--- /dev/null
+From c2ca42f190b6714d6c481dfd3d9b62ea091c946b Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <bentiss@kernel.org>
+Date: Thu, 10 Jul 2025 16:01:35 +0200
+Subject: HID: core: do not bypass hid_hw_raw_request
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+commit c2ca42f190b6714d6c481dfd3d9b62ea091c946b upstream.
+
+hid_hw_raw_request() is actually useful to ensure the provided buffer
+and length are valid. Directly calling in the low level transport driver
+function bypassed those checks and allowed invalid paramto be used.
+
+Reported-by: Alan Stern <stern@rowland.harvard.edu>
+Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250710-report-size-null-v2-3-ccf922b7c4e5@kernel.org
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1743,8 +1743,7 @@ int __hid_request(struct hid_device *hid
+ if (reqtype == HID_REQ_SET_REPORT)
+ hid_output_report(report, data_buf);
+
+- ret = hid->ll_driver->raw_request(hid, report->id, buf, len,
+- report->type, reqtype);
++ ret = hid_hw_raw_request(hid, report->id, buf, len, report->type, reqtype);
+ if (ret < 0) {
+ dbg_hid("unable to complete request: %d\n", ret);
+ goto out;
--- /dev/null
+From 0d0777ccaa2d46609d05b66ba0096802a2746193 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <bentiss@kernel.org>
+Date: Thu, 10 Jul 2025 16:01:34 +0200
+Subject: HID: core: ensure __hid_request reserves the report ID as the first byte
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+commit 0d0777ccaa2d46609d05b66ba0096802a2746193 upstream.
+
+The low level transport driver expects the first byte to be the report
+ID, even when the report ID is not use (in which case they just shift
+the buffer).
+
+However, __hid_request() whas not offsetting the buffer it used by one
+in this case, meaning that the raw_request() callback emitted by the
+transport driver would be stripped of the first byte.
+
+Note: this changes the API for uhid devices when a request is made
+through hid_hw_request. However, several considerations makes me think
+this is fine:
+- every request to a HID device made through hid_hw_request() would see
+ that change, but every request made through hid_hw_raw_request()
+ already has the new behaviour. So that means that the users are
+ already facing situations where they might have or not the first byte
+ being the null report ID when it is 0. We are making things more
+ straightforward in the end.
+- uhid is mainly used for BLE devices
+- uhid is also used for testing, but I don't see that change a big issue
+- for BLE devices, we can check which kernel module is calling
+ hid_hw_request()
+- and in those modules, we can check which are using a Bluetooth device
+- and then we can check if the command is used with a report ID or not.
+- surprise: none of the kernel module are using a report ID 0
+- and finally, bluez, in its function set_report()[0], does the same
+ shift if the report ID is 0 and the given buffer has a size > 0.
+
+[0] https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/profiles/input/hog-lib.c#n879
+
+Reported-by: Alan Stern <stern@rowland.harvard.edu>
+Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/
+Reported-by: syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43
+Tested-by: syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com
+Fixes: 4fa5a7f76cc7 ("HID: core: implement generic .request()")
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250710-report-size-null-v2-2-ccf922b7c4e5@kernel.org
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-core.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1723,7 +1723,7 @@ static struct hid_report *hid_get_report
+ int __hid_request(struct hid_device *hid, struct hid_report *report,
+ int reqtype)
+ {
+- char *buf;
++ char *buf, *data_buf;
+ int ret;
+ u32 len;
+
+@@ -1731,10 +1731,17 @@ int __hid_request(struct hid_device *hid
+ if (!buf)
+ return -ENOMEM;
+
++ data_buf = buf;
+ len = hid_report_len(report);
+
++ if (report->id == 0) {
++ /* reserve the first byte for the report ID */
++ data_buf++;
++ len++;
++ }
++
+ if (reqtype == HID_REQ_SET_REPORT)
+- hid_output_report(report, buf);
++ hid_output_report(report, data_buf);
+
+ ret = hid->ll_driver->raw_request(hid, report->id, buf, len,
+ report->type, reqtype);
--- /dev/null
+From 4f15ee98304b96e164ff2340e1dfd6181c3f42aa Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <bentiss@kernel.org>
+Date: Thu, 10 Jul 2025 16:01:33 +0200
+Subject: HID: core: ensure the allocated report buffer can contain the reserved report ID
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+commit 4f15ee98304b96e164ff2340e1dfd6181c3f42aa upstream.
+
+When the report ID is not used, the low level transport drivers expect
+the first byte to be 0. However, currently the allocated buffer not
+account for that extra byte, meaning that instead of having 8 guaranteed
+bytes for implement to be working, we only have 7.
