From: Greg Kroah-Hartman Date: Thu, 21 Aug 2025 12:50:02 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v6.16.3~102 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5b5630ac989ea83e55e43c3116c42dd77894c685;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: ata-fix-sata_mobile_lpm_policy-description-in-kconfig.patch bus-mhi-host-detect-events-pointing-to-unexpected-tres.patch bus-mhi-host-fix-endianness-of-bhi-vector-table.patch cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch dm-check-for-forbidden-splitting-of-zone-write-operations.patch dm-dm-crypt-do-not-partially-accept-write-bios-with-zoned-targets.patch m68k-fix-lost-column-on-framebuffer-debug-console.patch platform-chrome-cros_ec-unregister-notifier-in-cros_ec_unregister.patch pm-runtime-take-active-children-into-account-in-pm_runtime_get_if_in_use.patch usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch usb-dwc3-imx8mp-fix-device-leak-at-unbind.patch usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch usb-musb-omap2430-fix-device-leak-at-unbind.patch vt-defkeymap-map-keycodes-above-127-to-k_hole.patch vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch --- diff --git a/queue-6.12/ata-fix-sata_mobile_lpm_policy-description-in-kconfig.patch b/queue-6.12/ata-fix-sata_mobile_lpm_policy-description-in-kconfig.patch new file mode 100644 index 0000000000..7416490ced --- /dev/null +++ b/queue-6.12/ata-fix-sata_mobile_lpm_policy-description-in-kconfig.patch @@ -0,0 +1,73 @@ +From ed62a62a18bc144f73eadf866ae46842e8f6606e Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Wed, 18 Jun 2025 16:25:19 +0900 +Subject: ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig + +From: Damien Le Moal + +commit ed62a62a18bc144f73eadf866ae46842e8f6606e upstream. + +Improve the description of the possible default SATA link power +management policies and add the missing description for policy 5. +No functional changes. + +Fixes: a5ec5a7bfd1f ("ata: ahci: Support state with min power but Partial low power state") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Hannes Reinecke +Reviewed-by: Niklas Cassel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/Kconfig | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +--- a/drivers/ata/Kconfig ++++ b/drivers/ata/Kconfig +@@ -117,23 +117,39 @@ config SATA_AHCI + + config SATA_MOBILE_LPM_POLICY + int "Default SATA Link Power Management policy" +- range 0 4 ++ range 0 5 + default 3 + depends on SATA_AHCI + help + Select the Default SATA Link Power Management (LPM) policy to use + for chipsets / "South Bridges" supporting low-power modes. Such + chipsets are ubiquitous across laptops, desktops and servers. ++ Each policy combines power saving states and features: ++ - Partial: The Phy logic is powered but is in a reduced power ++ state. The exit latency from this state is no longer than ++ 10us). ++ - Slumber: The Phy logic is powered but is in an even lower power ++ state. The exit latency from this state is potentially ++ longer, but no longer than 10ms. ++ - DevSleep: The Phy logic may be powered down. The exit latency from ++ this state is no longer than 20 ms, unless otherwise ++ specified by DETO in the device Identify Device Data log. ++ - HIPM: Host Initiated Power Management (host automatically ++ transitions to partial and slumber). ++ - DIPM: Device Initiated Power Management (device automatically ++ transitions to partial and slumber). + +- The value set has the following meanings: ++ The possible values for the default SATA link power management ++ policies are: + 0 => Keep firmware settings +- 1 => Maximum performance +- 2 => Medium power +- 3 => Medium power with Device Initiated PM enabled +- 4 => Minimum power ++ 1 => No power savings (maximum performance) ++ 2 => HIPM (Partial) ++ 3 => HIPM (Partial) and DIPM (Partial and Slumber) ++ 4 => HIPM (Partial and DevSleep) and DIPM (Partial and Slumber) ++ 5 => HIPM (Slumber and DevSleep) and DIPM (Partial and Slumber) + +- Note "Minimum power" is known to cause issues, including disk +- corruption, with some disks and should not be used. ++ Excluding the value 0, higher values represent policies with higher ++ power savings. + + config SATA_AHCI_PLATFORM + tristate "Platform AHCI SATA support" diff --git a/queue-6.12/bus-mhi-host-detect-events-pointing-to-unexpected-tres.patch b/queue-6.12/bus-mhi-host-detect-events-pointing-to-unexpected-tres.patch new file mode 100644 index 0000000000..e743f0c2e3 --- /dev/null +++ b/queue-6.12/bus-mhi-host-detect-events-pointing-to-unexpected-tres.patch @@ -0,0 +1,75 @@ +From 5bd398e20f0833ae8a1267d4f343591a2dd20185 Mon Sep 17 00:00:00 2001 +From: Youssef Samir +Date: Mon, 14 Jul 2025 18:30:39 +0200 +Subject: bus: mhi: host: Detect events pointing to unexpected TREs + +From: Youssef Samir + +commit 5bd398e20f0833ae8a1267d4f343591a2dd20185 upstream. + +When a remote device sends a completion event to the host, it contains a +pointer to the consumed TRE. The host uses this pointer to process all of +the TREs between it and the host's local copy of the ring's read pointer. +This works when processing completion for chained transactions, but can +lead to nasty results if the device sends an event for a single-element +transaction with a read pointer that is multiple elements ahead of the +host's read pointer. + +For instance, if the host accesses an event ring while the device is +updating it, the pointer inside of the event might still point to an old +TRE. If the host uses the channel's xfer_cb() to directly free the buffer +pointed to by the TRE, the buffer will be double-freed. + +This behavior was observed on an ep that used upstream EP stack without +'commit 6f18d174b73d ("bus: mhi: ep: Update read pointer only after buffer +is written")'. Where the device updated the events ring pointer before +updating the event contents, so it left a window where the host was able to +access the stale data the event pointed to, before the device had the +chance to update them. The usual pattern was that the host received an +event pointing to a TRE that is not immediately after the last processed +one, so it got treated as if it was a chained transaction, processing all +of the TREs in between the two read pointers. + +This commit aims to harden the host by ensuring transactions where the +event points to a TRE that isn't local_rp + 1 are chained. + +Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") +Signed-off-by: Youssef Samir +[mani: added stable tag and reworded commit message] +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Jeff Hugo +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250714163039.3438985-1-quic_yabdulra@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/mhi/host/main.