--- /dev/null
+From matttbe@kernel.org Sat Oct 18 01:24:25 2025
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Fri, 17 Oct 2025 18:24:01 +0200
+Subject: arch: back to -std=gnu89 in < v5.18
+To: stable@vger.kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Cc: MPTCP Upstream <mptcp@lists.linux.dev>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Nathan Chancellor <nathan@kernel.org>, Ard Biesheuvel <ardb@kernel.org>, Alexey Dobriyan <adobriyan@gmail.com>, Arnd Bergmann <arnd@arndb.de>
+Message-ID: <20251017-v5-15-gcc-15-v1-2-da6c065049d7@kernel.org>
+
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+
+Recent fixes have been backported to < v5.18 to fix build issues with
+GCC 5.15. They all force -std=gnu11 in the CFLAGS, "because [the kernel]
+requests the gnu11 standard via '-std=' in the main Makefile".
+
+This is true for >= 5.18 versions, but not before. This switch to
+-std=gnu11 has been done in commit e8c07082a810 ("Kbuild: move to
+-std=gnu11").
+
+For a question of uniformity, force -std=gnu89, similar to what is done
+in the main Makefile.
+
+Note: the fixes tags below refers to upstream commits, but this fix is
+only for kernels not having commit e8c07082a810 ("Kbuild: move to
+-std=gnu11").
+
+Fixes: 7cbb015e2d3d ("parisc: fix building with gcc-15")
+Fixes: 3b8b80e99376 ("s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS")
+Fixes: b3bee1e7c3f2 ("x86/boot: Compile boot code with -std=gnu11 too")
+Fixes: ee2ab467bddf ("x86/boot: Use '-std=gnu11' to fix build with GCC 15")
+Fixes: 8ba14d9f490a ("efi: libstub: Use '-std=gnu11' to fix build with GCC 15")
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: Ard Biesheuvel <ardb@kernel.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/parisc/boot/compressed/Makefile | 2 +-
+ arch/s390/Makefile | 2 +-
+ arch/s390/purgatory/Makefile | 2 +-
+ arch/x86/Makefile | 2 +-
+ arch/x86/boot/compressed/Makefile | 2 +-
+ drivers/firmware/efi/libstub/Makefile | 2 +-
+ 6 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/parisc/boot/compressed/Makefile
++++ b/arch/parisc/boot/compressed/Makefile
+@@ -22,7 +22,7 @@ KBUILD_CFLAGS += -fno-PIE -mno-space-reg
+ ifndef CONFIG_64BIT
+ KBUILD_CFLAGS += -mfast-indirect-calls
+ endif
+-KBUILD_CFLAGS += -std=gnu11
++KBUILD_CFLAGS += -std=gnu89
+
+ OBJECTS += $(obj)/head.o $(obj)/real2.o $(obj)/firmware.o $(obj)/misc.o $(obj)/piggy.o
+
+--- a/arch/s390/Makefile
++++ b/arch/s390/Makefile
+@@ -23,7 +23,7 @@ endif
+ aflags_dwarf := -Wa,-gdwarf-2
+ KBUILD_AFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -D__ASSEMBLY__
+ KBUILD_AFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO),$(aflags_dwarf))
+-KBUILD_CFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -O2 -std=gnu11
++KBUILD_CFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -O2 -std=gnu89
+ KBUILD_CFLAGS_DECOMPRESSOR += -DDISABLE_BRANCH_PROFILING -D__NO_FORTIFY
+ KBUILD_CFLAGS_DECOMPRESSOR += -fno-delete-null-pointer-checks -msoft-float -mbackchain
+ KBUILD_CFLAGS_DECOMPRESSOR += -fno-asynchronous-unwind-tables
+--- a/arch/s390/purgatory/Makefile
++++ b/arch/s390/purgatory/Makefile
+@@ -21,7 +21,7 @@ UBSAN_SANITIZE := n
+ KASAN_SANITIZE := n
+ KCSAN_SANITIZE := n
+
+-KBUILD_CFLAGS := -std=gnu11 -fno-strict-aliasing -Wall -Wstrict-prototypes
++KBUILD_CFLAGS := -std=gnu89 -fno-strict-aliasing -Wall -Wstrict-prototypes
+ KBUILD_CFLAGS += -Wno-pointer-sign -Wno-sign-compare
+ KBUILD_CFLAGS += -fno-zero-initialized-in-bss -fno-builtin -ffreestanding
+ KBUILD_CFLAGS += -c -MD -Os -m64 -msoft-float -fno-common
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -24,7 +24,7 @@ endif
+
+ # How to compile the 16-bit code. Note we always compile for -march=i386;
+ # that way we can complain to the user if the CPU is insufficient.
+-REALMODE_CFLAGS := -std=gnu11 -m16 -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \
++REALMODE_CFLAGS := -std=gnu89 -m16 -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \
+ -Wall -Wstrict-prototypes -march=i386 -mregparm=3 \
+ -fno-strict-aliasing -fomit-frame-pointer -fno-pic \
+ -mno-mmx -mno-sse $(call cc-option,-fcf-protection=none)
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -33,7 +33,7 @@ targets := vmlinux vmlinux.bin vmlinux.b
+ # avoid errors with '-march=i386', and future flags may depend on the target to
+ # be valid.
+ KBUILD_CFLAGS := -m$(BITS) -O2 $(CLANG_FLAGS)
+-KBUILD_CFLAGS += -std=gnu11
++KBUILD_CFLAGS += -std=gnu89
+ KBUILD_CFLAGS += -fno-strict-aliasing -fPIE
+ KBUILD_CFLAGS += -Wundef
+ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
+--- a/drivers/firmware/efi/libstub/Makefile
++++ b/drivers/firmware/efi/libstub/Makefile
+@@ -7,7 +7,7 @@
+ #
+ cflags-$(CONFIG_X86_32) := -march=i386
+ cflags-$(CONFIG_X86_64) := -mcmodel=small
+-cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ -std=gnu11 \
++cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ -std=gnu89 \
+ -fPIC -fno-strict-aliasing -mno-red-zone \
+ -mno-mmx -mno-sse -fshort-wchar \
+ -Wno-pointer-sign \
--- /dev/null
+From stable+bounces-189968-greg=kroah.com@vger.kernel.org Mon Oct 27 21:53:33 2025
+From: Celeste Liu <uwu@coelacanthus.name>
+Date: Mon, 27 Oct 2025 20:47:27 +0800
+Subject: can: gs_usb: increase max interface to U8_MAX
+To: stable@vger.kernel.org
+Cc: Celeste Liu <uwu@coelacanthus.name>, Runcheng Lu <runcheng.lu@hpmicro.com>, Vincent Mailhol <mailhol@kernel.org>, Marc Kleine-Budde <mkl@pengutronix.de>
+Message-ID: <20251027124726.734092-2-uwu@coelacanthus.name>
+
+From: Celeste Liu <uwu@coelacanthus.name>
+
+commit 2a27f6a8fb5722223d526843040f747e9b0e8060 upstream
+
+This issue was found by Runcheng Lu when develop HSCanT USB to CAN FD
+converter[1]. The original developers may have only 3 interfaces
+device to test so they write 3 here and wait for future change.
+
+During the HSCanT development, we actually used 4 interfaces, so the
+limitation of 3 is not enough now. But just increase one is not
+future-proofed. Since the channel index type in gs_host_frame is u8,
+just make canch[] become a flexible array with a u8 index, so it
+naturally constraint by U8_MAX and avoid statically allocate 256
+pointer for every gs_usb device.
+
+[1]: https://github.com/cherry-embedded/HSCanT-hardware
+
+Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
+Reported-by: Runcheng Lu <runcheng.lu@hpmicro.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
+Signed-off-by: Celeste Liu <uwu@coelacanthus.name>
+Link: https://patch.msgid.link/20250930-gs-usb-max-if-v5-1-863330bf6666@coelacanthus.name
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/gs_usb.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -157,10 +157,6 @@ struct gs_host_frame {
+ #define GS_MAX_TX_URBS 10
+ /* Only launch a max of GS_MAX_RX_URBS usb requests at a time. */
+ #define GS_MAX_RX_URBS 30
+-/* Maximum number of interfaces the driver supports per device.
+- * Current hardware only supports 2 interfaces. The future may vary.
+- */
+-#define GS_MAX_INTF 2
+
+ struct gs_tx_context {
+ struct gs_can *dev;
+@@ -191,10 +187,11 @@ struct gs_can {
+
+ /* usb interface struct */
+ struct gs_usb {
+- struct gs_can *canch[GS_MAX_INTF];
+ struct usb_anchor rx_submitted;
+ struct usb_device *udev;
+ u8 active_channels;
++ u8 channel_cnt;
++ struct gs_can *canch[];
+ };
+
+ /* 'allocate' a tx context.
+@@ -322,7 +319,7 @@ static void gs_usb_receive_bulk_callback
+ }
+
+ /* device reports out of range channel id */
+- if (hf->channel >= GS_MAX_INTF)
++ if (hf->channel >= usbcan->channel_cnt)
+ goto device_detach;
+
+ dev = usbcan->canch[hf->channel];
+@@ -410,7 +407,7 @@ static void gs_usb_receive_bulk_callback
+ /* USB failure take down all interfaces */
+ if (rc == -ENODEV) {
+ device_detach:
+- for (rc = 0; rc < GS_MAX_INTF; rc++) {
++ for (rc = 0; rc < usbcan->channel_cnt; rc++) {
+ if (usbcan->canch[rc])
+ netif_device_detach(usbcan->canch[rc]->netdev);
+ }
+@@ -993,20 +990,22 @@ static int gs_usb_probe(struct usb_inter
+ icount = dconf->icount + 1;
+ dev_info(&intf->dev, "Configuring for %d interfaces\n", icount);
+
+- if (icount > GS_MAX_INTF) {
++ if (icount > type_max(typeof(dev->channel_cnt))) {
+ dev_err(&intf->dev,
+- "Driver cannot handle more that %d CAN interfaces\n",
+- GS_MAX_INTF);
++ "Driver cannot handle more that %u CAN interfaces\n",
++ type_max(typeof(dev->channel_cnt)));
+ kfree(dconf);
+ return -EINVAL;
+ }
+
+- dev = kzalloc(sizeof(*dev), GFP_KERNEL);
++ dev = kzalloc(struct_size(dev, canch, icount), GFP_KERNEL);
+ if (!dev) {
+ kfree(dconf);
+ return -ENOMEM;
+ }
+
++ dev->channel_cnt = icount;
++
+ init_usb_anchor(&dev->rx_submitted);
+
+ usb_set_intfdata(intf, dev);
+@@ -1047,7 +1046,7 @@ static void gs_usb_disconnect(struct usb
+ return;
+ }
+
+- for (i = 0; i < GS_MAX_INTF; i++)
++ for (i = 0; i < dev->channel_cnt; i++)
+ if (dev->canch[i])
+ gs_destroy_candev(dev->canch[i]);
+
--- /dev/null
+From stable+bounces-190037-greg=kroah.com@vger.kernel.org Tue Oct 28 01:29:09 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 12:28:58 -0400
+Subject: dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
+To: stable@vger.kernel.org
+Cc: Xu Yang <xu.yang_2@nxp.com>, stable <stable@kernel.org>, Jun Li <jun.li@nxp.com>, Frank Li <Frank.Li@nxp.com>, Conor Dooley <conor.dooley@microchip.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251027162858.577729-1-sashal@kernel.org>
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit 268eb6fb908bc82ce479e4dba9a2cad11f536c9c ]
+
+Only i.MX8MP need dma-range property to let USB controller work properly.
