--- /dev/null
+From b1bf1a782fdf5c482215c0c661b5da98b8e75773 Mon Sep 17 00:00:00 2001
+From: Sheng Yong <shengyong1@xiaomi.com>
+Date: Thu, 10 Jul 2025 14:48:55 +0800
+Subject: dm-bufio: fix sched in atomic context
+
+From: Sheng Yong <shengyong1@xiaomi.com>
+
+commit b1bf1a782fdf5c482215c0c661b5da98b8e75773 upstream.
+
+If "try_verify_in_tasklet" is set for dm-verity, DM_BUFIO_CLIENT_NO_SLEEP
+is enabled for dm-bufio. However, when bufio tries to evict buffers, there
+is a chance to trigger scheduling in spin_lock_bh, the following warning
+is hit:
+
+BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2745
+in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 123, name: kworker/2:2
+preempt_count: 201, expected: 0
+RCU nest depth: 0, expected: 0
+4 locks held by kworker/2:2/123:
+ #0: ffff88800a2d1548 ((wq_completion)dm_bufio_cache){....}-{0:0}, at: process_one_work+0xe46/0x1970
+ #1: ffffc90000d97d20 ((work_completion)(&dm_bufio_replacement_work)){....}-{0:0}, at: process_one_work+0x763/0x1970
+ #2: ffffffff8555b528 (dm_bufio_clients_lock){....}-{3:3}, at: do_global_cleanup+0x1ce/0x710
+ #3: ffff88801d5820b8 (&c->spinlock){....}-{2:2}, at: do_global_cleanup+0x2a5/0x710
+Preemption disabled at:
+[<0000000000000000>] 0x0
+CPU: 2 UID: 0 PID: 123 Comm: kworker/2:2 Not tainted 6.16.0-rc3-g90548c634bd0 #305 PREEMPT(voluntary)
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
+Workqueue: dm_bufio_cache do_global_cleanup
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0x53/0x70
+ __might_resched+0x360/0x4e0
+ do_global_cleanup+0x2f5/0x710
+ process_one_work+0x7db/0x1970
+ worker_thread+0x518/0xea0
+ kthread+0x359/0x690
+ ret_from_fork+0xf3/0x1b0
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+
+That can be reproduced by:
+
+ veritysetup format --data-block-size=4096 --hash-block-size=4096 /dev/vda /dev/vdb
+ SIZE=$(blockdev --getsz /dev/vda)
+ dmsetup create myverity -r --table "0 $SIZE verity 1 /dev/vda /dev/vdb 4096 4096 <data_blocks> 1 sha256 <root_hash> <salt> 1 try_verify_in_tasklet"
+ mount /dev/dm-0 /mnt -o ro
+ echo 102400 > /sys/module/dm_bufio/parameters/max_cache_size_bytes
+ [read files in /mnt]
+
+Cc: stable@vger.kernel.org # v6.4+
+Fixes: 450e8dee51aa ("dm bufio: improve concurrent IO performance")
+Signed-off-by: Wang Shuai <wangshuai12@xiaomi.com>
+Signed-off-by: Sheng Yong <shengyong1@xiaomi.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-bufio.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -2708,7 +2708,11 @@ static unsigned long __evict_many(struct
+ __make_buffer_clean(b);
+ __free_buffer_wake(b);
+
+- cond_resched();
++ if (need_resched()) {
++ dm_bufio_unlock(c);
++ cond_resched();
++ dm_bufio_lock(c);
++ }
+ }
+
+ return count;
--- /dev/null
+From c2ca42f190b6714d6c481dfd3d9b62ea091c946b Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <bentiss@kernel.org>
+Date: Thu, 10 Jul 2025 16:01:35 +0200
+Subject: HID: core: do not bypass hid_hw_raw_request
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+commit c2ca42f190b6714d6c481dfd3d9b62ea091c946b upstream.
+
+hid_hw_raw_request() is actually useful to ensure the provided buffer
+and length are valid. Directly calling in the low level transport driver
+function bypassed those checks and allowed invalid paramto be used.
+
+Reported-by: Alan Stern <stern@rowland.harvard.edu>
+Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250710-report-size-null-v2-3-ccf922b7c4e5@kernel.org
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1961,8 +1961,7 @@ int __hid_request(struct hid_device *hid
+ if (reqtype == HID_REQ_SET_REPORT)
+ hid_output_report(report, data_buf);
+
+- ret = hid->ll_driver->raw_request(hid, report->id, buf, len,
+- report->type, reqtype);
++ ret = hid_hw_raw_request(hid, report->id, buf, len, report->type, reqtype);
+ if (ret < 0) {
+ dbg_hid("unable to complete request: %d\n", ret);
+ goto out;
--- /dev/null
+From 0d0777ccaa2d46609d05b66ba0096802a2746193 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <bentiss@kernel.org>
+Date: Thu, 10 Jul 2025 16:01:34 +0200
+Subject: HID: core: ensure __hid_request reserves the report ID as the first byte
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+commit 0d0777ccaa2d46609d05b66ba0096802a2746193 upstream.
+
+The low level transport driver expects the first byte to be the report
+ID, even when the report ID is not use (in which case they just shift
+the buffer).
+
+However, __hid_request() whas not offsetting the buffer it used by one
+in this case, meaning that the raw_request() callback emitted by the
+transport driver would be stripped of the first byte.
+
+Note: this changes the API for uhid devices when a request is made
+through hid_hw_request. However, several considerations makes me think
+this is fine:
+- every request to a HID device made through hid_hw_request() would see
+ that change, but every request made through hid_hw_raw_request()
+ already has the new behaviour. So that means that the users are
+ already facing situations where they might have or not the first byte
+ being the null report ID when it is 0. We are making things more
+ straightforward in the end.
+- uhid is mainly used for BLE devices
+- uhid is also used for testing, but I don't see that change a big issue
+- for BLE devices, we can check which kernel module is calling
+ hid_hw_request()
+- and in those modules, we can check which are using a Bluetooth device
+- and then we can check if the command is used with a report ID or not.
+- surprise: none of the kernel module are using a report ID 0
+- and finally, bluez, in its function set_report()[0], does the same
+ shift if the report ID is 0 and the given buffer has a size > 0.