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/bus/mhi/host/main.c ++++ b/drivers/bus/mhi/host/main.c +@@ -602,7 +602,7 @@ static int parse_xfer_event(struct mhi_c + { + dma_addr_t ptr = MHI_TRE_GET_EV_PTR(event); + struct mhi_ring_element *local_rp, *ev_tre; +- void *dev_rp; ++ void *dev_rp, *next_rp; + struct mhi_buf_info *buf_info; + u16 xfer_len; + +@@ -621,6 +621,16 @@ static int parse_xfer_event(struct mhi_c + result.dir = mhi_chan->dir; + + local_rp = tre_ring->rp; ++ ++ next_rp = local_rp + 1; ++ if (next_rp >= tre_ring->base + tre_ring->len) ++ next_rp = tre_ring->base; ++ if (dev_rp != next_rp && !MHI_TRE_DATA_GET_CHAIN(local_rp)) { ++ dev_err(&mhi_cntrl->mhi_dev->dev, ++ "Event element points to an unexpected TRE\n"); ++ break; ++ } ++ + while (local_rp != dev_rp) { + buf_info = buf_ring->rp; + /* If it's the last TRE, get length from the event */ diff --git a/queue-6.12/bus-mhi-host-fix-endianness-of-bhi-vector-table.patch b/queue-6.12/bus-mhi-host-fix-endianness-of-bhi-vector-table.patch new file mode 100644 index 0000000000..c3c8a5f82a --- /dev/null +++ b/queue-6.12/bus-mhi-host-fix-endianness-of-bhi-vector-table.patch @@ -0,0 +1,79 @@ +From f471578e8b1a90623674433a01a8845110bc76ce Mon Sep 17 00:00:00 2001 +From: Alexander Wilhelm +Date: Mon, 19 May 2025 16:58:37 +0200 +Subject: bus: mhi: host: Fix endianness of BHI vector table + +From: Alexander Wilhelm + +commit f471578e8b1a90623674433a01a8845110bc76ce upstream. + +On big endian platform like PowerPC, the MHI bus (which is little endian) +does not start properly. The following example shows the error messages by +using QCN9274 WLAN device with ath12k driver: + + ath12k_pci 0001:01:00.0: BAR 0: assigned [mem 0xc00000000-0xc001fffff 64bit] + ath12k_pci 0001:01:00.0: MSI vectors: 1 + ath12k_pci 0001:01:00.0: Hardware name: qcn9274 hw2.0 + ath12k_pci 0001:01:00.0: failed to set mhi state: POWER_ON(2) + ath12k_pci 0001:01:00.0: failed to start mhi: -110 + ath12k_pci 0001:01:00.0: failed to power up :-110 + ath12k_pci 0001:01:00.0: failed to create soc core: -110 + ath12k_pci 0001:01:00.0: failed to init core: -110 + ath12k_pci: probe of 0001:01:00.0 failed with error -110 + +The issue seems to be with the incorrect DMA address/size used for +transferring the firmware image over BHI. So fix it by converting the DMA +address and size of the BHI vector table to little endian format before +sending them to the device. + +Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells") +Signed-off-by: Alexander Wilhelm +[mani: added stable tag and reworded commit message] +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Jeff Hugo +Reviewed-by: Krishna Chaitanya Chundru +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250519145837.958153-1-alexander.wilhelm@westermo.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/mhi/host/boot.c | 8 ++++---- + drivers/bus/mhi/host/internal.h | 4 ++-- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/bus/mhi/host/boot.c ++++ b/drivers/bus/mhi/host/boot.c +@@ -31,8 +31,8 @@ int mhi_rddm_prepare(struct mhi_controll + int ret; + + for (i = 0; i < img_info->entries - 1; i++, mhi_buf++, bhi_vec++) { +- bhi_vec->dma_addr = mhi_buf->dma_addr; +- bhi_vec->size = mhi_buf->len; ++ bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr); ++ bhi_vec->size = cpu_to_le64(mhi_buf->len); + } + + dev_dbg(dev, "BHIe programming for RDDM\n"); +@@ -375,8 +375,8 @@ static void mhi_firmware_copy(struct mhi + while (remainder) { + to_cpy = min(remainder, mhi_buf->len); + memcpy(mhi_buf->buf, buf, to_cpy); +- bhi_vec->dma_addr = mhi_buf->dma_addr; +- bhi_vec->size = to_cpy; ++ bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr); ++ bhi_vec->size = cpu_to_le64(to_cpy); + + buf += to_cpy; + remainder -= to_cpy; +--- a/drivers/bus/mhi/host/internal.h ++++ b/drivers/bus/mhi/host/internal.h +@@ -25,8 +25,8 @@ struct mhi_ctxt { + }; + + struct bhi_vec_entry { +- u64 dma_addr; +- u64 size; ++ __le64 dma_addr; ++ __le64 size; + }; + + enum mhi_ch_state_type { diff --git a/queue-6.12/cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch b/queue-6.12/cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch new file mode 100644 index 0000000000..b56b3777a1 --- /dev/null +++ b/queue-6.12/cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch @@ -0,0 +1,34 @@ +From 4a26df233266a628157d7f0285451d8655defdfc Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 1 Jul 2025 17:30:01 -0500 +Subject: cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() + +From: Dan Carpenter + +commit 4a26df233266a628157d7f0285451d8655defdfc upstream. + +The freq_tables[] array has num_possible_cpus() elements so, to avoid an +out of bounds access, this loop should be capped at "< nb_cpus" instead +of "<= nb_cpus". The freq_tables[] array is allocated in +armada_8k_cpufreq_init(). + +Cc: stable@vger.kernel.org +Fixes: f525a670533d ("cpufreq: ap806: add cpufreq driver for Armada 8K") +Signed-off-by: Dan Carpenter +Signed-off-by: Viresh Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/armada-8k-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/cpufreq/armada-8k-cpufreq.c ++++ b/drivers/cpufreq/armada-8k-cpufreq.c +@@ -103,7 +103,7 @@ static void armada_8k_cpufreq_free_table + { + int opps_index, nb_cpus = num_possible_cpus(); + +- for (opps_index = 0 ; opps_index <= nb_cpus; opps_index++) { ++ for (opps_index = 0 ; opps_index < nb_cpus; opps_index++) { + int i; + + /* If cpu_dev is NULL then we reached the end of the array */ diff --git a/queue-6.12/dm-check-for-forbidden-splitting-of-zone-write-operations.patch b/queue-6.12/dm-check-for-forbidden-splitting-of-zone-write-operations.patch new file mode 100644 index 0000000000..da6f81ca58 --- /dev/null +++ b/queue-6.12/dm-check-for-forbidden-splitting-of-zone-write-operations.patch @@ -0,0 +1,67 @@ +From 409f9287dab3b53bffe8d28d883a529028aa6a42 Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Wed, 25 Jun 2025 18:33:27 +0900 +Subject: dm: Check for forbidden splitting of zone write operations + +From: Damien Le Moal + +commit 