From: Greg Kroah-Hartman Date: Thu, 21 Aug 2025 12:49:52 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v6.16.3~103 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0c1959f9badbe934362e294b903cbe28a0f64a5c;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: bus-mhi-host-detect-events-pointing-to-unexpected-tres.patch bus-mhi-host-fix-endianness-of-bhi-vector-table.patch cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch m68k-fix-lost-column-on-framebuffer-debug-console.patch platform-chrome-cros_ec-unregister-notifier-in-cros_ec_unregister.patch usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch usb-musb-omap2430-fix-device-leak-at-unbind.patch vt-defkeymap-map-keycodes-above-127-to-k_hole.patch vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch --- diff --git a/queue-6.6/bus-mhi-host-detect-events-pointing-to-unexpected-tres.patch b/queue-6.6/bus-mhi-host-detect-events-pointing-to-unexpected-tres.patch new file mode 100644 index 0000000000..061066d557 --- /dev/null +++ b/queue-6.6/bus-mhi-host-detect-events-pointing-to-unexpected-tres.patch @@ -0,0 +1,75 @@ +From 5bd398e20f0833ae8a1267d4f343591a2dd20185 Mon Sep 17 00:00:00 2001 +From: Youssef Samir +Date: Mon, 14 Jul 2025 18:30:39 +0200 +Subject: bus: mhi: host: Detect events pointing to unexpected TREs + +From: Youssef Samir + +commit 5bd398e20f0833ae8a1267d4f343591a2dd20185 upstream. + +When a remote device sends a completion event to the host, it contains a +pointer to the consumed TRE. The host uses this pointer to process all of +the TREs between it and the host's local copy of the ring's read pointer. +This works when processing completion for chained transactions, but can +lead to nasty results if the device sends an event for a single-element +transaction with a read pointer that is multiple elements ahead of the +host's read pointer. + +For instance, if the host accesses an event ring while the device is +updating it, the pointer inside of the event might still point to an old +TRE. If the host uses the channel's xfer_cb() to directly free the buffer +pointed to by the TRE, the buffer will be double-freed. + +This behavior was observed on an ep that used upstream EP stack without +'commit 6f18d174b73d ("bus: mhi: ep: Update read pointer only after buffer +is written")'. Where the device updated the events ring pointer before +updating the event contents, so it left a window where the host was able to +access the stale data the event pointed to, before the device had the +chance to update them. The usual pattern was that the host received an +event pointing to a TRE that is not immediately after the last processed +one, so it got treated as if it was a chained transaction, processing all +of the TREs in between the two read pointers. + +This commit aims to harden the host by ensuring transactions where the +event points to a TRE that isn't local_rp + 1 are chained. + +Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") +Signed-off-by: Youssef Samir +[mani: added stable tag and reworded commit message] +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Jeff Hugo +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250714163039.3438985-1-quic_yabdulra@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/mhi/host/main.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/bus/mhi/host/main.c ++++ b/drivers/bus/mhi/host/main.c +@@ -603,7 +603,7 @@ static int parse_xfer_event(struct mhi_c + { + dma_addr_t ptr = MHI_TRE_GET_EV_PTR(event); + struct mhi_ring_element *local_rp, *ev_tre; +- void *dev_rp; ++ void *dev_rp, *next_rp; + struct mhi_buf_info *buf_info; + u16 xfer_len; + +@@ -622,6 +622,16 @@ static int parse_xfer_event(struct mhi_c + result.dir = mhi_chan->dir; + + local_rp = tre_ring->rp; ++ ++ next_rp = local_rp + 1; ++ if (next_rp >= tre_ring->base + tre_ring->len) ++ next_rp = tre_ring->base; ++ if (dev_rp != next_rp && !MHI_TRE_DATA_GET_CHAIN(local_rp)) { ++ dev_err(&mhi_cntrl->mhi_dev->dev, ++ "Event element points to an unexpected TRE\n"); ++ break; ++ } ++ + while (local_rp != dev_rp) { + buf_info = buf_ring->rp; + /* If it's the last TRE, get length from the event */ diff --git a/queue-6.6/bus-mhi-host-fix-endianness-of-bhi-vector-table.patch b/queue-6.6/bus-mhi-host-fix-endianness-of-bhi-vector-table.patch new file mode 100644 index 0000000000..e1c86f9df1 --- /dev/null +++ b/queue-6.6/bus-mhi-host-fix-endianness-of-bhi-vector-table.patch @@ -0,0 +1,79 @@ +From f471578e8b1a90623674433a01a8845110bc76ce Mon Sep 17 00:00:00 2001 +From: Alexander Wilhelm +Date: Mon, 19 May 2025 16:58:37 +0200 +Subject: bus: mhi: host: Fix endianness of BHI vector table + +From: Alexander Wilhelm + +commit f471578e8b1a90623674433a01a8845110bc76ce upstream. + +On big endian platform like PowerPC, the MHI bus (which is little endian) +does not start properly. The following example shows the error messages by +using QCN9274 WLAN device with ath12k driver: + + ath12k_pci 0001:01:00.0: BAR 0: assigned [mem 0xc00000000-0xc001fffff 64bit] + ath12k_pci 0001:01:00.0: MSI vectors: 1 + ath12k_pci 0001:01:00.0: Hardware name: qcn9274 hw2.0 + ath12k_pci 0001:01:00.0: failed to set mhi state: POWER_ON(2) + ath12k_pci 0001:01:00.0: failed to start mhi: -110 + ath12k_pci 0001:01:00.0: failed to power up :-110 + ath12k_pci 0001:01:00.0: failed to create soc core: -110 + ath12k_pci 0001:01:00.0: failed to init core: -110 + ath12k_pci: probe of 0001:01:00.0 failed with error -110 + +The issue seems to be with the incorrect DMA address/size used for +transferring the firmware image over BHI. So fix it by converting the DMA +address and size of the BHI vector table to little endian format before +sending them to the device. + +Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells") +Signed-off-by: Alexander Wilhelm +[mani: added stable tag and reworded commit message] +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Jeff Hugo +Reviewed-by: Krishna Chaitanya Chundru +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250519145837.958153-1-alexander.wilhelm@westermo.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/mhi/host/boot.c | 8 ++++---- + drivers/bus/mhi/host/internal.h | 4 ++-- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/bus/mhi/host/boot.c ++++ b/drivers/bus/mhi/host/boot.c +@@ -31,8 +31,8 @@ int mhi_rddm_prepare(struct mhi_controll + int ret; + + for (i = 0; i < img_info->entries - 1; i++, mhi_buf++, bhi_vec++) { +- bhi_vec->dma_addr = mhi_buf->dma_addr; +- bhi_vec->size = mhi_buf->len; ++ bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr); ++ bhi_vec->size = cpu_to_le64(mhi_buf->len); + } + + dev_dbg(dev, "BHIe programming for RDDM\n"); +@@ -375,8 +375,8 @@ static void mhi_firmware_copy(struct mhi + while (remainder) { + to_cpy = min(remainder, mhi_buf->len); + memcpy(mhi_buf->buf, buf, to_cpy); +- bhi_vec->dma_addr = mhi_buf->dma_addr; +- bhi_vec->size = to_cpy; ++ bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr); ++ bhi_vec->size = cpu_to_le64(to_cpy); + + buf += to_cpy; + remainder -= to_cpy; +--- a/drivers/bus/mhi/host/internal.h ++++ b/drivers/bus/mhi/host/internal.h +@@ -31,8 +31,8 @@ struct mhi_ctxt { + }; + + struct bhi_vec_entry { +- u64 dma_addr; +- u64 size; ++ __le64 dma_addr; ++ __le64 size; + }; + + enum mhi_ch_state_type { diff --git a/queue-6.6/cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch b/queue-6.6/cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch new file mode 100644 index 0000000000..b56b3777a1 --- /dev/null +++ b/queue-6.6/cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch @@ -0,0 +1,34 @@ +From 4a26df233266a628157d7f0285451d8655defdfc Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 1 Jul 2025 17:30:01 -0500 +Subject: cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() + +From: Dan Carpenter + +commit 4a26df233266a628157d7f0285451d8655defdfc upstream. + +The freq_tables[] array has num_possible_cpus() elements