+
+[0] https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/profiles/input/hog-lib.c#n879
+
+Reported-by: Alan Stern <stern@rowland.harvard.edu>
+Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/
+Reported-by: syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43
+Tested-by: syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com
+Fixes: 4fa5a7f76cc7 ("HID: core: implement generic .request()")
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250710-report-size-null-v2-2-ccf922b7c4e5@kernel.org
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-core.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1941,7 +1941,7 @@ static struct hid_report *hid_get_report
+ int __hid_request(struct hid_device *hid, struct hid_report *report,
+ enum hid_class_request reqtype)
+ {
+- char *buf;
++ char *buf, *data_buf;
+ int ret;
+ u32 len;
+
+@@ -1949,10 +1949,17 @@ int __hid_request(struct hid_device *hid
+ if (!buf)
+ return -ENOMEM;
+
++ data_buf = buf;
+ len = hid_report_len(report);
+
++ if (report->id == 0) {
++ /* reserve the first byte for the report ID */
++ data_buf++;
++ len++;
++ }
++
+ if (reqtype == HID_REQ_SET_REPORT)
+- hid_output_report(report, buf);
++ hid_output_report(report, data_buf);
+
+ ret = hid->ll_driver->raw_request(hid, report->id, buf, len,
+ report->type, reqtype);
--- /dev/null
+From 4f15ee98304b96e164ff2340e1dfd6181c3f42aa Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <bentiss@kernel.org>
+Date: Thu, 10 Jul 2025 16:01:33 +0200
+Subject: HID: core: ensure the allocated report buffer can contain the reserved report ID
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+commit 4f15ee98304b96e164ff2340e1dfd6181c3f42aa upstream.
+
+When the report ID is not used, the low level transport drivers expect
+the first byte to be 0. However, currently the allocated buffer not
+account for that extra byte, meaning that instead of having 8 guaranteed
+bytes for implement to be working, we only have 7.
+
+Reported-by: Alan Stern <stern@rowland.harvard.edu>
+Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/
+Cc: stable@vger.kernel.org
+Suggested-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://patch.msgid.link/20250710-report-size-null-v2-1-ccf922b7c4e5@kernel.org
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1873,9 +1873,12 @@ u8 *hid_alloc_report_buf(struct hid_repo
+ /*
+ * 7 extra bytes are necessary to achieve proper functionality
+ * of implement() working on 8 byte chunks
++ * 1 extra byte for the report ID if it is null (not used) so
++ * we can reserve that extra byte in the first position of the buffer
++ * when sending it to .raw_request()
+ */
+
+- u32 len = hid_report_len(report) + 7;
++ u32 len = hid_report_len(report) + 7 + (report->id == 0);
+
+ return kzalloc(len, flags);
+ }
--- /dev/null
+From c870cbbd71fccda71d575f0acd4a8d2b7cd88861 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Cl=C3=A9ment=20Le=20Goffic?= <clement.legoffic@foss.st.com>
+Date: Fri, 4 Jul 2025 10:39:14 +0200
+Subject: i2c: stm32: fix the device used for the DMA map
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Le Goffic <clement.legoffic@foss.st.com>
+
+commit c870cbbd71fccda71d575f0acd4a8d2b7cd88861 upstream.
+
+If the DMA mapping failed, it produced an error log with the wrong
+device name:
+"stm32-dma3 40400000.dma-controller: rejecting DMA map of vmalloc memory"
+Fix this issue by replacing the dev with the I2C dev.
+
+Fixes: bb8822cbbc53 ("i2c: i2c-stm32: Add generic DMA API")
+Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
+Cc: <stable@vger.kernel.org> # v4.18+
+Acked-by: Alain Volmat <alain.volmat@foss.st.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20250704-i2c-upstream-v4-1-84a095a2c728@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-stm32.c | 8 +++-----
+ drivers/i2c/busses/i2c-stm32f7.c | 4 ++--
+ 2 files changed, 5 insertions(+), 7 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-stm32.c
++++ b/drivers/i2c/busses/i2c-stm32.c
+@@ -102,7 +102,6 @@ int stm32_i2c_prep_dma_xfer(struct devic
+ void *dma_async_param)
+ {
+ struct dma_async_tx_descriptor *txdesc;
+- struct device *chan_dev;
+ int ret;
+
+ if (rd_wr) {
+@@ -116,11 +115,10 @@ int stm32_i2c_prep_dma_xfer(struct devic
+ }
+
+ dma->dma_len = len;
+- chan_dev = dma->chan_using->device->dev;
+
+- dma->dma_buf = dma_map_single(chan_dev, buf, dma->dma_len,
++ dma->dma_buf = dma_map_single(dev, buf, dma->dma_len,
+ dma->dma_data_dir);
+- if (dma_mapping_error(chan_dev, dma->dma_buf)) {
++ if (dma_mapping_error(dev, dma->dma_buf)) {
+ dev_err(dev, "DMA mapping failed\n");
+ return -EINVAL;
+ }
+@@ -150,7 +148,7 @@ int stm32_i2c_prep_dma_xfer(struct devic
+ return 0;
+
+ err:
+- dma_unmap_single(chan_dev, dma->dma_buf, dma->dma_len,
++ dma_unmap_single(dev, dma->dma_buf, dma->dma_len,
+ dma->dma_data_dir);
+ return ret;
+ }
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -728,10 +728,10 @@ static void stm32f7_i2c_dma_callback(voi
+ {
+ struct stm32f7_i2c_dev *i2c_dev = (struct stm32f7_i2c_dev *)arg;
+ struct stm32_i2c_dma *dma = i2c_dev->dma;
+- struct device *dev = dma->chan_using->device->dev;
+
+ stm32f7_i2c_disable_dma_req(i2c_dev);
+- dma_unmap_single(dev, dma->dma_buf, dma->dma_len, dma->dma_data_dir);
++ dma_unmap_single(i2c_dev->dev, dma->dma_buf, dma->dma_len,
++ dma->dma_data_dir);
+ complete(&dma->dma_complete);
+ }
+
--- /dev/null
+From bcce05041b21888f10b80ea903dcfe51a25c586e Mon Sep 17 00:00:00 2001
+From: Nilton Perim Neto <niltonperimneto@gmail.com>
+Date: Sat, 19 Jul 2025 22:07:36 -0700
+Subject: Input: xpad - set correct controller type for Acer NGR200
+
+From: Nilton Perim Neto <niltonperimneto@gmail.com>
+
+commit bcce05041b21888f10b80ea903dcfe51a25c586e upstream.
+
+The controller should have been set as XTYPE_XBOX360 and not XTYPE_XBOX.
+Also the entry is in the wrong place. Fix it.
+
+Reported-by: Vicki Pfau <vi@endrift.com>
+Signed-off-by: Nilton Perim Neto <niltonperimneto@gmail.com>
+Link: https://lore.kernel.org/r/20250708033126.26216-2-niltonperimneto@gmail.com
+Fixes: 22c69d786ef8 ("Input: xpad - support Acer NGR 200 Controller")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -169,12 +169,12 @@ static const struct xpad_device {
+ { 0x046d, 0xca88, "Logitech Compact Controller for Xbox", 0, XTYPE_XBOX },
+ { 0x046d, 0xca8a, "Logitech Precision Vibration Feedback Wheel", 0, XTYPE_XBOX },
+ { 0x046d, 0xcaa3, "Logitech DriveFx Racing Wheel", 0, XTYPE_XBOX360 },
++ { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX360 },
+ { 0x056e, 0x2004, "Elecom JC-U3613M", 0, XTYPE_XBOX360 },
+ { 0x05fd, 0x1007, "Mad Catz Controller (unverified)", 0, XTYPE_XBOX },
+ { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX },
+ { 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX },
+ { 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX },
+- { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX },
+ { 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX },
+ { 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX },
+ { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX },
--- /dev/null
+From 2aa4ad626ee7f817a8f4715a47b318cfdc1714c9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Steffen=20B=C3=A4tz?= <steffen@innosonix.de>
+Date: Sat, 12 Jul 2025 19:17:27 +0100
+Subject: nvmem: imx-ocotp: fix MAC address byte length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Steffen Bätz <steffen@innosonix.de>
+
+commit 2aa4ad626ee7f817a8f4715a47b318cfdc1714c9 upstream.
