From: Greg Kroah-Hartman Date: Mon, 21 Jul 2025 10:18:52 +0000 (+0200) Subject: 6.15-stable patches X-Git-Tag: v6.1.147~80 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=068c9dd9f0f09d33c927b8b9a9a7a747e624638a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.15-stable patches added patches: dm-bufio-fix-sched-in-atomic-context.patch hid-core-do-not-bypass-hid_hw_raw_request.patch hid-core-ensure-__hid_request-reserves-the-report-id-as-the-first-byte.patch hid-core-ensure-the-allocated-report-buffer-can-contain-the-reserved-report-id.patch i2c-omap-fix-an-error-handling-path-in-omap_i2c_probe.patch i2c-omap-handle-omap_i2c_init-errors-in-omap_i2c_probe.patch i2c-stm32-fix-the-device-used-for-the-dma-map.patch i2c-stm32f7-unmap-dma-mapped-buffer.patch input-xpad-set-correct-controller-type-for-acer-ngr200.patch nvmem-imx-ocotp-fix-mac-address-byte-length.patch nvmem-layouts-u-boot-env-remove-crc32-endianness-conversion.patch objtool-rust-add-one-more-noreturn-rust-function-for-rust-1.89.0.patch pch_uart-fix-dma_sync_sg_for_device-nents-value.patch phy-tegra-xusb-decouple-cya_trk_code_update_on_idle-from-trk_hw_mode.patch phy-tegra-xusb-disable-periodic-tracking-on-tegra234.patch phy-tegra-xusb-fix-unbalanced-regulator-disable-in-utmi-phy-mode.patch revert-staging-vchiq_arm-create-keep-alive-thread-during-probe.patch revert-staging-vchiq_arm-improve-initial-vchiq-connect.patch rust-init-fix-generics-in-_init-macros.patch series spi-add-check-for-8-bit-transfer-with-8-io-mode-support.patch thunderbolt-fix-bit-masking-in-tb_dp_port_set_hops.patch thunderbolt-fix-wake-on-connect-at-runtime.patch tools-hv-fcopy-fix-irregularities-with-size-of-ring-buffer.patch tracing-add-down_write-trace_event_sem-when-adding-trace-event.patch tracing-osnoise-fix-crash-in-timerlat_dump_stack.patch tracing-probes-avoid-using-params-uninitialized-in-parse_btf_arg.patch usb-dwc2-gadget-fix-enter-to-hibernation-for-utmi-phy.patch usb-gadget-configfs-fix-oob-read-on-empty-string-write.patch usb-musb-fix-gadget-state-on-disconnect.patch usb-serial-ftdi_sio-add-support-for-ndi-emguide-gemini.patch usb-serial-option-add-foxconn-t99w640.patch usb-serial-option-add-telit-cinterion-fe910c04-ecm-composition.patch --- diff --git a/queue-6.15/dm-bufio-fix-sched-in-atomic-context.patch b/queue-6.15/dm-bufio-fix-sched-in-atomic-context.patch new file mode 100644 index 0000000000..ef0c941387 --- /dev/null +++ b/queue-6.15/dm-bufio-fix-sched-in-atomic-context.patch @@ -0,0 +1,74 @@ +From b1bf1a782fdf5c482215c0c661b5da98b8e75773 Mon Sep 17 00:00:00 2001 +From: Sheng Yong +Date: Thu, 10 Jul 2025 14:48:55 +0800 +Subject: dm-bufio: fix sched in atomic context + +From: Sheng Yong + +commit b1bf1a782fdf5c482215c0c661b5da98b8e75773 upstream. + +If "try_verify_in_tasklet" is set for dm-verity, DM_BUFIO_CLIENT_NO_SLEEP +is enabled for dm-bufio. However, when bufio tries to evict buffers, there +is a chance to trigger scheduling in spin_lock_bh, the following warning +is hit: + +BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2745 +in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 123, name: kworker/2:2 +preempt_count: 201, expected: 0 +RCU nest depth: 0, expected: 0 +4 locks held by kworker/2:2/123: + #0: ffff88800a2d1548 ((wq_completion)dm_bufio_cache){....}-{0:0}, at: process_one_work+0xe46/0x1970 + #1: ffffc90000d97d20 ((work_completion)(&dm_bufio_replacement_work)){....}-{0:0}, at: process_one_work+0x763/0x1970 + #2: ffffffff8555b528 (dm_bufio_clients_lock){....}-{3:3}, at: do_global_cleanup+0x1ce/0x710 + #3: ffff88801d5820b8 (&c->spinlock){....}-{2:2}, at: do_global_cleanup+0x2a5/0x710 +Preemption disabled at: +[<0000000000000000>] 0x0 +CPU: 2 UID: 0 PID: 123 Comm: kworker/2:2 Not tainted 6.16.0-rc3-g90548c634bd0 #305 PREEMPT(voluntary) +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 +Workqueue: dm_bufio_cache do_global_cleanup +Call Trace: + + dump_stack_lvl+0x53/0x70 + __might_resched+0x360/0x4e0 + do_global_cleanup+0x2f5/0x710 + process_one_work+0x7db/0x1970 + worker_thread+0x518/0xea0 + kthread+0x359/0x690 + ret_from_fork+0xf3/0x1b0 + ret_from_fork_asm+0x1a/0x30 + + +That can be reproduced by: + + veritysetup format --data-block-size=4096 --hash-block-size=4096 /dev/vda /dev/vdb + SIZE=$(blockdev --getsz /dev/vda) + dmsetup create myverity -r --table "0 $SIZE verity 1 /dev/vda /dev/vdb 4096 4096 1 sha256 1 try_verify_in_tasklet" + mount /dev/dm-0 /mnt -o ro + echo 102400 > /sys/module/dm_bufio/parameters/max_cache_size_bytes + [read files in /mnt] + +Cc: stable@vger.kernel.org # v6.4+ +Fixes: 450e8dee51aa ("dm bufio: improve concurrent IO performance") +Signed-off-by: Wang Shuai +Signed-off-by: Sheng Yong +Signed-off-by: Mikulas Patocka +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-bufio.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/md/dm-bufio.c ++++ b/drivers/md/dm-bufio.c +@@ -2750,7 +2750,11 @@ static unsigned long __evict_many(struct + __make_buffer_clean(b); + __free_buffer_wake(b); + +- cond_resched(); ++ if (need_resched()) { ++ dm_bufio_unlock(c); ++ cond_resched(); ++ dm_bufio_lock(c); ++ } + } + + return count; diff --git a/queue-6.15/hid-core-do-not-bypass-hid_hw_raw_request.patch b/queue-6.15/hid-core-do-not-bypass-hid_hw_raw_request.patch new file mode 100644 index 0000000000..4316191592 --- /dev/null +++ b/queue-6.15/hid-core-do-not-bypass-hid_hw_raw_request.patch @@ -0,0 +1,35 @@ +From c2ca42f190b6714d6c481dfd3d9b62ea091c946b Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Thu, 10 Jul 2025 16:01:35 +0200 +Subject: HID: core: do not bypass hid_hw_raw_request + +From: Benjamin Tissoires + +commit c2ca42f190b6714d6c481dfd3d9b62ea091c946b upstream. + +hid_hw_raw_request() is actually useful to ensure the provided buffer +and length are valid. Directly calling in the low level transport driver +function bypassed those checks and allowed invalid paramto be used. + +Reported-by: Alan Stern +Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/ +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250710-report-size-null-v2-3-ccf922b7c4e5@kernel.org +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1996,8 +1996,7 @@ int __hid_request(struct hid_device *hid + if (reqtype == HID_REQ_SET_REPORT) + hid_output_report(report, data_buf); + +- ret = hid->ll_driver->raw_request(hid, report->id, buf, len, +- report->type, reqtype); ++ ret = hid_hw_raw_request(hid, report->id, buf, len, report->type, reqtype); + if (ret < 0) { + dbg_hid("unable to complete request: %d\n", ret); + goto out; diff --git a/queue-6.15/hid-core-ensure-__hid_request-reserves-the-report-id-as-the-first-byte.patch b/queue-6.15/hid-core-ensure-__hid_request-reserves-the-report-id-as-the-first-byte.patch new file mode 100644 index 0000000000..e2df3d66a4 --- /dev/null +++ b/queue-6.15/hid-core-ensure-__hid_request-reserves-the-report-id-as-the-first-byte.patch @@ -0,0 +1,82 @@ +From 0d0777ccaa2d46609d05b66ba0096802a2746193 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Thu, 10 Jul 2025 16:01:34 +0200 +Subject: HID: core: ensure __hid_request reserves the report ID as the first byte + +From: Benjamin Tissoires + +commit 0d0777ccaa2d46609d05b66ba0096802a2746193 upstream. + +The low level transport driver expects the first byte to be the report +ID, even when the report ID is not use (in which case they just shift +the buffer). + +However, __hid_request() whas not offsetting the buffer it used by one +in this case, meaning that the raw_request() callback emitted by the +transport driver would be stripped of the first byte. + +Note: this changes the API for uhid devices when a request is made +through hid_hw_request. However, several considerations makes me think +this is fine: +- every request to a HID device made through hid_hw_request() would see + that change, but every request made through hid_hw_raw_request() + already has the new behaviour. So that means