so, to avoid an +out of bounds access, this loop should be capped at "< nb_cpus" instead +of "<= nb_cpus". The freq_tables[] array is allocated in +armada_8k_cpufreq_init(). + +Cc: stable@vger.kernel.org +Fixes: f525a670533d ("cpufreq: ap806: add cpufreq driver for Armada 8K") +Signed-off-by: Dan Carpenter +Signed-off-by: Viresh Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/armada-8k-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/cpufreq/armada-8k-cpufreq.c ++++ b/drivers/cpufreq/armada-8k-cpufreq.c +@@ -103,7 +103,7 @@ static void armada_8k_cpufreq_free_table + { + int opps_index, nb_cpus = num_possible_cpus(); + +- for (opps_index = 0 ; opps_index <= nb_cpus; opps_index++) { ++ for (opps_index = 0 ; opps_index < nb_cpus; opps_index++) { + int i; + + /* If cpu_dev is NULL then we reached the end of the array */ diff --git a/queue-6.6/m68k-fix-lost-column-on-framebuffer-debug-console.patch b/queue-6.6/m68k-fix-lost-column-on-framebuffer-debug-console.patch new file mode 100644 index 0000000000..34475727ef --- /dev/null +++ b/queue-6.6/m68k-fix-lost-column-on-framebuffer-debug-console.patch @@ -0,0 +1,97 @@ +From 210a1ce8ed4391b64a888b3fb4b5611a13f5ccc7 Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Fri, 28 Mar 2025 09:39:55 +1100 +Subject: m68k: Fix lost column on framebuffer debug console + +From: Finn Thain + +commit 210a1ce8ed4391b64a888b3fb4b5611a13f5ccc7 upstream. + +Move the cursor position rightward after rendering the character, +not before. This avoids complications that arise when the recursive +console_putc call has to wrap the line and/or scroll the display. +This also fixes the linewrap bug that crops off the rightmost column. + +When the cursor is at the bottom of the display, a linefeed will not +move the cursor position further downward. Instead, the display scrolls +upward. Avoid the repeated add/subtract sequence by way of a single +subtraction at the initialization of console_struct_num_rows. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Finn Thain +Tested-by: Stan Johnson +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/9d4e8c68a456d5f2bc254ac6f87a472d066ebd5e.1743115195.git.fthain@linux-m68k.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman +--- + arch/m68k/kernel/head.S | 31 +++++++++++++++++++++---------- + 1 file changed, 21 insertions(+), 10 deletions(-) + +--- a/arch/m68k/kernel/head.S ++++ b/arch/m68k/kernel/head.S +@@ -3404,6 +3404,7 @@ L(console_clear_loop): + + movel %d4,%d1 /* screen height in pixels */ + divul %a0@(FONT_DESC_HEIGHT),%d1 /* d1 = max num rows */ ++ subql #1,%d1 /* row range is 0 to num - 1 */ + + movel %d0,%a2@(Lconsole_struct_num_columns) + movel %d1,%a2@(Lconsole_struct_num_rows) +@@ -3550,15 +3551,14 @@ func_start console_putc,%a0/%a1/%d0-%d7 + cmpib #10,%d7 + jne L(console_not_lf) + movel %a0@(Lconsole_struct_cur_row),%d0 +- addil #1,%d0 +- movel %d0,%a0@(Lconsole_struct_cur_row) + movel %a0@(Lconsole_struct_num_rows),%d1 + cmpl %d1,%d0 + jcs 1f +- subil #1,%d0 +- movel %d0,%a0@(Lconsole_struct_cur_row) + console_scroll ++ jra L(console_exit) + 1: ++ addql #1,%d0 ++ movel %d0,%a0@(Lconsole_struct_cur_row) + jra L(console_exit) + + L(console_not_lf): +@@ -3585,12 +3585,6 @@ L(console_not_cr): + */ + L(console_not_home): + movel %a0@(Lconsole_struct_cur_column),%d0 +- addql #1,%a0@(Lconsole_struct_cur_column) +- movel %a0@(Lconsole_struct_num_columns),%d1 +- cmpl %d1,%d0 +- jcs 1f +- console_putc #'\n' /* recursion is OK! */ +-1: + movel %a0@(Lconsole_struct_cur_row),%d1 + + /* +@@ -3637,6 +3631,23 @@ L(console_do_font_scanline): + addq #1,%d1 + dbra %d7,L(console_read_char_scanline) + ++ /* ++ * Register usage in the code below: ++ * a0 = pointer to console globals ++ * d0 = cursor column ++ * d1 = cursor column limit ++ */ ++ ++ lea %pc@(L(console_globals)),%a0 ++ ++ movel %a0@(Lconsole_struct_cur_column),%d0 ++ addql #1,%d0 ++ movel %d0,%a0@(Lconsole_struct_cur_column) /* Update cursor pos */ ++ movel %a0@(Lconsole_struct_num_columns),%d1 ++ cmpl %d1,%d0 ++ jcs L(console_exit) ++ console_putc #'\n' /* Line wrap using tail recursion */ ++ + L(console_exit): + func_return console_putc + diff --git a/queue-6.6/platform-chrome-cros_ec-unregister-notifier-in-cros_ec_unregister.patch b/queue-6.6/platform-chrome-cros_ec-unregister-notifier-in-cros_ec_unregister.patch new file mode 100644 index 0000000000..bc85a97035 --- /dev/null +++ b/queue-6.6/platform-chrome-cros_ec-unregister-notifier-in-cros_ec_unregister.patch @@ -0,0 +1,36 @@ +From e2374953461947eee49f69b3e3204ff080ef31b1 Mon Sep 17 00:00:00 2001 +From: Tzung-Bi Shih +Date: Tue, 22 Jul 2025 12:05:13 +0000 +Subject: platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() + +From: Tzung-Bi Shih + +commit e2374953461947eee49f69b3e3204ff080ef31b1 upstream. + +The blocking notifier is registered in cros_ec_register(); however, it +isn't unregistered in cros_ec_unregister(). + +Fix it. + +Fixes: 42cd0ab476e2 ("platform/chrome: cros_ec: Query EC protocol version if EC transitions between RO/RW") +Cc: stable@vger.kernel.org +Reviewed-by: Benson Leung +Link: https://lore.kernel.org/r/20250722120513.234031-1-tzungbi@kernel.org +Signed-off-by: Tzung-Bi Shih +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/chrome/cros_ec.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/platform/chrome/cros_ec.c ++++ b/drivers/platform/chrome/cros_ec.c +@@ -313,6 +313,9 @@ EXPORT_SYMBOL(cros_ec_register); + */ + void cros_ec_unregister(struct cros_ec_device *ec_dev) + { ++ if (ec_dev->mkbp_event_supported) ++ blocking_notifier_chain_unregister(&ec_dev->event_notifier, ++ &ec_dev->notifier_ready); + platform_device_unregister(ec_dev->pd); + platform_device_unregister(ec_dev->ec); + mutex_destroy(&ec_dev->lock); diff --git a/queue-6.6/series b/queue-6.6/series index a94d3a2382..76895f9d17 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -328,3 +328,14 @@ hid-magicmouse-avoid-setting-up-battery-timer-when-not-needed.patch hid-apple-avoid-setting-up-battery-timer-for-devices-without-battery.patch rcu-fix-racy-re-initialization-of-irq_work-causing-hangs.patch serial-8250-fix-panic-due-to-pslverr.patch +cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch +platform-chrome-cros_ec-unregister-notifier-in-cros_ec_unregister.patch +m68k-fix-lost-column-on-framebuffer-debug-console.patch +usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch +usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch +usb-musb-omap2430-fix-device-leak-at-unbind.patch +usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch +bus-mhi-host-fix-endianness-of-bhi-vector-table.patch +bus-mhi-host-detect-events-pointing-to-unexpected-tres.patch +vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch +vt-defkeymap-map-keycodes-above-127-to-k_hole.patch diff --git a/queue-6.6/usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch b/queue-6.6/usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch new file mode 100644 index 0000000000..8979b02926 --- /dev/null +++ b/queue-6.6/usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch @@ -0,0 +1,231 @@ +From 8d1b02e5d7e3a6d2acffb1f4c094678fda9e3456 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Tue, 22 Jul 2025 12:11:18 -0700 +Subject: usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() + +From: Nathan Chancellor + +commit 8d1b02e5d7e3a6d2acffb1f4c094678fda9e3456 upstream. + +After a recent change in clang to expose uninitialized warnings from +const variables [1], there is a warning in cxacru_heavy_init(): + + drivers/usb/atm/cxacru.c:1104:6: error: variable 'bp' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] + 1104 | if (instance->modem_type->boot_rom_patch) { + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + drivers/usb/atm/cxacru.c:1113:39: note: uninitialized use occurs here + 1113 | cxacru_upload_firmware(instance, fw, bp); + | ^~ + drivers/usb/atm/cxacru.c:1104:2: note: remove the 'if' if its