+
+The commit "13bcd440f2ff nvmem: core: verify cell's raw_len" caused an
+extension of the "mac-address" cell from 6 to 8 bytes due to word_size
+of 4 bytes. This led to a required byte swap of the full buffer length,
+which caused truncation of the mac-address when read.
+
+Previously, the mac-address was incorrectly truncated from
+70:B3:D5:14:E9:0E to 00:00:70:B3:D5:14.
+
+Fix the issue by swapping only the first 6 bytes to correctly pass the
+mac-address to the upper layers.
+
+Fixes: 13bcd440f2ff ("nvmem: core: verify cell's raw_len")
+Cc: stable@vger.kernel.org
+Signed-off-by: Steffen Bätz <steffen@innosonix.de>
+Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Link: https://lore.kernel.org/r/20250712181729.6495-3-srini@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/imx-ocotp-ele.c | 5 ++++-
+ drivers/nvmem/imx-ocotp.c | 5 ++++-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/nvmem/imx-ocotp-ele.c
++++ b/drivers/nvmem/imx-ocotp-ele.c
+@@ -12,6 +12,7 @@
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
++#include <linux/if_ether.h> /* ETH_ALEN */
+
+ enum fuse_type {
+ FUSE_FSB = 1,
+@@ -114,9 +115,11 @@ static int imx_ocotp_cell_pp(void *conte
+ int i;
+
+ /* Deal with some post processing of nvmem cell data */
+- if (id && !strcmp(id, "mac-address"))
++ if (id && !strcmp(id, "mac-address")) {
++ bytes = min(bytes, ETH_ALEN);
+ for (i = 0; i < bytes / 2; i++)
+ swap(buf[i], buf[bytes - i - 1]);
++ }
+
+ return 0;
+ }
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -23,6 +23,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+ #include <linux/delay.h>
++#include <linux/if_ether.h> /* ETH_ALEN */
+
+ #define IMX_OCOTP_OFFSET_B0W0 0x400 /* Offset from base address of the
+ * OTP Bank0 Word0
+@@ -227,9 +228,11 @@ static int imx_ocotp_cell_pp(void *conte
+ int i;
+
+ /* Deal with some post processing of nvmem cell data */
+- if (id && !strcmp(id, "mac-address"))
++ if (id && !strcmp(id, "mac-address")) {
++ bytes = min(bytes, ETH_ALEN);
+ for (i = 0; i < bytes / 2; i++)
+ swap(buf[i], buf[bytes - i - 1]);
++ }
+
+ return 0;
+ }
--- /dev/null
+From 6c0e9f05c9d7875995b0e92ace71be947f280bbd Mon Sep 17 00:00:00 2001
+From: Thomas Fourier <fourier.thomas@gmail.com>
+Date: Tue, 1 Jul 2025 13:34:52 +0200
+Subject: pch_uart: Fix dma_sync_sg_for_device() nents value
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+commit 6c0e9f05c9d7875995b0e92ace71be947f280bbd upstream.
+
+The dma_sync_sg_for_device() functions should be called with the same
+nents as the dma_map_sg(), not the value the map function returned
+according to the documentation in Documentation/core-api/dma-api.rst:450:
+ With the sync_sg API, all the parameters must be the same
+ as those passed into the sg mapping API.
+
+Fixes: da3564ee027e ("pch_uart: add multi-scatter processing")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20250701113452.18590-2-fourier.thomas@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/pch_uart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -967,7 +967,7 @@ static unsigned int dma_handle_tx(struct
+ __func__);
+ return 0;
+ }
+- dma_sync_sg_for_device(port->dev, priv->sg_tx_p, nent, DMA_TO_DEVICE);
++ dma_sync_sg_for_device(port->dev, priv->sg_tx_p, num, DMA_TO_DEVICE);
+ priv->desc_tx = desc;
+ desc->callback = pch_dma_tx_complete;
+ desc->callback_param = priv;
--- /dev/null
+From 24c63c590adca310e0df95c77cf7aa5552bc3fc5 Mon Sep 17 00:00:00 2001
+From: Wayne Chang <waynec@nvidia.com>
+Date: Mon, 19 May 2025 17:09:28 +0800
+Subject: phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode
+
+From: Wayne Chang <waynec@nvidia.com>
+
+commit 24c63c590adca310e0df95c77cf7aa5552bc3fc5 upstream.
+
+The logic that drives the pad calibration values resides in the
+controller reset domain and so the calibration values are only being
+captured when the controller is out of reset. However, by clearing the
+CYA_TRK_CODE_UPDATE_ON_IDLE bit, the calibration values can be set
+while the controller is in reset.
+
+The CYA_TRK_CODE_UPDATE_ON_IDLE bit was previously cleared based on the
+trk_hw_mode flag, but this dependency is not necessary. Instead,
+introduce a new flag, trk_update_on_idle, to independently control this
+bit.
+
+Fixes: d8163a32ca95 ("phy: tegra: xusb: Add Tegra234 support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Wayne Chang <waynec@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20250519090929.3132456-2-waynec@nvidia.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/tegra/xusb-tegra186.c | 14 ++++++++------
+ drivers/phy/tegra/xusb.h | 1 +
+ 2 files changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/phy/tegra/xusb-tegra186.c
++++ b/drivers/phy/tegra/xusb-tegra186.c
+@@ -648,14 +648,15 @@ static void tegra186_utmi_bias_pad_power
+ udelay(100);
+ }
+
+- if (padctl->soc->trk_hw_mode) {
+- value = padctl_readl(padctl, XUSB_PADCTL_USB2_BIAS_PAD_CTL2);
+- value |= USB2_TRK_HW_MODE;
++ value = padctl_readl(padctl, XUSB_PADCTL_USB2_BIAS_PAD_CTL2);
++ if (padctl->soc->trk_update_on_idle)
+ value &= ~CYA_TRK_CODE_UPDATE_ON_IDLE;
+- padctl_writel(padctl, value, XUSB_PADCTL_USB2_BIAS_PAD_CTL2);
+- } else {
++ if (padctl->soc->trk_hw_mode)
++ value |= USB2_TRK_HW_MODE;
++ padctl_writel(padctl, value, XUSB_PADCTL_USB2_BIAS_PAD_CTL2);
++
++ if (!padctl->soc->trk_hw_mode)
+ clk_disable_unprepare(priv->usb2_trk_clk);
+- }
+ }
+
+ static void tegra186_utmi_bias_pad_power_off(struct tegra_xusb_padctl *padctl)
+@@ -1726,6 +1727,7 @@ const struct tegra_xusb_padctl_soc tegra
+ .supports_gen2 = true,
+ .poll_trk_completed = true,
+ .trk_hw_mode = true,
++ .trk_update_on_idle = true,
+ .supports_lp_cfg_en = true,
+ };
+ EXPORT_SYMBOL_GPL(tegra234_xusb_padctl_soc);
+--- a/drivers/phy/tegra/xusb.h
++++ b/drivers/phy/tegra/xusb.h
+@@ -434,6 +434,7 @@ struct tegra_xusb_padctl_soc {
+ bool need_fake_usb3_port;
+ bool poll_trk_completed;
+ bool trk_hw_mode;
++ bool trk_update_on_idle;
+ bool supports_lp_cfg_en;
+ };
+
--- /dev/null
+From 7be54870e9bf5ed0b4fe2a23b41a630527882de5 Mon Sep 17 00:00:00 2001
+From: Haotien Hsu <haotienh@nvidia.com>
+Date: Mon, 19 May 2025 17:09:29 +0800
+Subject: phy: tegra: xusb: Disable periodic tracking on Tegra234
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Haotien Hsu <haotienh@nvidia.com>
+
+commit 7be54870e9bf5ed0b4fe2a23b41a630527882de5 upstream.
