else
+ atomic_dec(&brk_opinfo->breaking_cnt);
+ } else {
+ err = oplock_break_pending(brk_opinfo, req_op_level);
+@@ -1116,7 +1111,7 @@ void smb_send_parent_lease_break_noti(st
+ if (ksmbd_conn_releasing(opinfo->conn))
+ continue;
+
+- oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE);
++ oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL);
+ opinfo_put(opinfo);
+ }
+ }
+@@ -1152,7 +1147,7 @@ void smb_lazy_parent_lease_break_close(s
+
+ if (ksmbd_conn_releasing(opinfo->conn))
+ continue;
+- oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE);
++ oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL);
+ opinfo_put(opinfo);
+ }
+ }
+@@ -1252,8 +1247,7 @@ int smb_grant_oplock(struct ksmbd_work *
+ goto op_break_not_needed;
+ }
+
+- list_add(&work->interim_entry, &prev_opinfo->interim_list);
+- err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II);
++ err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II, work);
+ opinfo_put(prev_opinfo);
+ if (err == -ENOENT)
+ goto set_lev;
+@@ -1322,8 +1316,7 @@ static void smb_break_all_write_oplock(s
+ }
+
+ brk_opinfo->open_trunc = is_trunc;
+- list_add(&work->interim_entry, &brk_opinfo->interim_list);
+- oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II);
++ oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II, work);
+ opinfo_put(brk_opinfo);
+ }
+
+@@ -1386,7 +1379,7 @@ void smb_break_all_levII_oplock(struct k
+ SMB2_LEASE_KEY_SIZE))
+ goto next;
+ brk_op->open_trunc = is_trunc;
+- oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE);
++ oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE, NULL);
+ next:
+ opinfo_put(brk_op);
+ rcu_read_lock();
+--- a/fs/smb/server/oplock.h
++++ b/fs/smb/server/oplock.h
+@@ -74,7 +74,6 @@ struct oplock_info {
+ bool is_lease;
+ bool open_trunc; /* truncate on open */
+ struct lease *o_lease;
+- struct list_head interim_list;
+ struct list_head op_entry;
+ struct list_head lease_entry;
+ wait_queue_head_t oplock_q; /* Other server threads */
--- /dev/null
+From 3aa660c059240e0c795217182cf7df32909dd917 Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Thu, 6 Mar 2025 14:14:58 +0900
+Subject: ksmbd: prevent connection release during oplock break notification
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+commit 3aa660c059240e0c795217182cf7df32909dd917 upstream.
+
+ksmbd_work could be freed when after connection release.
+Increment r_count of ksmbd_conn to indicate that requests
+are not finished yet and to not release the connection.
+
+Cc: stable@vger.kernel.org
+Reported-by: Norbert Szetei <norbert@doyensec.com>
+Tested-by: Norbert Szetei <norbert@doyensec.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/server/connection.c | 20 ++++++++++++++++++++
+ fs/smb/server/connection.h | 2 ++
+ fs/smb/server/oplock.c | 6 ++++++
+ fs/smb/server/server.c | 14 ++------------
+ 4 files changed, 30 insertions(+), 12 deletions(-)
+
+--- a/fs/smb/server/connection.c
++++ b/fs/smb/server/connection.c
+@@ -432,6 +432,26 @@ void ksmbd_conn_init_server_callbacks(st
+ default_conn_ops.terminate_fn = ops->terminate_fn;
+ }
+
++void ksmbd_conn_r_count_inc(struct ksmbd_conn *conn)
++{
++ atomic_inc(&conn->r_count);
++}
++
++void ksmbd_conn_r_count_dec(struct ksmbd_conn *conn)
++{
++ /*
++ * Checking waitqueue to dropping pending requests on
++ * disconnection. waitqueue_active is safe because it
++ * uses atomic operation for condition.