that the users are + already facing situations where they might have or not the first byte + being the null report ID when it is 0. We are making things more + straightforward in the end. +- uhid is mainly used for BLE devices +- uhid is also used for testing, but I don't see that change a big issue +- for BLE devices, we can check which kernel module is calling + hid_hw_request() +- and in those modules, we can check which are using a Bluetooth device +- and then we can check if the command is used with a report ID or not. +- surprise: none of the kernel module are using a report ID 0 +- and finally, bluez, in its function set_report()[0], does the same + shift if the report ID is 0 and the given buffer has a size > 0. + +[0] https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/profiles/input/hog-lib.c#n879 + +Reported-by: Alan Stern +Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/ +Reported-by: syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43 +Tested-by: syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com +Fixes: 4fa5a7f76cc7 ("HID: core: implement generic .request()") +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250710-report-size-null-v2-2-ccf922b7c4e5@kernel.org +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-core.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1976,7 +1976,7 @@ static struct hid_report *hid_get_report + int __hid_request(struct hid_device *hid, struct hid_report *report, + enum hid_class_request reqtype) + { +- char *buf; ++ char *buf, *data_buf; + int ret; + u32 len; + +@@ -1984,10 +1984,17 @@ int __hid_request(struct hid_device *hid + if (!buf) + return -ENOMEM; + ++ data_buf = buf; + len = hid_report_len(report); + ++ if (report->id == 0) { ++ /* reserve the first byte for the report ID */ ++ data_buf++; ++ len++; ++ } ++ + if (reqtype == HID_REQ_SET_REPORT) +- hid_output_report(report, buf); ++ hid_output_report(report, data_buf); + + ret = hid->ll_driver->raw_request(hid, report->id, buf, len, + report->type, reqtype); diff --git a/queue-6.15/hid-core-ensure-the-allocated-report-buffer-can-contain-the-reserved-report-id.patch b/queue-6.15/hid-core-ensure-the-allocated-report-buffer-can-contain-the-reserved-report-id.patch new file mode 100644 index 0000000000..cd5f6cae09 --- /dev/null +++ b/queue-6.15/hid-core-ensure-the-allocated-report-buffer-can-contain-the-reserved-report-id.patch @@ -0,0 +1,41 @@ +From 4f15ee98304b96e164ff2340e1dfd6181c3f42aa Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Thu, 10 Jul 2025 16:01:33 +0200 +Subject: HID: core: ensure the allocated report buffer can contain the reserved report ID + +From: Benjamin Tissoires + +commit 4f15ee98304b96e164ff2340e1dfd6181c3f42aa upstream. + +When the report ID is not used, the low level transport drivers expect +the first byte to be 0. However, currently the allocated buffer not +account for that extra byte, meaning that instead of having 8 guaranteed +bytes for implement to be working, we only have 7. + +Reported-by: Alan Stern +Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/ +Cc: stable@vger.kernel.org +Suggested-by: Alan Stern +Link: https://patch.msgid.link/20250710-report-size-null-v2-1-ccf922b7c4e5@kernel.org +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1883,9 +1883,12 @@ u8 *hid_alloc_report_buf(struct hid_repo + /* + * 7 extra bytes are necessary to achieve proper functionality + * of implement() working on 8 byte chunks ++ * 1 extra byte for the report ID if it is null (not used) so ++ * we can reserve that extra byte in the first position of the buffer ++ * when sending it to .raw_request() + */ + +- u32 len = hid_report_len(report) + 7; ++ u32 len = hid_report_len(report) + 7 + (report->id == 0); + + return kzalloc(len, flags); + } diff --git a/queue-6.15/i2c-omap-fix-an-error-handling-path-in-omap_i2c_probe.patch b/queue-6.15/i2c-omap-fix-an-error-handling-path-in-omap_i2c_probe.patch new file mode 100644 index 0000000000..17fbe7bf66 --- /dev/null +++ b/queue-6.15/i2c-omap-fix-an-error-handling-path-in-omap_i2c_probe.patch @@ -0,0 +1,39 @@ +From 60c016afccac7acb78a43b9c75480887ed3ce48e Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sat, 5 Jul 2025 09:57:38 +0200 +Subject: i2c: omap: Fix an error handling path in omap_i2c_probe() + +From: Christophe JAILLET + +commit 60c016afccac7acb78a43b9c75480887ed3ce48e upstream. + +If an error occurs after pm_runtime_use_autosuspend(), a corresponding +pm_runtime_dont_use_autosuspend() should be called. + +In case of error in pm_runtime_resume_and_get(), it is not the case because +the error handling path is wrongly ordered. +Fix it. + +Fixes: 780f62974125 ("i2c: omap: fix reference leak when pm_runtime_get_sync fails") +Signed-off-by: Christophe JAILLET +Cc: # v5.13+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/af8a9b62996bebbaaa7c02986aa2a8325ef11596.1751701715.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-omap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-omap.c ++++ b/drivers/i2c/busses/i2c-omap.c +@@ -1521,9 +1521,9 @@ err_mux_state_deselect: + if (omap->mux_state) + mux_state_deselect(omap->mux_state); + err_put_pm: +- pm_runtime_dont_use_autosuspend(omap->dev); + pm_runtime_put_sync(omap->dev); + err_disable_pm: ++ pm_runtime_dont_use_autosuspend(omap->dev); + pm_runtime_disable(&pdev->dev); + + return r; diff --git a/queue-6.15/i2c-omap-handle-omap_i2c_init-errors-in-omap_i2c_probe.patch b/queue-6.15/i2c-omap-handle-omap_i2c_init-errors-in-omap_i2c_probe.patch new file mode 100644 index 0000000000..1bbac56503 --- /dev/null +++ b/queue-6.15/i2c-omap-handle-omap_i2c_init-errors-in-omap_i2c_probe.patch @@ -0,0 +1,42 @@ +From a9503a2ecd95e23d7243bcde7138192de8c1c281 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sat, 5 Jul 2025 09:57:37 +0200 +Subject: i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() + +From: Christophe JAILLET + +commit a9503a2ecd95e23d7243bcde7138192de8c1c281 upstream. + +omap_i2c_init() can fail. Handle this error in omap_i2c_probe(). + +Fixes: 010d442c4a29 ("i2c: New bus driver for TI OMAP boards") +Signed-off-by: Christophe JAILLET +Cc: # v2.6.19+ +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/565311abf9bafd7291ca82bcecb48c1fac1e727b.1751701715.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-omap.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-omap.c ++++ b/drivers/i2c/busses/i2c-omap.c +@@ -1472,7 +1472,9 @@ omap_i2c_probe(struct platform_device *p + } + + /* reset ASAP, clearing any IRQs */ +- omap_i2c_init(omap); ++ r = omap_i2c_init(omap); ++ if (r) ++ goto err_mux_state_deselect; + + if (omap->rev < OMAP_I2C_OMAP1_REV_2) + r = devm_request_irq(&pdev->dev, omap->irq, omap_i2c_omap1_isr, +@@ -1515,6 +1517,7 @@ omap_i2c_probe(struct platform_device *p + + err_unuse_clocks: + omap_i2c_write_reg(omap, OMAP_I2C_CON_REG, 0); ++err_mux_state_deselect: + if (omap->mux_state) + mux_state_deselect(omap->mux_state); + err_put_pm: diff --git a/queue-6.15/i2c-stm32-fix-the-device-used-for-the-dma-map.patch b/queue-6.15/i2c-stm32-fix-the-device-used-for-the-dma-map.patch new file mode 100644 index 0000000000..cfa893cb36 --- /dev/null +++ b/queue-6.15/i2c-stm32-fix-the-device-used-for-the-dma-map.patch @@ -0,0 +1,77 @@ +From c870cbbd71fccda71d575f0acd4a8d2b7cd88861 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Cl=C3=A9ment=20Le=20Goffic?= +Date: Fri, 4 Jul 2025 10:39:14 +0200 +Subject: i2c: stm32: fix the device used for the DMA map +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Le Goffic + +commit c870cbbd71fccda71d575f0acd4a8d2b7cd88861 upstream. + +If the DMA mapping failed, it produced an error log with the wrong +device name: +"stm32-dma3 40400000.dma-controller: rejecting DMA map of vmalloc memory" +Fix this issue by replacing the dev with the I2C dev. + +Fixes: bb8822cbbc53 ("i2c: i2c-stm32: Add generic DMA API") +Signed-off-by: Clément Le Goffic +Cc: # v4.18+ +Acked-by: Alain Volmat +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250704-i2c-upstream-v4-1-84a095a2c728@foss.st.