+
+Periodic calibration updates (~10µs) may overlap with transfers when
+PCIe NVMe SSD, LPDDR, and USB2 devices operate simultaneously, causing
+crosstalk on Tegra234 devices. Hence disable periodic calibration updates
+and make this a one-time calibration.
+
+Fixes: d8163a32ca95 ("phy: tegra: xusb: Add Tegra234 support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haotien Hsu <haotienh@nvidia.com>
+Signed-off-by: Wayne Chang <waynec@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20250519090929.3132456-3-waynec@nvidia.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/tegra/xusb-tegra186.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/phy/tegra/xusb-tegra186.c
++++ b/drivers/phy/tegra/xusb-tegra186.c
+@@ -1726,7 +1726,7 @@ const struct tegra_xusb_padctl_soc tegra
+ .num_supplies = ARRAY_SIZE(tegra194_xusb_padctl_supply_names),
+ .supports_gen2 = true,
+ .poll_trk_completed = true,
+- .trk_hw_mode = true,
++ .trk_hw_mode = false,
+ .trk_update_on_idle = true,
+ .supports_lp_cfg_en = true,
+ };
--- /dev/null
+From cefc1caee9dd06c69e2d807edc5949b329f52b22 Mon Sep 17 00:00:00 2001
+From: Wayne Chang <waynec@nvidia.com>
+Date: Fri, 2 May 2025 17:26:06 +0800
+Subject: phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
+
+From: Wayne Chang <waynec@nvidia.com>
+
+commit cefc1caee9dd06c69e2d807edc5949b329f52b22 upstream.
+
+When transitioning from USB_ROLE_DEVICE to USB_ROLE_NONE, the code
+assumed that the regulator should be disabled. However, if the regulator
+is marked as always-on, regulator_is_enabled() continues to return true,
+leading to an incorrect attempt to disable a regulator which is not
+enabled.
+
+This can result in warnings such as:
+
+[ 250.155624] WARNING: CPU: 1 PID: 7326 at drivers/regulator/core.c:3004
+_regulator_disable+0xe4/0x1a0
+[ 250.155652] unbalanced disables for VIN_SYS_5V0
+
+To fix this, we move the regulator control logic into
+tegra186_xusb_padctl_id_override() function since it's directly related
+to the ID override state. The regulator is now only disabled when the role
+transitions from USB_ROLE_HOST to USB_ROLE_NONE, by checking the VBUS_ID
+register. This ensures that regulator enable/disable operations are
+properly balanced and only occur when actually transitioning to/from host
+mode.
+
+Fixes: 49d46e3c7e59 ("phy: tegra: xusb: Add set_mode support for UTMI phy on Tegra186")
+Cc: stable@vger.kernel.org
+Signed-off-by: Wayne Chang <waynec@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20250502092606.2275682-1-waynec@nvidia.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/tegra/xusb-tegra186.c | 59 +++++++++++++++++++++++---------------
+ 1 file changed, 37 insertions(+), 22 deletions(-)
+
+--- a/drivers/phy/tegra/xusb-tegra186.c
++++ b/drivers/phy/tegra/xusb-tegra186.c
+@@ -782,13 +782,15 @@ static int tegra186_xusb_padctl_vbus_ove
+ }
+
+ static int tegra186_xusb_padctl_id_override(struct tegra_xusb_padctl *padctl,
+- bool status)
++ struct tegra_xusb_usb2_port *port, bool status)
+ {
+- u32 value;
++ u32 value, id_override;
++ int err = 0;
+
+ dev_dbg(padctl->dev, "%s id override\n", status ? "set" : "clear");
+
+ value = padctl_readl(padctl, USB2_VBUS_ID);
++ id_override = value & ID_OVERRIDE(~0);
+
+ if (status) {
+ if (value & VBUS_OVERRIDE) {
+@@ -799,14 +801,34 @@ static int tegra186_xusb_padctl_id_overr
+ value = padctl_readl(padctl, USB2_VBUS_ID);
+ }
+
+- value &= ~ID_OVERRIDE(~0);
+- value |= ID_OVERRIDE_GROUNDED;
++ if (id_override != ID_OVERRIDE_GROUNDED) {
++ value &= ~ID_OVERRIDE(~0);
++ value |= ID_OVERRIDE_GROUNDED;
++ padctl_writel(padctl, value, USB2_VBUS_ID);
++
++ err = regulator_enable(port->supply);
++ if (err) {
++ dev_err(padctl->dev, "Failed to enable regulator: %d\n", err);
++ return err;
++ }
++ }
+ } else {
+- value &= ~ID_OVERRIDE(~0);
+- value |= ID_OVERRIDE_FLOATING;
+- }
++ if (id_override == ID_OVERRIDE_GROUNDED) {
++ /*
++ * The regulator is disabled only when the role transitions
++ * from USB_ROLE_HOST to USB_ROLE_NONE.
++ */
++ err = regulator_disable(port->supply);
++ if (err) {
++ dev_err(padctl->dev, "Failed to disable regulator: %d\n", err);
++ return err;
++ }
+
+- padctl_writel(padctl, value, USB2_VBUS_ID);
++ value &= ~ID_OVERRIDE(~0);
++ value |= ID_OVERRIDE_FLOATING;
++ padctl_writel(padctl, value, USB2_VBUS_ID);
++ }
++ }
+
+ return 0;
+ }
+@@ -826,27 +848,20 @@ static int tegra186_utmi_phy_set_mode(st
+
+ if (mode == PHY_MODE_USB_OTG) {
+ if (submode == USB_ROLE_HOST) {
+- tegra186_xusb_padctl_id_override(padctl, true);
+-
+- err = regulator_enable(port->supply);
++ err = tegra186_xusb_padctl_id_override(padctl, port, true);
++ if (err)
++ goto out;
+ } else if (submode == USB_ROLE_DEVICE) {
+ tegra186_xusb_padctl_vbus_override(padctl, true);
+ } else if (submode == USB_ROLE_NONE) {
+- /*
+- * When port is peripheral only or role transitions to
+- * USB_ROLE_NONE from USB_ROLE_DEVICE, regulator is not
+- * enabled.