+
+Reported-by: Alan Stern <stern@rowland.harvard.edu>
+Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/
+Cc: stable@vger.kernel.org
+Suggested-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://patch.msgid.link/20250710-report-size-null-v2-1-ccf922b7c4e5@kernel.org
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1655,9 +1655,12 @@ u8 *hid_alloc_report_buf(struct hid_repo
+ /*
+ * 7 extra bytes are necessary to achieve proper functionality
+ * of implement() working on 8 byte chunks
++ * 1 extra byte for the report ID if it is null (not used) so
++ * we can reserve that extra byte in the first position of the buffer
++ * when sending it to .raw_request()
+ */
+
+- u32 len = hid_report_len(report) + 7;
++ u32 len = hid_report_len(report) + 7 + (report->id == 0);
+
+ return kzalloc(len, flags);
+ }
--- /dev/null
+From c870cbbd71fccda71d575f0acd4a8d2b7cd88861 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Cl=C3=A9ment=20Le=20Goffic?= <clement.legoffic@foss.st.com>
+Date: Fri, 4 Jul 2025 10:39:14 +0200
+Subject: i2c: stm32: fix the device used for the DMA map
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Le Goffic <clement.legoffic@foss.st.com>
+
+commit c870cbbd71fccda71d575f0acd4a8d2b7cd88861 upstream.
+
+If the DMA mapping failed, it produced an error log with the wrong
+device name:
+"stm32-dma3 40400000.dma-controller: rejecting DMA map of vmalloc memory"
+Fix this issue by replacing the dev with the I2C dev.
+
+Fixes: bb8822cbbc53 ("i2c: i2c-stm32: Add generic DMA API")
+Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
+Cc: <stable@vger.kernel.org> # v4.18+
+Acked-by: Alain Volmat <alain.volmat@foss.st.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20250704-i2c-upstream-v4-1-84a095a2c728@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-stm32.c | 8 +++-----
+ drivers/i2c/busses/i2c-stm32f7.c | 4 ++--
+ 2 files changed, 5 insertions(+), 7 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-stm32.c
++++ b/drivers/i2c/busses/i2c-stm32.c
+@@ -98,7 +98,6 @@ int stm32_i2c_prep_dma_xfer(struct devic
+ void *dma_async_param)
+ {
+ struct dma_async_tx_descriptor *txdesc;
+- struct device *chan_dev;
+ int ret;
+
+ if (rd_wr) {
+@@ -112,11 +111,10 @@ int stm32_i2c_prep_dma_xfer(struct devic
+ }
+
+ dma->dma_len = len;
+- chan_dev = dma->chan_using->device->dev;
+
+- dma->dma_buf = dma_map_single(chan_dev, buf, dma->dma_len,
++ dma->dma_buf = dma_map_single(dev, buf, dma->dma_len,
+ dma->dma_data_dir);
+- if (dma_mapping_error(chan_dev, dma->dma_buf)) {
++ if (dma_mapping_error(dev, dma->dma_buf)) {
+ dev_err(dev, "DMA mapping failed\n");
+ return -EINVAL;
+ }
+@@ -146,7 +144,7 @@ int stm32_i2c_prep_dma_xfer(struct devic
+ return 0;
+
+ err:
+- dma_unmap_single(chan_dev, dma->dma_buf, dma->dma_len,
++ dma_unmap_single(dev, dma->dma_buf, dma->dma_len,
+ dma->dma_data_dir);
+ return ret;
+ }
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -632,10 +632,10 @@ static void stm32f7_i2c_dma_callback(voi
+ {
+ struct stm32f7_i2c_dev *i2c_dev = (struct stm32f7_i2c_dev *)arg;
+ struct stm32_i2c_dma *dma = i2c_dev->dma;
+- struct device *dev = dma->chan_using->device->dev;
+
+ stm32f7_i2c_disable_dma_req(i2c_dev);
+- dma_unmap_single(dev, dma->dma_buf, dma->dma_len, dma->dma_data_dir);
++ dma_unmap_single(i2c_dev->dev, dma->dma_buf, dma->dma_len,
++ dma->dma_data_dir);
+ complete(&dma->dma_complete);
+ }
+
--- /dev/null
+From bcce05041b21888f10b80ea903dcfe51a25c586e Mon Sep 17 00:00:00 2001
+From: Nilton Perim Neto <niltonperimneto@gmail.com>
+Date: Sat, 19 Jul 2025 22:07:36 -0700
+Subject: Input: xpad - set correct controller type for Acer NGR200
+
+From: Nilton Perim Neto <niltonperimneto@gmail.com>
+
+commit bcce05041b21888f10b80ea903dcfe51a25c586e upstream.