+Remove dma-range from required list and add limitation for imx8mp.
+
+Fixes: d2a704e29711 ("dt-bindings: usb: dwc3-imx8mp: add imx8mp dwc3 glue bindings")
+Cc: stable <stable@kernel.org>
+Reviewed-by: Jun Li <jun.li@nxp.com>
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml
++++ b/Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml
+@@ -60,12 +60,20 @@ required:
+ - reg
+ - "#address-cells"
+ - "#size-cells"
+- - dma-ranges
+ - ranges
+ - clocks
+ - clock-names
+ - interrupts
+
++allOf:
++ - if:
++ properties:
++ compatible:
++ const: fsl,imx8mp-dwc3
++ then:
++ required:
++ - dma-ranges
++
+ additionalProperties: false
+
+ examples:
--- /dev/null
+From stable+bounces-192087-greg=kroah.com@vger.kernel.org Mon Nov 3 05:15:58 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Nov 2025 15:15:50 -0500
+Subject: mptcp: drop bogus optimization in __mptcp_check_push()
+To: stable@vger.kernel.org
+Cc: Paolo Abeni <pabeni@redhat.com>, Geliang Tang <geliang@kernel.org>, Mat Martineau <martineau@kernel.org>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251102201550.3588174-1-sashal@kernel.org>
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 27b0e701d3872ba59c5b579a9e8a02ea49ad3d3b ]
+
+Accessing the transmit queue without owning the msk socket lock is
+inherently racy, hence __mptcp_check_push() could actually quit early
+even when there is pending data.
+
+That in turn could cause unexpected tx lock and timeout.
+
+Dropping the early check avoids the race, implicitly relaying on later
+tests under the relevant lock. With such change, all the other
+mptcp_send_head() call sites are now under the msk socket lock and we
+can additionally drop the now unneeded annotation on the transmit head
+pointer accesses.
+
+Fixes: 6e628cd3a8f7 ("mptcp: use mptcp release_cb for delayed tasks")
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Tested-by: Geliang Tang <geliang@kernel.org>
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-1-38ffff5a9ec8@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ split upstream __subflow_push_pending modification across __mptcp_push_pending and __mptcp_subflow_push_pending ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 13 +++++--------
+ net/mptcp/protocol.h | 2 +-
+ 2 files changed, 6 insertions(+), 9 deletions(-)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -1137,7 +1137,7 @@ static void __mptcp_clean_una(struct soc
+ if (WARN_ON_ONCE(!msk->recovery))
+ break;
+
+- WRITE_ONCE(msk->first_pending, mptcp_send_next(sk));
++ msk->first_pending = mptcp_send_next(sk);
+ }
+
+ dfrag_clear(sk, dfrag);
+@@ -1674,7 +1674,7 @@ void __mptcp_push_pending(struct sock *s
+
+ mptcp_update_post_push(msk, dfrag, ret);
+ }
+- WRITE_ONCE(msk->first_pending, mptcp_send_next(sk));
++ msk->first_pending = mptcp_send_next(sk);
+ }
+
+ /* at this point we held the socket lock for the last subflow we used */
+@@ -1732,7 +1732,7 @@ static void __mptcp_subflow_push_pending
+
+ mptcp_update_post_push(msk, dfrag, ret);
+ }
+- WRITE_ONCE(msk->first_pending, mptcp_send_next(sk));
++ msk->first_pending = mptcp_send_next(sk);
+ }
+
+ out:
+@@ -1850,7 +1850,7 @@ static int mptcp_sendmsg(struct sock *sk
+ get_page(dfrag->page);
+ list_add_tail(&dfrag->list, &msk->rtx_queue);
+ if (!msk->first_pending)
+- WRITE_ONCE(msk->first_pending, dfrag);
++ msk->first_pending = dfrag;
+ }
+ pr_debug("msk=%p dfrag at seq=%llu len=%u sent=%u new=%d\n", msk,
+ dfrag->data_seq, dfrag->data_len, dfrag->already_sent,
+@@ -2645,7 +2645,7 @@ static void __mptcp_clear_xmit(struct so
+ struct mptcp_sock *msk = mptcp_sk(sk);
+ struct mptcp_data_frag *dtmp, *dfrag;
+
+- WRITE_ONCE(msk->first_pending, NULL);
++ msk->first_pending = NULL;
+ list_for_each_entry_safe(dfrag, dtmp, &msk->rtx_queue, list)
+ dfrag_clear(sk, dfrag);
+ }
+@@ -3114,9 +3114,6 @@ void __mptcp_data_acked(struct sock *sk)
+
+ void __mptcp_check_push(struct sock *sk, struct sock *ssk)
+ {
+- if (!mptcp_send_head(sk))
+- return;
+-
+ if (!sock_owned_by_user(sk)) {
+ struct sock *xmit_ssk = mptcp_subflow_get_send(mptcp_sk(sk));
+
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -325,7 +325,7 @@ static inline struct mptcp_data_frag *mp
+ {
+ const struct mptcp_sock *msk = mptcp_sk(sk);
+
+- return READ_ONCE(msk->first_pending);
++ return msk->first_pending;
+ }
+
+ static inline struct mptcp_data_frag *mptcp_send_next(struct sock *sk)
--- /dev/null
+From stable+bounces-192088-greg=kroah.com@vger.kernel.org Mon Nov 3 05:30:47 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Nov 2025 15:30:39 -0500
+Subject: net: phy: dp83867: Disable EEE support as not implemented
+To: stable@vger.kernel.org
+Cc: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>, Andrew Lunn <andrew@lunn.ch>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251102203040.3593522-1-sashal@kernel.org>
+
+From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
+
+[ Upstream commit 84a905290cb4c3d9a71a9e3b2f2e02e031e7512f ]
+
+While the DP83867 PHYs report EEE capability through their feature
+registers, the actual hardware does not support EEE (see Links).
+When the connected MAC enables EEE, it causes link instability and
+communication failures.
+
+The issue is reproducible with a iMX8MP and relevant stmmac ethernet port.
+Since the introduction of phylink-managed EEE support in the stmmac driver,
+EEE is now enabled by default, leading to issues on systems using the
+DP83867 PHY.
+
+Call phy_disable_eee during phy initialization to prevent EEE from being
+enabled on DP83867 PHYs.
+
+Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/1445244/dp83867ir-dp83867-disable-eee-lpi
+Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/658638/dp83867ir-eee-energy-efficient-ethernet
+Fixes: 2a10154abcb7 ("net: phy: dp83867: Add TI dp83867 phy")
+Cc: stable@vger.kernel.org
+Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20251023144857.529566-1-ghidoliemanuele@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ replaced phy_disable_eee() call with direct eee_broken_modes assignment ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/dp83867.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/phy/dp83867.c
++++ b/drivers/net/phy/dp83867.c
+@@ -674,6 +674,12 @@ static int dp83867_config_init(struct ph
+ return ret;
+ }
+
++ /* Although the DP83867 reports EEE capability through the
++ * MDIO_PCS_EEE_ABLE and MDIO_AN_EEE_ADV registers, the feature
++ * is not actually implemented in hardware.
++ */
++ phydev->eee_broken_modes = MDIO_EEE_100TX | MDIO_EEE_1000T;
++
+ if (phy_interface_is_rgmii(phydev) ||
+ phydev->interface == PHY_INTERFACE_MODE_SGMII) {
+ val = phy_read(phydev, MII_DP83867_PHYCTRL);
--- /dev/null
+From stable+bounces-189988-greg=kroah.com@vger.kernel.org Mon Oct 27 22:57:20 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 09:49:31 -0400
+Subject: net: ravb: Enforce descriptor type ordering
+To: stable@vger.kernel.org
+Cc: "Lad Prabhakar" <prabhakar.mahadev-lad.rj@bp.renesas.com>, "Fabrizio Castro" <fabrizio.castro.jz@renesas.com>, "Niklas Söderlund" <niklas.soderlund+renesas@ragnatech.se>, "Jakub Kicinski" <kuba@kernel.org>, "Sasha Levin" <sashal@kernel.org>
+Message-ID: <20251027134931.492032-2-sashal@kernel.org>
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 5370c31e84b0e0999c7b5ff949f4e104def35584 ]
+
+Ensure the TX descriptor type fields are published in a safe order so the
+DMA engine never begins processing a descriptor chain before all descriptor
+fields are fully initialised.
+
+For multi-descriptor transmits the driver writes DT_FEND into the last
+descriptor and DT_FSTART into the first. The DMA engine begins processing
+when it observes DT_FSTART. Move the dma_wmb() barrier so it executes
+immediately after DT_FEND and immediately before writing DT_FSTART
+(and before DT_FSINGLE in the single-descriptor case). This guarantees
+that all prior CPU writes to the descriptor memory are visible to the
+device before DT_FSTART is seen.
+
+This avoids a situation where compiler/CPU reordering could publish
+DT_FSTART ahead of DT_FEND or other descriptor fields, allowing the DMA to
+start on a partially initialised chain and causing corrupted transmissions
+or TX timeouts. Such a failure was observed on RZ/G2L with an RT kernel as
+transmit queue timeouts and device resets.
+
+Fixes: 2f45d1902acf ("ravb: minimize TX data copying")
+Cc: stable@vger.kernel.org
+Co-developed-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+Signed-off-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Link: https://patch.msgid.link/20251017151830.171062-4-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/renesas/ravb_main.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1668,13 +1668,25 @@ static netdev_tx_t ravb_start_xmit(struc
+
+ skb_tx_timestamp(skb);
+ }
+- /* Descriptor type must be set after all the above writes */
+- dma_wmb();
++
+ if (num_tx_desc > 1) {
+ desc->die_dt = DT_FEND;
+ desc--;
++ /* When using multi-descriptors, DT_FEND needs to get written
++ * before DT_FSTART, but the compiler may reorder the memory
++ * writes in an attempt to optimize the code.