+- */
+- if (regulator_is_enabled(port->supply))
+- regulator_disable(port->supply);
+-
+- tegra186_xusb_padctl_id_override(padctl, false);
++ err = tegra186_xusb_padctl_id_override(padctl, port, false);
++ if (err)
++ goto out;
+ tegra186_xusb_padctl_vbus_override(padctl, false);
+ }
+ }
+-
++out:
+ mutex_unlock(&padctl->lock);
+-
+ return err;
+ }
+
--- /dev/null
+phy-tegra-xusb-fix-unbalanced-regulator-disable-in-utmi-phy-mode.patch
+phy-tegra-xusb-decouple-cya_trk_code_update_on_idle-from-trk_hw_mode.patch
+phy-tegra-xusb-disable-periodic-tracking-on-tegra234.patch
+usb-serial-option-add-telit-cinterion-fe910c04-ecm-composition.patch
+usb-serial-option-add-foxconn-t99w640.patch
+usb-serial-ftdi_sio-add-support-for-ndi-emguide-gemini.patch
+usb-musb-fix-gadget-state-on-disconnect.patch
+usb-gadget-configfs-fix-oob-read-on-empty-string-write.patch
+i2c-stm32-fix-the-device-used-for-the-dma-map.patch
+thunderbolt-fix-wake-on-connect-at-runtime.patch
+thunderbolt-fix-bit-masking-in-tb_dp_port_set_hops.patch
+nvmem-imx-ocotp-fix-mac-address-byte-length.patch
+input-xpad-set-correct-controller-type-for-acer-ngr200.patch
+pch_uart-fix-dma_sync_sg_for_device-nents-value.patch
+spi-add-check-for-8-bit-transfer-with-8-io-mode-support.patch
+dm-bufio-fix-sched-in-atomic-context.patch
+hid-core-ensure-the-allocated-report-buffer-can-contain-the-reserved-report-id.patch
+hid-core-ensure-__hid_request-reserves-the-report-id-as-the-first-byte.patch
+hid-core-do-not-bypass-hid_hw_raw_request.patch
+tracing-probes-avoid-using-params-uninitialized-in-parse_btf_arg.patch
+tracing-add-down_write-trace_event_sem-when-adding-trace-event.patch
+tracing-osnoise-fix-crash-in-timerlat_dump_stack.patch
--- /dev/null
+From 710505212e3272396394f8cf78e3ddfd05df3f22 Mon Sep 17 00:00:00 2001
+From: Cheng Ming Lin <chengminglin@mxic.com.tw>
+Date: Mon, 14 Jul 2025 11:10:23 +0800
+Subject: spi: Add check for 8-bit transfer with 8 IO mode support
+
+From: Cheng Ming Lin <chengminglin@mxic.com.tw>
+
+commit 710505212e3272396394f8cf78e3ddfd05df3f22 upstream.
+
+The current SPI framework does not verify if the SPI device supports
+8 IO mode when doing an 8-bit transfer. This patch adds a check to
+ensure that if the transfer tx_nbits or rx_nbits is 8, the SPI mode must
+support 8 IO. If not, an error is returned, preventing undefined behavior.
+
+Fixes: d6a711a898672 ("spi: Fix OCTAL mode support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cheng Ming Lin <chengminglin@mxic.com.tw>
+Link: https://patch.msgid.link/20250714031023.504752-1-linchengming884@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -4011,10 +4011,13 @@ static int __spi_validate(struct spi_dev
+ xfer->tx_nbits != SPI_NBITS_OCTAL)
+ return -EINVAL;
+ if ((xfer->tx_nbits == SPI_NBITS_DUAL) &&
+- !(spi->mode & (SPI_TX_DUAL | SPI_TX_QUAD)))
++ !(spi->mode & (SPI_TX_DUAL | SPI_TX_QUAD | SPI_TX_OCTAL)))
+ return -EINVAL;
+ if ((xfer->tx_nbits == SPI_NBITS_QUAD) &&
+- !(spi->mode & SPI_TX_QUAD))
++ !(spi->mode & (SPI_TX_QUAD | SPI_TX_OCTAL)))
++ return -EINVAL;
++ if ((xfer->tx_nbits == SPI_NBITS_OCTAL) &&
++ !(spi->mode & SPI_TX_OCTAL))
+ return -EINVAL;
+ }
+ /* Check transfer rx_nbits */
+@@ -4027,10 +4030,13 @@ static int __spi_validate(struct spi_dev
+ xfer->rx_nbits != SPI_NBITS_OCTAL)
+ return -EINVAL;
+ if ((xfer->rx_nbits == SPI_NBITS_DUAL) &&
+- !(spi->mode & (SPI_RX_DUAL | SPI_RX_QUAD)))
++ !(spi->mode & (SPI_RX_DUAL | SPI_RX_QUAD | SPI_RX_OCTAL)))
+ return -EINVAL;
+ if ((xfer->rx_nbits == SPI_NBITS_QUAD) &&
+- !(spi->mode & SPI_RX_QUAD))
++ !(spi->mode & (SPI_RX_QUAD | SPI_RX_OCTAL)))
++ return -EINVAL;
++ if ((xfer->rx_nbits == SPI_NBITS_OCTAL) &&
++ !(spi->mode & SPI_RX_OCTAL))
+ return -EINVAL;
+ }
+
--- /dev/null
+From 2cdde91c14ec358087f43287513946d493aef940 Mon Sep 17 00:00:00 2001
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+Date: Sun, 22 Jun 2025 10:17:02 -0700
+Subject: thunderbolt: Fix bit masking in tb_dp_port_set_hops()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+commit 2cdde91c14ec358087f43287513946d493aef940 upstream.
+
+The tb_dp_port_set_hops() function was incorrectly clearing
+ADP_DP_CS_1_AUX_RX_HOPID_MASK twice. According to the function's
+purpose, it should clear both TX and RX AUX HopID fields. Replace the
+first instance with ADP_DP_CS_1_AUX_TX_HOPID_MASK to ensure proper
+configuration of both AUX directions.