condition is always true + 1104 | if (instance->modem_type->boot_rom_patch) { + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + drivers/usb/atm/cxacru.c:1095:32: note: initialize the variable 'bp' to silence this warning + 1095 | const struct firmware *fw, *bp; + | ^ + | = NULL + +While the warning is technically correct that bp is conditionally passed +uninitialized to cxacru_upload_firmware(), it is ultimately a false +positive warning on the uninitialized use of bp because the same +condition that initializes bp, instance->modem_type->boot_rom_patch, is +the same one that gates the use of bp within cxacru_upload_firmware(). +As this warning occurs in clang's frontend before inlining occurs, it +cannot know that these conditions are indentical to avoid the warning. + +Manually inline cxacru_upload_firmware() into cxacru_heavy_init(), as +that is its only callsite, so that clang can see that bp is initialized +and used under the same condition, clearing up the warning without any +functional changes to the code (LLVM was already doing this inlining +later). + +Cc: stable@vger.kernel.org +Fixes: 1b0e61465234 ("[PATCH] USB ATM: driver for the Conexant AccessRunner chipset cxacru") +Closes: https://github.com/ClangBuiltLinux/linux/issues/2102 +Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1] +Signed-off-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20250722-usb-cxacru-fix-clang-21-uninit-warning-v2-1-6708a18decd2@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/atm/cxacru.c | 106 +++++++++++++++++++++-------------------------- + 1 file changed, 49 insertions(+), 57 deletions(-) + +--- a/drivers/usb/atm/cxacru.c ++++ b/drivers/usb/atm/cxacru.c +@@ -980,25 +980,60 @@ cleanup: + return ret; + } + +-static void cxacru_upload_firmware(struct cxacru_data *instance, +- const struct firmware *fw, +- const struct firmware *bp) ++ ++static int cxacru_find_firmware(struct cxacru_data *instance, ++ char *phase, const struct firmware **fw_p) + { +- int ret; ++ struct usbatm_data *usbatm = instance->usbatm; ++ struct device *dev = &usbatm->usb_intf->dev; ++ char buf[16]; ++ ++ sprintf(buf, "cxacru-%s.bin", phase); ++ usb_dbg(usbatm, "cxacru_find_firmware: looking for %s\n", buf); ++ ++ if (request_firmware(fw_p, buf, dev)) { ++ usb_dbg(usbatm, "no stage %s firmware found\n", phase); ++ return -ENOENT; ++ } ++ ++ usb_info(usbatm, "found firmware %s\n", buf); ++ ++ return 0; ++} ++ ++static int cxacru_heavy_init(struct usbatm_data *usbatm_instance, ++ struct usb_interface *usb_intf) ++{ ++ const struct firmware *fw, *bp; ++ struct cxacru_data *instance = usbatm_instance->driver_data; + struct usbatm_data *usbatm = instance->usbatm; + struct usb_device *usb_dev = usbatm->usb_dev; + __le16 signature[] = { usb_dev->descriptor.idVendor, + usb_dev->descriptor.idProduct }; + __le32 val; ++ int ret; ++ ++ ret = cxacru_find_firmware(instance, "fw", &fw); ++ if (ret) { ++ usb_warn(usbatm_instance, "firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n"); ++ return ret; ++ } + +- usb_dbg(usbatm, "%s\n", __func__); ++ if (instance->modem_type->boot_rom_patch) { ++ ret = cxacru_find_firmware(instance, "bp", &bp); ++ if (ret) { ++ usb_warn(usbatm_instance, "boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n"); ++ release_firmware(fw); ++ return ret; ++ } ++ } + + /* FirmwarePllFClkValue */ + val = cpu_to_le32(instance->modem_type->pll_f_clk); + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLFCLK_ADDR, (u8 *) &val, 4); + if (ret) { + usb_err(usbatm, "FirmwarePllFClkValue failed: %d\n", ret); +- return; ++ goto done; + } + + /* FirmwarePllBClkValue */ +@@ -1006,7 +1041,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLBCLK_ADDR, (u8 *) &val, 4); + if (ret) { + usb_err(usbatm, "FirmwarePllBClkValue failed: %d\n", ret); +- return; ++ goto done; + } + + /* Enable SDRAM */ +@@ -1014,7 +1049,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SDRAMEN_ADDR, (u8 *) &val, 4); + if (ret) { + usb_err(usbatm, "Enable SDRAM failed: %d\n", ret); +- return; ++ goto done; + } + + /* Firmware */ +@@ -1022,7 +1057,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, FW_ADDR, fw->data, fw->size); + if (ret) { + usb_err(usbatm, "Firmware upload failed: %d\n", ret); +- return; ++ goto done; + } + + /* Boot ROM patch */ +@@ -1031,7 +1066,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, BR_ADDR, bp->data, bp->size); + if (ret) { + usb_err(usbatm, "Boot ROM patching failed: %d\n", ret); +- return; ++ goto done; + } + } + +@@ -1039,7 +1074,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SIG_ADDR, (u8 *) signature, 4); + if (ret) { + usb_err(usbatm, "Signature storing failed: %d\n", ret); +- return; ++ goto done; + } + + usb_info(usbatm, "starting device\n"); +@@ -1051,7 +1086,7 @@ static void cxacru_upload_firmware(struc + } + if (ret) { + usb_err(usbatm, "Passing control to firmware failed: %d\n", ret); +- return; ++ goto done; + } + + /* Delay to allow firmware to start up. */ +@@ -1065,53 +1100,10 @@ static void cxacru_upload_firmware(struc + ret = cxacru_cm(instance, CM_REQUEST_CARD_GET_STATUS, NULL, 0, NULL, 0); + if (ret < 0) { + usb_err(usbatm, "modem failed to initialize: %d\n", ret); +- return; +- } +-} +- +-static int cxacru_find_firmware(struct cxacru_data *instance, +- char *phase, const struct firmware **fw_p) +-{ +- struct usbatm_data *usbatm = instance->usbatm; +- struct device *dev = &usbatm->usb_intf->dev; +- char buf[16]; +- +- sprintf(buf, "cxacru-%s.bin", phase); +- usb_dbg(usbatm, "cxacru_find_firmware: looking for %s\n", buf); +- +- if (request_firmware(fw_p, buf, dev)) { +- usb_dbg(usbatm, "no stage %s firmware found\n", phase); +- return -ENOENT; ++ goto done; + } + +- usb_info(usbatm, "found firmware %s\n", buf); +- +- return 0; +-} +- +-static int cxacru_heavy_init(struct usbatm_data *usbatm_instance, +- struct usb_interface *usb_intf) +-{ +- const struct firmware *fw, *bp; +- struct cxacru_data *instance = usbatm_instance->driver_data; +- int ret = cxacru_find_firmware(instance, "fw", &fw); +- +- if (ret) { +- usb_warn(usbatm_instance, "firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n"); +- return ret; +- } +- +- if (instance->modem_type->boot_rom_patch) { +- ret = cxacru_find_firmware(instance, "bp", &bp); +- if (ret) { +- usb_warn(usbatm_instance, "boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n"); +- release_firmware(fw); +- return ret; +- } +- } +- +- cxacru_upload_firmware(instance, fw, bp); +- ++done: + if (instance->modem_type->boot_rom_patch) + release_firmware(bp); + release_firmware(fw); diff --git a/queue-6.6/usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch b/queue-6.6/usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch new file mode 100644 index 0000000000..d204b2dd0d --- /dev/null +++ b/queue-6.6/usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch @@ -0,0 +1,35 @@ +From 93b400f4951404d040197943a25d6fef9f8ccabb Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 24 Jul 2025 11:19:07 +0200 +Subject: usb: dwc3: meson-g12a: fix device leaks at unbind + +From: Johan Hovold + +commit 93b400f4951404d040197943a25d6fef9f8ccabb upstream. + +Make sure to drop the references taken to the child devices by +of_find_device_by_node() during probe on driver unbind. + +Fixes: c99993376f72 ("usb: dwc3: Add Amlogic G12A DWC3 glue") +Cc: stable@vger.kernel.org # 5.2 +Cc: Neil Armstrong +Signed-off-by: Johan Hovold +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250724091910.21092-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-meson-g12a.