++ * Use a dma_wmb() barrier to make sure DT_FEND and DT_FSTART
++ * are written exactly in the order shown in the code.
++ * This is particularly important for cases where the DMA engine
++ * is already running when we are running this code. If the DMA
++ * sees DT_FSTART without the corresponding DT_FEND it will enter
++ * an error condition.
++ */
++ dma_wmb();
+ desc->die_dt = DT_FSTART;
+ } else {
++ /* Descriptor type must be set after all the above writes */
++ dma_wmb();
+ desc->die_dt = DT_FSINGLE;
+ }
+
--- /dev/null
+From stable+bounces-189987-greg=kroah.com@vger.kernel.org Mon Oct 27 22:52:03 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 09:49:30 -0400
+Subject: ravb: Exclude gPTP feature support for RZ/G2L
+To: stable@vger.kernel.org
+Cc: Biju Das <biju.das.jz@bp.renesas.com>, Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>, "David S. Miller" <davem@davemloft.net>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251027134931.492032-1-sashal@kernel.org>
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 7e09a052dc4e30ce07fd7b3aa58a7d993f73a9d7 ]
+
+R-Car supports gPTP feature whereas RZ/G2L does not support it.
+This patch excludes gtp feature support for RZ/G2L.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: 5370c31e84b0 ("net: ravb: Enforce descriptor type ordering")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/renesas/ravb_main.c | 87 +++++++++++++++++--------------
+ 1 file changed, 50 insertions(+), 37 deletions(-)
+
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1321,6 +1321,7 @@ static int ravb_get_ts_info(struct net_d
+ struct ethtool_ts_info *info)
+ {
+ struct ravb_private *priv = netdev_priv(ndev);
++ const struct ravb_hw_info *hw_info = priv->info;
+
+ info->so_timestamping =
+ SOF_TIMESTAMPING_TX_SOFTWARE |
+@@ -1334,7 +1335,8 @@ static int ravb_get_ts_info(struct net_d
+ (1 << HWTSTAMP_FILTER_NONE) |
+ (1 << HWTSTAMP_FILTER_PTP_V2_L2_EVENT) |
+ (1 << HWTSTAMP_FILTER_ALL);
+- info->phc_index = ptp_clock_index(priv->ptp.clock);
++ if (hw_info->gptp || hw_info->ccc_gac)
++ info->phc_index = ptp_clock_index(priv->ptp.clock);
+
+ return 0;
+ }
+@@ -1565,6 +1567,7 @@ out_unlock:
+ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct ravb_private *priv = netdev_priv(ndev);
++ const struct ravb_hw_info *info = priv->info;
+ unsigned int num_tx_desc = priv->num_tx_desc;
+ u16 q = skb_get_queue_mapping(skb);
+ struct ravb_tstamp_skb *ts_skb;
+@@ -1641,28 +1644,30 @@ static netdev_tx_t ravb_start_xmit(struc
+ desc->dptr = cpu_to_le32(dma_addr);
+
+ /* TX timestamp required */
+- if (q == RAVB_NC) {
+- ts_skb = kmalloc(sizeof(*ts_skb), GFP_ATOMIC);
+- if (!ts_skb) {
+- if (num_tx_desc > 1) {
+- desc--;
+- dma_unmap_single(ndev->dev.parent, dma_addr,
+- len, DMA_TO_DEVICE);
++ if (info->gptp || info->ccc_gac) {
++ if (q == RAVB_NC) {
++ ts_skb = kmalloc(sizeof(*ts_skb), GFP_ATOMIC);
++ if (!ts_skb) {
++ if (num_tx_desc > 1) {
++ desc--;
++ dma_unmap_single(ndev->dev.parent, dma_addr,
++ len, DMA_TO_DEVICE);
++ }
++ goto unmap;
+ }
+- goto unmap;
++ ts_skb->skb = skb_get(skb);
++ ts_skb->tag = priv->ts_skb_tag++;
++ priv->ts_skb_tag &= 0x3ff;
++ list_add_tail(&ts_skb->list, &priv->ts_skb_list);
++
++ /* TAG and timestamp required flag */
++ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
++ desc->tagh_tsr = (ts_skb->tag >> 4) | TX_TSR;
++ desc->ds_tagl |= cpu_to_le16(ts_skb->tag << 12);
+ }
+- ts_skb->skb = skb_get(skb);
+- ts_skb->tag = priv->ts_skb_tag++;
+- priv->ts_skb_tag &= 0x3ff;
+- list_add_tail(&ts_skb->list, &priv->ts_skb_list);
+-
+- /* TAG and timestamp required flag */
+- skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+- desc->tagh_tsr = (ts_skb->tag >> 4) | TX_TSR;
+- desc->ds_tagl |= cpu_to_le16(ts_skb->tag << 12);
+- }
+
+- skb_tx_timestamp(skb);
++ skb_tx_timestamp(skb);
++ }
+ /* Descriptor type must be set after all the above writes */
+ dma_wmb();
+ if (num_tx_desc > 1) {
+@@ -1781,10 +1786,12 @@ static int ravb_close(struct net_device
+ "device will be stopped after h/w processes are done.\n");
+
+ /* Clear the timestamp list */
+- list_for_each_entry_safe(ts_skb, ts_skb2, &priv->ts_skb_list, list) {
+- list_del(&ts_skb->list);
+- kfree_skb(ts_skb->skb);
+- kfree(ts_skb);
++ if (info->gptp || info->ccc_gac) {
++ list_for_each_entry_safe(ts_skb, ts_skb2, &priv->ts_skb_list, list) {
++ list_del(&ts_skb->list);
++ kfree_skb(ts_skb->skb);
++ kfree(ts_skb);
++ }
+ }
+
+ /* PHY disconnect */
+@@ -2116,9 +2123,11 @@ static void ravb_set_config_mode(struct
+ ravb_modify(ndev, CCC, CCC_OPC, CCC_OPC_CONFIG);
+ /* Set CSEL value */
+ ravb_modify(ndev, CCC, CCC_CSEL, CCC_CSEL_HPB);
+- } else {
++ } else if (info->ccc_gac) {
+ ravb_modify(ndev, CCC, CCC_OPC, CCC_OPC_CONFIG |
+ CCC_GAC | CCC_CSEL_HPB);
++ } else {
++ ravb_modify(ndev, CCC, CCC_OPC, CCC_OPC_CONFIG);
+ }
+ }
+
+@@ -2306,13 +2315,15 @@ static int ravb_probe(struct platform_de
+ /* Set AVB config mode */
+ ravb_set_config_mode(ndev);
+
+- /* Set GTI value */
+- error = ravb_set_gti(ndev);
+- if (error)
+- goto out_disable_refclk;
++ if (info->gptp || info->ccc_gac) {
++ /* Set GTI value */
++ error = ravb_set_gti(ndev);
++ if (error)
++ goto out_disable_refclk;
+
+- /* Request GTI loading */
+- ravb_modify(ndev, GCCR, GCCR_LTI, GCCR_LTI);
++ /* Request GTI loading */
++ ravb_modify(ndev, GCCR, GCCR_LTI, GCCR_LTI);
++ }
+
+ if (info->internal_delay) {
+ ravb_parse_delay_mode(np, ndev);
+@@ -2509,13 +2520,15 @@ static int __maybe_unused ravb_resume(st
+ /* Set AVB config mode */
+ ravb_set_config_mode(ndev);
+
+- /* Set GTI value */
+- ret = ravb_set_gti(ndev);
+- if (ret)
+- return ret;
++ if (info->gptp || info->ccc_gac) {
++ /* Set GTI value */
++ ret = ravb_set_gti(ndev);
++ if (ret)
++ return ret;
+
+- /* Request GTI loading */
+- ravb_modify(ndev, GCCR, GCCR_LTI, GCCR_LTI);
++ /* Request GTI loading */
++ ravb_modify(ndev, GCCR, GCCR_LTI, GCCR_LTI);
++ }
+
+ if (info->internal_delay)
+ ravb_set_delay_mode(ndev);
--- /dev/null
+From matttbe@kernel.org Sat Oct 18 01:24:23 2025
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Fri, 17 Oct 2025 18:24:02 +0200
+Subject: Revert "docs/process/howto: Replace C89 with C11"
+To: stable@vger.kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Cc: MPTCP Upstream <mptcp@lists.linux.dev>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Akira Yokosawa <akiyks@gmail.com>, Arnd Bergmann <arnd@arndb.de>, Federico Vaga <federico.vaga@vaga.pv.it>, Alex Shi <alexs@kernel.org>, Hu Haowen <src.res@email.cn>, Tsugikazu Shibata <shibata@linuxfoundation.org>, Jonathan Corbet <corbet@lwn.net>
+Message-ID: <20251017-v5-15-gcc-15-v1-3-da6c065049d7@kernel.org>
+
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+
+This reverts commit dc52117cd797f71f9686fa0cec91509eb7a9623d which is
+commit 2f3f53d62307262f0086804ea7cea99b0e085450 upstream.
+
+In this kernel version, C89 is still the default ISO standard.
+
+The reverted commit was fixing commit e8c07082a810 ("Kbuild: move to
+-std=gnu11"), introduced in v5.18, and not backported to older versions.
+It was then not supported to be backported to v5.15. It can then safely
+be reverted.
+
+Fixes: 2f3f53d62307 ("docs/process/howto: Replace C89 with C11")
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Cc: Akira Yokosawa <akiyks@gmail.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Federico Vaga <federico.vaga@vaga.pv.it>
+Cc: Alex Shi <alexs@kernel.org>
+Cc: Hu Haowen <src.res@email.cn>
+Cc: Tsugikazu Shibata <shibata@linuxfoundation.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/process/howto.rst | 2 +-
+ Documentation/translations/it_IT/process/howto.rst | 2 +-
+ Documentation/translations/ja_JP/howto.rst | 2 +-
+ Documentation/translations/ko_KR/howto.rst | 2 +-
+ Documentation/translations/zh_CN/process/howto.rst | 2 +-
+ Documentation/translations/zh_TW/process/howto.rst | 2 +-
+ 6 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/Documentation/process/howto.rst
++++ b/Documentation/process/howto.rst
+@@ -36,7 +36,7 @@ experience, the following books are good
+ - "C: A Reference Manual" by Harbison and Steele [Prentice Hall]
+
+ The kernel is written using GNU C and the GNU toolchain. While it
+-adheres to the ISO C11 standard, it uses a number of extensions that are
++adheres to the ISO C89 standard, it uses a number of extensions that are
+ not featured in the standard. The kernel is a freestanding C
+ environment, with no reliance on the standard C library, so some
+ portions of the C standard are not supported. Arbitrary long long
+--- a/Documentation/translations/it_IT/process/howto.rst
++++ b/Documentation/translations/it_IT/process/howto.rst
+@@ -44,7 +44,7 @@ altro, utili riferimenti:
+ - "C: A Reference Manual" di Harbison and Steele [Prentice Hall]
+
+ Il kernel è stato scritto usando GNU C e la toolchain GNU.