+
+The controller should have been set as XTYPE_XBOX360 and not XTYPE_XBOX.
+Also the entry is in the wrong place. Fix it.
+
+Reported-by: Vicki Pfau <vi@endrift.com>
+Signed-off-by: Nilton Perim Neto <niltonperimneto@gmail.com>
+Link: https://lore.kernel.org/r/20250708033126.26216-2-niltonperimneto@gmail.com
+Fixes: 22c69d786ef8 ("Input: xpad - support Acer NGR 200 Controller")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -142,12 +142,12 @@ static const struct xpad_device {
+ { 0x046d, 0xca88, "Logitech Compact Controller for Xbox", 0, XTYPE_XBOX },
+ { 0x046d, 0xca8a, "Logitech Precision Vibration Feedback Wheel", 0, XTYPE_XBOX },
+ { 0x046d, 0xcaa3, "Logitech DriveFx Racing Wheel", 0, XTYPE_XBOX360 },
++ { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX360 },
+ { 0x056e, 0x2004, "Elecom JC-U3613M", 0, XTYPE_XBOX360 },
+ { 0x05fd, 0x1007, "Mad Catz Controller (unverified)", 0, XTYPE_XBOX },
+ { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX },
+ { 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX },
+ { 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX },
+- { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX },
+ { 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX },
+ { 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX },
+ { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX },
--- /dev/null
+From 6c0e9f05c9d7875995b0e92ace71be947f280bbd Mon Sep 17 00:00:00 2001
+From: Thomas Fourier <fourier.thomas@gmail.com>
+Date: Tue, 1 Jul 2025 13:34:52 +0200
+Subject: pch_uart: Fix dma_sync_sg_for_device() nents value
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+commit 6c0e9f05c9d7875995b0e92ace71be947f280bbd upstream.
+
+The dma_sync_sg_for_device() functions should be called with the same
+nents as the dma_map_sg(), not the value the map function returned
+according to the documentation in Documentation/core-api/dma-api.rst:450:
+ With the sync_sg API, all the parameters must be the same
+ as those passed into the sg mapping API.
+
+Fixes: da3564ee027e ("pch_uart: add multi-scatter processing")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20250701113452.18590-2-fourier.thomas@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/pch_uart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -1025,7 +1025,7 @@ static unsigned int dma_handle_tx(struct
+ __func__);
+ return 0;
+ }
+- dma_sync_sg_for_device(port->dev, priv->sg_tx_p, nent, DMA_TO_DEVICE);
++ dma_sync_sg_for_device(port->dev, priv->sg_tx_p, num, DMA_TO_DEVICE);
+ priv->desc_tx = desc;
+ desc->callback = pch_dma_tx_complete;
+ desc->callback_param = priv;
--- /dev/null
+usb-serial-option-add-telit-cinterion-fe910c04-ecm-composition.patch
+usb-serial-option-add-foxconn-t99w640.patch
+usb-serial-ftdi_sio-add-support-for-ndi-emguide-gemini.patch
+usb-gadget-configfs-fix-oob-read-on-empty-string-write.patch
+i2c-stm32-fix-the-device-used-for-the-dma-map.patch
+input-xpad-set-correct-controller-type-for-acer-ngr200.patch
+pch_uart-fix-dma_sync_sg_for_device-nents-value.patch
+hid-core-ensure-the-allocated-report-buffer-can-contain-the-reserved-report-id.patch
+hid-core-ensure-__hid_request-reserves-the-report-id-as-the-first-byte.patch
+hid-core-do-not-bypass-hid_hw_raw_request.patch
--- /dev/null
+From 3014168731b7930300aab656085af784edc861f6 Mon Sep 17 00:00:00 2001
+From: Xinyu Liu <1171169449@qq.com>
+Date: Wed, 9 Jul 2025 11:55:33 +0800
+Subject: usb: gadget: configfs: Fix OOB read on empty string write
+
+From: Xinyu Liu <1171169449@qq.com>
+
+commit 3014168731b7930300aab656085af784edc861f6 upstream.
+
+When writing an empty string to either 'qw_sign' or 'landingPage'
+sysfs attributes, the store functions attempt to access page[l - 1]
+before validating that the length 'l' is greater than zero.
+
+This patch fixes the vulnerability by adding a check at the beginning
+of os_desc_qw_sign_store() and webusb_landingPage_store() to handle
+the zero-length input case gracefully by returning immediately.