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/dwc3/dwc3-meson-g12a.c ++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c +@@ -837,6 +837,9 @@ static void dwc3_meson_g12a_remove(struc + + usb_role_switch_unregister(priv->role_switch); + ++ put_device(priv->switch_desc.udc); ++ put_device(priv->switch_desc.usb2_port); ++ + of_platform_depopulate(dev); + + for (i = 0 ; i < PHY_COUNT ; ++i) { diff --git a/queue-6.6/usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch b/queue-6.6/usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch new file mode 100644 index 0000000000..69196cc876 --- /dev/null +++ b/queue-6.6/usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch @@ -0,0 +1,32 @@ +From 868837b0a94c6b1b1fdbc04d3ba218ca83432393 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 24 Jul 2025 11:19:08 +0200 +Subject: usb: gadget: udc: renesas_usb3: fix device leak at unbind + +From: Johan Hovold + +commit 868837b0a94c6b1b1fdbc04d3ba218ca83432393 upstream. + +Make sure to drop the reference to the companion device taken during +probe when the driver is unbound. + +Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch") +Cc: stable@vger.kernel.org # 4.19 +Cc: Yoshihiro Shimoda +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20250724091910.21092-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/renesas_usb3.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -2658,6 +2658,7 @@ static void renesas_usb3_remove(struct p + struct renesas_usb3 *usb3 = platform_get_drvdata(pdev); + + debugfs_remove_recursive(usb3->dentry); ++ put_device(usb3->host_dev); + device_remove_file(&pdev->dev, &dev_attr_role); + + cancel_work_sync(&usb3->role_work); diff --git a/queue-6.6/usb-musb-omap2430-fix-device-leak-at-unbind.patch b/queue-6.6/usb-musb-omap2430-fix-device-leak-at-unbind.patch new file mode 100644 index 0000000000..7af7374798 --- /dev/null +++ b/queue-6.6/usb-musb-omap2430-fix-device-leak-at-unbind.patch @@ -0,0 +1,79 @@ +From 1473e9e7679bd4f5a62d1abccae894fb86de280f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 24 Jul 2025 11:19:09 +0200 +Subject: usb: musb: omap2430: fix device leak at unbind + +From: Johan Hovold + +commit 1473e9e7679bd4f5a62d1abccae894fb86de280f upstream. + +Make sure to drop the reference to the control device taken by +of_find_device_by_node() during probe when the driver is unbound. + +Fixes: 8934d3e4d0e7 ("usb: musb: omap2430: Don't use omap_get_control_dev()") +Cc: stable@vger.kernel.org # 3.13 +Cc: Roger Quadros +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20250724091910.21092-5-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/musb/omap2430.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/usb/musb/omap2430.c ++++ b/drivers/usb/musb/omap2430.c +@@ -400,7 +400,7 @@ static int omap2430_probe(struct platfor + ret = platform_device_add_resources(musb, pdev->resource, pdev->num_resources); + if (ret) { + dev_err(&pdev->dev, "failed to add resources\n"); +- goto err2; ++ goto err_put_control_otghs; + } + + if (populate_irqs) { +@@ -413,7 +413,7 @@ static int omap2430_probe(struct platfor + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!res) { + ret = -EINVAL; +- goto err2; ++ goto err_put_control_otghs; + } + + musb_res[i].start = res->start; +@@ -441,14 +441,14 @@ static int omap2430_probe(struct platfor + ret = platform_device_add_resources(musb, musb_res, i); + if (ret) { + dev_err(&pdev->dev, "failed to add IRQ resources\n"); +- goto err2; ++ goto err_put_control_otghs; + } + } + + ret = platform_device_add_data(musb, pdata, sizeof(*pdata)); + if (ret) { + dev_err(&pdev->dev, "failed to add platform_data\n"); +- goto err2; ++ goto err_put_control_otghs; + } + + pm_runtime_enable(glue->dev); +@@ -463,7 +463,9 @@ static int omap2430_probe(struct platfor + + err3: + pm_runtime_disable(glue->dev); +- ++err_put_control_otghs: ++ if (!IS_ERR(glue->control_otghs)) ++ put_device(glue->control_otghs); + err2: + platform_device_put(musb); + +@@ -477,6 +479,8 @@ static void omap2430_remove(struct platf + + platform_device_unregister(glue->musb); + pm_runtime_disable(glue->dev); ++ if (!IS_ERR(glue->control_otghs)) ++ put_device(glue->control_otghs); + } + + #ifdef CONFIG_PM diff --git a/queue-6.6/vt-defkeymap-map-keycodes-above-127-to-k_hole.patch b/queue-6.6/vt-defkeymap-map-keycodes-above-127-to-k_hole.patch