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-stm32.c | 8 +++----- + drivers/i2c/busses/i2c-stm32f7.c | 4 ++-- + 2 files changed, 5 insertions(+), 7 deletions(-) + +--- a/drivers/i2c/busses/i2c-stm32.c ++++ b/drivers/i2c/busses/i2c-stm32.c +@@ -102,7 +102,6 @@ int stm32_i2c_prep_dma_xfer(struct devic + void *dma_async_param) + { + struct dma_async_tx_descriptor *txdesc; +- struct device *chan_dev; + int ret; + + if (rd_wr) { +@@ -116,11 +115,10 @@ int stm32_i2c_prep_dma_xfer(struct devic + } + + dma->dma_len = len; +- chan_dev = dma->chan_using->device->dev; + +- dma->dma_buf = dma_map_single(chan_dev, buf, dma->dma_len, ++ dma->dma_buf = dma_map_single(dev, buf, dma->dma_len, + dma->dma_data_dir); +- if (dma_mapping_error(chan_dev, dma->dma_buf)) { ++ if (dma_mapping_error(dev, dma->dma_buf)) { + dev_err(dev, "DMA mapping failed\n"); + return -EINVAL; + } +@@ -150,7 +148,7 @@ int stm32_i2c_prep_dma_xfer(struct devic + return 0; + + err: +- dma_unmap_single(chan_dev, dma->dma_buf, dma->dma_len, ++ dma_unmap_single(dev, dma->dma_buf, dma->dma_len, + dma->dma_data_dir); + return ret; + } +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -741,10 +741,10 @@ static void stm32f7_i2c_dma_callback(voi + { + struct stm32f7_i2c_dev *i2c_dev = (struct stm32f7_i2c_dev *)arg; + struct stm32_i2c_dma *dma = i2c_dev->dma; +- struct device *dev = dma->chan_using->device->dev; + + stm32f7_i2c_disable_dma_req(i2c_dev); +- dma_unmap_single(dev, dma->dma_buf, dma->dma_len, dma->dma_data_dir); ++ dma_unmap_single(i2c_dev->dev, dma->dma_buf, dma->dma_len, ++ dma->dma_data_dir); + complete(&dma->dma_complete); + } + diff --git a/queue-6.15/i2c-stm32f7-unmap-dma-mapped-buffer.patch b/queue-6.15/i2c-stm32f7-unmap-dma-mapped-buffer.patch new file mode 100644 index 0000000000..cf82d988a2 --- /dev/null +++ b/queue-6.15/i2c-stm32f7-unmap-dma-mapped-buffer.patch @@ -0,0 +1,105 @@ +From 6aae87fe7f180cd93a74466cdb6cf2aa9bb28798 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Cl=C3=A9ment=20Le=20Goffic?= +Date: Fri, 4 Jul 2025 10:39:15 +0200 +Subject: i2c: stm32f7: unmap DMA mapped buffer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Le Goffic + +commit 6aae87fe7f180cd93a74466cdb6cf2aa9bb28798 upstream. + +Before each I2C transfer using DMA, the I2C buffer is DMA'pped to make +sure the memory buffer is DMA'able. This is handle in the function +`stm32_i2c_prep_dma_xfer()`. +If the transfer fails for any reason the I2C buffer must be unmap. +Use the dma_callback to factorize the code and fix this issue. + +Note that the `stm32f7_i2c_dma_callback()` is now called in case of DMA +transfer success and error and that the `complete()` on the dma_complete +completion structure is done inconditionnally in case of transfer +success or error as well as the `dmaengine_terminate_async()`. +This is allowed as a `complete()` in case transfer error has no effect +as well as a `dmaengine_terminate_async()` on a transfer success. + +Also fix the unneeded cast and remove not more needed variables. + +Fixes: 7ecc8cfde553 ("i2c: i2c-stm32f7: Add DMA support") +Signed-off-by: Clément Le Goffic +Cc: # v4.18+ +Acked-by: Alain Volmat +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250704-i2c-upstream-v4-2-84a095a2c728@foss.st.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-stm32f7.c | 20 +++++++------------- + 1 file changed, 7 insertions(+), 13 deletions(-) + +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -739,10 +739,11 @@ static void stm32f7_i2c_disable_dma_req( + + static void stm32f7_i2c_dma_callback(void *arg) + { +- struct stm32f7_i2c_dev *i2c_dev = (struct stm32f7_i2c_dev *)arg; ++ struct stm32f7_i2c_dev *i2c_dev = arg; + struct stm32_i2c_dma *dma = i2c_dev->dma; + + stm32f7_i2c_disable_dma_req(i2c_dev); ++ dmaengine_terminate_async(dma->chan_using); + dma_unmap_single(i2c_dev->dev, dma->dma_buf, dma->dma_len, + dma->dma_data_dir); + complete(&dma->dma_complete); +@@ -1510,7 +1511,6 @@ static irqreturn_t stm32f7_i2c_handle_is + u16 addr = f7_msg->addr; + void __iomem *base = i2c_dev->base; + struct device *dev = i2c_dev->dev; +- struct stm32_i2c_dma *dma = i2c_dev->dma; + + /* Bus error */ + if (status & STM32F7_I2C_ISR_BERR) { +@@ -1551,10 +1551,8 @@ static irqreturn_t stm32f7_i2c_handle_is + } + + /* Disable dma */ +- if (i2c_dev->use_dma) { +- stm32f7_i2c_disable_dma_req(i2c_dev); +- dmaengine_terminate_async(dma->chan_using); +- } ++ if (i2c_dev->use_dma) ++ stm32f7_i2c_dma_callback(i2c_dev); + + i2c_dev->master_mode = false; + complete(&i2c_dev->complete); +@@ -1600,7 +1598,6 @@ static irqreturn_t stm32f7_i2c_isr_event + { + struct stm32f7_i2c_dev *i2c_dev = data; + struct stm32f7_i2c_msg *f7_msg = &i2c_dev->f7_msg; +- struct stm32_i2c_dma *dma = i2c_dev->dma; + void __iomem *base = i2c_dev->base; + u32 status, mask; + int ret; +@@ -1619,10 +1616,8 @@ static irqreturn_t stm32f7_i2c_isr_event + dev_dbg(i2c_dev->dev, "<%s>: Receive NACK (addr %x)\n", + __func__, f7_msg->addr); + writel_relaxed(STM32F7_I2C_ICR_NACKCF, base + STM32F7_I2C_ICR); +- if (i2c_dev->use_dma) { +- stm32f7_i2c_disable_dma_req(i2c_dev); +- dmaengine_terminate_async(dma->chan_using); +- } ++ if (i2c_dev->use_dma) ++ stm32f7_i2c_dma_callback(i2c_dev); + f7_msg->result = -ENXIO; + } + +@@ -1640,8 +1635,7 @@ static irqreturn_t stm32f7_i2c_isr_event + ret = wait_for_completion_timeout(&i2c_dev->dma->dma_complete, HZ); + if (!ret) { + dev_dbg(i2c_dev->dev, "<%s>: Timed out\n", __func__); +- stm32f7_i2c_disable_dma_req(i2c_dev); +- dmaengine_terminate_async(dma->chan_using); ++ stm32f7_i2c_dma_callback(i2c_dev); + f7_msg->result = -ETIMEDOUT; + } + } diff --git a/queue-6.15/input-xpad-set-correct-controller-type-for-acer-ngr200.patch b/queue-6.15/input-xpad-set-correct-controller-type-for-acer-ngr200.patch new file mode 100644 index 0000000000..f72655706e --- /dev/null +++ b/queue-6.15/input-xpad-set-correct-controller-type-for-acer-ngr200.patch @@ -0,0 +1,39 @@ +From bcce05041b21888f10b80ea903dcfe51a25c586e Mon Sep 17 00:00:00 2001 +From: Nilton Perim Neto +Date: Sat, 19 Jul 2025 22:07:36 -0700 +Subject: Input: xpad - set correct controller type for Acer NGR200 + +From: Nilton Perim Neto + +commit bcce05041b21888f10b80ea903dcfe51a25c586e upstream. + +The controller should have been set as XTYPE_XBOX360 and not XTYPE_XBOX. +Also the entry is in the wrong place. Fix it. + +Reported-by: Vicki Pfau +Signed-off-by: Nilton Perim Neto +Link: https://lore.kernel.org/r/20250708033126.26216-2-niltonperimneto@gmail.com +Fixes: 22c69d786ef8 ("Input: xpad - support Acer NGR 200 Controller") +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -169,12 +169,12 @@ static const struct xpad_device { + { 0x046d, 0xca88, "Logitech Compact Controller for Xbox", 0, XTYPE_XBOX }, + { 0x046d, 0xca8a, "Logitech Precision Vibration Feedback Wheel", 0, XTYPE_XBOX }, + { 0x046d, 0xcaa3, "Logitech DriveFx Racing Wheel", 0, XTYPE_XBOX360 }, ++ { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX360 }, + { 0x056e, 0x2004, "Elecom JC-U3613M", 0, XTYPE_XBOX360 }, + { 0x05fd, 0x1007, "Mad Catz Controller (unverified)", 0, XTYPE_XBOX }, + { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX }, + { 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX }, + { 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX }, +- { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX }, + { 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX }, + { 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX }, + { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX }, diff --git a/queue-6.15/nvmem-imx-ocotp-fix-mac-address-byte-length.patch b/queue-6.15/nvmem-imx-ocotp-fix-mac-address-byte-length.patch new file mode 100644 index 0000000000..e850f43d74 --- /dev/null +++ b/queue-6.15/nvmem-imx-ocotp-fix-mac-address-byte-length.patch @@ -0,0 +1,81 @@ +From 2aa4ad626ee7f817a8f4715a47b318cfdc1714c9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Steffen=20B=C3=A4tz?