409f9287dab3b53bffe8d28d883a529028aa6a42 upstream. + +DM targets must not split zone append and write operations using +dm_accept_partial_bio() as doing so is forbidden for zone append BIOs, +breaks zone append emulation using regular write BIOs and potentially +creates deadlock situations with queue freeze operations. + +Modify dm_accept_partial_bio() to add missing BUG_ON() checks for all +these cases, that is, check that the BIO is a write or write zeroes +operation. This change packs all the zone related checks together under +a static_branch_unlikely(&zoned_enabled) and done only if the target is +a zoned device. + +Fixes: f211268ed1f9 ("dm: Use the block layer zone append emulation") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Mikulas Patocka +Link: https://lore.kernel.org/r/20250625093327.548866-6-dlemoal@kernel.org +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1307,8 +1307,9 @@ out: + /* + * A target may call dm_accept_partial_bio only from the map routine. It is + * allowed for all bio types except REQ_PREFLUSH, REQ_OP_ZONE_* zone management +- * operations, REQ_OP_ZONE_APPEND (zone append writes) and any bio serviced by +- * __send_duplicate_bios(). ++ * operations, zone append writes (native with REQ_OP_ZONE_APPEND or emulated ++ * with write BIOs flagged with BIO_EMULATES_ZONE_APPEND) and any bio serviced ++ * by __send_duplicate_bios(). + * + * dm_accept_partial_bio informs the dm that the target only wants to process + * additional n_sectors sectors of the bio and the rest of the data should be +@@ -1341,11 +1342,19 @@ void dm_accept_partial_bio(struct bio *b + unsigned int bio_sectors = bio_sectors(bio); + + BUG_ON(dm_tio_flagged(tio, DM_TIO_IS_DUPLICATE_BIO)); +- BUG_ON(op_is_zone_mgmt(bio_op(bio))); +- BUG_ON(bio_op(bio) == REQ_OP_ZONE_APPEND); + BUG_ON(bio_sectors > *tio->len_ptr); + BUG_ON(n_sectors > bio_sectors); + ++ if (static_branch_unlikely(&zoned_enabled) && ++ unlikely(bdev_is_zoned(bio->bi_bdev))) { ++ enum req_op op = bio_op(bio); ++ ++ BUG_ON(op_is_zone_mgmt(op)); ++ BUG_ON(op == REQ_OP_WRITE); ++ BUG_ON(op == REQ_OP_WRITE_ZEROES); ++ BUG_ON(op == REQ_OP_ZONE_APPEND); ++ } ++ + *tio->len_ptr -= bio_sectors - n_sectors; + bio->bi_iter.bi_size = n_sectors << SECTOR_SHIFT; + diff --git a/queue-6.12/dm-dm-crypt-do-not-partially-accept-write-bios-with-zoned-targets.patch b/queue-6.12/dm-dm-crypt-do-not-partially-accept-write-bios-with-zoned-targets.patch new file mode 100644 index 0000000000..98569a839a --- /dev/null +++ b/queue-6.12/dm-dm-crypt-do-not-partially-accept-write-bios-with-zoned-targets.patch @@ -0,0 +1,150 @@ +From e549663849e5bb3b985dc2d293069f0d9747ae72 Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Wed, 25 Jun 2025 18:33:26 +0900 +Subject: dm: dm-crypt: Do not partially accept write BIOs with zoned targets + +From: Damien Le Moal + +commit e549663849e5bb3b985dc2d293069f0d9747ae72 upstream. + +Read and write operations issued to a dm-crypt target may be split +according to the dm-crypt internal limits defined by the max_read_size +and max_write_size module parameters (default is 128 KB). The intent is +to improve processing time of large BIOs by splitting them into smaller +operations that can be parallelized on different CPUs. + +For zoned dm-crypt targets, this BIO splitting is still done but without +the parallel execution to ensure that the issuing order of write +operations to the underlying devices remains sequential. However, the +splitting itself causes other problems: + +1) Since dm-crypt relies on the block layer zone write plugging to + handle zone append emulation using regular write operations, the + reminder of a split write BIO will always be plugged into the target + zone write plugged. Once the on-going write BIO finishes, this + reminder BIO is unplugged and issued from the zone write plug work. + If this reminder BIO itself needs to be split, the reminder will be + re-issued and plugged again, but that causes a call to a + blk_queue_enter(), which may block if a queue freeze operation was + initiated. This results in a deadlock as DM submission still holds + BIOs that the queue freeze side is waiting for. + +2) dm-crypt relies on the emulation done by the block layer using + regular write operations for processing zone append operations. This + still requires to properly return the written sector as the BIO + sector of the original BIO. However, this can be done correctly only + and only if there is a single clone BIO used for processing the + original zone append operation issued by the user. If the size of a + zone append operation is larger than dm-crypt max_write_size, then + the orginal BIO will be split and processed as a chain of regular + write operations. Such chaining result in an incorrect written sector + being returned to the zone append issuer using the original BIO + sector. This in turn results in file system data corruptions using + xfs or btrfs. + +Fix this by modifying get_max_request_size() to always return the size +of the BIO to avoid it being split with dm_accpet_partial_bio() in +crypt_map(). get_max_request_size() is renamed to +get_max_request_sectors() to clarify the unit of the value returned +and its interface is changed to take a struct dm_target pointer and a +pointer to the struct bio being processed. In addition to this change, +to ensure that crypt_alloc_buffer() works correctly, set the dm-crypt +device max_hw_sectors limit to be at most +BIO_MAX_VECS << PAGE_SECTORS_SHIFT (1 MB with a 4KB page architecture). +This forces DM core to split write BIOs before passing them to +crypt_map(), and thus guaranteeing that dm-crypt can always accept an +entire write BIO without needing to split it. + +This change does not have any effect on the read path of dm-crypt. Read +operations can still be split and the BIO fragments processed in +parallel. There is also no impact on the performance of the write path +given that all zone write BIOs were already processed inline instead of +in parallel. + +This change also does not affect in any way regular dm-crypt block +devices. + +Fixes: f211268ed1f9 ("dm: Use the block layer zone append emulation") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Mikulas Patocka +Link: https://lore.kernel.org/r/20250625093327.548866-5-dlemoal@kernel.org +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-crypt.c | 47 ++++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 38 insertions(+), 9 deletions(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -253,17 +253,35 @@ MODULE_PARM_DESC(max_read_size, "Maximum + static unsigned int max_write_size = 0; + module_param(max_write_size, uint, 0644); + MODULE_PARM_DESC(max_write_size, "Maximum size of a write request"); +-static unsigned get_max_request_size(struct crypt_config *cc, bool wrt) ++ ++static unsigned get_max_request_sectors(struct dm_target *ti, struct bio *bio) + { ++ struct crypt_config *cc = ti->private; + unsigned val, sector_align; +- val = !wrt ? READ_ONCE(max_read_size) : READ_ONCE(max_write_size); +- if (likely(!val)) +- val = !wrt ? DM_CRYPT_DEFAULT_MAX_READ_SIZE : DM_CRYPT_DEFAULT_MAX_WRITE_SIZE; +- if (wrt || cc->used_tag_size) { +- if (unlikely(val > BIO_MAX_VECS << PAGE_SHIFT)) +- val = BIO_MAX_VECS << PAGE_SHIFT; ++ bool wrt = op_is_write(bio_op(bio)); ++ ++ if (wrt) { ++ /* ++ * For zoned devices, splitting write operations creates the ++ * risk of deadlocking queue freeze operations with zone write ++ * plugging BIO work when the reminder of a split BIO is ++ * issued. So always allow the entire BIO to proceed. ++ */ ++ if (ti->emulate_zone_append) ++ return bio_sectors(bio); ++ ++ val = min_not_zero(READ_ONCE(max_write_size), ++ DM_CRYPT_DEFAULT_MAX_WRITE_SIZE); ++ } else { ++ val = min_not_zero(READ_ONCE(max_read_size), ++ DM_CRYPT_DEFAULT_MAX_READ_SIZE); + } +- sector_align = max(bdev_logical_block_size(cc->dev->bdev), (unsigned)cc->sector_size); ++ ++ if (wrt || cc->used_tag_size) ++ val = min(val, BIO_MAX_VECS << PAGE_SHIFT); ++ ++ sector_align = max(bdev_logical_block_size(cc->dev->bdev), ++ (unsigned)cc->sector_size); + val = round_down(val, sector_align); + if (unlikely(!val)) + val = sector_align; +@@ -3517,7 +3535,7 @@ static int crypt_map(struct dm_target *t + /* + * Check if bio is too large, split as needed. + */ +- max_sectors = get_max_request_size(cc, bio_data_dir(bio) == WRITE); ++ max_sectors = get_max_request_sectors(ti, bio); + if (unlikely(bio_sectors(bio) > max_sectors)) + dm_accept_partial_bio(bio, max_sectors); + +@@ -3754,6 +3772,17 @@ static void crypt_io_hints(struct dm_tar + max_t(unsigned int, limits->physical_block_size, cc->sector_size); + limits->io_min = max_t(unsigned int, limits->io_min, cc->sector_size); + limits->dma_alignment = limits->logical_block_size - 1; ++ ++ /* ++ * For zoned dm-crypt targets, there will be no internal splitting of ++ * write BIOs to avoid exceeding BIO_MAX_VECS vectors per BIO. But ++ * without respecting this limit, crypt_alloc_buffer() will trigger a ++ * BUG(). Avoid this by forcing DM core to split write BIOs to this ++ * limit. ++ */ ++ if (ti->emulate_zone_append) ++ limits->max_hw_sectors = min(limits->max_hw_sectors, ++ BIO_MAX_VECS << PAGE_SECTORS_SHIFT); + } + + static struct target_type crypt_target = { diff --git a/queue-6.12/m68k-fix-lost-column-on-framebuffer-debug-console.patch b/queue-6.12/m68k-fix-lost-column-on-framebuffer-debug-console.patch new file mode 100644 index 0000000000..2060246d93 --- /dev/null +++ b/queue-6.12/m68k-fix-lost-column-on-framebuffer-debug-console.patch @@ -0,0 +1,97 @@ +From 210a1ce8ed4391b64a888b3fb4b5611a13f5ccc7 Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Fri, 28 Mar 2025 09:39:55 +1100 +Subject: m68k: Fix lost column on framebuffer debug console + +From: Finn Thain + +commit 210a1ce8ed4391b64a888b3fb4b5611a13f5ccc7 upstream. + +Move the cursor position rightward after rendering the character, +not before. This avoids complications that arise when the recursive +console_putc call has to wrap the line and/or scroll the display. +This also fixes the linewrap bug that crops off the rightmost column. + +When the cursor is at the bottom of the display, a linefeed will not +move the cursor position further downward. Instead, the display scrolls +upward. Avoid the repeated add/subtract sequence by way of a single +subtraction at the initialization of console_struct_num_rows. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Finn Thain +Tested-by: Stan Johnson +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/9d4e8c68a456d5f2bc254ac6f87a472d066ebd5e.1743115195.git.fthain@linux-m68k.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman +--- + arch/m68k/kernel/head.S | 31 +++++++++++++++++++++---------- + 1 file changed, 21 insertions(+), 10 deletions(-) + +--- a/arch/m68k/kernel/head.S ++++ b/arch/m68k/kernel/head.S +@@ -3400,6 +3400,7 @@ L(console_clear_loop): + + movel %d4,%d1 /* screen height in pixels */ + divul %a0@(FONT_DESC_HEIGHT),%d1 /* d1 = max num rows */ ++ subql #1,%d1 /* row range is 0 to num - 1 */ + + movel %d0,%a2@(Lconsole_struct_num_columns) + movel %d1,%a2@(Lconsole_struct_num_rows) +@@ -3546,15 +3547,14 @@ func_start console_putc,%a0/%a1/%d0-%d7 + cmpib #10,%d7 + jne L(console_not_lf) + movel %a0@(Lconsole_struct_cur_row),%d0 +- addil #1,%d0 +- movel %d0,%a0@(Lconsole_struct_cur_row) + movel %a0@(Lconsole_struct_num_rows),%d1 + cmpl %d1,%d0 + jcs 1f +- subil #1,%d0 +- movel %d0,%a0@(Lconsole_struct_cur_row) + console_scroll ++ jra L(console_exit) + 1: ++ addql #1,%d0 ++ movel %d0,%a0@(Lconsole_struct_cur_row) + jra L(console_exit) + + L(console_not_lf): +@@ -3581,12 +3581,6 @@ L(console_not_cr): + */ + L(console_not_home): + movel %a0@(Lconsole_struct_cur_column),%d0 +- addql #1,%a0@(Lconsole_struct_cur_column) +- movel %a0@(Lconsole_struct_num_columns),%d1 +- cmpl %d1,%d0 +- jcs 1f +- console_putc #'\n' /* recursion is OK! */ +-1: + movel %a0@(Lconsole_struct_cur_row),%d1 + + /* +@@ -3633,6 +3627,23 @@ L(console_do_font_scanline): + addq #1,%d1 + dbra %d7,L(console_read_char_scanline) + ++ /* ++ * Register usage in the code below: ++ * a0 = pointer to console globals ++ * d0 = cursor column ++ * d1 = cursor column limit ++ */ ++ ++ lea %pc@(L(console_globals)),%a0 ++ ++ movel %a0@(Lconsole_struct_cur_column),%d0 ++ addql #1,%d0 ++ movel %d0,%a0@(Lconsole_struct_cur_column) /* Update cursor pos */ ++ movel %a0@(Lconsole_struct_num_columns),%d1 ++ cmpl %d1,%d0 ++ jcs L(console_exit) ++ console_putc #'\n' /* Line wrap using tail recursion */ ++ + L(console_exit): + func_return console_putc + diff --git a/queue-6.12/platform-chrome-cros_ec-unregister-notifier-in-cros_ec_unregister.patch b/queue-6.12/platform-chrome-cros_ec-unregister-notifier-in-cros_ec_unregister.patch new file mode 100644 index 0000000000..bc85a97035 --- /dev/null +++ b/queue-6.12/platform-chrome-cros_ec-unregister-notifier-in-cros_ec_unregister.patch @@ -0,0 +1,36 @@ +From e2374953461947eee49f69b3e3204ff080ef31b1 Mon Sep 17 00:00:00 2001 +From: Tzung-Bi Shih +Date: Tue, 22 Jul 2025 12:05:13 +0000 +Subject: platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() + +From: Tzung-Bi Shih + +commit e2374953461947eee49f69b3e3204ff080ef31b1 upstream. + +The blocking notifier is registered in cros_ec_register(); however, it +isn't unregistered in cros_ec_unregister(). + +Fix it. + +Fixes: 42cd0ab476e2 ("platform/chrome: cros_ec: Query EC protocol version if EC transitions between RO/RW") +Cc: stable@vger.kernel.org +Reviewed-by: Benson Leung +Link: https://lore.kernel.org/r/20250722120513.234031-1-tzungbi@kernel.org +Signed-off-by: Tzung-Bi Shih +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/chrome/cros_ec.