+-Sebbene si attenga allo standard ISO C11, esso utilizza una serie di
++Sebbene si attenga allo standard ISO C89, esso utilizza una serie di
+ estensioni che non sono previste in questo standard. Il kernel è un
+ ambiente C indipendente, che non ha alcuna dipendenza dalle librerie
+ C standard, così alcune parti del C standard non sono supportate.
+--- a/Documentation/translations/ja_JP/howto.rst
++++ b/Documentation/translations/ja_JP/howto.rst
+@@ -65,7 +65,7 @@ Linux カーネル開発のやり方
+ - 『新・詳説 C 言語 H&S リファレンス』 (サミュエル P ハービソン/ガイ L スティール共著 斉藤 信男監訳)[ソフトバンク]
+
+ カーネルは GNU C と GNU ツールチェインを使って書かれています。カーネル
+-は ISO C11 仕様に準拠して書く一方で、標準には無い言語拡張を多く使って
++は ISO C89 仕様に準拠して書く一方で、標準には無い言語拡張を多く使って
+ います。カーネルは標準 C ライブラリに依存しない、C 言語非依存環境です。
+ そのため、C の標準の中で使えないものもあります。特に任意の long long
+ の除算や浮動小数点は使えません。カーネルがツールチェインや C 言語拡張
+--- a/Documentation/translations/ko_KR/howto.rst
++++ b/Documentation/translations/ko_KR/howto.rst
+@@ -62,7 +62,7 @@ Documentation/process/howto.rst
+ - "Practical C Programming" by Steve Oualline [O'Reilly]
+ - "C: A Reference Manual" by Harbison and Steele [Prentice Hall]
+
+-커널은 GNU C와 GNU 툴체인을 사용하여 작성되었다. 이 툴들은 ISO C11 표준을
++커널은 GNU C와 GNU 툴체인을 사용하여 작성되었다. 이 툴들은 ISO C89 표준을
+ 따르는 반면 표준에 있지 않은 많은 확장기능도 가지고 있다. 커널은 표준 C
+ 라이브러리와는 관계없이 freestanding C 환경이어서 C 표준의 일부는
+ 지원되지 않는다. 임의의 long long 나누기나 floating point는 지원되지 않는다.
+--- a/Documentation/translations/zh_CN/process/howto.rst
++++ b/Documentation/translations/zh_CN/process/howto.rst
+@@ -45,7 +45,7 @@ Linuxå\86\85æ ¸å¤§é\83¨å\88\86æ\98¯ç\94±Cè¯è¨\80å\86\99æ\88\90ç
+ - "C: A Reference Manual" by Harbison and Steele [Prentice Hall]
+ 《C语言参考手册（原书第5版）》（邱仲潘 等译）[机械工业出版社]
+
+-Linux内核使用GNU C和GNU工具链开发。虽然它遵循ISO C11标准，但也用到了一些
++Linux内核使用GNU C和GNU工具链开发。虽然它遵循ISO C89标准，但也用到了一些
+ 标准中没有定义的扩展。内核是自给自足的C环境，不依赖于标准C库的支持，所以
+ 并不支持C标准中的部分定义。比如long long类型的大数除法和浮点运算就不允许
+ 使用。有时候确实很难弄清楚内核对工具链的要求和它所使用的扩展，不幸的是目
+--- a/Documentation/translations/zh_TW/process/howto.rst
++++ b/Documentation/translations/zh_TW/process/howto.rst
+@@ -48,7 +48,7 @@ Linuxå\85§æ ¸å¤§é\83¨å\88\86æ\98¯ç\94±Cèª\9eè¨\80寫æ\88\90ç
+ - "C: A Reference Manual" by Harbison and Steele [Prentice Hall]
+ 《C語言參考手冊（原書第5版）》（邱仲潘 等譯）[機械工業出版社]
+
+-Linux內核使用GNU C和GNU工具鏈開發。雖然它遵循ISO C11標準，但也用到了一些
++Linux內核使用GNU C和GNU工具鏈開發。雖然它遵循ISO C89標準，但也用到了一些
+ 標準中沒有定義的擴展。內核是自給自足的C環境，不依賴於標準C庫的支持，所以
+ 並不支持C標準中的部分定義。比如long long類型的大數除法和浮點運算就不允許
+ 使用。有時候確實很難弄清楚內核對工具鏈的要求和它所使用的擴展，不幸的是目
--- /dev/null
+From stable+bounces-190054-greg=kroah.com@vger.kernel.org Tue Oct 28 02:31:53 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 13:31:45 -0400
+Subject: serial: 8250_dw: handle reset control deassert error
+To: stable@vger.kernel.org
+Cc: Artem Shimko <a.shimko.dev@gmail.com>, stable <stable@kernel.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251027173145.608096-2-sashal@kernel.org>
+
+From: Artem Shimko <a.shimko.dev@gmail.com>
+
+[ Upstream commit daeb4037adf7d3349b4a1fb792f4bc9824686a4b ]
+
+Check the return value of reset_control_deassert() in the probe
+function to prevent continuing probe when reset deassertion fails.
+
+Previously, reset_control_deassert() was called without checking its
+return value, which could lead to probe continuing even when the
+device reset wasn't properly deasserted.
+
+The fix checks the return value and returns an error with dev_err_probe()
+if reset deassertion fails, providing better error handling and
+diagnostics.
+
+Fixes: acbdad8dd1ab ("serial: 8250_dw: simplify optional reset handling")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Artem Shimko <a.shimko.dev@gmail.com>
+Link: https://patch.msgid.link/20251019095131.252848-1-a.shimko.dev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_dw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -580,7 +580,9 @@ static int dw8250_probe(struct platform_
+ if (IS_ERR(data->rst))
+ return PTR_ERR(data->rst);
+
+- reset_control_deassert(data->rst);
++ err = reset_control_deassert(data->rst);
++ if (err)
++ return dev_err_probe(dev, err, "failed to deassert resets\n");
+
+ err = devm_add_action_or_reset(dev, dw8250_reset_control_assert, data->rst);
+ if (err)
--- /dev/null
+From stable+bounces-190055-greg=kroah.com@vger.kernel.org Tue Oct 28 02:32:02 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 13:31:44 -0400
+Subject: serial: 8250_dw: Use devm_add_action_or_reset()
+To: stable@vger.kernel.org
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251027173145.608096-1-sashal@kernel.org>
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 295b09128d12fb1a7a67f771cc0ae0df869eafaf ]
+
+Slightly simplify ->probe() and drop a few goto labels by using
+devm_add_action_or_reset() for clock and reset cleanup.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20220509172129.37770-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: daeb4037adf7 ("serial: 8250_dw: handle reset control deassert error")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_dw.c | 63 ++++++++++++++++++--------------------
+ 1 file changed, 31 insertions(+), 32 deletions(-)
+
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -438,6 +438,16 @@ static void dw8250_quirks(struct uart_po
+ }
+ }
+
++static void dw8250_clk_disable_unprepare(void *data)
++{
++ clk_disable_unprepare(data);
++}
++
++static void dw8250_reset_control_assert(void *data)
++{
++ reset_control_assert(data);
++}
++
+ static int dw8250_probe(struct platform_device *pdev)
+ {
+ struct uart_8250_port uart = {}, *up = &uart;
+@@ -539,35 +549,43 @@ static int dw8250_probe(struct platform_
+ if (err)
+ dev_warn(dev, "could not enable optional baudclk: %d\n", err);
+
++ err = devm_add_action_or_reset(dev, dw8250_clk_disable_unprepare, data->clk);
++ if (err)
++ return err;
++
+ if (data->clk)
+ p->uartclk = clk_get_rate(data->clk);
+
+ /* If no clock rate is defined, fail. */
+ if (!p->uartclk) {
+ dev_err(dev, "clock rate not defined\n");
+- err = -EINVAL;
+- goto err_clk;
++ return -EINVAL;
+ }
+
+ data->pclk = devm_clk_get_optional(dev, "apb_pclk");
+- if (IS_ERR(data->pclk)) {
+- err = PTR_ERR(data->pclk);
+- goto err_clk;
+- }
++ if (IS_ERR(data->pclk))
++ return PTR_ERR(data->pclk);
+
+ err = clk_prepare_enable(data->pclk);
+ if (err) {
+ dev_err(dev, "could not enable apb_pclk\n");
+- goto err_clk;
++ return err;
+ }
+
++ err = devm_add_action_or_reset(dev, dw8250_clk_disable_unprepare, data->pclk);
++ if (err)
++ return err;
++
+ data->rst = devm_reset_control_get_optional_exclusive(dev, NULL);
+- if (IS_ERR(data->rst)) {
+- err = PTR_ERR(data->rst);
+- goto err_pclk;
+- }
++ if (IS_ERR(data->rst))
++ return PTR_ERR(data->rst);
++
+ reset_control_deassert(data->rst);
+
++ err = devm_add_action_or_reset(dev, dw8250_reset_control_assert, data->rst);
++ if (err)
++ return err;
++
+ dw8250_quirks(p, data);
+
+ /* If the Busy Functionality is not implemented, don't handle it */
+@@ -585,10 +603,8 @@ static int dw8250_probe(struct platform_
+ }
+
+ data->data.line = serial8250_register_8250_port(up);
+- if (data->data.line < 0) {
+- err = data->data.line;
+- goto err_reset;
+- }
++ if (data->data.line < 0)
++ return data->data.line;
+
+ /*
+ * Some platforms may provide a reference clock shared between several
+@@ -609,17 +625,6 @@ static int dw8250_probe(struct platform_
+ pm_runtime_enable(dev);
+
+ return 0;
+-
+-err_reset:
+- reset_control_assert(data->rst);
+-
+-err_pclk:
+- clk_disable_unprepare(data->pclk);
+-
+-err_clk:
+- clk_disable_unprepare(data->clk);
+-
+- return err;
+ }
+
+ static int dw8250_remove(struct platform_device *pdev)
+@@ -637,12 +642,6 @@ static int dw8250_remove(struct platform
+
+ serial8250_unregister_port(data->data.line);
+
+- reset_control_assert(data->rst);
+-
+- clk_disable_unprepare(data->pclk);
+-
+- clk_disable_unprepare(data->clk);
+-
+ pm_runtime_disable(dev);
+ pm_runtime_put_noidle(dev);
+
drm-amd-pm-powerplay-smumgr-fix-pciebootlinklevel-va.patch-3340
block-fix-op_is_zone_mgmt-to-handle-req_op_zone_reset_all.patch
regmap-slimbus-fix-bus_context-pointer-in-regmap-init-calls.patch
+serial-8250_dw-use-devm_add_action_or_reset.patch
+serial-8250_dw-handle-reset-control-deassert-error.patch
+dt-bindings-usb-dwc3-imx8mp-dma-range-is-required-only-for-imx8mp.patch
+ravb-exclude-gptp-feature-support-for-rz-g2l.patch
+net-ravb-enforce-descriptor-type-ordering.patch
+can-gs_usb-increase-max-interface-to-u8_max.patch
+net-phy-dp83867-disable-eee-support-as-not-implemented.patch
+mptcp-drop-bogus-optimization-in-__mptcp_check_push.patch
+x86-resctrl-fix-miscount-of-bandwidth-event-when-reactivating-previously-unavailable-rmid.patch
+xhci-dbc-provide-sysfs-option-to-configure-dbc-descriptors.patch
+xhci-dbc-poll-at-different-rate-depending-on-data-transfer-activity.patch
+xhci-dbc-allow-users-to-modify-dbc-poll-interval-via-sysfs.patch
+xhci-dbc-improve-performance-by-removing-delay-in-transfer-event-polling.patch
+xhci-dbc-avoid-event-polling-busyloop-if-pending-rx-transfers-are-inactive.patch
+xhci-dbc-fix-bogus-1024-byte-prefix-if-ttydbc-read-races-with-stall-event.patch
+x86-boot-compile-boot-code-with-std-gnu11-too.patch
+arch-back-to-std-gnu89-in-v5.18.patch
+revert-docs-process-howto-replace-c89-with-c11.patch
--- /dev/null
+From matttbe@kernel.org Sat Oct 18 01:24:24 2025
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Fri, 17 Oct 2025 18:24:00 +0200
+Subject: x86/boot: Compile boot code with -std=gnu11 too
+To: stable@vger.kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Cc: MPTCP Upstream <mptcp@lists.linux.dev>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Alexey Dobriyan <adobriyan@gmail.com>, Ingo Molnar <mingo@kernel.org>, "H. Peter Anvin (Intel)" <hpa@zytor.com>, Nathan Chancellor <nathan@kernel.org>, Dave Hansen <dave.hansen@linux.intel.com>, Ard Biesheuvel <ardb@kernel.org>
+Message-ID: <20251017-v5-15-gcc-15-v1-1-da6c065049d7@kernel.org>
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+commit b3bee1e7c3f2b1b77182302c7b2131c804175870 upstream.