= +Date: Sat, 12 Jul 2025 19:17:27 +0100 +Subject: nvmem: imx-ocotp: fix MAC address byte length +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steffen Bätz + +commit 2aa4ad626ee7f817a8f4715a47b318cfdc1714c9 upstream. + +The commit "13bcd440f2ff nvmem: core: verify cell's raw_len" caused an +extension of the "mac-address" cell from 6 to 8 bytes due to word_size +of 4 bytes. This led to a required byte swap of the full buffer length, +which caused truncation of the mac-address when read. + +Previously, the mac-address was incorrectly truncated from +70:B3:D5:14:E9:0E to 00:00:70:B3:D5:14. + +Fix the issue by swapping only the first 6 bytes to correctly pass the +mac-address to the upper layers. + +Fixes: 13bcd440f2ff ("nvmem: core: verify cell's raw_len") +Cc: stable@vger.kernel.org +Signed-off-by: Steffen Bätz +Tested-by: Alexander Stein +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20250712181729.6495-3-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/imx-ocotp-ele.c | 5 ++++- + drivers/nvmem/imx-ocotp.c | 5 ++++- + 2 files changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/nvmem/imx-ocotp-ele.c ++++ b/drivers/nvmem/imx-ocotp-ele.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include /* ETH_ALEN */ + + enum fuse_type { + FUSE_FSB = BIT(0), +@@ -118,9 +119,11 @@ static int imx_ocotp_cell_pp(void *conte + int i; + + /* Deal with some post processing of nvmem cell data */ +- if (id && !strcmp(id, "mac-address")) ++ if (id && !strcmp(id, "mac-address")) { ++ bytes = min(bytes, ETH_ALEN); + for (i = 0; i < bytes / 2; i++) + swap(buf[i], buf[bytes - i - 1]); ++ } + + return 0; + } +--- a/drivers/nvmem/imx-ocotp.c ++++ b/drivers/nvmem/imx-ocotp.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include /* ETH_ALEN */ + + #define IMX_OCOTP_OFFSET_B0W0 0x400 /* Offset from base address of the + * OTP Bank0 Word0 +@@ -227,9 +228,11 @@ static int imx_ocotp_cell_pp(void *conte + int i; + + /* Deal with some post processing of nvmem cell data */ +- if (id && !strcmp(id, "mac-address")) ++ if (id && !strcmp(id, "mac-address")) { ++ bytes = min(bytes, ETH_ALEN); + for (i = 0; i < bytes / 2; i++) + swap(buf[i], buf[bytes - i - 1]); ++ } + + return 0; + } diff --git a/queue-6.15/nvmem-layouts-u-boot-env-remove-crc32-endianness-conversion.patch b/queue-6.15/nvmem-layouts-u-boot-env-remove-crc32-endianness-conversion.patch new file mode 100644 index 0000000000..c8cb82d2b5 --- /dev/null +++ b/queue-6.15/nvmem-layouts-u-boot-env-remove-crc32-endianness-conversion.patch @@ -0,0 +1,97 @@ +From 2d7521aa26ec2dc8b877bb2d1f2611a2df49a3cf Mon Sep 17 00:00:00 2001 +From: "Michael C. Pratt" +Date: Wed, 16 Jul 2025 15:42:10 +0100 +Subject: nvmem: layouts: u-boot-env: remove crc32 endianness conversion + +From: Michael C. Pratt + +commit 2d7521aa26ec2dc8b877bb2d1f2611a2df49a3cf upstream. + +On 11 Oct 2022, it was reported that the crc32 verification +of the u-boot environment failed only on big-endian systems +for the u-boot-env nvmem layout driver with the following error. + + Invalid calculated CRC32: 0x88cd6f09 (expected: 0x096fcd88) + +This problem has been present since the driver was introduced, +and before it was made into a layout driver. + +The suggested fix at the time was to use further endianness +conversion macros in order to have both the stored and calculated +crc32 values to compare always represented in the system's endianness. +This was not accepted due to sparse warnings +and some disagreement on how to handle the situation. +Later on in a newer revision of the patch, it was proposed to use +cpu_to_le32() for both values to compare instead of le32_to_cpu() +and store the values as __le32 type to remove compilation errors. + +The necessity of this is based on the assumption that the use of crc32() +requires endianness conversion because the algorithm uses little-endian, +however, this does not prove to be the case and the issue is unrelated. + +Upon inspecting the current kernel code, +there already is an existing use of le32_to_cpu() in this driver, +which suggests there already is special handling for big-endian systems, +however, it is big-endian systems that have the problem. + +This, being the only functional difference between architectures +in the driver combined with the fact that the suggested fix +was to use the exact same endianness conversion for the values +brings up the possibility that it was not necessary to begin with, +as the same endianness conversion for two values expected to be the same +is expected to be equivalent to no conversion at all. + +After inspecting the u-boot environment of devices of both endianness +and trying to remove the existing endianness conversion, +the problem is resolved in an equivalent way as the other suggested fixes. + +Ultimately, it seems that u-boot is agnostic to endianness +at least for the purpose of environment variables. +In other words, u-boot reads and writes the stored crc32 value +with the same endianness that the crc32 value is calculated with +in whichever endianness a certain architecture runs on. + +Therefore, the u-boot-env driver does not need to convert endianness. +Remove the usage of endianness macros in the u-boot-env driver, +and change the type of local variables to maintain the same return type. + +If there is a special situation in the case of endianness, +it would be a corner case and should be handled by a unique "compatible". + +Even though it is not necessary to use endianness conversion macros here, +it may be useful to use them in the future for consistent error printing. + +Fixes: d5542923f200 ("nvmem: add driver handling U-Boot environment variables") +Reported-by: INAGAKI Hiroshi +Link: https://lore.kernel.org/all/20221011024928.1807-1-musashino.open@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: "Michael C. Pratt" +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20250716144210.4804-1-srini@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/layouts/u-boot-env.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/nvmem/layouts/u-boot-env.c ++++ b/drivers/nvmem/layouts/u-boot-env.c +@@ -92,7 +92,7 @@ int u_boot_env_parse(struct device *dev, + size_t crc32_data_offset; + size_t crc32_data_len; + size_t crc32_offset; +- __le32 *crc32_addr; ++ uint32_t *crc32_addr; + size_t data_offset; + size_t data_len; + size_t dev_size; +@@ -143,8 +143,8 @@ int u_boot_env_parse(struct device *dev, + goto err_kfree; + } + +- crc32_addr = (__le32 *)(buf + crc32_offset); +- crc32 = le32_to_cpu(*crc32_addr); ++ crc32_addr = (uint32_t *)(buf + crc32_offset); ++ crc32 = *crc32_addr; + crc32_data_len = dev_size - crc32_data_offset; + data_len = dev_size - data_offset; + diff --git a/queue-6.15/objtool-rust-add-one-more-noreturn-rust-function-for-rust-1.89.0.patch b/queue-6.15/objtool-rust-add-one-more-noreturn-rust-function-for-rust-1.89.0.patch new file mode 100644 index 0000000000..46af1dd88e --- /dev/null +++ b/queue-6.15/objtool-rust-add-one-more-noreturn-rust-function-for-rust-1.89.0.patch @@ -0,0 +1,46 @@ +From aa7b65c2a29e8b07057b13624102c6810597c0d5 Mon Sep 17 00:00:00 2001 +From: Miguel Ojeda +Date: Sat, 12 Jul 2025 18:01:02 +0200 +Subject: objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 + +From: Miguel Ojeda + +commit aa7b65c2a29e8b07057b13624102c6810597c0d5 upstream. + +Starting with Rust 1.89.0 (expected 2025-08-07), under +`CONFIG_RUST_DEBUG_ASSERTIONS=y`, `objtool` may report: + + rust/kernel.o: warning: objtool: _R..._6kernel4pageNtB5_4Page8read_raw() + falls through to next function _R..._6kernel4pageNtB5_4Page9write_raw() + +(and many others) due to calls to the `noreturn` symbol: + + core::panicking::panic_nounwind_fmt + +Thus add the mangled one to the list so that `objtool` knows it is +actually `noreturn`. + +See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions") +for more details. + +Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). +Cc: Josh Poimboeuf +Cc: Peter Zijlstra +Acked-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20250712160103.1244945-2-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + tools/objtool/check.