++ */
++ atomic_inc(&conn->refcnt);
++ if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q))
++ wake_up(&conn->r_count_q);
++
++ if (atomic_dec_and_test(&conn->refcnt))
++ kfree(conn);
++}
++
+ int ksmbd_conn_transport_init(void)
+ {
+ int ret;
+--- a/fs/smb/server/connection.h
++++ b/fs/smb/server/connection.h
+@@ -168,6 +168,8 @@ int ksmbd_conn_transport_init(void);
+ void ksmbd_conn_transport_destroy(void);
+ void ksmbd_conn_lock(struct ksmbd_conn *conn);
+ void ksmbd_conn_unlock(struct ksmbd_conn *conn);
++void ksmbd_conn_r_count_inc(struct ksmbd_conn *conn);
++void ksmbd_conn_r_count_dec(struct ksmbd_conn *conn);
+
+ /*
+ * WARNING
+--- a/fs/smb/server/oplock.c
++++ b/fs/smb/server/oplock.c
+@@ -634,6 +634,7 @@ static void __smb2_oplock_break_noti(str
+ {
+ struct smb2_oplock_break *rsp = NULL;
+ struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work);
++ struct ksmbd_conn *conn = work->conn;
+ struct oplock_break_info *br_info = work->request_buf;
+ struct smb2_hdr *rsp_hdr;
+ struct ksmbd_file *fp;
+@@ -689,6 +690,7 @@ static void __smb2_oplock_break_noti(str
+
+ out:
+ ksmbd_free_work_struct(work);
++ ksmbd_conn_r_count_dec(conn);
+ }
+
+ /**
+@@ -723,6 +725,7 @@ static int smb2_oplock_break_noti(struct
+ work->sess = opinfo->sess;
+
+ if (opinfo->op_state == OPLOCK_ACK_WAIT) {
++ ksmbd_conn_r_count_inc(conn);
+ INIT_WORK(&work->work, __smb2_oplock_break_noti);
+ ksmbd_queue_work(work);
+
+@@ -744,6 +747,7 @@ static void __smb2_lease_break_noti(stru
+ {
+ struct smb2_lease_break *rsp = NULL;
+ struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work);
++ struct ksmbd_conn *conn = work->conn;
+ struct lease_break_info *br_info = work->request_buf;
+ struct smb2_hdr *rsp_hdr;
+
+@@ -790,6 +794,7 @@ static void __smb2_lease_break_noti(stru
+
+ out:
+ ksmbd_free_work_struct(work);
++ ksmbd_conn_r_count_dec(conn);
+ }
+
+ /**
+@@ -829,6 +834,7 @@ static int smb2_lease_break_noti(struct
+ work->sess = opinfo->sess;
+
+ if (opinfo->op_state == OPLOCK_ACK_WAIT) {
++ ksmbd_conn_r_count_inc(conn);
+ INIT_WORK(&work->work, __smb2_lease_break_noti);
+ ksmbd_queue_work(work);
+ wait_for_break_ack(opinfo);
+--- a/fs/smb/server/server.c
++++ b/fs/smb/server/server.c
+@@ -270,17 +270,7 @@ static void handle_ksmbd_work(struct wor
+
+ ksmbd_conn_try_dequeue_request(work);
+ ksmbd_free_work_struct(work);
+- /*
+- * Checking waitqueue to dropping pending requests on
+- * disconnection. waitqueue_active is safe because it
+- * uses atomic operation for condition.
+- */
+- atomic_inc(&conn->refcnt);
+- if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q))
+- wake_up(&conn->r_count_q);
+-
+- if (atomic_dec_and_test(&conn->refcnt))
+- kfree(conn);
++ ksmbd_conn_r_count_dec(conn);
+ }
+
+ /**
+@@ -310,7 +300,7 @@ static int queue_ksmbd_work(struct ksmbd
+ conn->request_buf = NULL;
+
+ ksmbd_conn_enqueue_request(work);
+- atomic_inc(&conn->r_count);
++ ksmbd_conn_r_count_inc(conn);
+ /* update activity on connection */
+ conn->last_active = jiffies;
+ INIT_WORK(&work->work, handle_ksmbd_work);
--- /dev/null
+From d2b9d97e89c79c95f8b517e4fa43fd100f936acc Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Fri, 7 Mar 2025 17:49:52 +0800
+Subject: qlcnic: fix memory leak issues in qlcnic_sriov_common.c
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit d2b9d97e89c79c95f8b517e4fa43fd100f936acc upstream.
+
+Add qlcnic_sriov_free_vlans() in qlcnic_sriov_alloc_vlans() if
+any sriov_vlans fails to be allocated.
+Add qlcnic_sriov_free_vlans() to free the memory allocated by
+qlcnic_sriov_alloc_vlans() if "sriov->allowed_vlans" fails to
+be allocated.