+
+Use -std=gnu11 for consistency with main kernel code.
+
+It doesn't seem to change anything in vmlinux.
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: H. Peter Anvin (Intel) <hpa@zytor.com>
+Link: https://lore.kernel.org/r/2058761e-12a4-4b2f-9690-3c3c1c9902a5@p183
+[ This kernel version doesn't build with GCC 15:
+ In file included from include/uapi/linux/posix_types.h:5,
+ from include/uapi/linux/types.h:14,
+ from include/linux/types.h:6,
+ from arch/x86/realmode/rm/wakeup.h:11,
+ from arch/x86/realmode/rm/wakemain.c:2:
+ include/linux/stddef.h:11:9: error: cannot use keyword 'false' as enumeration constant
+ 11 | false = 0,
+ | ^~~~~
+ include/linux/stddef.h:11:9: note: 'false' is a keyword with '-std=c23' onwards
+ include/linux/types.h:30:33: error: 'bool' cannot be defined via 'typedef'
+ 30 | typedef _Bool bool;
+ | ^~~~
+ include/linux/types.h:30:33: note: 'bool' is a keyword with '-std=c23' onwards
+ include/linux/types.h:30:1: warning: useless type name in empty declaration
+ 30 | typedef _Bool bool;
+ | ^~~~~~~
+
+ The fix is similar to commit ee2ab467bddf ("x86/boot: Use '-std=gnu11'
+ to fix build with GCC 15") which has been backported to this kernel.
+
+ Note: In < 5.18 version, -std=gnu89 is used instead of -std=gnu11, see
+ commit e8c07082a810 ("Kbuild: move to -std=gnu11"). I suggest not to
+ modify that in this commit here as all the other similar fixes to
+ support GCC 15 set -std=gnu11. This can be done in a dedicated commit
+ if needed. ]
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -24,7 +24,7 @@ endif
+
+ # How to compile the 16-bit code. Note we always compile for -march=i386;
+ # that way we can complain to the user if the CPU is insufficient.
+-REALMODE_CFLAGS := -m16 -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \
++REALMODE_CFLAGS := -std=gnu11 -m16 -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \
+ -Wall -Wstrict-prototypes -march=i386 -mregparm=3 \
+ -fno-strict-aliasing -fomit-frame-pointer -fno-pic \
+ -mno-mmx -mno-sse $(call cc-option,-fcf-protection=none)
--- /dev/null
+From stable+bounces-191509-greg=kroah.com@vger.kernel.org Wed Oct 29 01:02:30 2025
+From: Babu Moger <babu.moger@amd.com>
+Date: Tue, 28 Oct 2025 10:56:50 -0500
+Subject: x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
+To: <stable@vger.kernel.org>
+Message-ID: <20251028155650.159936-1-babu.moger@amd.com>
+
+From: Babu Moger <babu.moger@amd.com>
+
+[ Upstream commit 15292f1b4c55a3a7c940dbcb6cb8793871ed3d92 ]
+
+Users can create as many monitoring groups as the number of RMIDs supported
+by the hardware. However, on AMD systems, only a limited number of RMIDs
+are guaranteed to be actively tracked by the hardware. RMIDs that exceed
+this limit are placed in an "Unavailable" state.
+
+When a bandwidth counter is read for such an RMID, the hardware sets
+MSR_IA32_QM_CTR.Unavailable (bit 62). When such an RMID starts being tracked
+again the hardware counter is reset to zero. MSR_IA32_QM_CTR.Unavailable
+remains set on first read after tracking re-starts and is clear on all
+subsequent reads as long as the RMID is tracked.
+
+resctrl miscounts the bandwidth events after an RMID transitions from the
+"Unavailable" state back to being tracked. This happens because when the
+hardware starts counting again after resetting the counter to zero, resctrl
+in turn compares the new count against the counter value stored from the
+previous time the RMID was tracked.
+
+This results in resctrl computing an event value that is either undercounting
+(when new counter is more than stored counter) or a mistaken overflow (when
+new counter is less than stored counter).
+
+Reset the stored value (arch_mbm_state::prev_msr) of MSR_IA32_QM_CTR to
+zero whenever the RMID is in the "Unavailable" state to ensure accurate
+counting after the RMID resets to zero when it starts to be tracked again.
+
+Example scenario that results in mistaken overflow
+==================================================
+1. The resctrl filesystem is mounted, and a task is assigned to a
+ monitoring group.
+
+ $mount -t resctrl resctrl /sys/fs/resctrl
+ $mkdir /sys/fs/resctrl/mon_groups/test1/
+ $echo 1234 > /sys/fs/resctrl/mon_groups/test1/tasks
+
+ $cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
+ 21323 <- Total bytes on domain 0
+ "Unavailable" <- Total bytes on domain 1
+
+ Task is running on domain 0. Counter on domain 1 is "Unavailable".
+
+2. The task runs on domain 0 for a while and then moves to domain 1. The
+ counter starts incrementing on domain 1.
+
+ $cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
+ 7345357 <- Total bytes on domain 0
+ 4545 <- Total bytes on domain 1
+
+3. At some point, the RMID in domain 0 transitions to the "Unavailable"
+ state because the task is no longer executing in that domain.
+
+ $cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
+ "Unavailable" <- Total bytes on domain 0
+ 434341 <- Total bytes on domain 1
+
+4. Since the task continues to migrate between domains, it may eventually
+ return to domain 0.
+
+ $cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
+ 17592178699059 <- Overflow on domain 0
+ 3232332 <- Total bytes on domain 1
+
+In this case, the RMID on domain 0 transitions from "Unavailable" state to
+active state. The hardware sets MSR_IA32_QM_CTR.Unavailable (bit 62) when
+the counter is read and begins tracking the RMID counting from 0.
+
+Subsequent reads succeed but return a value smaller than the previously
+saved MSR value (7345357). Consequently, the resctrl's overflow logic is
+triggered, it compares the previous value (7345357) with the new, smaller
+value and incorrectly interprets this as a counter overflow, adding a large
+delta.
+
+In reality, this is a false positive: the counter did not overflow but was
+simply reset when the RMID transitioned from "Unavailable" back to active
+state.
+
+Here is the text from APM [1] available from [2].
+
+"In PQOS Version 2.0 or higher, the MBM hardware will set the U bit on the
+first QM_CTR read when it begins tracking an RMID that it was not
+previously tracking. The U bit will be zero for all subsequent reads from
+that RMID while it is still tracked by the hardware. Therefore, a QM_CTR
+read with the U bit set when that RMID is in use by a processor can be
+considered 0 when calculating the difference with a subsequent read."
+
+[1] AMD64 Architecture Programmer's Manual Volume 2: System Programming
+ Publication # 24593 Revision 3.41 section 19.3.3 Monitoring L3 Memory
+ Bandwidth (MBM).
