From: Greg Kroah-Hartman Date: Thu, 21 Aug 2025 12:49:24 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v6.16.3~106 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4b75f0f43cbe026d53fd57820f213a6665da92ef;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: bus-mhi-host-fix-endianness-of-bhi-vector-table.patch cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch m68k-fix-lost-column-on-framebuffer-debug-console.patch usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch vt-defkeymap-map-keycodes-above-127-to-k_hole.patch vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch --- diff --git a/queue-5.10/bus-mhi-host-fix-endianness-of-bhi-vector-table.patch b/queue-5.10/bus-mhi-host-fix-endianness-of-bhi-vector-table.patch new file mode 100644 index 0000000000..c3eca776c2 --- /dev/null +++ b/queue-5.10/bus-mhi-host-fix-endianness-of-bhi-vector-table.patch @@ -0,0 +1,79 @@ +From f471578e8b1a90623674433a01a8845110bc76ce Mon Sep 17 00:00:00 2001 +From: Alexander Wilhelm +Date: Mon, 19 May 2025 16:58:37 +0200 +Subject: bus: mhi: host: Fix endianness of BHI vector table + +From: Alexander Wilhelm + +commit f471578e8b1a90623674433a01a8845110bc76ce upstream. + +On big endian platform like PowerPC, the MHI bus (which is little endian) +does not start properly. The following example shows the error messages by +using QCN9274 WLAN device with ath12k driver: + + ath12k_pci 0001:01:00.0: BAR 0: assigned [mem 0xc00000000-0xc001fffff 64bit] + ath12k_pci 0001:01:00.0: MSI vectors: 1 + ath12k_pci 0001:01:00.0: Hardware name: qcn9274 hw2.0 + ath12k_pci 0001:01:00.0: failed to set mhi state: POWER_ON(2) + ath12k_pci 0001:01:00.0: failed to start mhi: -110 + ath12k_pci 0001:01:00.0: failed to power up :-110 + ath12k_pci 0001:01:00.0: failed to create soc core: -110 + ath12k_pci 0001:01:00.0: failed to init core: -110 + ath12k_pci: probe of 0001:01:00.0 failed with error -110 + +The issue seems to be with the incorrect DMA address/size used for +transferring the firmware image over BHI. So fix it by converting the DMA +address and size of the BHI vector table to little endian format before +sending them to the device. + +Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells") +Signed-off-by: Alexander Wilhelm +[mani: added stable tag and reworded commit message] +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Jeff Hugo +Reviewed-by: Krishna Chaitanya Chundru +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250519145837.958153-1-alexander.wilhelm@westermo.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/mhi/host/boot.c | 8 ++++---- + drivers/bus/mhi/host/internal.h | 4 ++-- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/bus/mhi/host/boot.c ++++ b/drivers/bus/mhi/host/boot.c +@@ -30,8 +30,8 @@ void mhi_rddm_prepare(struct mhi_control + unsigned int i; + + for (i = 0; i < img_info->entries - 1; i++, mhi_buf++, bhi_vec++) { +- bhi_vec->dma_addr = mhi_buf->dma_addr; +- bhi_vec->size = mhi_buf->len; ++ bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr); ++ bhi_vec->size = cpu_to_le64(mhi_buf->len); + } + + dev_dbg(dev, "BHIe programming for RDDM\n"); +@@ -372,8 +372,8 @@ static void mhi_firmware_copy(struct mhi + while (remainder) { + to_cpy = min(remainder, mhi_buf->len); + memcpy(mhi_buf->buf, buf, to_cpy); +- bhi_vec->dma_addr = mhi_buf->dma_addr; +- bhi_vec->size = to_cpy; ++ bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr); ++ bhi_vec->size = cpu_to_le64(to_cpy); + + buf += to_cpy; + remainder -= to_cpy; +--- a/drivers/bus/mhi/host/internal.h ++++ b/drivers/bus/mhi/host/internal.h +@@ -263,8 +263,8 @@ struct mhi_tre { + }; + + struct bhi_vec_entry { +- u64 dma_addr; +- u64 size; ++ __le64 dma_addr; ++ __le64 size; + }; + + enum mhi_cmd_type { diff --git a/queue-5.10/cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch b/queue-5.10/cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch new file mode 100644 index 0000000000..3f3e2724fe --- /dev/null +++ b/queue-5.10/cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch @@ -0,0 +1,34 @@ +From 4a26df233266a628157d7f0285451d8655defdfc Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 1 Jul 2025 17:30:01 -0500 +Subject: cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() + +From: Dan Carpenter + +commit 4a26df233266a628157d7f0285451d8655defdfc upstream. + +The freq_tables[] array has num_possible_cpus() elements so, to avoid an +out of bounds access, this loop should be capped at "< nb_cpus" instead +of "<= nb_cpus". The freq_tables[] array is allocated in +armada_8k_cpufreq_init(). + +Cc: stable@vger.kernel.org +Fixes: f525a670533d ("cpufreq: ap806: add cpufreq driver for Armada 8K") +Signed-off-by: Dan Carpenter +Signed-off-by: Viresh Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/armada-8k-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/cpufreq/armada-8k-cpufreq.c ++++ b/drivers/cpufreq/armada-8k-cpufreq.c +@@ -96,7 +96,7 @@ static void armada_8k_cpufreq_free_table + { + int opps_index, nb_cpus = num_possible_cpus(); + +- for (opps_index = 0 ; opps_index <= nb_cpus; opps_index++) { ++ for (opps_index = 0 ; opps_index < nb_cpus; opps_index++) { + int i; + + /* If cpu_dev is NULL then we reached the end of the array */ diff --git a/queue-5.10/m68k-fix-lost-column-on-framebuffer-debug-console.patch b/queue-5.10/m68k-fix-lost-column-on-framebuffer-debug-console.patch new file mode 100644 index 0000000000..0543d2e8b3 --- /dev/null +++ b/queue-5.10/m68k-fix-lost-column-on-framebuffer-debug-console.patch @@ -0,0 +1,97 @@ +From 210a1ce8ed4391b64a888b3fb4b5611a13f5ccc7 Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Fri, 28 Mar 2025 09:39:55 +1100 +Subject: m68k: Fix lost column on framebuffer debug console + +From: Finn Thain + +commit 210a1ce8ed4391b64a888b3fb4b5611a13f5ccc7 upstream. + +Move the cursor position rightward after rendering the character, +not before. This avoids complications that arise when the recursive +console_putc call has to wrap the line and/or scroll the display. +This also fixes the linewrap bug that crops off the rightmost column. + +When the cursor is at the bottom of the display, a linefeed will not +move the cursor position further downward. Instead, the display scrolls +upward. Avoid the repeated add/subtract sequence by way of a single +subtraction at the initialization of console_struct_num_rows. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Finn Thain +Tested-by: Stan Johnson +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/9d4e8c68a456d5f2bc254ac6f87a472d066ebd5e.1743115195.git.fthain@linux-m68k.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman +--- + arch/m68k/kernel/head.S | 31 +++++++++++++++++++++---------- + 1 file changed, 21 insertions(+), 10 deletions(-) + +--- a/arch/m68k/kernel/head.S ++++ b/arch/m68k/kernel/head.S +@@ -3379,6 +3379,7 @@ L(console_clear_loop): + + movel %d4,%d1 /* screen height in pixels */ + divul %a0@(FONT_DESC_HEIGHT),%d1 /* d1 = max num rows */ ++ subql #1,%d1 /* row range is 0 to num - 1 */ + + movel %d0,%a2@(Lconsole_struct_num_columns) + movel %d1,%a2@(Lconsole_struct_num_rows) +@@ -3525,15 +3526,14 @@ func_start console_putc,%a0/%a1/%d0-%d7 + cmpib #10,%d7 + jne L(console_not_lf) + movel %a0@(Lconsole_struct_cur_row),%d0 +- addil #1,%d0 +- movel %d0,%a0@(Lconsole_struct_cur_row) + movel %a0@(Lconsole_struct_num_rows),%d1 + cmpl %d1,%d0 + jcs 1f +- subil #1,%d0 +- movel %d0,%a0@(Lconsole_struct_cur_row) + console_scroll ++ jra L(console_exit) + 1: ++ addql #1,%d0 ++ movel %d0,%a0@(Lconsole_struct_cur_row) + jra L(console_exit) + + L(console_not_lf): +@@ -3560,12 +3560,6 @@ L(console_not_cr): + */ + L(console_not_home): + movel %a0@(Lconsole_struct_cur_column),%d0 +- addql #1,%a0@(Lconsole_struct_cur_column) +- movel %a0@(Lconsole_struct_num_columns),%d1 +- cmpl %d1,%d0 +- jcs 1f +- console_putc #'\n' /* recursion is OK! */ +-1: + movel %a0@(Lconsole_struct_cur_row),%d1 + + /* +@@ -3612,6 +3606,23 @@ L(console_do_font_scanline): + addq #1,%d1 + dbra %d7,L(console_read_char_scanline) + ++ /* ++ * Register usage in the code below: ++ * a0 = pointer to console globals ++ * d0 = cursor column ++ * d1 = cursor column limit ++ */ ++ ++ lea %pc@(L(console_globals)),%a0 ++ ++ movel %a0@(Lconsole_struct_cur_column),%d0 ++ addql #1,%d0 ++ movel %d0,%a0@(Lconsole_struct_cur_column) /* Update cursor pos */ ++ movel %a0@(Lconsole_struct_num_columns),%d1 ++ cmpl %d1,%d0 ++ jcs L(console_exit) ++ console_putc #'\n' /* Line wrap using tail recursion */ ++ + L(console_exit): + func_return console_putc + diff --git a/queue-5.10/series b/queue-5.10/series index 8cd478a54d..7988a62c99 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -352,3 +352,11 @@ mm-kmemleak-avoid-deadlock-by-moving-pr_warn-outside-kmemleak_lock.patch media-uvcvideo-fix-1-byte-out-of-bounds-read-in-uvc_parse_format.patch media-uvcvideo-do-not-mark-valid-metadata-as-invalid.patch serial-8250-fix-panic-due-to-pslverr.patch +cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch +m68k-fix-lost-column-on-framebuffer-debug-console.patch +usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch +usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch +usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch +bus-mhi-host-fix-endianness-of-bhi-vector-table.patch +vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch +vt-defkeymap-map-keycodes-above-127-to-k_hole.patch diff --git a/queue-5.10/usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch b/queue-5.10/usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch new file mode 100644 index 0000000000..ff217c0486 --- /dev/null +++ b/queue-5.10/usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch @@ -0,0 +1,231 @@ +From 8d1b02e5d7e3a6d2acffb1f4c094678fda9e3456 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Tue, 22 Jul 2025 12:11:18 -0700 +Subject: usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() + +From: Nathan Chancellor + +commit 8d1b02e5d7e3a6d2acffb1f4c094678fda9e3456 upstream. + +After a recent change in clang to expose uninitialized warnings from +const variables [1], there is a warning in cxacru_heavy_init(): + + drivers/usb/atm/cxacru.c:1104:6: error: variable 'bp' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] + 1104 | if (instance->modem_type->boot_rom_patch) { + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + drivers/usb/atm/cxacru.c:1113:39: note: uninitialized use occurs here + 1113 | cxacru_upload_firmware(instance, fw, bp); + | ^~ + drivers/usb/atm/cxacru.c:1104:2: note: remove the 'if' if its condition is always true + 1104 | if (instance->modem_type->boot_rom_patch) { + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + drivers/usb/atm/cxacru.c:1095:32: note: initialize the variable 'bp' to silence this warning + 1095 | const struct firmware *fw, *bp; + | ^ + | = NULL + +While the warning is technically correct that bp is conditionally passed +uninitialized to cxacru_upload_firmware(), it is ultimately a false +positive warning on the uninitialized use of bp because the same +condition that initializes bp, instance->modem_type->boot_rom_patch, is +the same one that gates the use of bp within cxacru_upload_firmware(). +As this warning occurs in clang's frontend before inlining occurs, it +cannot know that these conditions are indentical to avoid the warning. + +Manually inline cxacru_upload_firmware() into cxacru_heavy_init(), as +that is its only callsite, so that clang can see that bp is initialized +and used under the same condition, clearing up the warning without any +functional changes to the code (LLVM was already doing this inlining +later). + +Cc: stable@vger.kernel.org +Fixes: 1b0e61465234 ("[PATCH] USB ATM: driver for the Conexant AccessRunner chipset cxacru") +Closes: https://github.com/ClangBuiltLinux/linux/issues/2102 +Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1] +Signed-off-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20250722-usb-cxacru-fix-clang-21-uninit-warning-v2-1-6708a18decd2@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/atm/cxacru.c | 106 +++++++++++++++++++++-------------------------- + 1 file changed, 49 insertions(+), 57 deletions(-) + +--- a/drivers/usb/atm/cxacru.c ++++ b/drivers/usb/atm/cxacru.c +@@ -983,25 +983,60 @@ cleanup: + return ret; + } + +-static void cxacru_upload_firmware(struct cxacru_data *instance, +- const struct firmware *fw, +- const struct firmware *bp) ++ ++static int cxacru_find_firmware(struct cxacru_data *instance, ++ char *phase, const struct firmware **fw_p) + { +- int ret; ++ struct usbatm_data *usbatm = instance->usbatm; ++ struct device *dev = &usbatm->usb_intf->dev; ++ char buf[16]; ++ ++ sprintf(buf, "cxacru-%s.bin", phase); ++ usb_dbg(usbatm, "cxacru_find_firmware: looking for %s\n", buf); ++ ++ if (request_firmware(fw_p, buf, dev)) { ++ usb_dbg(usbatm, "no stage %s firmware found\n", phase); ++ return -ENOENT; ++ } ++ ++ usb_info(usbatm, "found firmware %s\n", buf); ++ ++ return 0; ++} ++ ++static int cxacru_heavy_init(struct usbatm_data *usbatm_instance, ++ struct usb_interface *usb_intf) ++{ ++ const struct firmware *fw, *bp; ++ struct cxacru_data *instance = usbatm_instance->driver_data; + struct usbatm_data *usbatm = instance->usbatm; + struct usb_device *usb_dev = usbatm->usb_dev; + __le16 signature[] = { usb_dev->descriptor.idVendor, + usb_dev->descriptor.idProduct }; + __le32 val; ++ int ret; ++ ++ ret = cxacru_find_firmware(instance, "fw", &fw); ++ if (ret) { ++ usb_warn(usbatm_instance, "firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n"); ++ return ret; ++ } + +- usb_dbg(usbatm, "%s\n", __func__); ++ if (instance->modem_type->boot_rom_patch) { ++ ret = cxacru_find_firmware(instance, "bp", &bp); ++ if (ret) { ++ usb_warn(usbatm_instance, "boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n"); ++ release_firmware(fw); ++ return ret; ++ } ++ } + + /* FirmwarePllFClkValue */ + val = cpu_to_le32(instance->modem_type->pll_f_clk); + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLFCLK_ADDR, (u8 *) &val, 4); + if (ret) { + usb_err(usbatm, "FirmwarePllFClkValue failed: %d\n", ret); +- return; ++ goto done; + } + + /* FirmwarePllBClkValue */ +@@ -1009,7 +1044,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLBCLK_ADDR, (u8 *) &val, 4); + if (ret) { + usb_err(usbatm, "FirmwarePllBClkValue failed: %d\n", ret); +- return; ++ goto done; + } + + /* Enable SDRAM */ +@@ -1017,7 +1052,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SDRAMEN_ADDR, (u8 *) &val, 4); + if (ret) { + usb_err(usbatm, "Enable SDRAM failed: %d\n", ret); +- return; ++ goto done; + } + + /* Firmware */ +@@ -1025,7 +1060,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, FW_ADDR, fw->data, fw->size); + if (ret) { + usb_err(usbatm, "Firmware upload failed: %d\n", ret); +- return; ++ goto done; + } + + /* Boot ROM patch */ +@@ -1034,7 +1069,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, BR_ADDR, bp->data, bp->size); + if (ret) { + usb_err(usbatm, "Boot ROM patching failed: %d\n", ret); +- return; ++ goto done; + } + } + +@@ -1042,7 +1077,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SIG_ADDR, (u8 *) signature, 4); + if (ret) { + usb_err(usbatm, "Signature storing failed: %d\n", ret); +- return; ++ goto done; + } + + usb_info(usbatm, "starting device\n"); +@@ -1054,7 +1089,7 @@ static void cxacru_upload_firmware(struc + } + if (ret) { + usb_err(usbatm, "Passing control to firmware failed: %d\n", ret); +- return; ++ goto done; + } + + /* Delay to allow firmware to start up. */ +@@ -1068,53 +1103,10 @@ static void cxacru_upload_firmware(struc + ret = cxacru_cm(instance, CM_REQUEST_CARD_GET_STATUS, NULL, 0, NULL, 0); + if (ret < 0) { + usb_err(usbatm, "modem failed to initialize: %d\n", ret); +- return; +- } +-} +- +-static int cxacru_find_firmware(struct cxacru_data *instance, +- char *phase, const struct firmware **fw_p) +-{ +- struct usbatm_data *usbatm = instance->usbatm; +- struct