+
+Fixes: 91b7282b613d ("qlcnic: Support VLAN id config.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Link: https://patch.msgid.link/20250307094952.14874-1-haoxiang_li2024@163.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+@@ -454,8 +454,10 @@ static int qlcnic_sriov_set_guest_vlan_m
+
+ num_vlans = sriov->num_allowed_vlans;
+ sriov->allowed_vlans = kcalloc(num_vlans, sizeof(u16), GFP_KERNEL);
+- if (!sriov->allowed_vlans)
++ if (!sriov->allowed_vlans) {
++ qlcnic_sriov_free_vlans(adapter);
+ return -ENOMEM;
++ }
+
+ vlans = (u16 *)&cmd->rsp.arg[3];
+ for (i = 0; i < num_vlans; i++)
+@@ -2167,8 +2169,10 @@ int qlcnic_sriov_alloc_vlans(struct qlcn
+ vf = &sriov->vf_info[i];
+ vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans,
+ sizeof(*vf->sriov_vlans), GFP_KERNEL);
+- if (!vf->sriov_vlans)
++ if (!vf->sriov_vlans) {
++ qlcnic_sriov_free_vlans(adapter);
+ return -ENOMEM;
++ }
+ }
+
+ return 0;
io_uring-kbuf-use-vm_insert_pages-for-mmap-ed-pbuf-ring.patch
io_uring-use-unpin_user_pages-where-appropriate.patch
io_uring-fix-error-pbuf-checking.patch
+input-ads7846-fix-gpiod-allocation.patch
+input-iqs7222-preserve-system-status-register.patch
+input-xpad-add-8bitdo-sn30-pro-hyperkin-x91-and-gamesir-g7-se-controllers.patch
+input-xpad-add-multiple-supported-devices.patch
+input-xpad-add-support-for-zotac-gaming-zone.patch
+input-xpad-add-support-for-tecno-pocket-go.patch
+input-xpad-rename-qh-controller-to-legion-go-s.patch
+input-i8042-swap-old-quirk-combination-with-new-quirk-for-nhxxrzq.patch
+input-i8042-add-required-quirks-for-missing-old-boardnames.patch
+input-i8042-swap-old-quirk-combination-with-new-quirk-for-several-devices.patch
+input-i8042-swap-old-quirk-combination-with-new-quirk-for-more-devices.patch
+usb-serial-ftdi_sio-add-support-for-altera-usb-blaster-3.patch
+usb-serial-option-add-telit-cinterion-fe990b-compositions.patch
+usb-serial-option-fix-telit-cinterion-fe990a-name.patch
+usb-serial-option-match-on-interface-class-for-telit-fn990b.patch
+x86-microcode-amd-fix-out-of-bounds-on-systems-with-cpu-less-numa-nodes.patch
+drm-i915-cdclk-do-cdclk-post-plane-programming-later.patch
+drm-atomic-filter-out-redundant-dpms-calls.patch
+drm-dp_mst-fix-locking-when-skipping-csn-before-topology-probing.patch
+drm-amd-display-disable-unneeded-hpd-interrupts-during-dm_init.patch
+drm-amd-display-restore-correct-backlight-brightness-after-a-gpu-reset.patch
+drm-amd-display-assign-normalized_pix_clk-when-color-depth-14.patch
+drm-amd-display-fix-slab-use-after-free-on-hdcp_work.patch
+ksmbd-fix-use-after-free-in-ksmbd_free_work_struct.patch
+ksmbd-prevent-connection-release-during-oplock-break-notification.patch
+clk-samsung-update-pll-locktime-for-pll142xx-used-on-fsd-platform.patch
+asoc-amd-yc-support-mic-on-another-lenovo-thinkpad-e16-gen-2-model.patch
+dm-flakey-fix-memory-corruption-in-optional-corrupt_bio_byte-feature.patch
+arm64-mm-populate-vmemmap-at-the-page-level-if-not-section-aligned.patch
+qlcnic-fix-memory-leak-issues-in-qlcnic_sriov_common.c.patch
+smb-client-fix-regression-with-guest-option.patch
--- /dev/null
+From fc99045effa81fdf509c2a97cbb7e6e8f2fd4443 Mon Sep 17 00:00:00 2001
+From: Paulo Alcantara <pc@manguebit.com>
+Date: Wed, 12 Mar 2025 10:51:31 -0300
+Subject: smb: client: fix regression with guest option
+
+From: Paulo Alcantara <pc@manguebit.com>
+
+commit fc99045effa81fdf509c2a97cbb7e6e8f2fd4443 upstream.