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -224,6 +224,7 @@ static bool is_rust_noreturn(const struc + str_ends_with(func->name, "_4core9panicking14panic_explicit") || + str_ends_with(func->name, "_4core9panicking14panic_nounwind") || + str_ends_with(func->name, "_4core9panicking18panic_bounds_check") || ++ str_ends_with(func->name, "_4core9panicking18panic_nounwind_fmt") || + str_ends_with(func->name, "_4core9panicking19assert_failed_inner") || + str_ends_with(func->name, "_4core9panicking30panic_null_pointer_dereference") || + str_ends_with(func->name, "_4core9panicking36panic_misaligned_pointer_dereference") || diff --git a/queue-6.15/pch_uart-fix-dma_sync_sg_for_device-nents-value.patch b/queue-6.15/pch_uart-fix-dma_sync_sg_for_device-nents-value.patch new file mode 100644 index 0000000000..e10fadda4c --- /dev/null +++ b/queue-6.15/pch_uart-fix-dma_sync_sg_for_device-nents-value.patch @@ -0,0 +1,36 @@ +From 6c0e9f05c9d7875995b0e92ace71be947f280bbd Mon Sep 17 00:00:00 2001 +From: Thomas Fourier +Date: Tue, 1 Jul 2025 13:34:52 +0200 +Subject: pch_uart: Fix dma_sync_sg_for_device() nents value + +From: Thomas Fourier + +commit 6c0e9f05c9d7875995b0e92ace71be947f280bbd upstream. + +The dma_sync_sg_for_device() functions should be called with the same +nents as the dma_map_sg(), not the value the map function returned +according to the documentation in Documentation/core-api/dma-api.rst:450: + With the sync_sg API, all the parameters must be the same + as those passed into the sg mapping API. + +Fixes: da3564ee027e ("pch_uart: add multi-scatter processing") +Cc: stable +Signed-off-by: Thomas Fourier +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20250701113452.18590-2-fourier.thomas@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/pch_uart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/pch_uart.c ++++ b/drivers/tty/serial/pch_uart.c +@@ -954,7 +954,7 @@ static unsigned int dma_handle_tx(struct + __func__); + return 0; + } +- dma_sync_sg_for_device(port->dev, priv->sg_tx_p, nent, DMA_TO_DEVICE); ++ dma_sync_sg_for_device(port->dev, priv->sg_tx_p, num, DMA_TO_DEVICE); + priv->desc_tx = desc; + desc->callback = pch_dma_tx_complete; + desc->callback_param = priv; diff --git a/queue-6.15/phy-tegra-xusb-decouple-cya_trk_code_update_on_idle-from-trk_hw_mode.patch b/queue-6.15/phy-tegra-xusb-decouple-cya_trk_code_update_on_idle-from-trk_hw_mode.patch new file mode 100644 index 0000000000..5e1bb1088f --- /dev/null +++ b/queue-6.15/phy-tegra-xusb-decouple-cya_trk_code_update_on_idle-from-trk_hw_mode.patch @@ -0,0 +1,75 @@ +From 24c63c590adca310e0df95c77cf7aa5552bc3fc5 Mon Sep 17 00:00:00 2001 +From: Wayne Chang +Date: Mon, 19 May 2025 17:09:28 +0800 +Subject: phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode + +From: Wayne Chang + +commit 24c63c590adca310e0df95c77cf7aa5552bc3fc5 upstream. + +The logic that drives the pad calibration values resides in the +controller reset domain and so the calibration values are only being +captured when the controller is out of reset. However, by clearing the +CYA_TRK_CODE_UPDATE_ON_IDLE bit, the calibration values can be set +while the controller is in reset. + +The CYA_TRK_CODE_UPDATE_ON_IDLE bit was previously cleared based on the +trk_hw_mode flag, but this dependency is not necessary. Instead, +introduce a new flag, trk_update_on_idle, to independently control this +bit. + +Fixes: d8163a32ca95 ("phy: tegra: xusb: Add Tegra234 support") +Cc: stable@vger.kernel.org +Signed-off-by: Wayne Chang +Reviewed-by: Jon Hunter +Tested-by: Jon Hunter +Link: https://lore.kernel.org/r/20250519090929.3132456-2-waynec@nvidia.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/tegra/xusb-tegra186.c | 14 ++++++++------ + drivers/phy/tegra/xusb.h | 1 + + 2 files changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/phy/tegra/xusb-tegra186.c ++++ b/drivers/phy/tegra/xusb-tegra186.c +@@ -648,14 +648,15 @@ static void tegra186_utmi_bias_pad_power + udelay(100); + } + +- if (padctl->soc->trk_hw_mode) { +- value = padctl_readl(padctl, XUSB_PADCTL_USB2_BIAS_PAD_CTL2); +- value |= USB2_TRK_HW_MODE; ++ value = padctl_readl(padctl, XUSB_PADCTL_USB2_BIAS_PAD_CTL2); ++ if (padctl->soc->trk_update_on_idle) + value &= ~CYA_TRK_CODE_UPDATE_ON_IDLE; +- padctl_writel(padctl, value, XUSB_PADCTL_USB2_BIAS_PAD_CTL2); +- } else { ++ if (padctl->soc->trk_hw_mode) ++ value |= USB2_TRK_HW_MODE; ++ padctl_writel(padctl, value, XUSB_PADCTL_USB2_BIAS_PAD_CTL2); ++ ++ if (!padctl->soc->trk_hw_mode) + clk_disable_unprepare(priv->usb2_trk_clk); +- } + } + + static void tegra186_utmi_bias_pad_power_off(struct tegra_xusb_padctl *padctl) +@@ -1726,6 +1727,7 @@ const struct tegra_xusb_padctl_soc tegra + .supports_gen2 = true, + .poll_trk_completed = true, + .trk_hw_mode = true, ++ .trk_update_on_idle = true, + .supports_lp_cfg_en = true, + }; + EXPORT_SYMBOL_GPL(tegra234_xusb_padctl_soc); +--- a/drivers/phy/tegra/xusb.h ++++ b/drivers/phy/tegra/xusb.h +@@ -434,6 +434,7 @@ struct tegra_xusb_padctl_soc { + bool need_fake_usb3_port; + bool poll_trk_completed; + bool trk_hw_mode; ++ bool trk_update_on_idle; + bool supports_lp_cfg_en; + }; + diff --git a/queue-6.15/phy-tegra-xusb-disable-periodic-tracking-on-tegra234.patch b/queue-6.15/phy-tegra-xusb-disable-periodic-tracking-on-tegra234.patch new file mode 100644 index 0000000000..6041927f87 --- /dev/null +++ b/queue-6.15/phy-tegra-xusb-disable-periodic-tracking-on-tegra234.patch @@ -0,0 +1,41 @@ +From 7be54870e9bf5ed0b4fe2a23b41a630527882de5 Mon Sep 17 00:00:00 2001 +From: Haotien Hsu +Date: Mon, 19 May 2025 17:09:29 +0800 +Subject: phy: tegra: xusb: Disable periodic tracking on Tegra234 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Haotien Hsu + +commit 7be54870e9bf5ed0b4fe2a23b41a630527882de5 upstream. + +Periodic calibration updates (~10µs) may overlap with transfers when +PCIe NVMe SSD, LPDDR, and USB2 devices operate simultaneously, causing +crosstalk on Tegra234 devices. Hence disable periodic calibration updates +and make this a one-time calibration. + +Fixes: d8163a32ca95 ("phy: tegra: xusb: Add Tegra234 support") +Cc: stable@vger.kernel.org +Signed-off-by: Haotien Hsu +Signed-off-by: Wayne Chang +Reviewed-by: Jon Hunter +Tested-by: Jon Hunter +Link: https://lore.kernel.org/r/20250519090929.3132456-3-waynec@nvidia.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/tegra/xusb-tegra186.