device *dev = &usbatm->usb_intf->dev; +- char buf[16]; +- +- sprintf(buf, "cxacru-%s.bin", phase); +- usb_dbg(usbatm, "cxacru_find_firmware: looking for %s\n", buf); +- +- if (request_firmware(fw_p, buf, dev)) { +- usb_dbg(usbatm, "no stage %s firmware found\n", phase); +- return -ENOENT; ++ goto done; + } + +- usb_info(usbatm, "found firmware %s\n", buf); +- +- return 0; +-} +- +-static int cxacru_heavy_init(struct usbatm_data *usbatm_instance, +- struct usb_interface *usb_intf) +-{ +- const struct firmware *fw, *bp; +- struct cxacru_data *instance = usbatm_instance->driver_data; +- int ret = cxacru_find_firmware(instance, "fw", &fw); +- +- if (ret) { +- usb_warn(usbatm_instance, "firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n"); +- return ret; +- } +- +- if (instance->modem_type->boot_rom_patch) { +- ret = cxacru_find_firmware(instance, "bp", &bp); +- if (ret) { +- usb_warn(usbatm_instance, "boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n"); +- release_firmware(fw); +- return ret; +- } +- } +- +- cxacru_upload_firmware(instance, fw, bp); +- ++done: + if (instance->modem_type->boot_rom_patch) + release_firmware(bp); + release_firmware(fw); diff --git a/queue-5.10/usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch b/queue-5.10/usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch new file mode 100644 index 0000000000..2461d20412 --- /dev/null +++ b/queue-5.10/usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch @@ -0,0 +1,35 @@ +From 93b400f4951404d040197943a25d6fef9f8ccabb Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 24 Jul 2025 11:19:07 +0200 +Subject: usb: dwc3: meson-g12a: fix device leaks at unbind + +From: Johan Hovold + +commit 93b400f4951404d040197943a25d6fef9f8ccabb upstream. + +Make sure to drop the references taken to the child devices by +of_find_device_by_node() during probe on driver unbind. + +Fixes: c99993376f72 ("usb: dwc3: Add Amlogic G12A DWC3 glue") +Cc: stable@vger.kernel.org # 5.2 +Cc: Neil Armstrong +Signed-off-by: Johan Hovold +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250724091910.21092-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-meson-g12a.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/dwc3/dwc3-meson-g12a.c ++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c +@@ -844,6 +844,9 @@ static int dwc3_meson_g12a_remove(struct + if (priv->drvdata->otg_switch_supported) + usb_role_switch_unregister(priv->role_switch); + ++ put_device(priv->switch_desc.udc); ++ put_device(priv->switch_desc.usb2_port); ++ + of_platform_depopulate(dev); + + for (i = 0 ; i < PHY_COUNT ; ++i) { diff --git a/queue-5.10/usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch b/queue-5.10/usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch new file mode 100644 index 0000000000..8c5548c440 --- /dev/null +++ b/queue-5.10/usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch @@ -0,0 +1,32 @@ +From 868837b0a94c6b1b1fdbc04d3ba218ca83432393 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 24 Jul 2025 11:19:08 +0200 +Subject: usb: gadget: udc: renesas_usb3: fix device leak at unbind + +From: Johan Hovold + +commit 868837b0a94c6b1b1fdbc04d3ba218ca83432393 upstream. + +Make sure to drop the reference to the companion device taken during +probe when the driver is unbound. + +Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch") +Cc: stable@vger.kernel.org # 4.19 +Cc: Yoshihiro Shimoda +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20250724091910.21092-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/renesas_usb3.