new file mode 100644 index 0000000000..605a81f234 --- /dev/null +++ b/queue-6.6/vt-defkeymap-map-keycodes-above-127-to-k_hole.patch @@ -0,0 +1,194 @@ +From b43cb4ff85da5cf29c4cd351ef1d7dd8210780f7 Mon Sep 17 00:00:00 2001 +From: Myrrh Periwinkle +Date: Wed, 2 Jul 2025 21:17:58 +0700 +Subject: vt: defkeymap: Map keycodes above 127 to K_HOLE + +From: Myrrh Periwinkle + +commit b43cb4ff85da5cf29c4cd351ef1d7dd8210780f7 upstream. + +The maximum number of keycodes got bumped to 256 a very long time ago, +but the default keymaps were never adjusted to match. This is causing +the kernel to interpret keycodes above 127 as U+0000 if the shipped +generated keymap is used. + +Fix this by mapping all keycodes above 127 to K_HOLE so the kernel +ignores them. + +The contents of this patche were generated by rerunning `loadkeys +--mktable --unicode` and only including the changes to map keycodes +above 127 to K_HOLE. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Myrrh Periwinkle +Cc: stable +Reviewed-by: Jiri Slaby +Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-2-c27e143cc2eb@qtmlabs.xyz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/vt/defkeymap.c_shipped | 112 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 112 insertions(+) + +--- a/drivers/tty/vt/defkeymap.c_shipped ++++ b/drivers/tty/vt/defkeymap.c_shipped +@@ -23,6 +23,22 @@ unsigned short plain_map[NR_KEYS] = { + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short shift_map[NR_KEYS] = { +@@ -42,6 +58,22 @@ static unsigned short shift_map[NR_KEYS] + 0xf20b, 0xf601, 0xf602, 0xf117, 0xf600, 0xf20a, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short altgr_map[NR_KEYS] = { +@@ -61,6 +93,22 @@ static unsigned short altgr_map[NR_KEYS] + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short ctrl_map[NR_KEYS] = { +@@ -80,6 +128,22 @@ static unsigned short ctrl_map[NR_KEYS] + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short shift_ctrl_map[NR_KEYS] = { +@@ -99,6 +163,22 @@ static unsigned short shift_ctrl_map[NR_ + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short alt_map[NR_KEYS] = { +@@ -118,6 +198,22 @@ static unsigned short alt_map[NR_KEYS] = + 0xf118, 0xf210, 0xf211, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short ctrl_alt_map[NR_KEYS] = { +@@ -137,6 +233,22 @@ static unsigned short ctrl_alt_map[NR_KE + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf20c, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + unsigned short *key_maps[MAX_NR_KEYMAPS] = { diff --git a/queue-6.6/vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch b/queue-6.6/vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch new file mode 100644 index 0000000000..5709d7d4b4 --- /dev/null +++ b/queue-6.6/vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch @@ -0,0 +1,35 @@ +From b1cc2092ea7a52e2c435aee6d2b1bcb773202663 Mon Sep 17 00:00:00 2001 +From: Myrrh Periwinkle +Date: Wed, 2 Jul 2025 21:17:57 +0700 +Subject: vt: keyboard: Don't process Unicode characters in K_OFF mode + +From: Myrrh Periwinkle + +commit b1cc2092ea7a52e2c435aee6d2b1bcb773202663 upstream. + +We don't process Unicode characters if the virtual terminal is in raw +mode, so there's no reason why we shouldn't do the same for K_OFF +(especially since people would expect K_OFF to actually turn off all VT +key processing). + +Fixes: 9fc3de9c8356 ("vt: Add virtual console keyboard mode OFF") +Signed-off-by: Myrrh Periwinkle +Cc: stable +Reviewed-by: Jiri Slaby +Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-1-c27e143cc2eb@qtmlabs.xyz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/vt/keyboard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -1496,7 +1496,7 @@ static void kbd_keycode(unsigned int key + rc = atomic_notifier_call_chain(&keyboard_notifier_list, + KBD_UNICODE, ¶m); + if (rc != NOTIFY_STOP) +- if (down && !raw_mode) ++ if (down && !(raw_mode || kbd->kbdmode == VC_OFF)) + k_unicode(vc, keysym, !down); + return; + }