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/phy/tegra/xusb-tegra186.c ++++ b/drivers/phy/tegra/xusb-tegra186.c +@@ -1726,7 +1726,7 @@ const struct tegra_xusb_padctl_soc tegra + .num_supplies = ARRAY_SIZE(tegra194_xusb_padctl_supply_names), + .supports_gen2 = true, + .poll_trk_completed = true, +- .trk_hw_mode = true, ++ .trk_hw_mode = false, + .trk_update_on_idle = true, + .supports_lp_cfg_en = true, + }; diff --git a/queue-6.15/phy-tegra-xusb-fix-unbalanced-regulator-disable-in-utmi-phy-mode.patch b/queue-6.15/phy-tegra-xusb-fix-unbalanced-regulator-disable-in-utmi-phy-mode.patch new file mode 100644 index 0000000000..a600f142ef --- /dev/null +++ b/queue-6.15/phy-tegra-xusb-fix-unbalanced-regulator-disable-in-utmi-phy-mode.patch @@ -0,0 +1,137 @@ +From cefc1caee9dd06c69e2d807edc5949b329f52b22 Mon Sep 17 00:00:00 2001 +From: Wayne Chang +Date: Fri, 2 May 2025 17:26:06 +0800 +Subject: phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode + +From: Wayne Chang + +commit cefc1caee9dd06c69e2d807edc5949b329f52b22 upstream. + +When transitioning from USB_ROLE_DEVICE to USB_ROLE_NONE, the code +assumed that the regulator should be disabled. However, if the regulator +is marked as always-on, regulator_is_enabled() continues to return true, +leading to an incorrect attempt to disable a regulator which is not +enabled. + +This can result in warnings such as: + +[ 250.155624] WARNING: CPU: 1 PID: 7326 at drivers/regulator/core.c:3004 +_regulator_disable+0xe4/0x1a0 +[ 250.155652] unbalanced disables for VIN_SYS_5V0 + +To fix this, we move the regulator control logic into +tegra186_xusb_padctl_id_override() function since it's directly related +to the ID override state. The regulator is now only disabled when the role +transitions from USB_ROLE_HOST to USB_ROLE_NONE, by checking the VBUS_ID +register. This ensures that regulator enable/disable operations are +properly balanced and only occur when actually transitioning to/from host +mode. + +Fixes: 49d46e3c7e59 ("phy: tegra: xusb: Add set_mode support for UTMI phy on Tegra186") +Cc: stable@vger.kernel.org +Signed-off-by: Wayne Chang +Reviewed-by: Jon Hunter +Tested-by: Jon Hunter +Link: https://lore.kernel.org/r/20250502092606.2275682-1-waynec@nvidia.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/tegra/xusb-tegra186.c | 59 +++++++++++++++++++++++--------------- + 1 file changed, 37 insertions(+), 22 deletions(-) + +--- a/drivers/phy/tegra/xusb-tegra186.c ++++ b/drivers/phy/tegra/xusb-tegra186.c +@@ -782,13 +782,15 @@ static int tegra186_xusb_padctl_vbus_ove + } + + static int tegra186_xusb_padctl_id_override(struct tegra_xusb_padctl *padctl, +- bool status) ++ struct tegra_xusb_usb2_port *port, bool status) + { +- u32 value; ++ u32 value, id_override; ++ int err = 0; + + dev_dbg(padctl->dev, "%s id override\n", status ? "set" : "clear"); + + value = padctl_readl(padctl, USB2_VBUS_ID); ++ id_override = value & ID_OVERRIDE(~0); + + if (status) { + if (value & VBUS_OVERRIDE) { +@@ -799,14 +801,34 @@ static int tegra186_xusb_padctl_id_overr + value = padctl_readl(padctl, USB2_VBUS_ID); + } + +- value &= ~ID_OVERRIDE(~0); +- value |= ID_OVERRIDE_GROUNDED; ++ if (id_override != ID_OVERRIDE_GROUNDED) { ++ value &= ~ID_OVERRIDE(~0); ++ value |= ID_OVERRIDE_GROUNDED; ++ padctl_writel(padctl, value, USB2_VBUS_ID); ++ ++ err = regulator_enable(port->supply); ++ if (err) { ++ dev_err(padctl->dev, "Failed to enable regulator: %d\n", err); ++ return err; ++ } ++ } + } else { +- value &= ~ID_OVERRIDE(~0); +- value |= ID_OVERRIDE_FLOATING; +- } ++ if (id_override == ID_OVERRIDE_GROUNDED) { ++ /* ++ * The regulator is disabled only when the role transitions ++ * from USB_ROLE_HOST to USB_ROLE_NONE. ++ */ ++ err = regulator_disable(port->supply); ++ if (err) { ++ dev_err(padctl->dev, "Failed to disable regulator: %d\n", err); ++ return err; ++ } + +- padctl_writel(padctl, value, USB2_VBUS_ID); ++ value &= ~ID_OVERRIDE(~0); ++ value |= ID_OVERRIDE_FLOATING; ++ padctl_writel(padctl, value, USB2_VBUS_ID); ++ } ++ } + + return 0; + } +@@ -826,27 +848,20 @@ static int tegra186_utmi_phy_set_mode(st + + if (mode == PHY_MODE_USB_OTG) { + if (submode == USB_ROLE_HOST) { +- tegra186_xusb_padctl_id_override(padctl, true); +- +- err = regulator_enable(port->supply); ++ err = tegra186_xusb_padctl_id_override(padctl, port, true); ++ if (err) ++ goto out; + } else if (submode == USB_ROLE_DEVICE) { + tegra186_xusb_padctl_vbus_override(padctl, true); + } else if (submode == USB_ROLE_NONE) { +- /* +- * When port is peripheral only or role transitions to +- * USB_ROLE_NONE from USB_ROLE_DEVICE, regulator is not +- * enabled. +- */ +- if (regulator_is_enabled(port->supply)) +- regulator_disable(port->supply); +- +- tegra186_xusb_padctl_id_override(padctl, false); ++ err = tegra186_xusb_padctl_id_override(padctl, port, false); ++ if (err) ++ goto out; + tegra186_xusb_padctl_vbus_override(padctl, false); + } + } +- ++out: + mutex_unlock(&padctl->lock); +- + return err; + } + diff --git a/queue-6.15/revert-staging-vchiq_arm-create-keep-alive-thread-during-probe.patch b/queue-6.15/revert-staging-vchiq_arm-create-keep-alive-thread-during-probe.patch new file mode 100644 index 0000000000..41d16892f6 --- /dev/null +++ b/queue-6.15/revert-staging-vchiq_arm-create-keep-alive-thread-during-probe.patch @@ -0,0 +1,140 @@ +From 228af5a58524fba09ec4b7d184694db4f7fe96f5 Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Tue, 15 Jul 2025 18:11:07 +0200 +Subject: Revert "staging: vchiq_arm: Create keep-alive thread during probe" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Wahren + +commit 228af5a58524fba09ec4b7d184694db4f7fe96f5 upstream. + +The commit 86bc88217006 ("staging: vchiq_arm: Create keep-alive thread +during probe") introduced a regression for certain configurations, +which doesn't have a VCHIQ user. This results in a unused and hanging +keep-alive thread: + + INFO: task vchiq-keep/0:85 blocked for more than 120 seconds. + Not tainted 6.12.34-v8-+ #13 + "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + task:vchiq-keep/0 state:D stack:0 pid:85 tgid:85 ppid:2 + Call trace: + __switch_to+0x188/0x230 + __schedule+0xa54/0xb28 + schedule+0x80/0x120 + schedule_preempt_disabled+0x30/0x50 + kthread+0xd4/0x1a0 + ret_from_fork+0x10/0x20 + +Fixes: 86bc88217006 ("staging: vchiq_arm: Create keep-alive thread during probe") +Reported-by: Maíra Canal +Closes: https://lore.kernel.org/linux-staging/ba35b960-a981-4671-9f7f-060da10feaa1@usp.br/ +Cc: stable@kernel.org +Signed-off-by: Stefan Wahren +Reviewed-by: Maíra Canal +Link: https://lore.kernel.org/r/20250715161108.3411-3-wahrenst@gmx.net +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 69 +++++----- + 1 file changed, 35 insertions(+), 34 deletions(-) + +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +@@ -280,6 +280,29 @@ static int vchiq_platform_init(struct pl + return 0; + } + ++int ++vchiq_platform_init_state(struct vchiq_state *state) ++{ ++ struct vchiq_arm_state *platform_state; ++ ++ platform_state = devm_kzalloc(state->dev, sizeof(*platform_state), GFP_KERNEL); ++ if (!platform_state) ++ return -ENOMEM; ++ ++ rwlock_init(&platform_state->susp_res_lock); ++ ++ init_completion(&platform_state->ka_evt); ++ atomic_set(&platform_state->ka_use_count, 0); ++ atomic_set(&platform_state->ka_use_ack_count, 0); ++ atomic_set(&platform_state->ka_release_count, 0); ++ ++ platform_state->state = state; ++ ++ state->platform_state = (struct opaque_platform_state *)platform_state; ++ ++ return 0; ++} ++ + static struct vchiq_arm_state *vchiq_platform_get_arm_state(struct vchiq_state *state) + { + return (struct vchiq_arm_state *)state->platform_state; +@@ -989,39 +1012,6 @@ exit: + } + + int +-vchiq_platform_init_state(struct vchiq_state *state) +-{ +- struct vchiq_arm_state *platform_state; +- char threadname[16]; +- +- platform_state = devm_kzalloc(state->dev, sizeof(*platform_state), GFP_KERNEL); +- if (!platform_state) +- return -ENOMEM; +- +- snprintf(threadname, sizeof(threadname), "vchiq-keep/%d", +- state->id); +- platform_state->ka_thread = kthread_create(&vchiq_keepalive_thread_func, +- (void *)state, threadname); +- if (IS_ERR(platform_state->ka_thread)) { +- dev_err(state->dev, "couldn't create thread %s\n", threadname); +- return PTR_ERR(platform_state->ka_thread); +- } +- +- rwlock_init(&platform_state->susp_res_lock); +- +- init_completion(&platform_state->ka_evt); +- atomic_set(&platform_state->ka_use_count, 0); +- atomic_set(&platform_state->ka_use_ack_count, 0); +- atomic_set(&platform_state->ka_release_count, 0); +- +- platform_state->state = state; +- +- state->platform_state = (struct opaque_platform_state *)platform_state; +- +- return 0; +-} +- +-int + vchiq_use_internal(struct vchiq_state *state, struct vchiq_service *service, + enum USE_TYPE_E use_type) + { +@@ -1341,6 +1331,7 @@ void vchiq_platform_conn_state_changed(s + enum vchiq_connstate newstate) + { + struct vchiq_arm_state *arm_state = vchiq_platform_get_arm_state(state); ++ char