+
+Fixes: 98176380cbe5 ("thunderbolt: Convert DP adapter register names to follow the USB4 spec")
+Cc: stable@vger.kernel.org
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thunderbolt/switch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -1465,7 +1465,7 @@ int tb_dp_port_set_hops(struct tb_port *
+ return ret;
+
+ data[0] &= ~ADP_DP_CS_0_VIDEO_HOPID_MASK;
+- data[1] &= ~ADP_DP_CS_1_AUX_RX_HOPID_MASK;
++ data[1] &= ~ADP_DP_CS_1_AUX_TX_HOPID_MASK;
+ data[1] &= ~ADP_DP_CS_1_AUX_RX_HOPID_MASK;
+
+ data[0] |= (video << ADP_DP_CS_0_VIDEO_HOPID_SHIFT) &
--- /dev/null
+From 58d71d4242ce057955c783a14c82270c71f9e1e8 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Thu, 19 Jun 2025 16:38:30 -0500
+Subject: thunderbolt: Fix wake on connect at runtime
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit 58d71d4242ce057955c783a14c82270c71f9e1e8 upstream.
+
+commit 1a760d10ded37 ("thunderbolt: Fix a logic error in wake on connect")
+fixated on the USB4 port sysfs wakeup file not working properly to control
+policy, but it had an unintended side effect that the sysfs file controls
+policy both at runtime and at suspend time. The sysfs file is supposed to
+only control behavior while system is suspended.
+
+Pass whether programming a port for runtime into usb4_switch_set_wake()
+and if runtime then ignore the value in the sysfs file.
+
+Cc: stable@vger.kernel.org
+Reported-by: Alexander Kovacs <Alexander.Kovacs@amd.com>
+Tested-by: Alexander Kovacs <Alexander.Kovacs@amd.com>
+Fixes: 1a760d10ded37 ("thunderbolt: Fix a logic error in wake on connect")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thunderbolt/switch.c | 8 ++++----
+ drivers/thunderbolt/tb.h | 2 +-
+ drivers/thunderbolt/usb4.c | 12 +++++-------
+ 3 files changed, 10 insertions(+), 12 deletions(-)
+
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -3439,7 +3439,7 @@ void tb_sw_set_unplugged(struct tb_switc
+ }
+ }
+
+-static int tb_switch_set_wake(struct tb_switch *sw, unsigned int flags)
++static int tb_switch_set_wake(struct tb_switch *sw, unsigned int flags, bool runtime)
+ {
+ if (flags)
+ tb_sw_dbg(sw, "enabling wakeup: %#x\n", flags);
+@@ -3447,7 +3447,7 @@ static int tb_switch_set_wake(struct tb_
+ tb_sw_dbg(sw, "disabling wakeup\n");
+
+ if (tb_switch_is_usb4(sw))
+- return usb4_switch_set_wake(sw, flags);
++ return usb4_switch_set_wake(sw, flags, runtime);
+ return tb_lc_set_wake(sw, flags);
+ }
+
+@@ -3523,7 +3523,7 @@ int tb_switch_resume(struct tb_switch *s
+ tb_switch_check_wakes(sw);
+
+ /* Disable wakes */
+- tb_switch_set_wake(sw, 0);
++ tb_switch_set_wake(sw, 0, true);
+
+ err = tb_switch_tmu_init(sw);
+ if (err)
+@@ -3604,7 +3604,7 @@ void tb_switch_suspend(struct tb_switch
+ flags |= TB_WAKE_ON_USB4 | TB_WAKE_ON_USB3 | TB_WAKE_ON_PCIE;
+ }
+
+- tb_switch_set_wake(sw, flags);
++ tb_switch_set_wake(sw, flags, runtime);
+
+ if (tb_switch_is_usb4(sw))
+ usb4_switch_set_sleep(sw);
+--- a/drivers/thunderbolt/tb.h
++++ b/drivers/thunderbolt/tb.h
+@@ -1266,7 +1266,7 @@ int usb4_switch_read_uid(struct tb_switc
+ int usb4_switch_drom_read(struct tb_switch *sw, unsigned int address, void *buf,
+ size_t size);
+ bool usb4_switch_lane_bonding_possible(struct tb_switch *sw);
+-int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags);
++int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags, bool runtime);
+ int usb4_switch_set_sleep(struct tb_switch *sw);
+ int usb4_switch_nvm_sector_size(struct tb_switch *sw);
+ int usb4_switch_nvm_read(struct tb_switch *sw, unsigned int address, void *buf,
+--- a/drivers/thunderbolt/usb4.c
++++ b/drivers/thunderbolt/usb4.c
+@@ -405,12 +405,12 @@ bool usb4_switch_lane_bonding_possible(s
+ * usb4_switch_set_wake() - Enabled/disable wake
+ * @sw: USB4 router
+ * @flags: Wakeup flags (%0 to disable)
++ * @runtime: Wake is being programmed during system runtime
+ *
+ * Enables/disables router to wake up from sleep.
+ */
+-int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags)
++int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags, bool runtime)
+ {
+- struct usb4_port *usb4;
+ struct tb_port *port;
+ u64 route = tb_route(sw);
+ u32 val;
+@@ -440,13 +440,11 @@ int usb4_switch_set_wake(struct tb_switc
+ val |= PORT_CS_19_WOU4;
+ } else {
+ bool configured = val & PORT_CS_19_PC;
+- usb4 = port->usb4;
++ bool wakeup = runtime || device_may_wakeup(&port->usb4->dev);
+
+- if (((flags & TB_WAKE_ON_CONNECT) &&
+- device_may_wakeup(&usb4->dev)) && !configured)
++ if ((flags & TB_WAKE_ON_CONNECT) && wakeup && !configured)
+ val |= PORT_CS_19_WOC;
+- if (((flags & TB_WAKE_ON_DISCONNECT) &&
+- device_may_wakeup(&usb4->dev)) && configured)
++ if ((flags & TB_WAKE_ON_DISCONNECT) && wakeup && configured)
+ val |= PORT_CS_19_WOD;
+ if ((flags & TB_WAKE_ON_USB4) && configured)
+ val |= PORT_CS_19_WOU4;
--- /dev/null
+From b5e8acc14dcb314a9b61ff19dcd9fdd0d88f70df Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <rostedt@goodmis.org>
+Date: Fri, 18 Jul 2025 22:31:58 -0400
+Subject: tracing: Add down_write(trace_event_sem) when adding trace event
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Steven Rostedt <rostedt@goodmis.org>
+
+commit b5e8acc14dcb314a9b61ff19dcd9fdd0d88f70df upstream.
+
+When a module is loaded, it adds trace events defined by the module. It
+may also need to modify the modules trace printk formats to replace enum
+names with their values.
+
+If two modules are loaded at the same time, the adding of the event to the
+ftrace_events list can corrupt the walking of the list in the code that is
+modifying the printk format strings and crash the kernel.
+
+The addition of the event should take the trace_event_sem for write while
+it adds the new event.
+
+Also add a lockdep_assert_held() on that semaphore in
+__trace_add_event_dirs() as it iterates the list.