+
+When mounting a CIFS share with 'guest' mount option, mount.cifs(8)
+will set empty password= and password2= options. Currently we only
+handle empty strings from user= and password= options, so the mount
+will fail with
+
+ cifs: Bad value for 'password2'
+
+Fix this by handling empty string from password2= option as well.
+
+Link: https://bbs.archlinux.org/viewtopic.php?id=303927
+Reported-by: Adam Williamson <awilliam@redhat.com>
+Closes: https://lore.kernel.org/r/83c00b5fea81c07f6897a5dd3ef50fd3b290f56c.camel@redhat.com
+Fixes: 35f834265e0d ("smb3: fix broken reconnect when password changing on the server by allowing password rotation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/fs_context.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/smb/client/fs_context.c
++++ b/fs/smb/client/fs_context.c
+@@ -162,6 +162,7 @@ const struct fs_parameter_spec smb3_fs_p
+ fsparam_string("username", Opt_user),
+ fsparam_string("pass", Opt_pass),
+ fsparam_string("password", Opt_pass),
++ fsparam_string("pass2", Opt_pass2),
+ fsparam_string("password2", Opt_pass2),
+ fsparam_string("ip", Opt_ip),
+ fsparam_string("addr", Opt_ip),
+@@ -1041,6 +1042,9 @@ static int smb3_fs_context_parse_param(s
+ } else if (!strcmp("user", param->key) || !strcmp("username", param->key)) {
+ skip_parsing = true;
+ opt = Opt_user;
++ } else if (!strcmp("pass2", param->key) || !strcmp("password2", param->key)) {
++ skip_parsing = true;
++ opt = Opt_pass2;
+ }
+ }
+
--- /dev/null
+From 18e0885bd2ca738407036434418a26a58394a60e Mon Sep 17 00:00:00 2001
+From: Boon Khai Ng <boon.khai.ng@intel.com>
+Date: Wed, 12 Mar 2025 11:05:44 +0800
+Subject: USB: serial: ftdi_sio: add support for Altera USB Blaster 3
+
+From: Boon Khai Ng <boon.khai.ng@intel.com>
+
+commit 18e0885bd2ca738407036434418a26a58394a60e upstream.
+
+The Altera USB Blaster 3, available as both a cable and an on-board
+solution, is primarily used for programming and debugging FPGAs.
+
+It interfaces with host software such as Quartus Programmer,
+System Console, SignalTap, and Nios Debugger. The device utilizes
+either an FT2232 or FT4232 chip.
+
+Enabling the support for various configurations of the on-board
+USB Blaster 3 by including the appropriate VID/PID pairs,
+allowing it to function as a serial device via ftdi_sio.
+
+Note that this check-in does not include support for the
+cable solution, as it does not support UART functionality.
+The supported configurations are determined by the
+hardware design and include:
+
+1) PID 0x6022, FT2232, 1 JTAG port (Port A) + Port B as UART
+2) PID 0x6025, FT4232, 1 JTAG port (Port A) + Port C as UART
+3) PID 0x6026, FT4232, 1 JTAG port (Port A) + Port C, D as UART
+4) PID 0x6029, FT4232, 1 JTAG port (Port B) + Port C as UART
+5) PID 0x602a, FT4232, 1 JTAG port (Port B) + Port C, D as UART
+6) PID 0x602c, FT4232, 1 JTAG port (Port A) + Port B as UART
+7) PID 0x602d, FT4232, 1 JTAG port (Port A) + Port B, C as UART
+8) PID 0x602e, FT4232, 1 JTAG port (Port A) + Port B, C, D as UART
+
+These configurations allow for flexibility in how the USB Blaster 3 is
+used, depending on the specific needs of the hardware design.
+
+Signed-off-by: Boon Khai Ng <boon.khai.ng@intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 14 ++++++++++++++
+ drivers/usb/serial/ftdi_sio_ids.h | 13 +++++++++++++
+ 2 files changed, 27 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1079,6 +1079,20 @@ static const struct usb_device_id id_tab
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ /* GMC devices */
+ { USB_DEVICE(GMC_VID, GMC_Z216C_PID) },
++ /* Altera USB Blaster 3 */
++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6022_PID, 1) },
++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6025_PID, 2) },
++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6026_PID, 2) },
++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6026_PID, 3) },
++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6029_PID, 2) },
++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602A_PID, 2) },
++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602A_PID, 3) },
++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602C_PID, 1) },
++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602D_PID, 1) },
++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602D_PID, 2) },
++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 1) },
++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 2) },
++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 3) },
+ { } /* Terminating entry */
+ };
+
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1612,3 +1612,16 @@
+ */
+ #define GMC_VID 0x1cd7
+ #define GMC_Z216C_PID 0x0217 /* GMC Z216C Adapter IR-USB */
++
++/*
++ * Altera USB Blaster 3 (http://www.altera.com).