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/platform/chrome/cros_ec.c ++++ b/drivers/platform/chrome/cros_ec.c +@@ -313,6 +313,9 @@ EXPORT_SYMBOL(cros_ec_register); + */ + void cros_ec_unregister(struct cros_ec_device *ec_dev) + { ++ if (ec_dev->mkbp_event_supported) ++ blocking_notifier_chain_unregister(&ec_dev->event_notifier, ++ &ec_dev->notifier_ready); + platform_device_unregister(ec_dev->pd); + platform_device_unregister(ec_dev->ec); + mutex_destroy(&ec_dev->lock); diff --git a/queue-6.12/pm-runtime-take-active-children-into-account-in-pm_runtime_get_if_in_use.patch b/queue-6.12/pm-runtime-take-active-children-into-account-in-pm_runtime_get_if_in_use.patch new file mode 100644 index 0000000000..3655ef361e --- /dev/null +++ b/queue-6.12/pm-runtime-take-active-children-into-account-in-pm_runtime_get_if_in_use.patch @@ -0,0 +1,81 @@ +From 51888393cc64dd0462d0b96c13ab94873abbc030 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 9 Jul 2025 12:41:45 +0200 +Subject: PM: runtime: Take active children into account in pm_runtime_get_if_in_use() + +From: Rafael J. Wysocki + +commit 51888393cc64dd0462d0b96c13ab94873abbc030 upstream. + +For all practical purposes, there is no difference between the situation +in which a given device is not ignoring children and its active child +count is nonzero and the situation in which its runtime PM usage counter +is nonzero. However, pm_runtime_get_if_in_use() will only increment the +device's usage counter and return 1 in the latter case. + +For consistency, make it do so in the former case either by adjusting +pm_runtime_get_conditional() and update the related kerneldoc comments +accordingly. + +Fixes: c111566bea7c ("PM: runtime: Add pm_runtime_get_if_active()") +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Reviewed-by: Sakari Ailus +Cc: 5.10+ # 5.10+: c0ef3df8dbae: PM: runtime: Simplify pm_runtime_get_if_active() usage +Cc: 5.10+ # 5.10+ +Link: https://patch.msgid.link/12700973.O9o76ZdvQC@rjwysocki.net +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/power/runtime.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -1183,10 +1183,12 @@ EXPORT_SYMBOL_GPL(__pm_runtime_resume); + * + * Return -EINVAL if runtime PM is disabled for @dev. + * +- * Otherwise, if the runtime PM status of @dev is %RPM_ACTIVE and either +- * @ign_usage_count is %true or the runtime PM usage counter of @dev is not +- * zero, increment the usage counter of @dev and return 1. Otherwise, return 0 +- * without changing the usage counter. ++ * Otherwise, if its runtime PM status is %RPM_ACTIVE and (1) @ign_usage_count ++ * is set, or (2) @dev is not ignoring children and its active child count is ++ * nonero, or (3) the runtime PM usage counter of @dev is not zero, increment ++ * the usage counter of @dev and return 1. ++ * ++ * Otherwise, return 0 without changing the usage counter. + * + * If @ign_usage_count is %true, this function can be used to prevent suspending + * the device when its runtime PM status is %RPM_ACTIVE. +@@ -1208,7 +1210,8 @@ static int pm_runtime_get_conditional(st + retval = -EINVAL; + } else if (dev->power.runtime_status != RPM_ACTIVE) { + retval = 0; +- } else if (ign_usage_count) { ++ } else if (ign_usage_count || (!dev->power.ignore_children && ++ atomic_read(&dev->power.child_count) > 0)) { + retval = 1; + atomic_inc(&dev->power.usage_count); + } else { +@@ -1241,10 +1244,16 @@ EXPORT_SYMBOL_GPL(pm_runtime_get_if_acti + * @dev: Target device. + * + * Increment the runtime PM usage counter of @dev if its runtime PM status is +- * %RPM_ACTIVE and its runtime PM usage counter is greater than 0, in which case +- * it returns 1. If the device is in a different state or its usage_count is 0, +- * 0 is returned. -EINVAL is returned if runtime PM is disabled for the device, +- * in which case also the usage_count will remain unmodified. ++ * %RPM_ACTIVE and its runtime PM usage counter is greater than 0 or it is not ++ * ignoring children and its active child count is nonzero. 1 is returned in ++ * this case. ++ * ++ * If @dev is in a different state or it is not in use (that is, its usage ++ * counter is 0, or it is ignoring children, or its active child count is 0), ++ * 0 is returned. ++ * ++ * -EINVAL is returned if runtime PM is disabled for the device, in which case ++ * also the usage counter of @dev is not updated. + */ + int pm_runtime_get_if_in_use(struct device *dev) + { diff --git a/queue-6.12/series b/queue-6.12/series index 10b9317334..ac6167e5dd 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -1 +1,17 @@ serial-8250-fix-panic-due-to-pslverr.patch +ata-fix-sata_mobile_lpm_policy-description-in-kconfig.patch +cpufreq-armada-8k-fix-off-by-one-in-armada_8k_cpufreq_free_table.patch +platform-chrome-cros_ec-unregister-notifier-in-cros_ec_unregister.patch +pm-runtime-take-active-children-into-account-in-pm_runtime_get_if_in_use.patch +dm-dm-crypt-do-not-partially-accept-write-bios-with-zoned-targets.patch +dm-check-for-forbidden-splitting-of-zone-write-operations.patch +m68k-fix-lost-column-on-framebuffer-debug-console.patch +usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch +usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch +usb-musb-omap2430-fix-device-leak-at-unbind.patch +usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch +usb-dwc3-imx8mp-fix-device-leak-at-unbind.patch +bus-mhi-host-fix-endianness-of-bhi-vector-table.patch +bus-mhi-host-detect-events-pointing-to-unexpected-tres.patch +vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch +vt-defkeymap-map-keycodes-above-127-to-k_hole.patch diff --git a/queue-6.12/usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch b/queue-6.12/usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch new file mode 100644 index 0000000000..8979b02926 --- /dev/null +++ b/queue-6.12/usb-atm-cxacru-merge-cxacru_upload_firmware-into-cxacru_heavy_init.patch @@ -0,0 +1,231 @@ +From 8d1b02e5d7e3a6d2acffb1f4c094678fda9e3456 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Tue, 22 Jul 2025 12:11:18 -0700 +Subject: usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() + +From: Nathan Chancellor + +commit 8d1b02e5d7e3a6d2acffb1f4c094678fda9e3456 upstream. + +After a recent change in clang to expose uninitialized warnings from +const variables [1], there is a warning in cxacru_heavy_init(): + + drivers/usb/atm/cxacru.c:1104:6: error: variable 'bp' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] + 1104 | if (instance->modem_type->boot_rom_patch) { + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + drivers/usb/atm/cxacru.c:1113:39: note: uninitialized use occurs here + 1113 | cxacru_upload_firmware(instance, fw, bp); + | ^~ + drivers/usb/atm/cxacru.c:1104:2: note: remove the 'if' if its condition is always true + 1104 | if (instance->modem_type->boot_rom_patch) { + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + drivers/usb/atm/cxacru.c:1095:32: note: initialize the variable 'bp' to silence this warning + 1095 | const struct firmware *fw, *bp; + | ^ + | = NULL + +While the warning is technically correct that bp is conditionally passed +uninitialized to cxacru_upload_firmware(), it is ultimately a false +positive warning on the uninitialized use of bp because the same +condition that initializes bp, instance->modem_type->boot_rom_patch, is +the same one that gates the use of bp within cxacru_upload_firmware(). +As this warning occurs in clang's frontend before inlining occurs, it +cannot know that these conditions are indentical to avoid the warning. + +Manually inline cxacru_upload_firmware() into cxacru_heavy_init(), as +that is its only callsite, so that clang can see that bp is initialized +and used under the same condition, clearing up the warning without any +functional changes to the code (LLVM was already doing this inlining +later). + +Cc: stable@vger.kernel.org +Fixes: 1b0e61465234 ("[PATCH] USB ATM: driver for the Conexant AccessRunner chipset cxacru") +Closes: https://github.com/ClangBuiltLinux/linux/issues/2102 +Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1] +Signed-off-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20250722-usb-cxacru-fix-clang-21-uninit-warning-v2-1-6708a18decd2@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/atm/cxacru.c | 106 +++++++++++++++++++++-------------------------- + 1 file changed, 49 insertions(+), 57 deletions(-) + +--- a/drivers/usb/atm/cxacru.c ++++ b/drivers/usb/atm/cxacru.c +@@ -980,25 +980,60 @@ cleanup: + return ret; + } + +-static void cxacru_upload_firmware(struct cxacru_data *instance, +- const struct firmware *fw, +- const struct firmware *bp) ++ ++static int cxacru_find_firmware(struct cxacru_data *instance, ++ char *phase, const struct firmware **fw_p) + { +- int ret; ++ struct usbatm_data *usbatm = instance->usbatm; ++ struct device *dev = &usbatm->usb_intf->dev; ++ char buf[16]; ++ ++ sprintf(buf, "cxacru-%s.bin", phase); ++ usb_dbg(usbatm, "cxacru_find_firmware: looking for %s\n", buf); ++ ++ if (request_firmware(fw_p, buf, dev)) { ++ usb_dbg(usbatm, "no stage %s firmware found\n", phase); ++ return -ENOENT; ++ } ++ ++ usb_info(usbatm, "found firmware %s\n", buf); ++ ++ return 0; ++} ++ ++static int cxacru_heavy_init(struct usbatm_data *usbatm_instance, ++ struct usb_interface *usb_intf) ++{ ++ const struct firmware *fw, *bp; ++ struct cxacru_data *instance = usbatm_instance->driver_data; + struct usbatm_data *usbatm = instance->usbatm; + struct usb_device *usb_dev = usbatm->usb_dev; + __le16 signature[] = { usb_dev->descriptor.idVendor, + usb_dev->descriptor.idProduct }; + __le32 val; ++ int ret; ++ ++ ret = cxacru_find_firmware(instance, "fw", &fw); ++ if (ret) { ++ usb_warn(usbatm_instance, "firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n"); ++ return ret; ++ } + +- usb_dbg(usbatm, "%s\n", __func__); ++ if (instance->modem_type->boot_rom_patch) { ++ ret = cxacru_find_firmware(instance, "bp", &bp); ++ if (ret) { ++ usb_warn(usbatm_instance, "boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n"); ++ release_firmware(fw); ++ return ret; ++ } ++ } + + /* FirmwarePllFClkValue */ + val = cpu_to_le32(instance->modem_type->pll_f_clk); + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLFCLK_ADDR, (u8 *) &val, 4); + if (ret) { + usb_err(usbatm, "FirmwarePllFClkValue failed: %d\n", ret); +- return; ++ goto done; + } + + /* FirmwarePllBClkValue */ +@@ -1006,7 +1041,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLBCLK_ADDR, (u8 *) &val, 4); + if (ret) { + usb_err(usbatm, "FirmwarePllBClkValue failed: %d\n", ret); +- return; ++ goto done; + } + + /* Enable SDRAM */ +@@ -1014,7 +1049,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SDRAMEN_ADDR, (u8 *) &val, 4); + if (ret) { + usb_err(usbatm, "Enable SDRAM failed: %d\n", ret); +- return; ++ goto done; + } + + /* Firmware */ +@@ -1022,7 +1057,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, FW_ADDR, fw->data, fw->size); + if (ret) { + usb_err(usbatm, "Firmware upload failed: %d\n", ret); +- return; ++ goto done; + } + + /* Boot ROM patch */ +@@ -1031,7 +1066,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, BR_ADDR, bp->data, bp->size); + if (ret) { + usb_err(usbatm, "Boot ROM patching failed: %d\n", ret); +- return; ++ goto done; + } + } + +@@ -1039,7 +1074,7 @@ static void cxacru_upload_firmware(struc + ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SIG_ADDR, (u8 *) signature, 4); + if (ret) { + usb_err(usbatm, "Signature storing failed: %d\n", ret); +- return; ++ goto done; + } + + usb_info(usbatm, "starting device\n"); +@@ -1051,7 +1086,7 @@ static void cxacru_upload_firmware(struc + } + if (ret) { + usb_err(usbatm, "Passing control to firmware failed: %d\n", ret); +- return; ++ goto done; + } + + /* Delay to allow firmware to start up. */ +@@ -1065,53 +1100,10 @@ static void cxacru_upload_firmware(struc + ret = cxacru_cm(instance, CM_REQUEST_CARD_GET_STATUS, NULL, 0, NULL, 