+
+Cc: stable@vger.kernel.org
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Link: https://lore.kernel.org/20250718223158.799bfc0c@batman.local.home
+Reported-by: Fusheng Huang(黄富生) <Fusheng.Huang@luxshare-ict.com>
+Closes: https://lore.kernel.org/all/20250717105007.46ccd18f@batman.local.home/
+Fixes: 110bf2b764eb6 ("tracing: add protection around module events unload")
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_events.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -2845,7 +2845,10 @@ __register_event(struct trace_event_call
+ if (ret < 0)
+ return ret;
+
++ down_write(&trace_event_sem);
+ list_add(&call->list, &ftrace_events);
++ up_write(&trace_event_sem);
++
+ if (call->flags & TRACE_EVENT_FL_DYNAMIC)
+ atomic_set(&call->refcnt, 0);
+ else
+@@ -3437,6 +3440,8 @@ __trace_add_event_dirs(struct trace_arra
+ struct trace_event_call *call;
+ int ret;
+
++ lockdep_assert_held(&trace_event_sem);
++
+ list_for_each_entry(call, &ftrace_events, list) {
+ ret = __trace_add_new_event(call, tr);
+ if (ret < 0)
--- /dev/null
+From 85a3bce695b361d85fc528e6fbb33e4c8089c806 Mon Sep 17 00:00:00 2001
+From: Tomas Glozar <tglozar@redhat.com>
+Date: Wed, 16 Jul 2025 16:36:01 +0200
+Subject: tracing/osnoise: Fix crash in timerlat_dump_stack()
+
+From: Tomas Glozar <tglozar@redhat.com>
+
+commit 85a3bce695b361d85fc528e6fbb33e4c8089c806 upstream.
+
+We have observed kernel panics when using timerlat with stack saving,
+with the following dmesg output:
+
+memcpy: detected buffer overflow: 88 byte write of buffer size 0
+WARNING: CPU: 2 PID: 8153 at lib/string_helpers.c:1032 __fortify_report+0x55/0xa0
+CPU: 2 UID: 0 PID: 8153 Comm: timerlatu/2 Kdump: loaded Not tainted 6.15.3-200.fc42.x86_64 #1 PREEMPT(lazy)
+Call Trace:
+ <TASK>
+ ? trace_buffer_lock_reserve+0x2a/0x60
+ __fortify_panic+0xd/0xf
+ __timerlat_dump_stack.cold+0xd/0xd
+ timerlat_dump_stack.part.0+0x47/0x80
+ timerlat_fd_read+0x36d/0x390
+ vfs_read+0xe2/0x390
+ ? syscall_exit_to_user_mode+0x1d5/0x210
+ ksys_read+0x73/0xe0
+ do_syscall_64+0x7b/0x160
+ ? exc_page_fault+0x7e/0x1a0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+__timerlat_dump_stack() constructs the ftrace stack entry like this:
+
+struct stack_entry *entry;
+...
+memcpy(&entry->caller, fstack->calls, size);
+entry->size = fstack->nr_entries;
+
+Since commit e7186af7fb26 ("tracing: Add back FORTIFY_SOURCE logic to
+kernel_stack event structure"), struct stack_entry marks its caller
+field with __counted_by(size). At the time of the memcpy, entry->size
+contains garbage from the ringbuffer, which under some circumstances is
+zero, triggering a kernel panic by buffer overflow.
+
+Populate the size field before the memcpy so that the out-of-bounds
+check knows the correct size. This is analogous to
+__ftrace_trace_stack().
+
+Cc: stable@vger.kernel.org
+Cc: John Kacur <jkacur@redhat.com>
+Cc: Luis Goncalves <lgoncalv@redhat.com>
+Cc: Attila Fazekas <afazekas@redhat.com>
+Link: https://lore.kernel.org/20250716143601.7313-1-tglozar@redhat.com
+Fixes: e7186af7fb26 ("tracing: Add back FORTIFY_SOURCE logic to kernel_stack event structure")
+Signed-off-by: Tomas Glozar <tglozar@redhat.com>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_osnoise.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_osnoise.c
++++ b/kernel/trace/trace_osnoise.c
+@@ -665,8 +665,8 @@ __timerlat_dump_stack(struct trace_buffe
+
+ entry = ring_buffer_event_data(event);
+
+- memcpy(&entry->caller, fstack->calls, size);
+ entry->size = fstack->nr_entries;
++ memcpy(&entry->caller, fstack->calls, size);
+
+ if (!call_filter_check_discard(call, entry, buffer, event))
+ trace_buffer_unlock_commit_nostack(buffer, event);
--- /dev/null
+From 1ed171a3afe81531b3ace96bd151a372dda3ee25 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Tue, 15 Jul 2025 20:19:44 -0700
+Subject: tracing/probes: Avoid using params uninitialized in parse_btf_arg()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 1ed171a3afe81531b3ace96bd151a372dda3ee25 upstream.
+
+After a recent change in clang to strengthen uninitialized warnings [1],
+it points out that in one of the error paths in parse_btf_arg(), params
+is used uninitialized:
+
+ kernel/trace/trace_probe.c:660:19: warning: variable 'params' is uninitialized when used here [-Wuninitialized]
+ 660 | return PTR_ERR(params);
+ | ^~~~~~
+
+Match many other NO_BTF_ENTRY error cases and return -ENOENT, clearing
+up the warning.
+
+Link: https://lore.kernel.org/all/20250715-trace_probe-fix-const-uninit-warning-v1-1-98960f91dd04@kernel.org/
+
+Cc: stable@vger.kernel.org
+Closes: https://github.com/ClangBuiltLinux/linux/issues/2110
+Fixes: d157d7694460 ("tracing/probes: Support BTF field access from $retval")
+Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_probe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_probe.c
++++ b/kernel/trace/trace_probe.c
+@@ -656,7 +656,7 @@ static int parse_btf_arg(char *varname,
+ ret = query_btf_context(ctx);
+ if (ret < 0 || ctx->nr_params == 0) {
+ trace_probe_log_err(ctx->offset, NO_BTF_ENTRY);
+- return PTR_ERR(params);
++ return -ENOENT;
+ }
+ }
+ params = ctx->params;
--- /dev/null
+From 3014168731b7930300aab656085af784edc861f6 Mon Sep 17 00:00:00 2001
+From: Xinyu Liu <1171169449@qq.com>
+Date: Wed, 9 Jul 2025 11:55:33 +0800
+Subject: usb: gadget: configfs: Fix OOB read on empty string write
+
+From: Xinyu Liu <1171169449@qq.com>
+
+commit 3014168731b7930300aab656085af784edc861f6 upstream.
+
+When writing an empty string to either 'qw_sign' or 'landingPage'
+sysfs attributes, the store functions attempt to access page[l - 1]
+before validating that the length 'l' is greater than zero.
+
+This patch fixes the vulnerability by adding a check at the beginning
+of os_desc_qw_sign_store() and webusb_landingPage_store() to handle
+the zero-length input case gracefully by returning immediately.