++ */
++#define ALTERA_VID 0x09fb
++#define ALTERA_UB3_6022_PID 0x6022
++#define ALTERA_UB3_6025_PID 0x6025
++#define ALTERA_UB3_6026_PID 0x6026
++#define ALTERA_UB3_6029_PID 0x6029
++#define ALTERA_UB3_602A_PID 0x602a
++#define ALTERA_UB3_602C_PID 0x602c
++#define ALTERA_UB3_602D_PID 0x602d
++#define ALTERA_UB3_602E_PID 0x602e
--- /dev/null
+From 4981bb50392b7515b765da28cf8768ce624c2670 Mon Sep 17 00:00:00 2001
+From: Fabio Porcedda <fabio.porcedda@gmail.com>
+Date: Tue, 4 Mar 2025 10:19:38 +0100
+Subject: USB: serial: option: add Telit Cinterion FE990B compositions
+
+From: Fabio Porcedda <fabio.porcedda@gmail.com>
+
+commit 4981bb50392b7515b765da28cf8768ce624c2670 upstream.
+
+Add the following Telit Cinterion FE990B40 compositions:
+
+0x10b0: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
+ tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
+T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 7 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=10b0 Rev=05.15
+S: Manufacturer=Telit Cinterion
+S: Product=FE990
+S: SerialNumber=28c2595e
+C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
+E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
+E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+0x10b1: MBIM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
+ tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
+T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 8 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=10b1 Rev=05.15
+S: Manufacturer=Telit Cinterion
+S: Product=FE990
+S: SerialNumber=28c2595e
+C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
+E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
+E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+0x10b2: RNDIS + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
+ tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
+T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 9 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=10b2 Rev=05.15
+S: Manufacturer=Telit Cinterion
+S: Product=FE990
+S: SerialNumber=28c2595e
+C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
+E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
+E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
+E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+0x10b3: ECM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
+ tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb
+T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 11 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=10b3 Rev=05.15
+S: Manufacturer=Telit Cinterion
+S: Product=FE990
+S: SerialNumber=28c2595e
+C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
+E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
+E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
+Reviewed-by: Daniele Palmas <dnlplm@gmail.com>
+[ johan: use USB_DEVICE_AND_INTERFACE_INFO() and sort by protocol ]
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1388,6 +1388,22 @@ static const struct usb_device_id option
+ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */
+ .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x30), /* Telit FE990B (rmnet) */
++ .driver_info = NCTRL(5) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x60) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x30), /* Telit FE990B (MBIM) */
++ .driver_info = NCTRL(6) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x60) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x30), /* Telit FE990B (RNDIS) */
++ .driver_info = NCTRL(6) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x60) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x30), /* Telit FE990B (ECM) */
++ .driver_info = NCTRL(6) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x60) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff), /* Telit FE910C04 (rmnet) */
+ .driver_info = RSVD(0) | NCTRL(3) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff), /* Telit FE910C04 (rmnet) */
--- /dev/null
+From 6232f0d8e100a26275bbd773fc56a60af2c95322 Mon Sep 17 00:00:00 2001
+From: Fabio Porcedda <fabio.porcedda@gmail.com>
+Date: Tue, 4 Mar 2025 10:19:39 +0100
+Subject: USB: serial: option: fix Telit Cinterion FE990A name
+
+From: Fabio Porcedda <fabio.porcedda@gmail.com>
+
+commit 6232f0d8e100a26275bbd773fc56a60af2c95322 upstream.
+
+The correct name for FE990 is FE990A so use it in order to avoid
+confusion with FE990B.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1368,13 +1368,13 @@ static const struct usb_device_id option
+ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990A (PCIe) */
+ .driver_info = RSVD(0) },
+- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990 (rmnet) */
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990A (rmnet) */
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990 (MBIM) */
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990A (MBIM) */
+ .driver_info = NCTRL(0) | RSVD(1) },
+- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990 (RNDIS) */
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990A (RNDIS) */
+ .driver_info = NCTRL(2) | RSVD(3) },
+- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990 (ECM) */
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990A (ECM) */
+ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */
+ .driver_info = RSVD(0) | NCTRL(3) },
--- /dev/null
+From 9a665fe3d967fe46edb4fd2497c7a5cc2dac2f55 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 6 Mar 2025 11:44:41 +0100
+Subject: USB: serial: option: match on interface class for Telit FN990B
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 9a665fe3d967fe46edb4fd2497c7a5cc2dac2f55 upstream.