0); + if (ret < 0) { + usb_err(usbatm, "modem failed to initialize: %d\n", ret); +- return; +- } +-} +- +-static int cxacru_find_firmware(struct cxacru_data *instance, +- char *phase, const struct firmware **fw_p) +-{ +- struct usbatm_data *usbatm = instance->usbatm; +- struct device *dev = &usbatm->usb_intf->dev; +- char buf[16]; +- +- sprintf(buf, "cxacru-%s.bin", phase); +- usb_dbg(usbatm, "cxacru_find_firmware: looking for %s\n", buf); +- +- if (request_firmware(fw_p, buf, dev)) { +- usb_dbg(usbatm, "no stage %s firmware found\n", phase); +- return -ENOENT; ++ goto done; + } + +- usb_info(usbatm, "found firmware %s\n", buf); +- +- return 0; +-} +- +-static int cxacru_heavy_init(struct usbatm_data *usbatm_instance, +- struct usb_interface *usb_intf) +-{ +- const struct firmware *fw, *bp; +- struct cxacru_data *instance = usbatm_instance->driver_data; +- int ret = cxacru_find_firmware(instance, "fw", &fw); +- +- if (ret) { +- usb_warn(usbatm_instance, "firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n"); +- return ret; +- } +- +- if (instance->modem_type->boot_rom_patch) { +- ret = cxacru_find_firmware(instance, "bp", &bp); +- if (ret) { +- usb_warn(usbatm_instance, "boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n"); +- release_firmware(fw); +- return ret; +- } +- } +- +- cxacru_upload_firmware(instance, fw, bp); +- ++done: + if (instance->modem_type->boot_rom_patch) + release_firmware(bp); + release_firmware(fw); diff --git a/queue-6.12/usb-dwc3-imx8mp-fix-device-leak-at-unbind.patch b/queue-6.12/usb-dwc3-imx8mp-fix-device-leak-at-unbind.patch new file mode 100644 index 0000000000..701bebd7c5 --- /dev/null +++ b/queue-6.12/usb-dwc3-imx8mp-fix-device-leak-at-unbind.patch @@ -0,0 +1,54 @@ +From 086a0e516f7b3844e6328a5c69e2708b66b0ce18 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 24 Jul 2025 11:19:06 +0200 +Subject: usb: dwc3: imx8mp: fix device leak at unbind + +From: Johan Hovold + +commit 086a0e516f7b3844e6328a5c69e2708b66b0ce18 upstream. + +Make sure to drop the reference to the dwc3 device taken by +of_find_device_by_node() on probe errors and on driver unbind. + +Fixes: 6dd2565989b4 ("usb: dwc3: add imx8mp dwc3 glue layer driver") +Cc: stable@vger.kernel.org # 5.12 +Cc: Li Jun +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20250724091910.21092-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-imx8mp.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/dwc3-imx8mp.c ++++ b/drivers/usb/dwc3/dwc3-imx8mp.c +@@ -244,7 +244,7 @@ static int dwc3_imx8mp_probe(struct plat + IRQF_ONESHOT, dev_name(dev), dwc3_imx); + if (err) { + dev_err(dev, "failed to request IRQ #%d --> %d\n", irq, err); +- goto depopulate; ++ goto put_dwc3; + } + + device_set_wakeup_capable(dev, true); +@@ -252,6 +252,8 @@ static int dwc3_imx8mp_probe(struct plat + + return 0; + ++put_dwc3: ++ put_device(&dwc3_imx->dwc3->dev); + depopulate: + of_platform_depopulate(dev); + remove_swnode: +@@ -265,8 +267,11 @@ disable_rpm: + + static void dwc3_imx8mp_remove(struct platform_device *pdev) + { ++ struct dwc3_imx8mp *dwc3_imx = platform_get_drvdata(pdev); + struct device *dev = &pdev->dev; + ++ put_device(&dwc3_imx->dwc3->dev); ++ + pm_runtime_get_sync(dev); + of_platform_depopulate(dev); + device_remove_software_node(dev); diff --git a/queue-6.12/usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch b/queue-6.12/usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch new file mode 100644 index 0000000000..d204b2dd0d --- /dev/null +++ b/queue-6.12/usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch @@ -0,0 +1,35 @@ +From 93b400f4951404d040197943a25d6fef9f8ccabb Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 24 Jul 2025 11:19:07 +0200 +Subject: usb: dwc3: meson-g12a: fix device leaks at unbind + +From: Johan Hovold + +commit 93b400f4951404d040197943a25d6fef9f8ccabb upstream. + +Make sure to drop the references taken to the child devices by +of_find_device_by_node() during probe on driver unbind. + +Fixes: c99993376f72 ("usb: dwc3: Add Amlogic G12A DWC3 glue") +Cc: stable@vger.kernel.org # 5.2 +Cc: Neil Armstrong +Signed-off-by: Johan Hovold +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20250724091910.21092-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-meson-g12a.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/dwc3/dwc3-meson-g12a.c ++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c +@@ -837,6 +837,9 @@ static void dwc3_meson_g12a_remove(struc + + usb_role_switch_unregister(priv->role_switch); + ++ put_device(priv->switch_desc.udc); ++ put_device(priv->switch_desc.usb2_port); ++ + of_platform_depopulate(dev); + + for (i = 0 ; i < PHY_COUNT ; ++i) { diff --git a/queue-6.12/usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch b/queue-6.12/usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch new file mode 100644 index 0000000000..69196cc876 --- /dev/null +++ b/queue-6.12/usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch @@ -0,0 +1,32 @@ +From 868837b0a94c6b1b1fdbc04d3ba218ca83432393 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 24 Jul 2025 11:19:08 +0200 +Subject: usb: gadget: udc: renesas_usb3: fix device leak at unbind + +From: Johan Hovold + +commit 868837b0a94c6b1b1fdbc04d3ba218ca83432393 upstream. + +Make sure to drop the reference to the companion device taken during +probe when the driver is unbound. + +Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch") +Cc: stable@vger.kernel.org # 4.19 +Cc: Yoshihiro Shimoda +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20250724091910.21092-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/renesas_usb3.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -2658,6 +2658,7 @@ static void renesas_usb3_remove(struct p + struct renesas_usb3 *usb3 = platform_get_drvdata(pdev); + + debugfs_remove_recursive(usb3->dentry); ++ put_device(usb3->host_dev); + device_remove_file(&pdev->dev, &dev_attr_role); + + cancel_work_sync(&usb3->role_work); diff --git a/queue-6.12/usb-musb-omap2430-fix-device-leak-at-unbind.patch b/queue-6.12/usb-musb-omap2430-fix-device-leak-at-unbind.patch new file mode 100644 index 0000000000..7af7374798 --- /dev/null +++ b/queue-6.12/usb-musb-omap2430-fix-device-leak-at-unbind.patch @@ -0,0 +1,79 @@ +From 1473e9e7679bd4f5a62d1abccae894fb86de280f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 24 Jul 2025 11:19:09 +0200 +Subject: usb: musb: omap2430: fix device leak at unbind + +From: Johan Hovold + +commit 1473e9e7679bd4f5a62d1abccae894fb86de280f upstream. + +Make sure to drop the reference to the control device taken by +of_find_device_by_node() during probe when the driver is unbound. + +Fixes: 8934d3e4d0e7 ("usb: musb: omap2430: Don't use omap_get_control_dev()") +Cc: stable@vger.kernel.org # 3.13 +Cc: Roger Quadros +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20250724091910.21092-5-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/musb/omap2430.