+
+Signed-off-by: Xinyu Liu <katieeliu@tencent.com>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/tencent_B1C9481688D0E95E7362AB2E999DE8048207@qq.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/configfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1062,6 +1062,8 @@ static ssize_t webusb_landingPage_store(
+ unsigned int bytes_to_strip = 0;
+ int l = len;
+
++ if (!len)
++ return len;
+ if (page[l - 1] == '\n') {
+ --l;
+ ++bytes_to_strip;
+@@ -1185,6 +1187,8 @@ static ssize_t os_desc_qw_sign_store(str
+ struct gadget_info *gi = os_desc_item_to_gadget_info(item);
+ int res, l;
+
++ if (!len)
++ return len;
+ l = min((int)len, OS_STRING_QW_SIGN_LEN >> 1);
+ if (page[l - 1] == '\n')
+ --l;
--- /dev/null
+From 67a59f82196c8c4f50c83329f0577acfb1349b50 Mon Sep 17 00:00:00 2001
+From: Drew Hamilton <drew.hamilton@zetier.com>
+Date: Tue, 1 Jul 2025 11:41:26 -0400
+Subject: usb: musb: fix gadget state on disconnect
+
+From: Drew Hamilton <drew.hamilton@zetier.com>
+
+commit 67a59f82196c8c4f50c83329f0577acfb1349b50 upstream.
+
+When unplugging the USB cable or disconnecting a gadget in usb peripheral mode with
+echo "" > /sys/kernel/config/usb_gadget/<your_gadget>/UDC,
+/sys/class/udc/musb-hdrc.0/state does not change from USB_STATE_CONFIGURED.
+
+Testing on dwc2/3 shows they both update the state to USB_STATE_NOTATTACHED.
+
+Add calls to usb_gadget_set_state in musb_g_disconnect and musb_gadget_stop
+to fix both cases.
+
+Fixes: 49401f4169c0 ("usb: gadget: introduce gadget state tracking")
+Cc: stable@vger.kernel.org
+Co-authored-by: Yehowshua Immanuel <yehowshua.immanuel@twosixtech.com>
+Signed-off-by: Yehowshua Immanuel <yehowshua.immanuel@twosixtech.com>
+Signed-off-by: Drew Hamilton <drew.hamilton@zetier.com>
+Link: https://lore.kernel.org/r/20250701154126.8543-1-drew.hamilton@zetier.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/musb/musb_gadget.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/musb/musb_gadget.c
++++ b/drivers/usb/musb/musb_gadget.c
+@@ -1925,6 +1925,7 @@ static int musb_gadget_stop(struct usb_g
+ * gadget driver here and have everything work;
+ * that currently misbehaves.
+ */
++ usb_gadget_set_state(g, USB_STATE_NOTATTACHED);
+
+ /* Force check of devctl register for PM runtime */
+ pm_runtime_mark_last_busy(musb->controller);
+@@ -2031,6 +2032,7 @@ void musb_g_disconnect(struct musb *musb
+ case OTG_STATE_B_PERIPHERAL:
+ case OTG_STATE_B_IDLE:
+ musb_set_state(musb, OTG_STATE_B_IDLE);
++ usb_gadget_set_state(&musb->g, USB_STATE_NOTATTACHED);
+ break;
+ case OTG_STATE_B_SRP_INIT:
+ break;
--- /dev/null
+From c980666b6958d9a841597331b38115a29a32250e Mon Sep 17 00:00:00 2001
+From: "Ryan Mann (NDI)" <rmann@ndigital.com>
+Date: Thu, 10 Jul 2025 13:08:00 +0000
+Subject: USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
+
+From: Ryan Mann (NDI) <rmann@ndigital.com>
+
+commit c980666b6958d9a841597331b38115a29a32250e upstream.
+
+NDI (Northern Digital Inc.) is introducing a new product called the
+EMGUIDE GEMINI that will use an FTDI chip for USB serial communications.
+Add the NDI EMGUIDE GEMINI product ID that uses the NDI Vendor ID
+rather than the FTDI Vendor ID, unlike older products.
+
+Signed-off-by: Ryan Mann <rmann@ndigital.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 3 +++
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -803,6 +803,8 @@ static const struct usb_device_id id_tab
+ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
++ { USB_DEVICE(FTDI_NDI_VID, FTDI_NDI_EMGUIDE_GEMINI_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
+ { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) },
+ { USB_DEVICE(FTDI_VID, RTSYSTEMS_USB_VX8_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -204,6 +204,9 @@
+ #define FTDI_NDI_FUTURE_3_PID 0xDA73 /* NDI future device #3 */
+ #define FTDI_NDI_AURORA_SCU_PID 0xDA74 /* NDI Aurora SCU */
+
++#define FTDI_NDI_VID 0x23F2
++#define FTDI_NDI_EMGUIDE_GEMINI_PID 0x0003 /* NDI Emguide Gemini */
++
+ /*
+ * ChamSys Limited (www.chamsys.co.uk) USB wing/interface product IDs
+ */
--- /dev/null
+From 08f49cdb71f3759368fded4dbc9dde35a404ec2b Mon Sep 17 00:00:00 2001
+From: Slark Xiao <slark_xiao@163.com>
+Date: Fri, 20 Jun 2025 11:57:21 +0800
+Subject: USB: serial: option: add Foxconn T99W640
+
+From: Slark Xiao <slark_xiao@163.com>
+
+commit 08f49cdb71f3759368fded4dbc9dde35a404ec2b upstream.
+
+T99W640 is designed based on Qualconn SDX72 chip. There are 3
+serial ports to be enumerated: Diag, NMEA and AT.
+
+Test evidence as below:
+T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
+D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1
+P: Vendor=0489 ProdID=e167 Rev=05.15
+S: Manufacturer=QCOM
+S: Product=SDXPINNL USB WWAN Adapter
+S: SerialNumber=cc1f1d92
+C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag
+
+Signed-off-by: Slark Xiao <slark_xiao@163.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2346,6 +2346,8 @@ static const struct usb_device_id option
+ .driver_info = RSVD(3) },
+ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */
+ .driver_info = RSVD(5) | RSVD(6) },
++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe167, 0xff), /* Foxconn T99W640 MBIM */
++ .driver_info = RSVD(3) },
+ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */
+ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
+ { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */
--- /dev/null
+From 252f4ac08cd2f16ecd20e4c5e41ac2a17dd86942 Mon Sep 17 00:00:00 2001
+From: Fabio Porcedda <fabio.porcedda@gmail.com>
+Date: Thu, 10 Jul 2025 14:16:38 +0200
+Subject: USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
+
+From: Fabio Porcedda <fabio.porcedda@gmail.com>
+
+commit 252f4ac08cd2f16ecd20e4c5e41ac2a17dd86942 upstream.
+
+Add Telit Cinterion FE910C04 (ECM) composition:
+0x10c7: ECM + tty (AT) + tty (AT) + tty (diag)
+
+usb-devices output:
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=10c7 Rev=05.15
+S: Manufacturer=Telit Cinterion
+S: Product=FE910
+S: SerialNumber=f71b8b32
+C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1415,6 +1415,9 @@ static const struct usb_device_id option
+ .driver_info = NCTRL(5) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */
++ .driver_info = NCTRL(4) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */
+ .driver_info = NCTRL(6) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) },
projects / thirdparty / kernel / stable-queue.git / commitdiff