threadname[16]; + + dev_dbg(state->dev, "suspend: %d: %s->%s\n", + state->id, get_conn_state_name(oldstate), get_conn_state_name(newstate)); +@@ -1355,7 +1346,17 @@ void vchiq_platform_conn_state_changed(s + + arm_state->first_connect = 1; + write_unlock_bh(&arm_state->susp_res_lock); +- wake_up_process(arm_state->ka_thread); ++ snprintf(threadname, sizeof(threadname), "vchiq-keep/%d", ++ state->id); ++ arm_state->ka_thread = kthread_create(&vchiq_keepalive_thread_func, ++ (void *)state, ++ threadname); ++ if (IS_ERR(arm_state->ka_thread)) { ++ dev_err(state->dev, "suspend: Couldn't create thread %s\n", ++ threadname); ++ } else { ++ wake_up_process(arm_state->ka_thread); ++ } + } + + static const struct of_device_id vchiq_of_match[] = { diff --git a/queue-6.15/revert-staging-vchiq_arm-improve-initial-vchiq-connect.patch b/queue-6.15/revert-staging-vchiq_arm-improve-initial-vchiq-connect.patch new file mode 100644 index 0000000000..064b448d5f --- /dev/null +++ b/queue-6.15/revert-staging-vchiq_arm-improve-initial-vchiq-connect.patch @@ -0,0 +1,112 @@ +From ebe0b2ecb7b8285852414a0f20044432e37d9b4c Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Tue, 15 Jul 2025 18:11:06 +0200 +Subject: Revert "staging: vchiq_arm: Improve initial VCHIQ connect" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Wahren + +commit ebe0b2ecb7b8285852414a0f20044432e37d9b4c upstream. + +The commit 3e5def4249b9 ("staging: vchiq_arm: Improve initial VCHIQ connect") +based on the assumption that in good case the VCHIQ connect always happen and +therefore the keep-alive thread is guaranteed to be woken up. This is wrong, +because in certain configurations there are no VCHIQ users and so the VCHIQ +connect never happen. So revert it. + +Fixes: 3e5def4249b9 ("staging: vchiq_arm: Improve initial VCHIQ connect") +Reported-by: Maíra Canal +Closes: https://lore.kernel.org/linux-staging/ba35b960-a981-4671-9f7f-060da10feaa1@usp.br/ +Cc: stable@kernel.org +Signed-off-by: Stefan Wahren +Reviewed-by: Maíra Canal +Link: https://lore.kernel.org/r/20250715161108.3411-2-wahrenst@gmx.net +Signed-off-by: Greg Kroah-Hartman +--- + .../interface/vchiq_arm/vchiq_arm.c | 28 ++++++++++++++----- + .../interface/vchiq_arm/vchiq_core.c | 1 - + .../interface/vchiq_arm/vchiq_core.h | 2 -- + 3 files changed, 21 insertions(+), 10 deletions(-) + +diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +index 5dbf8d53db09..cdf5687ad4f0 100644 +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +@@ -97,6 +97,13 @@ struct vchiq_arm_state { + * tracked separately with the state. + */ + int peer_use_count; ++ ++ /* ++ * Flag to indicate that the first vchiq connect has made it through. ++ * This means that both sides should be fully ready, and we should ++ * be able to suspend after this point. ++ */ ++ int first_connect; + }; + + static int +@@ -1329,19 +1336,26 @@ vchiq_check_service(struct vchiq_service *service) + return ret; + } + +-void vchiq_platform_connected(struct vchiq_state *state) +-{ +- struct vchiq_arm_state *arm_state = vchiq_platform_get_arm_state(state); +- +- wake_up_process(arm_state->ka_thread); +-} +- + void vchiq_platform_conn_state_changed(struct vchiq_state *state, + enum vchiq_connstate oldstate, + enum vchiq_connstate newstate) + { ++ struct vchiq_arm_state *arm_state = vchiq_platform_get_arm_state(state); ++ + dev_dbg(state->dev, "suspend: %d: %s->%s\n", + state->id, get_conn_state_name(oldstate), get_conn_state_name(newstate)); ++ if (state->conn_state != VCHIQ_CONNSTATE_CONNECTED) ++ return; ++ ++ write_lock_bh(&arm_state->susp_res_lock); ++ if (arm_state->first_connect) { ++ write_unlock_bh(&arm_state->susp_res_lock); ++ return; ++ } ++ ++ arm_state->first_connect = 1; ++ write_unlock_bh(&arm_state->susp_res_lock); ++ wake_up_process(arm_state->ka_thread); + } + + static const struct of_device_id vchiq_of_match[] = { +diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c +index e7b0c800a205..e2cac0898b8f 100644 +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c +@@ -3343,7 +3343,6 @@ vchiq_connect_internal(struct vchiq_state *state, struct vchiq_instance *instanc + return -EAGAIN; + + vchiq_set_conn_state(state, VCHIQ_CONNSTATE_CONNECTED); +- vchiq_platform_connected(state); + complete(&state->connect); + } + +diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h +index 3b5c0618e567..9b4e766990a4 100644 +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h +@@ -575,8 +575,6 @@ int vchiq_send_remote_use(struct vchiq_state *state); + + int vchiq_send_remote_use_active(struct vchiq_state *state); + +-void vchiq_platform_connected(struct vchiq_state *state); +- + void vchiq_platform_conn_state_changed(struct vchiq_state *state, + enum vchiq_connstate oldstate, + enum vchiq_connstate newstate); +-- +2.50.1 + diff --git a/queue-6.15/rust-init-fix-generics-in-_init-macros.patch b/queue-6.15/rust-init-fix-generics-in-_init-macros.patch new file mode 100644 index 0000000000..96432253a7 --- /dev/null +++ b/queue-6.15/rust-init-fix-generics-in-_init-macros.patch @@ -0,0 +1,73 @@ +From fe49aae0fcb348b656bbde2eb1d1c75d8a1a5c3c Mon Sep 17 00:00:00 2001 +From: Janne Grunau +Date: Sat, 28 Jun 2025 13:36:00 +0200 +Subject: rust: init: Fix generics in *_init! macros + +From: Janne Grunau + +commit fe49aae0fcb348b656bbde2eb1d1c75d8a1a5c3c upstream. + +The match pattern for a optional trailing comma in the list of generics +is erroneously repeated in the code block resulting in following error: + +| error: attempted to repeat an expression containing no syntax variables matched as repeating at this depth +| --> rust/kernel/init.rs:301:73 +| | +| 301 | ::pin_init::try_pin_init!($(&$this in)? $t $(::<$($generics),* $(,)?>)? { +| | ^^^ + +Remove "$(,)?" from all code blocks in the try_init! and try_pin_init! +definitions. + +Cc: stable@vger.kernel.org +Fixes: 578eb8b6db13 ("rust: pin-init: move the default error behavior of `try_[pin_]init`") +Signed-off-by: Janne Grunau +Reviewed-by: Benno Lossin +Link: https://lore.kernel.org/r/20250628-rust_init_trailing_comma-v1-1-2d162ae1a757@jannau.net +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + rust/kernel/init.rs | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/rust/kernel/init.rs b/rust/kernel/init.rs +index 8d228c237954..21ef202ab0db 100644 +--- a/rust/kernel/init.rs ++++ b/rust/kernel/init.rs +@@ -231,14 +231,14 @@ macro_rules! try_init { + ($(&$this:ident in)? $t:ident $(::<$($generics:ty),* $(,)?>)? { + $($fields:tt)* + }) => { +- ::pin_init::try_init!($(&$this in)? $t $(::<$($generics),* $(,)?>)? { ++ ::pin_init::try_init!($(&$this in)? $t $(::<$($generics),*>)? { + $($fields)* + }? $crate::error::Error) + }; + ($(&$this:ident in)? $t:ident $(::<$($generics:ty),* $(,)?>)? { + $($fields:tt)* + }? $err:ty) => { +- ::pin_init::try_init!($(&$this in)? $t $(::<$($generics),* $(,)?>)? { ++ ::pin_init::try_init!($(&$this in)? $t $(::<$($generics),*>)? { + $($fields)* + }? $err) + }; +@@ -291,14 +291,14 @@ macro_rules! try_pin_init { + ($(&$this:ident in)? $t:ident $(::<$($generics:ty),* $(,)?>)? { + $($fields:tt)* + }) => { +- ::pin_init::try_pin_init!($(&$this in)? $t $(::<$($generics),* $(,)?>)? { ++ ::pin_init::try_pin_init!($(&$this in)? $t $(::<$($generics),*>)? { + $($fields)* + }? $crate::error::Error) + }; + ($(&$this:ident in)? $t:ident $(::<$($generics:ty),* $(,)?>)? { + $($fields:tt)* + }? $err:ty) => { +- ::pin_init::try_pin_init!($(&$this in)? $t $(::<$($generics),* $(,)?>)? { ++ ::pin_init::try_pin_init!