+
+ [ bp: Split commit message into smaller paragraph chunks for better
+ consumption. ]
+
+Fixes: 4d05bf71f157d ("x86/resctrl: Introduce AMD QOS feature")
+Signed-off-by: Babu Moger <babu.moger@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Tested-by: Reinette Chatre <reinette.chatre@intel.com>
+Cc: stable@vger.kernel.org # needs adjustments for <= v6.17
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 # [2]
+(cherry picked from commit 15292f1b4c55a3a7c940dbcb6cb8793871ed3d92)
+[babu.moger@amd.com: Fix conflict in monitor.c for v5.15 stable]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/resctrl/monitor.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/resctrl/monitor.c
++++ b/arch/x86/kernel/cpu/resctrl/monitor.c
+@@ -288,11 +288,19 @@ static u64 mbm_overflow_count(u64 prev_m
+ static u64 __mon_event_count(u32 rmid, struct rmid_read *rr)
+ {
+ struct rdt_hw_resource *hw_res = resctrl_to_arch_res(rr->r);
+- struct mbm_state *m;
++ struct mbm_state *m = NULL;
+ u64 chunks, tval;
+
+ tval = __rmid_read(rmid, rr->evtid);
+ if (tval & (RMID_VAL_ERROR | RMID_VAL_UNAVAIL)) {
++ if (tval & RMID_VAL_UNAVAIL) {
++ if (rr->evtid == QOS_L3_MBM_TOTAL_EVENT_ID)
++ m = &rr->d->mbm_total[rmid];
++ else if (rr->evtid == QOS_L3_MBM_LOCAL_EVENT_ID)
++ m = &rr->d->mbm_local[rmid];
++ if (m)
++ m->prev_msr = 0;
++ }
+ return tval;
+ }
+ switch (rr->evtid) {
--- /dev/null
+From stable+bounces-190160-greg=kroah.com@vger.kernel.org Tue Oct 28 03:45:53 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 14:42:49 -0400
+Subject: xhci: dbc: Allow users to modify DbC poll interval via sysfs
+To: stable@vger.kernel.org
+Cc: Uday M Bhat <uday.m.bhat@intel.com>, Samuel Jacob <samjaco@google.com>, Mathias Nyman <mathias.nyman@linux.intel.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251027184252.639069-3-sashal@kernel.org>
+
+From: Uday M Bhat <uday.m.bhat@intel.com>
+
+[ Upstream commit de3edd47a18fe05a560847cc3165871474e08196 ]
+
+xhci DbC driver polls the host controller for DbC events at a reduced
+rate when DbC is enabled but there are no active data transfers.
+
+Allow users to modify this reduced poll interval via dbc_poll_interval_ms
+sysfs entry. Unit is milliseconds and accepted range is 0 to 5000.
+Max interval of 5000 ms is selected as it matches the common 5 second
+timeout used in usb stack.
+Default value is 64 milliseconds.
+
+A long interval is useful when users know there won't be any activity
+on systems connected via DbC for long periods, and want to avoid
+battery drainage due to unnecessary CPU usage.
+
+Example being Android Debugger (ADB) usage over DbC on ChromeOS systems
+running Android Runtime.
+
+[minor changes and rewording -Mathias]
+
+Co-developed-by: Samuel Jacob <samjaco@google.com>
+Signed-off-by: Samuel Jacob <samjaco@google.com>
+Signed-off-by: Uday M Bhat <uday.m.bhat@intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20240626124835.1023046-5-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd | 10 +++
+ drivers/usb/host/xhci-dbgcap.c | 38 +++++++++++++++
+ drivers/usb/host/xhci-dbgcap.h | 2
+ 3 files changed, 49 insertions(+), 1 deletion(-)
+
+--- a/Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd
++++ b/Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd
+@@ -75,3 +75,13 @@ Description:
+ The default value is 1 (GNU Remote Debug command).
+ Other permissible value is 0 which is for vendor defined debug
+ target.
++
++What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_poll_interval_ms
++Date: February 2024
++Contact: Mathias Nyman <mathias.nyman@linux.intel.com>
++Description:
++ This attribute adjust the polling interval used to check for
++ DbC events. Unit is milliseconds. Accepted values range from 0
++ up to 5000. The default value is 64 ms.
++ This polling interval is used while DbC is enabled but has no
++ active data transfers.
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -1214,11 +1214,48 @@ static ssize_t dbc_bInterfaceProtocol_st
+ return size;
+ }
+
++static ssize_t dbc_poll_interval_ms_show(struct device *dev,
++ struct device_attribute *attr,
++ char *buf)
++{
++ struct xhci_dbc *dbc;
++ struct xhci_hcd *xhci;
++
++ xhci = hcd_to_xhci(dev_get_drvdata(dev));
++ dbc = xhci->dbc;
++
++ return sysfs_emit(buf, "%u\n", dbc->poll_interval);
++}
++
++static ssize_t dbc_poll_interval_ms_store(struct device *dev,
++ struct device_attribute *attr,
++ const char *buf, size_t size)
++{
++ struct xhci_dbc *dbc;
++ struct xhci_hcd *xhci;
++ u32 value;
++ int ret;
++
++ ret = kstrtou32(buf, 0, &value);
++ if (ret || value > DBC_POLL_INTERVAL_MAX)
++ return -EINVAL;
++
++ xhci = hcd_to_xhci(dev_get_drvdata(dev));
++ dbc = xhci->dbc;
++
++ dbc->poll_interval = value;
++
++ mod_delayed_work(system_wq, &dbc->event_work, 0);
++
++ return size;
++}
++
+ static DEVICE_ATTR_RW(dbc);
+ static DEVICE_ATTR_RW(dbc_idVendor);
+ static DEVICE_ATTR_RW(dbc_idProduct);
+ static DEVICE_ATTR_RW(dbc_bcdDevice);
+ static DEVICE_ATTR_RW(dbc_bInterfaceProtocol);
++static DEVICE_ATTR_RW(dbc_poll_interval_ms);
+
+ static struct attribute *dbc_dev_attributes[] = {
+ &dev_attr_dbc.attr,
+@@ -1226,6 +1263,7 @@ static struct attribute *dbc_dev_attribu
+ &dev_attr_dbc_idProduct.attr,
+ &dev_attr_dbc_bcdDevice.attr,
+ &dev_attr_dbc_bInterfaceProtocol.attr,
++ &dev_attr_dbc_poll_interval_ms.attr,
+ NULL
+ };
+
+--- a/drivers/usb/host/xhci-dbgcap.h
++++ b/drivers/usb/host/xhci-dbgcap.h
+@@ -94,7 +94,7 @@ struct dbc_ep {
+ #define DBC_QUEUE_SIZE 16
+ #define DBC_WRITE_BUF_SIZE 8192
+ #define DBC_POLL_INTERVAL_DEFAULT 64 /* milliseconds */
+-
++#define DBC_POLL_INTERVAL_MAX 5000 /* milliseconds */
+ /*
+ * Private structure for DbC hardware state:
+ */
--- /dev/null
+From stable+bounces-190163-greg=kroah.com@vger.kernel.org Tue Oct 28 03:46:12 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 14:42:51 -0400
+Subject: xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.
+To: stable@vger.kernel.org
+Cc: "Mathias Nyman" <mathias.nyman@linux.intel.com>, "Łukasz Bartosik" <ukaszb@chromium.org>, "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>, "Sasha Levin" <sashal@kernel.org>
+Message-ID: <20251027184252.639069-5-sashal@kernel.org>
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit cab63934c33b12c0d1e9f4da7450928057f2c142 ]
+
+Event polling delay is set to 0 if there are any pending requests in
+either rx or tx requests lists. Checking for pending requests does
+not work well for "IN" transfers as the tty driver always queues
+requests to the list and TRBs to the ring, preparing to receive data
+from the host.
+
+This causes unnecessary busylooping and cpu hogging.
+
+Only set the event polling delay to 0 if there are pending tx "write"
+transfers, or if it was less than 10ms since last active data transfer
+in any direction.
+
+Cc: Łukasz Bartosik <ukaszb@chromium.org>
+Fixes: fb18e5bb9660 ("xhci: dbc: poll at different rate depending on data transfer activity")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250505125630.561699-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-dbgcap.c | 19 ++++++++++++++++---
+ drivers/usb/host/xhci-dbgcap.h | 3 +++
+ 2 files changed, 19 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -855,6 +855,7 @@ static enum evtreturn xhci_dbc_do_handle
+ {
+ dma_addr_t deq;
+ union xhci_trb *evt;
++ enum evtreturn ret = EVT_DONE;
+ u32 ctrl, portsc;
+ bool update_erdp = false;
+
+@@ -939,6 +940,7 @@ static enum evtreturn xhci_dbc_do_handle
+ break;
+ case TRB_TYPE(TRB_TRANSFER):
+ dbc_handle_xfer_event(dbc, evt);
++ ret = EVT_XFER_DONE;
+ break;
+ default:
+ break;
+@@ -957,7 +959,7 @@ static enum evtreturn xhci_dbc_do_handle
+ lo_hi_writeq(deq, &dbc->regs->erdp);
+ }
+
+- return EVT_DONE;
++ return ret;
+ }
+
+ static void xhci_dbc_handle_events(struct work_struct *work)
+@@ -966,6 +968,7 @@ static void xhci_dbc_handle_events(struc
+ struct xhci_dbc *dbc;
+ unsigned long flags;
+ unsigned int poll_interval;
++ unsigned long busypoll_timelimit;
+
+ dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work);
+ poll_interval = dbc->poll_interval;
+@@ -984,11 +987,21 @@ static void xhci_dbc_handle_events(struc
+ dbc->driver->disconnect(dbc);
+ break;
+ case EVT_DONE:
+- /* set fast poll rate if there are pending data transfers */
++ /*
++ * Set fast poll rate if there are pending out transfers, or
++ * a transfer was recently processed
++ */
++ busypoll_timelimit = dbc->xfer_timestamp +
++ msecs_to_jiffies(DBC_XFER_INACTIVITY_TIMEOUT);
++
+ if (!list_empty(&dbc->eps[BULK_OUT].list_pending) ||
+- !list_empty(&dbc->eps[BULK_IN].list_pending))
++ time_is_after_jiffies(busypoll_timelimit))
+ poll_interval = 0;
+ break;
++ case EVT_XFER_DONE:
++ dbc->xfer_timestamp = jiffies;
++ poll_interval = 0;
++ break;
+ default:
+ dev_info(dbc->dev, "stop handling dbc events\n");
+ return;
+--- a/drivers/usb/host/xhci-dbgcap.h
++++ b/drivers/usb/host/xhci-dbgcap.h
+@@ -95,6 +95,7 @@ struct dbc_ep {
+ #define DBC_WRITE_BUF_SIZE 8192
+ #define DBC_POLL_INTERVAL_DEFAULT 64 /* milliseconds */
+ #define DBC_POLL_INTERVAL_MAX 5000 /* milliseconds */
++#define DBC_XFER_INACTIVITY_TIMEOUT 10 /* milliseconds */
+ /*
+ * Private structure for DbC hardware state:
+ */
+@@ -140,6 +141,7 @@ struct xhci_dbc {
+ enum dbc_state state;
+ struct delayed_work event_work;
+ unsigned int poll_interval; /* ms */
++ unsigned long xfer_timestamp;
+ unsigned resume_required:1;
+ struct dbc_ep eps[2];
+
+@@ -185,6 +187,7 @@ struct dbc_request {
+ enum evtreturn {
+ EVT_ERR = -1,
+ EVT_DONE,
++ EVT_XFER_DONE,
+ EVT_GSER,
+ EVT_DISC,
+ };
--- /dev/null
+From stable+bounces-190165-greg=kroah.com@vger.kernel.org Tue Oct 28 03:46:16 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 14:42:52 -0400
+Subject: xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event
+To: stable@vger.kernel.org
+Cc: "Mathias Nyman" <mathias.nyman@linux.intel.com>, stable <stable@kernel.org>, "Łukasz Bartosik" <ukaszb@chromium.org>, "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>, "Sasha Levin" <sashal@kernel.org>
+Message-ID: <20251027184252.639069-6-sashal@kernel.org>
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit f3d12ec847b945d5d65846c85f062d07d5e73164 ]
+
+DbC may add 1024 bogus bytes to the beginneing of the receiving endpoint
+if DbC hw triggers a STALL event before any Transfer Blocks (TRBs) for
+incoming data are queued, but driver handles the event after it queued
+the TRBs.