+
+The device id entries for Telit FN990B ended up matching only on the
+interface protocol. While this works, the protocol is qualified by the
+interface class (and subclass) which should have been included.
+
+Switch to matching using USB_DEVICE_AND_INTERFACE_INFO() while keeping
+the entries sorted also by protocol for consistency.
+
+Link: https://lore.kernel.org/20250227110655.3647028-2-fabio.porcedda@gmail.com/
+Cc: Fabio Porcedda <fabio.porcedda@gmail.com>
+Cc: Daniele Palmas <dnlplm@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1410,22 +1410,22 @@ static const struct usb_device_id option
+ .driver_info = RSVD(0) | NCTRL(3) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */
+ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
+- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x60) }, /* Telit FN990B (rmnet) */
+- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x40) },
+- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x30),
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x30), /* Telit FN990B (rmnet) */
+ .driver_info = NCTRL(5) },
+- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x60) }, /* Telit FN990B (MBIM) */
+- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x40) },
+- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x30),
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */
+ .driver_info = NCTRL(6) },
+- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x60) }, /* Telit FN990B (RNDIS) */
+- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x40) },
+- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x30),
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x60) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x30), /* Telit FN990B (RNDIS) */
+ .driver_info = NCTRL(6) },
+- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x60) }, /* Telit FN990B (ECM) */
+- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x40) },
+- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x30),
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x60) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x30), /* Telit FN990B (ECM) */
+ .driver_info = NCTRL(6) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x60) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
--- /dev/null
+From e3e89178a9f4a80092578af3ff3c8478f9187d59 Mon Sep 17 00:00:00 2001
+From: Florent Revest <revest@chromium.org>
+Date: Mon, 10 Mar 2025 15:42:43 +0100
+Subject: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
+
+From: Florent Revest <revest@chromium.org>
+
+commit e3e89178a9f4a80092578af3ff3c8478f9187d59 upstream.
+
+Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their
+CPU masks and unconditionally accesses per-CPU data for the first CPU of each
+mask.
+
+According to Documentation/admin-guide/mm/numaperf.rst:
+
+ "Some memory may share the same node as a CPU, and others are provided as
+ memory only nodes."
+
+Therefore, some node CPU masks may be empty and wouldn't have a "first CPU".
+
+On a machine with far memory (and therefore CPU-less NUMA nodes):
+- cpumask_of_node(nid) is 0
+- cpumask_first(0) is CONFIG_NR_CPUS
+- cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an
+ index that is 1 out of bounds
+
+This does not have any security implications since flashing microcode is
+a privileged operation but I believe this has reliability implications by
+potentially corrupting memory while flashing a microcode update.
+
+When booting with CONFIG_UBSAN_BOUNDS=y on an AMD machine that flashes
+a microcode update. I get the following splat:
+
+ UBSAN: array-index-out-of-bounds in arch/x86/kernel/cpu/microcode/amd.c:X:Y
+ index 512 is out of range for type 'unsigned long[512]'
+ [...]
+ Call Trace:
+ dump_stack
+ __ubsan_handle_out_of_bounds
+ load_microcode_amd
+ request_microcode_amd
+ reload_store
+ kernfs_fop_write_iter
+ vfs_write
+ ksys_write
+ do_syscall_64
+ entry_SYSCALL_64_after_hwframe
+
+Change the loop to go over only NUMA nodes which have CPUs before determining
+whether the first CPU on the respective node needs microcode update.
+
+ [ bp: Massage commit message, fix typo. ]
+
+Fixes: 7ff6edf4fef3 ("x86/microcode/AMD: Fix mixed steppings support")
+Signed-off-by: Florent Revest <revest@chromium.org>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20250310144243.861978-1-revest@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/microcode/amd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/microcode/amd.c
++++ b/arch/x86/kernel/cpu/microcode/amd.c
+@@ -1078,7 +1078,7 @@ static enum ucode_state load_microcode_a
+ if (ret != UCODE_OK)
+ return ret;
+
+- for_each_node(nid) {
++ for_each_node_with_cpus(nid) {
+ cpu = cpumask_first(cpumask_of_node(nid));
+ c = &cpu_data(cpu);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