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -2566,6 +2566,7 @@ static int renesas_usb3_remove(struct pl + struct renesas_usb3 *usb3 = platform_get_drvdata(pdev); + + debugfs_remove_recursive(usb3->dentry); ++ put_device(usb3->host_dev); + device_remove_file(&pdev->dev, &dev_attr_role); + + cancel_work_sync(&usb3->role_work); diff --git a/queue-5.10/vt-defkeymap-map-keycodes-above-127-to-k_hole.patch b/queue-5.10/vt-defkeymap-map-keycodes-above-127-to-k_hole.patch new file mode 100644 index 0000000000..bc0075abdc --- /dev/null +++ b/queue-5.10/vt-defkeymap-map-keycodes-above-127-to-k_hole.patch @@ -0,0 +1,194 @@ +From b43cb4ff85da5cf29c4cd351ef1d7dd8210780f7 Mon Sep 17 00:00:00 2001 +From: Myrrh Periwinkle +Date: Wed, 2 Jul 2025 21:17:58 +0700 +Subject: vt: defkeymap: Map keycodes above 127 to K_HOLE + +From: Myrrh Periwinkle + +commit b43cb4ff85da5cf29c4cd351ef1d7dd8210780f7 upstream. + +The maximum number of keycodes got bumped to 256 a very long time ago, +but the default keymaps were never adjusted to match. This is causing +the kernel to interpret keycodes above 127 as U+0000 if the shipped +generated keymap is used. + +Fix this by mapping all keycodes above 127 to K_HOLE so the kernel +ignores them. + +The contents of this patche were generated by rerunning `loadkeys +--mktable --unicode` and only including the changes to map keycodes +above 127 to K_HOLE. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Myrrh Periwinkle +Cc: stable +Reviewed-by: Jiri Slaby +Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-2-c27e143cc2eb@qtmlabs.xyz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/vt/defkeymap.c_shipped | 112 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 112 insertions(+) + +--- a/drivers/tty/vt/defkeymap.c_shipped ++++ b/drivers/tty/vt/defkeymap.c_shipped +@@ -23,6 +23,22 @@ u_short plain_map[NR_KEYS] = { + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + u_short shift_map[NR_KEYS] = { +@@ -42,6 +58,22 @@ u_short shift_map[NR_KEYS] = { + 0xf20b, 0xf601, 0xf602, 0xf117, 0xf600, 0xf20a, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + u_short altgr_map[NR_KEYS] = { +@@ -61,6 +93,22 @@ u_short altgr_map[NR_KEYS] = { + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + u_short ctrl_map[NR_KEYS] = { +@@ -80,6 +128,22 @@ u_short ctrl_map[NR_KEYS] = { + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + u_short shift_ctrl_map[NR_KEYS] = { +@@ -99,6 +163,22 @@ u_short shift_ctrl_map[NR_KEYS] = { + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + u_short alt_map[NR_KEYS] = { +@@ -118,6 +198,22 @@ u_short alt_map[NR_KEYS] = { + 0xf118, 0xf210, 0xf211, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + u_short ctrl_alt_map[NR_KEYS] = { +@@ -137,6 +233,22 @@ u_short ctrl_alt_map[NR_KEYS] = { + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf20c, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + ushort *key_maps[MAX_NR_KEYMAPS] = { diff --git a/queue-5.10/vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch b/queue-5.10/vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch new file mode 100644 index 0000000000..80274a609c --- /dev/null +++ b/queue-5.10/vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch @@ -0,0 +1,35 @@ +From b1cc2092ea7a52e2c435aee6d2b1bcb773202663 Mon Sep 17 00:00:00 2001 +From: Myrrh Periwinkle +Date: Wed, 2 Jul 2025 21:17:57 +0700 +Subject: vt: keyboard: Don't process Unicode characters in K_OFF mode + +From: Myrrh Periwinkle + +commit b1cc2092ea7a52e2c435aee6d2b1bcb773202663 upstream. + +We don't process Unicode characters if the virtual terminal is in raw +mode, so there's no reason why we shouldn't do the same for K_OFF +(especially since people would expect K_OFF to actually turn off all VT +key processing). + +Fixes: 9fc3de9c8356 ("vt: Add virtual console keyboard mode OFF") +Signed-off-by: Myrrh Periwinkle +Cc: stable +Reviewed-by: Jiri Slaby +Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-1-c27e143cc2eb@qtmlabs.xyz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/vt/keyboard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -1461,7 +1461,7 @@ static void kbd_keycode(unsigned int key + rc = atomic_notifier_call_chain(&keyboard_notifier_list, + KBD_UNICODE, ¶m); + if (rc != NOTIFY_STOP) +- if (down && !raw_mode) ++ if (down && !(raw_mode || kbd->kbdmode == VC_OFF)) + k_unicode(vc, keysym, !down); + return; + }