+
+This is possible as xHCI DbC hardware may trigger spurious STALL transfer
+events even if endpoint is empty. The STALL event contains a pointer
+to the stalled TRB, and "remaining" untransferred data length.
+
+As there are no TRBs queued yet the STALL event will just point to first
+TRB position of the empty ring, with '0' bytes remaining untransferred.
+
+DbC driver is polling for events, and may not handle the STALL event
+before /dev/ttyDBC0 is opened and incoming data TRBs are queued.
+
+The DbC event handler will now assume the first queued TRB (length 1024)
+has stalled with '0' bytes remaining untransferred, and copies the data
+
+This race situation can be practically mitigated by making sure the event
+handler handles all pending transfer events when DbC reaches configured
+state, and only then create dev/ttyDbC0, and start queueing transfers.
+The event handler can this way detect the STALL events on empty rings
+and discard them before any transfers are queued.
+
+This does in practice solve the issue, but still leaves a small possible
+gap for the race to trigger.
+We still need a way to distinguish spurious STALLs on empty rings with '0'
+bytes remaing, from actual STALL events with all bytes transmitted.
+
+Cc: stable <stable@kernel.org>
+Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver")
+Tested-by: Łukasz Bartosik <ukaszb@chromium.org>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-dbgcap.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -880,7 +880,8 @@ static enum evtreturn xhci_dbc_do_handle
+ dev_info(dbc->dev, "DbC configured\n");
+ portsc = readl(&dbc->regs->portsc);
+ writel(portsc, &dbc->regs->portsc);
+- return EVT_GSER;
++ ret = EVT_GSER;
++ break;
+ }
+
+ return EVT_DONE;
+@@ -940,7 +941,8 @@ static enum evtreturn xhci_dbc_do_handle
+ break;
+ case TRB_TYPE(TRB_TRANSFER):
+ dbc_handle_xfer_event(dbc, evt);
+- ret = EVT_XFER_DONE;
++ if (ret != EVT_GSER)
++ ret = EVT_XFER_DONE;
+ break;
+ default:
+ break;
--- /dev/null
+From stable+bounces-190162-greg=kroah.com@vger.kernel.org Tue Oct 28 03:44:50 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 14:42:50 -0400
+Subject: xhci: dbc: Improve performance by removing delay in transfer event polling.
+To: stable@vger.kernel.org
+Cc: "Mathias Nyman" <mathias.nyman@linux.intel.com>, "Łukasz Bartosik" <ukaszb@chromium.org>, "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>, "Sasha Levin" <sashal@kernel.org>
+Message-ID: <20251027184252.639069-4-sashal@kernel.org>
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit 03e3d9c2bd85cda941b3cf78e895c1498ac05c5f ]
+
+Queue event polling work with 0 delay in case there are pending transfers
+queued up. This is part 2 of a 3 part series that roughly triples dbc
+performace when using adb push and pull over dbc.
+
+Max/min push rate after patches is 210/118 MB/s, pull rate 171/133 MB/s,
+tested with large files (300MB-9GB) by Łukasz Bartosik
+
+First performance improvement patch was commit 31128e7492dc
+("xhci: dbc: add dbgtty request to end of list once it completes")
+
+Cc: Łukasz Bartosik <ukaszb@chromium.org>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20241227120142.1035206-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-dbgcap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -987,7 +987,7 @@ static void xhci_dbc_handle_events(struc
+ /* set fast poll rate if there are pending data transfers */
+ if (!list_empty(&dbc->eps[BULK_OUT].list_pending) ||
+ !list_empty(&dbc->eps[BULK_IN].list_pending))
+- poll_interval = 1;
++ poll_interval = 0;
+ break;
+ default:
+ dev_info(dbc->dev, "stop handling dbc events\n");
--- /dev/null
+From stable+bounces-190159-greg=kroah.com@vger.kernel.org Tue Oct 28 03:44:38 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 14:42:48 -0400
+Subject: xhci: dbc: poll at different rate depending on data transfer activity
+To: stable@vger.kernel.org
+Cc: Mathias Nyman <mathias.nyman@linux.intel.com>, Uday M Bhat <uday.m.bhat@intel.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251027184252.639069-2-sashal@kernel.org>
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit fb18e5bb96603cc79d97f03e4c05f3992cf28624 ]
+
+DbC driver starts polling for events immediately when DbC is enabled.
+The current polling interval is 1ms, which keeps the CPU busy, impacting
+power management even when there are no active data transfers.
+
+Solve this by polling at a slower rate, with a 64ms interval as default
+until a transfer request is queued, or if there are still are pending
+unhandled transfers at event completion.
+
+Tested-by: Uday M Bhat <uday.m.bhat@intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20240229141438.619372-9-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-dbgcap.c | 13 +++++++++++--
+ drivers/usb/host/xhci-dbgcap.h | 2 ++
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -665,7 +665,8 @@ static int xhci_dbc_start(struct xhci_db
+ return ret;
+ }
+
+- return mod_delayed_work(system_wq, &dbc->event_work, 1);
++ return mod_delayed_work(system_wq, &dbc->event_work,
++ msecs_to_jiffies(dbc->poll_interval));
+ }
+
+ static void xhci_dbc_stop(struct xhci_dbc *dbc)
+@@ -964,8 +965,10 @@ static void xhci_dbc_handle_events(struc
+ enum evtreturn evtr;
+ struct xhci_dbc *dbc;
+ unsigned long flags;
++ unsigned int poll_interval;
+
+ dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work);
++ poll_interval = dbc->poll_interval;
+
+ spin_lock_irqsave(&dbc->lock, flags);
+ evtr = xhci_dbc_do_handle_events(dbc);
+@@ -981,13 +984,18 @@ static void xhci_dbc_handle_events(struc
+ dbc->driver->disconnect(dbc);
+ break;
+ case EVT_DONE:
++ /* set fast poll rate if there are pending data transfers */
++ if (!list_empty(&dbc->eps[BULK_OUT].list_pending) ||
++ !list_empty(&dbc->eps[BULK_IN].list_pending))
++ poll_interval = 1;
+ break;
+ default:
+ dev_info(dbc->dev, "stop handling dbc events\n");
+ return;
+ }
+
+- mod_delayed_work(system_wq, &dbc->event_work, 1);
++ mod_delayed_work(system_wq, &dbc->event_work,
++ msecs_to_jiffies(poll_interval));
+ }
+
+ static ssize_t dbc_show(struct device *dev,
+@@ -1242,6 +1250,7 @@ xhci_alloc_dbc(struct device *dev, void
+ dbc->idVendor = DBC_VENDOR_ID;
+ dbc->bcdDevice = DBC_DEVICE_REV;
+ dbc->bInterfaceProtocol = DBC_PROTOCOL;
++ dbc->poll_interval = DBC_POLL_INTERVAL_DEFAULT;
+
+ if (readl(&dbc->regs->control) & DBC_CTRL_DBC_ENABLE)
+ goto err;
+--- a/drivers/usb/host/xhci-dbgcap.h
++++ b/drivers/usb/host/xhci-dbgcap.h
+@@ -93,6 +93,7 @@ struct dbc_ep {
+
+ #define DBC_QUEUE_SIZE 16
+ #define DBC_WRITE_BUF_SIZE 8192
++#define DBC_POLL_INTERVAL_DEFAULT 64 /* milliseconds */
+
+ /*
+ * Private structure for DbC hardware state:
+@@ -138,6 +139,7 @@ struct xhci_dbc {
+
+ enum dbc_state state;
+ struct delayed_work event_work;
++ unsigned int poll_interval; /* ms */
+ unsigned resume_required:1;
+ struct dbc_ep eps[2];
+
--- /dev/null
+From stable+bounces-190158-greg=kroah.com@vger.kernel.org Tue Oct 28 03:53:52 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 14:42:47 -0400
+Subject: xhci: dbc: Provide sysfs option to configure dbc descriptors
+To: stable@vger.kernel.org
+Cc: Mathias Nyman <mathias.nyman@linux.intel.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251027184252.639069-1-sashal@kernel.org>
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit edf1664f3249a091a2b91182fc087b3253b0b4c2 ]
+
+When DbC is enabled the first port on the xHC host acts as a usb device.
+xHC provides the descriptors automatically when the DbC device is
+enumerated. Most of the values are hardcoded, but some fields such as
+idProduct, idVendor, bcdDevice and bInterfaceProtocol can be modified.
+
+Add sysfs entries that allow userspace to change these.
+User can only change them before dbc is enabled, i.e. before writing
+"enable" to dbc sysfs file as we don't want these values to change while
+device is connected, or during enumeration.
+
+Add documentation for these entries in
+Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20230317154715.535523-9-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f3d12ec847b9 ("xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd | 52 ++++
+ drivers/usb/host/xhci-dbgcap.c | 191 ++++++++++++++-
+ drivers/usb/host/xhci-dbgcap.h | 4
+ 3 files changed, 243 insertions(+), 4 deletions(-)
+
+--- a/Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd
++++ b/Documentation/ABI/testing/sysfs-bus-pci-drivers-xhci_hcd
+@@ -23,3 +23,55 @@ Description:
+ Reading this attribute gives the state of the DbC. It
+ can be one of the following states: disabled, enabled,
+ initialized, connected, configured and stalled.
++
++What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_idVendor
++Date: March 2023
++Contact: Mathias Nyman <mathias.nyman@linux.intel.com>
++Description:
++ This dbc_idVendor attribute lets us change the idVendor field
++ presented in the USB device descriptor by this xhci debug
++ device.
++ Value can only be changed while debug capability (DbC) is in
++ disabled state to prevent USB device descriptor change while
++ connected to a USB host.
++ The default value is 0x1d6b (Linux Foundation).
++ It can be any 16-bit integer.