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/usb/musb/omap2430.c ++++ b/drivers/usb/musb/omap2430.c +@@ -400,7 +400,7 @@ static int omap2430_probe(struct platfor + ret = platform_device_add_resources(musb, pdev->resource, pdev->num_resources); + if (ret) { + dev_err(&pdev->dev, "failed to add resources\n"); +- goto err2; ++ goto err_put_control_otghs; + } + + if (populate_irqs) { +@@ -413,7 +413,7 @@ static int omap2430_probe(struct platfor + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!res) { + ret = -EINVAL; +- goto err2; ++ goto err_put_control_otghs; + } + + musb_res[i].start = res->start; +@@ -441,14 +441,14 @@ static int omap2430_probe(struct platfor + ret = platform_device_add_resources(musb, musb_res, i); + if (ret) { + dev_err(&pdev->dev, "failed to add IRQ resources\n"); +- goto err2; ++ goto err_put_control_otghs; + } + } + + ret = platform_device_add_data(musb, pdata, sizeof(*pdata)); + if (ret) { + dev_err(&pdev->dev, "failed to add platform_data\n"); +- goto err2; ++ goto err_put_control_otghs; + } + + pm_runtime_enable(glue->dev); +@@ -463,7 +463,9 @@ static int omap2430_probe(struct platfor + + err3: + pm_runtime_disable(glue->dev); +- ++err_put_control_otghs: ++ if (!IS_ERR(glue->control_otghs)) ++ put_device(glue->control_otghs); + err2: + platform_device_put(musb); + +@@ -477,6 +479,8 @@ static void omap2430_remove(struct platf + + platform_device_unregister(glue->musb); + pm_runtime_disable(glue->dev); ++ if (!IS_ERR(glue->control_otghs)) ++ put_device(glue->control_otghs); + } + + #ifdef CONFIG_PM diff --git a/queue-6.12/vt-defkeymap-map-keycodes-above-127-to-k_hole.patch b/queue-6.12/vt-defkeymap-map-keycodes-above-127-to-k_hole.patch new file mode 100644 index 0000000000..605a81f234 --- /dev/null +++ b/queue-6.12/vt-defkeymap-map-keycodes-above-127-to-k_hole.patch @@ -0,0 +1,194 @@ +From b43cb4ff85da5cf29c4cd351ef1d7dd8210780f7 Mon Sep 17 00:00:00 2001 +From: Myrrh Periwinkle +Date: Wed, 2 Jul 2025 21:17:58 +0700 +Subject: vt: defkeymap: Map keycodes above 127 to K_HOLE + +From: Myrrh Periwinkle + +commit b43cb4ff85da5cf29c4cd351ef1d7dd8210780f7 upstream. + +The maximum number of keycodes got bumped to 256 a very long time ago, +but the default keymaps were never adjusted to match. This is causing +the kernel to interpret keycodes above 127 as U+0000 if the shipped +generated keymap is used. + +Fix this by mapping all keycodes above 127 to K_HOLE so the kernel +ignores them. + +The contents of this patche were generated by rerunning `loadkeys +--mktable --unicode` and only including the changes to map keycodes +above 127 to K_HOLE. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Myrrh Periwinkle +Cc: stable +Reviewed-by: Jiri Slaby +Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-2-c27e143cc2eb@qtmlabs.xyz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/vt/defkeymap.c_shipped | 112 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 112 insertions(+) + +--- a/drivers/tty/vt/defkeymap.c_shipped ++++ b/drivers/tty/vt/defkeymap.c_shipped +@@ -23,6 +23,22 @@ unsigned short plain_map[NR_KEYS] = { + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short shift_map[NR_KEYS] = { +@@ -42,6 +58,22 @@ static unsigned short shift_map[NR_KEYS] + 0xf20b, 0xf601, 0xf602, 0xf117, 0xf600, 0xf20a, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short altgr_map[NR_KEYS] = { +@@ -61,6 +93,22 @@ static unsigned short altgr_map[NR_KEYS] + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short ctrl_map[NR_KEYS] = { +@@ -80,6 +128,22 @@ static unsigned short ctrl_map[NR_KEYS] + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short shift_ctrl_map[NR_KEYS] = { +@@ -99,6 +163,22 @@ static unsigned short shift_ctrl_map[NR_ + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short alt_map[NR_KEYS] = { +@@ -118,6 +198,22 @@ static unsigned short alt_map[NR_KEYS] = + 0xf118, 0xf210, 0xf211, 0xf117, 0xf600, 0xf119, 0xf115, 0xf116, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + static unsigned short ctrl_alt_map[NR_KEYS] = { +@@ -137,6 +233,22 @@ static unsigned short ctrl_alt_map[NR_KE + 0xf118, 0xf601, 0xf602, 0xf117, 0xf600, 0xf119, 0xf115, 0xf20c, + 0xf11a, 0xf10c, 0xf10d, 0xf11b, 0xf11c, 0xf110, 0xf311, 0xf11d, + 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, ++ 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, 0xf200, + }; + + unsigned short *key_maps[MAX_NR_KEYMAPS] = { diff --git a/queue-6.12/vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch b/queue-6.12/vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch new file mode 100644 index 0000000000..6b4caf39bf --- /dev/null +++ b/queue-6.12/vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch @@ -0,0 +1,35 @@ +From b1cc2092ea7a52e2c435aee6d2b1bcb773202663 Mon Sep 17 00:00:00 2001 +From: Myrrh Periwinkle +Date: Wed, 2 Jul 2025 21:17:57 +0700 +Subject: vt: keyboard: Don't process Unicode characters in K_OFF mode + +From: Myrrh Periwinkle + +commit b1cc2092ea7a52e2c435aee6d2b1bcb773202663 upstream. + +We don't process Unicode characters if the virtual terminal is in raw +mode, so there's no reason why we shouldn't do the same for K_OFF +(especially since people would expect K_OFF to actually turn off all VT +key processing). + +Fixes: 9fc3de9c8356 ("vt: Add virtual console keyboard mode OFF") +Signed-off-by: Myrrh Periwinkle +Cc: stable +Reviewed-by: Jiri Slaby +Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-1-c27e143cc2eb@qtmlabs.xyz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/vt/keyboard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -1494,7 +1494,7 @@ static void kbd_keycode(unsigned int key + rc = atomic_notifier_call_chain(&keyboard_notifier_list, + KBD_UNICODE, ¶m); + if (rc != NOTIFY_STOP) +- if (down && !raw_mode) ++ if (down && !(raw_mode || kbd->kbdmode == VC_OFF)) + k_unicode(vc, keysym, !down); + return; + }