+
+Signed-off-by: Xinyu Liu <katieeliu@tencent.com>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/tencent_B1C9481688D0E95E7362AB2E999DE8048207@qq.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/configfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -824,6 +824,8 @@ static ssize_t os_desc_qw_sign_store(str
+ struct gadget_info *gi = os_desc_item_to_gadget_info(item);
+ int res, l;
+
++ if (!len)
++ return len;
+ l = min((int)len, OS_STRING_QW_SIGN_LEN >> 1);
+ if (page[l - 1] == '\n')
+ --l;
--- /dev/null
+From c980666b6958d9a841597331b38115a29a32250e Mon Sep 17 00:00:00 2001
+From: "Ryan Mann (NDI)" <rmann@ndigital.com>
+Date: Thu, 10 Jul 2025 13:08:00 +0000
+Subject: USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
+
+From: Ryan Mann (NDI) <rmann@ndigital.com>
+
+commit c980666b6958d9a841597331b38115a29a32250e upstream.
+
+NDI (Northern Digital Inc.) is introducing a new product called the
+EMGUIDE GEMINI that will use an FTDI chip for USB serial communications.
+Add the NDI EMGUIDE GEMINI product ID that uses the NDI Vendor ID
+rather than the FTDI Vendor ID, unlike older products.
+
+Signed-off-by: Ryan Mann <rmann@ndigital.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 3 +++
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -781,6 +781,8 @@ static const struct usb_device_id id_tab
+ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
++ { USB_DEVICE(FTDI_NDI_VID, FTDI_NDI_EMGUIDE_GEMINI_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
+ { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) },
+ { USB_DEVICE(FTDI_VID, RTSYSTEMS_USB_VX8_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -197,6 +197,9 @@
+ #define FTDI_NDI_FUTURE_3_PID 0xDA73 /* NDI future device #3 */
+ #define FTDI_NDI_AURORA_SCU_PID 0xDA74 /* NDI Aurora SCU */
+
++#define FTDI_NDI_VID 0x23F2
++#define FTDI_NDI_EMGUIDE_GEMINI_PID 0x0003 /* NDI Emguide Gemini */
++
+ /*
+ * ChamSys Limited (www.chamsys.co.uk) USB wing/interface product IDs
+ */
--- /dev/null
+From 08f49cdb71f3759368fded4dbc9dde35a404ec2b Mon Sep 17 00:00:00 2001
+From: Slark Xiao <slark_xiao@163.com>
+Date: Fri, 20 Jun 2025 11:57:21 +0800
+Subject: USB: serial: option: add Foxconn T99W640
+
+From: Slark Xiao <slark_xiao@163.com>
+
+commit 08f49cdb71f3759368fded4dbc9dde35a404ec2b upstream.
+
+T99W640 is designed based on Qualconn SDX72 chip. There are 3
+serial ports to be enumerated: Diag, NMEA and AT.
+
+Test evidence as below:
+T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
+D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1
+P: Vendor=0489 ProdID=e167 Rev=05.15
+S: Manufacturer=QCOM
+S: Product=SDXPINNL USB WWAN Adapter
+S: SerialNumber=cc1f1d92
+C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag
+
+Signed-off-by: Slark Xiao <slark_xiao@163.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2346,6 +2346,8 @@ static const struct usb_device_id option
+ .driver_info = RSVD(3) },
+ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */
+ .driver_info = RSVD(5) | RSVD(6) },
++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe167, 0xff), /* Foxconn T99W640 MBIM */
++ .driver_info = RSVD(3) },
+ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */
+ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
+ { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */
--- /dev/null
+From 252f4ac08cd2f16ecd20e4c5e41ac2a17dd86942 Mon Sep 17 00:00:00 2001
+From: Fabio Porcedda <fabio.porcedda@gmail.com>
+Date: Thu, 10 Jul 2025 14:16:38 +0200
+Subject: USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
+
+From: Fabio Porcedda <fabio.porcedda@gmail.com>
+
+commit 252f4ac08cd2f16ecd20e4c5e41ac2a17dd86942 upstream.
+
+Add Telit Cinterion FE910C04 (ECM) composition:
+0x10c7: ECM + tty (AT) + tty (AT) + tty (diag)
+
+usb-devices output:
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=10c7 Rev=05.15
+S: Manufacturer=Telit Cinterion
+S: Product=FE910
+S: SerialNumber=f71b8b32
+C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1415,6 +1415,9 @@ static const struct usb_device_id option
+ .driver_info = NCTRL(5) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */
++ .driver_info = NCTRL(4) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */
+ .driver_info = NCTRL(6) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) },
projects / thirdparty / kernel / stable-queue.git / commitdiff