++
++What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_idProduct
++Date: March 2023
++Contact: Mathias Nyman <mathias.nyman@linux.intel.com>
++Description:
++ This dbc_idProduct attribute lets us change the idProduct field
++ presented in the USB device descriptor by this xhci debug
++ device.
++ Value can only be changed while debug capability (DbC) is in
++ disabled state to prevent USB device descriptor change while
++ connected to a USB host.
++ The default value is 0x0010. It can be any 16-bit integer.
++
++What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_bcdDevice
++Date: March 2023
++Contact: Mathias Nyman <mathias.nyman@linux.intel.com>
++Description:
++ This dbc_bcdDevice attribute lets us change the bcdDevice field
++ presented in the USB device descriptor by this xhci debug
++ device.
++ Value can only be changed while debug capability (DbC) is in
++ disabled state to prevent USB device descriptor change while
++ connected to a USB host.
++ The default value is 0x0010. (device rev 0.10)
++ It can be any 16-bit integer.
++
++What: /sys/bus/pci/drivers/xhci_hcd/.../dbc_bInterfaceProtocol
++Date: March 2023
++Contact: Mathias Nyman <mathias.nyman@linux.intel.com>
++Description:
++ This attribute lets us change the bInterfaceProtocol field
++ presented in the USB Interface descriptor by the xhci debug
++ device.
++ Value can only be changed while debug capability (DbC) is in
++ disabled state to prevent USB descriptor change while
++ connected to a USB host.
++ The default value is 1 (GNU Remote Debug command).
++ Other permissible value is 0 which is for vendor defined debug
++ target.
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -133,10 +133,10 @@ static void xhci_dbc_init_contexts(struc
+ /* Set DbC context and info registers: */
+ lo_hi_writeq(dbc->ctx->dma, &dbc->regs->dccp);
+
+- dev_info = cpu_to_le32((DBC_VENDOR_ID << 16) | DBC_PROTOCOL);
++ dev_info = (dbc->idVendor << 16) | dbc->bInterfaceProtocol;
+ writel(dev_info, &dbc->regs->devinfo1);
+
+- dev_info = cpu_to_le32((DBC_DEVICE_REV << 16) | DBC_PRODUCT_ID);
++ dev_info = (dbc->bcdDevice << 16) | dbc->idProduct;
+ writel(dev_info, &dbc->regs->devinfo2);
+ }
+
+@@ -1044,7 +1044,186 @@ static ssize_t dbc_store(struct device *
+ return count;
+ }
+
++static ssize_t dbc_idVendor_show(struct device *dev,
++ struct device_attribute *attr,
++ char *buf)
++{
++ struct xhci_dbc *dbc;
++ struct xhci_hcd *xhci;
++
++ xhci = hcd_to_xhci(dev_get_drvdata(dev));
++ dbc = xhci->dbc;
++
++ return sprintf(buf, "%04x\n", dbc->idVendor);
++}
++
++static ssize_t dbc_idVendor_store(struct device *dev,
++ struct device_attribute *attr,
++ const char *buf, size_t size)
++{
++ struct xhci_dbc *dbc;
++ struct xhci_hcd *xhci;
++ void __iomem *ptr;
++ u16 value;
++ u32 dev_info;
++
++ if (kstrtou16(buf, 0, &value))
++ return -EINVAL;
++
++ xhci = hcd_to_xhci(dev_get_drvdata(dev));
++ dbc = xhci->dbc;
++ if (dbc->state != DS_DISABLED)
++ return -EBUSY;
++
++ dbc->idVendor = value;
++ ptr = &dbc->regs->devinfo1;
++ dev_info = readl(ptr);
++ dev_info = (dev_info & ~(0xffffu << 16)) | (value << 16);
++ writel(dev_info, ptr);
++
++ return size;
++}
++
++static ssize_t dbc_idProduct_show(struct device *dev,
++ struct device_attribute *attr,
++ char *buf)
++{
++ struct xhci_dbc *dbc;
++ struct xhci_hcd *xhci;
++
++ xhci = hcd_to_xhci(dev_get_drvdata(dev));
++ dbc = xhci->dbc;
++
++ return sprintf(buf, "%04x\n", dbc->idProduct);
++}
++
++static ssize_t dbc_idProduct_store(struct device *dev,
++ struct device_attribute *attr,
++ const char *buf, size_t size)
++{
++ struct xhci_dbc *dbc;
++ struct xhci_hcd *xhci;
++ void __iomem *ptr;
++ u32 dev_info;
++ u16 value;
++
++ if (kstrtou16(buf, 0, &value))
++ return -EINVAL;
++
++ xhci = hcd_to_xhci(dev_get_drvdata(dev));
++ dbc = xhci->dbc;
++ if (dbc->state != DS_DISABLED)
++ return -EBUSY;
++
++ dbc->idProduct = value;
++ ptr = &dbc->regs->devinfo2;
++ dev_info = readl(ptr);
++ dev_info = (dev_info & ~(0xffffu)) | value;
++ writel(dev_info, ptr);
++ return size;
++}
++
++static ssize_t dbc_bcdDevice_show(struct device *dev,
++ struct device_attribute *attr,
++ char *buf)
++{
++ struct xhci_dbc *dbc;
++ struct xhci_hcd *xhci;
++
++ xhci = hcd_to_xhci(dev_get_drvdata(dev));
++ dbc = xhci->dbc;
++
++ return sprintf(buf, "%04x\n", dbc->bcdDevice);
++}
++
++static ssize_t dbc_bcdDevice_store(struct device *dev,
++ struct device_attribute *attr,
++ const char *buf, size_t size)
++{
++ struct xhci_dbc *dbc;
++ struct xhci_hcd *xhci;
++ void __iomem *ptr;
++ u32 dev_info;
++ u16 value;
++
++ if (kstrtou16(buf, 0, &value))
++ return -EINVAL;
++
++ xhci = hcd_to_xhci(dev_get_drvdata(dev));
++ dbc = xhci->dbc;
++ if (dbc->state != DS_DISABLED)
++ return -EBUSY;
++
++ dbc->bcdDevice = value;
++ ptr = &dbc->regs->devinfo2;
++ dev_info = readl(ptr);
++ dev_info = (dev_info & ~(0xffffu << 16)) | (value << 16);
++ writel(dev_info, ptr);
++
++ return size;
++}
++
++static ssize_t dbc_bInterfaceProtocol_show(struct device *dev,
++ struct device_attribute *attr,
++ char *buf)
++{
++ struct xhci_dbc *dbc;
++ struct xhci_hcd *xhci;
++
++ xhci = hcd_to_xhci(dev_get_drvdata(dev));
++ dbc = xhci->dbc;
++
++ return sprintf(buf, "%02x\n", dbc->bInterfaceProtocol);
++}
++
++static ssize_t dbc_bInterfaceProtocol_store(struct device *dev,
++ struct device_attribute *attr,
++ const char *buf, size_t size)
++{
++ struct xhci_dbc *dbc;
++ struct xhci_hcd *xhci;
++ void __iomem *ptr;
++ u32 dev_info;
++ u8 value;
++ int ret;
++
++ /* bInterfaceProtocol is 8 bit, but xhci only supports values 0 and 1 */
++ ret = kstrtou8(buf, 0, &value);
++ if (ret || value > 1)
++ return -EINVAL;
++
++ xhci = hcd_to_xhci(dev_get_drvdata(dev));
++ dbc = xhci->dbc;
++ if (dbc->state != DS_DISABLED)
++ return -EBUSY;
++
++ dbc->bInterfaceProtocol = value;
++ ptr = &dbc->regs->devinfo1;
++ dev_info = readl(ptr);
++ dev_info = (dev_info & ~(0xffu)) | value;
++ writel(dev_info, ptr);
++
++ return size;
++}
++
+ static DEVICE_ATTR_RW(dbc);
++static DEVICE_ATTR_RW(dbc_idVendor);
++static DEVICE_ATTR_RW(dbc_idProduct);
++static DEVICE_ATTR_RW(dbc_bcdDevice);
++static DEVICE_ATTR_RW(dbc_bInterfaceProtocol);
++
++static struct attribute *dbc_dev_attributes[] = {
++ &dev_attr_dbc.attr,
++ &dev_attr_dbc_idVendor.attr,
++ &dev_attr_dbc_idProduct.attr,
++ &dev_attr_dbc_bcdDevice.attr,
++ &dev_attr_dbc_bInterfaceProtocol.attr,
++ NULL
++};
++
++static const struct attribute_group dbc_dev_attrib_grp = {
++ .attrs = dbc_dev_attributes,
++};
+
+ struct xhci_dbc *
+ xhci_alloc_dbc(struct device *dev, void __iomem *base, const struct dbc_driver *driver)
+@@ -1059,6 +1238,10 @@ xhci_alloc_dbc(struct device *dev, void
+ dbc->regs = base;
+ dbc->dev = dev;
+ dbc->driver = driver;
++ dbc->idProduct = DBC_PRODUCT_ID;
++ dbc->idVendor = DBC_VENDOR_ID;
++ dbc->bcdDevice = DBC_DEVICE_REV;
++ dbc->bInterfaceProtocol = DBC_PROTOCOL;
+
+ if (readl(&dbc->regs->control) & DBC_CTRL_DBC_ENABLE)
+ goto err;
+@@ -1066,7 +1249,7 @@ xhci_alloc_dbc(struct device *dev, void
+ INIT_DELAYED_WORK(&dbc->event_work, xhci_dbc_handle_events);
+ spin_lock_init(&dbc->lock);
+
+- ret = device_create_file(dev, &dev_attr_dbc);
++ ret = sysfs_create_group(&dev->kobj, &dbc_dev_attrib_grp);
+ if (ret)
+ goto err;
+
+@@ -1085,7 +1268,7 @@ void xhci_dbc_remove(struct xhci_dbc *db
+ xhci_dbc_stop(dbc);
+
+ /* remove sysfs files */
+- device_remove_file(dbc->dev, &dev_attr_dbc);
++ sysfs_remove_group(&dbc->dev->kobj, &dbc_dev_attrib_grp);
+
+ kfree(dbc);
+ }
+--- a/drivers/usb/host/xhci-dbgcap.h
++++ b/drivers/usb/host/xhci-dbgcap.h
+@@ -131,6 +131,10 @@ struct xhci_dbc {
+ struct dbc_str_descs *string;
+ dma_addr_t string_dma;
+ size_t string_size;
++ u16 idVendor;
++ u16 idProduct;
++ u16 bcdDevice;
++ u8 bInterfaceProtocol;
+
+ enum dbc_state state;
+ struct delayed_work event_work;
projects / thirdparty / kernel / stable-queue.git / commitdiff