($(&$this in)? $t $(::<$($generics),*>)? { + $($fields)* + }? $err) + }; +-- +2.50.1 + diff --git a/queue-6.15/series b/queue-6.15/series new file mode 100644 index 0000000000..73c65bf9d0 --- /dev/null +++ b/queue-6.15/series @@ -0,0 +1,32 @@ +phy-tegra-xusb-fix-unbalanced-regulator-disable-in-utmi-phy-mode.patch +phy-tegra-xusb-decouple-cya_trk_code_update_on_idle-from-trk_hw_mode.patch +phy-tegra-xusb-disable-periodic-tracking-on-tegra234.patch +usb-serial-option-add-telit-cinterion-fe910c04-ecm-composition.patch +usb-serial-option-add-foxconn-t99w640.patch +usb-serial-ftdi_sio-add-support-for-ndi-emguide-gemini.patch +usb-musb-fix-gadget-state-on-disconnect.patch +usb-dwc2-gadget-fix-enter-to-hibernation-for-utmi-phy.patch +usb-gadget-configfs-fix-oob-read-on-empty-string-write.patch +i2c-stm32-fix-the-device-used-for-the-dma-map.patch +i2c-stm32f7-unmap-dma-mapped-buffer.patch +i2c-omap-handle-omap_i2c_init-errors-in-omap_i2c_probe.patch +i2c-omap-fix-an-error-handling-path-in-omap_i2c_probe.patch +thunderbolt-fix-wake-on-connect-at-runtime.patch +thunderbolt-fix-bit-masking-in-tb_dp_port_set_hops.patch +revert-staging-vchiq_arm-improve-initial-vchiq-connect.patch +revert-staging-vchiq_arm-create-keep-alive-thread-during-probe.patch +nvmem-imx-ocotp-fix-mac-address-byte-length.patch +nvmem-layouts-u-boot-env-remove-crc32-endianness-conversion.patch +input-xpad-set-correct-controller-type-for-acer-ngr200.patch +pch_uart-fix-dma_sync_sg_for_device-nents-value.patch +spi-add-check-for-8-bit-transfer-with-8-io-mode-support.patch +tools-hv-fcopy-fix-irregularities-with-size-of-ring-buffer.patch +dm-bufio-fix-sched-in-atomic-context.patch +hid-core-ensure-the-allocated-report-buffer-can-contain-the-reserved-report-id.patch +hid-core-ensure-__hid_request-reserves-the-report-id-as-the-first-byte.patch +hid-core-do-not-bypass-hid_hw_raw_request.patch +tracing-probes-avoid-using-params-uninitialized-in-parse_btf_arg.patch +tracing-add-down_write-trace_event_sem-when-adding-trace-event.patch +tracing-osnoise-fix-crash-in-timerlat_dump_stack.patch +rust-init-fix-generics-in-_init-macros.patch +objtool-rust-add-one-more-noreturn-rust-function-for-rust-1.89.0.patch diff --git a/queue-6.15/spi-add-check-for-8-bit-transfer-with-8-io-mode-support.patch b/queue-6.15/spi-add-check-for-8-bit-transfer-with-8-io-mode-support.patch new file mode 100644 index 0000000000..981fef5727 --- /dev/null +++ b/queue-6.15/spi-add-check-for-8-bit-transfer-with-8-io-mode-support.patch @@ -0,0 +1,58 @@ +From 710505212e3272396394f8cf78e3ddfd05df3f22 Mon Sep 17 00:00:00 2001 +From: Cheng Ming Lin +Date: Mon, 14 Jul 2025 11:10:23 +0800 +Subject: spi: Add check for 8-bit transfer with 8 IO mode support + +From: Cheng Ming Lin + +commit 710505212e3272396394f8cf78e3ddfd05df3f22 upstream. + +The current SPI framework does not verify if the SPI device supports +8 IO mode when doing an 8-bit transfer. This patch adds a check to +ensure that if the transfer tx_nbits or rx_nbits is 8, the SPI mode must +support 8 IO. If not, an error is returned, preventing undefined behavior. + +Fixes: d6a711a898672 ("spi: Fix OCTAL mode support") +Cc: stable@vger.kernel.org +Signed-off-by: Cheng Ming Lin +Link: https://patch.msgid.link/20250714031023.504752-1-linchengming884@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -4133,10 +4133,13 @@ static int __spi_validate(struct spi_dev + xfer->tx_nbits != SPI_NBITS_OCTAL) + return -EINVAL; + if ((xfer->tx_nbits == SPI_NBITS_DUAL) && +- !(spi->mode & (SPI_TX_DUAL | SPI_TX_QUAD))) ++ !(spi->mode & (SPI_TX_DUAL | SPI_TX_QUAD | SPI_TX_OCTAL))) + return -EINVAL; + if ((xfer->tx_nbits == SPI_NBITS_QUAD) && +- !(spi->mode & SPI_TX_QUAD)) ++ !(spi->mode & (SPI_TX_QUAD | SPI_TX_OCTAL))) ++ return -EINVAL; ++ if ((xfer->tx_nbits == SPI_NBITS_OCTAL) && ++ !(spi->mode & SPI_TX_OCTAL)) + return -EINVAL; + } + /* Check transfer rx_nbits */ +@@ -4149,10 +4152,13 @@ static int __spi_validate(struct spi_dev + xfer->rx_nbits != SPI_NBITS_OCTAL) + return -EINVAL; + if ((xfer->rx_nbits == SPI_NBITS_DUAL) && +- !(spi->mode & (SPI_RX_DUAL | SPI_RX_QUAD))) ++ !(spi->mode & (SPI_RX_DUAL | SPI_RX_QUAD | SPI_RX_OCTAL))) + return -EINVAL; + if ((xfer->rx_nbits == SPI_NBITS_QUAD) && +- !(spi->mode & SPI_RX_QUAD)) ++ !(spi->mode & (SPI_RX_QUAD | SPI_RX_OCTAL))) ++ return -EINVAL; ++ if ((xfer->rx_nbits == SPI_NBITS_OCTAL) && ++ !(spi->mode & SPI_RX_OCTAL)) + return -EINVAL; + } + diff --git a/queue-6.15/thunderbolt-fix-bit-masking-in-tb_dp_port_set_hops.patch b/queue-6.15/thunderbolt-fix-bit-masking-in-tb_dp_port_set_hops.patch new file mode 100644 index 0000000000..6b9b50bbbf --- /dev/null +++ b/queue-6.15/thunderbolt-fix-bit-masking-in-tb_dp_port_set_hops.patch @@ -0,0 +1,35 @@ +From 2cdde91c14ec358087f43287513946d493aef940 Mon Sep 17 00:00:00 2001 +From: Alok Tiwari +Date: Sun, 22 Jun 2025 10:17:02 -0700 +Subject: thunderbolt: Fix bit masking in tb_dp_port_set_hops() + +From: Alok Tiwari + +commit 2cdde91c14ec358087f43287513946d493aef940 upstream. + +The tb_dp_port_set_hops() function was incorrectly clearing +ADP_DP_CS_1_AUX_RX_HOPID_MASK twice. According to the function's +purpose, it should clear both TX and RX AUX HopID fields. Replace the +first instance with ADP_DP_CS_1_AUX_TX_HOPID_MASK to ensure proper +configuration of both AUX directions. + +Fixes: 98176380cbe5 ("thunderbolt: Convert DP adapter register names to follow the USB4 spec") +Cc: stable@vger.kernel.org +Signed-off-by: Alok Tiwari +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thunderbolt/switch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/thunderbolt/switch.c ++++ b/drivers/thunderbolt/switch.c +@@ -1450,7 +1450,7 @@ int tb_dp_port_set_hops(struct tb_port * + return ret; + + data[0] &= ~ADP_DP_CS_0_VIDEO_HOPID_MASK; +- data[1] &= ~ADP_DP_CS_1_AUX_RX_HOPID_MASK; ++ data[1] &= ~ADP_DP_CS_1_AUX_TX_HOPID_MASK; + data[1] &= ~ADP_DP_CS_1_AUX_RX_HOPID_MASK; + + data[0] |= (video << ADP_DP_CS_0_VIDEO_HOPID_SHIFT) & diff --git a/queue-6.15/thunderbolt-fix-wake-on-connect-at-runtime.patch b/queue-6.15/thunderbolt-fix-wake-on-connect-at-runtime.patch new file mode 100644 index 0000000000..c480302daa --- /dev/null +++ b/queue-6.15/thunderbolt-fix-wake-on-connect-at-runtime.patch @@ -0,0 +1,114 @@ +From 58d71d4242ce057955c783a14c82270c71f9e1e8 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Thu, 19 Jun 2025 16:38:30 -0500 +Subject: thunderbolt: Fix wake on connect at runtime + +From: Mario Limonciello + +commit 58d71d4242ce057955c783a14c82270c71f9e1e8 upstream. + +commit 1a760d10ded37 ("thunderbolt: Fix a logic error in wake on connect") +fixated on the USB4 port sysfs wakeup file not working properly to control +policy, but it had an unintended side effect that the sysfs file controls +policy both at runtime and at suspend time. The sysfs file is supposed to +only control behavior while system is suspended. + +Pass whether programming a port for runtime into usb4_switch_set_wake() +and if runtime then ignore the value in the sysfs file. + +Cc: stable@vger.kernel.org +Reported-by: Alexander Kovacs +Tested-by: Alexander Kovacs +Fixes: 1a760d10ded37 ("thunderbolt: Fix a logic error in wake on connect") +Signed-off-by: Mario Limonciello +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thunderbolt/switch.c | 8 ++++---- + drivers/thunderbolt/tb.h | 2 +- + drivers/thunderbolt/usb4.c | 12 +++++------- + 3 files changed, 10 insertions(+), 12 deletions(-) + +--- a/drivers/thunderbolt/switch.c ++++ b/drivers/thunderbolt/switch.c +@@ -3437,7 +3437,7 @@ void tb_sw_set_unplugged(struct tb_switc + } + } + +-static int tb_switch_set_wake(struct tb_switch *sw, unsigned int flags) ++static int tb_switch_set_wake(struct tb_switch *sw, unsigned int flags, bool runtime) + { + if (flags) + tb_sw_dbg(sw, "enabling wakeup: %#x\n", flags); +@@ -3445,7 +3445,7 @@ static int tb_switch_set_wake(struct tb_ + tb_sw_dbg(sw, "disabling wakeup\n"); + + if (tb_switch_is_usb4(sw)) +- return usb4_switch_set_wake(sw, flags); ++ return usb4_switch_set_wake(sw, flags, runtime); + return tb_lc_set_wake(sw, flags); + } + +@@ -3521,7 +3521,7 @@ int tb_switch_resume(struct tb_switch *s + tb_switch_check_wakes(sw); + + /* Disable wakes */ +- tb_switch_set_wake(sw, 0); ++ tb_switch_set_wake(sw, 0, true); + + err = tb_switch_tmu_init(sw); + if (err) +@@ -3602,7 +3602,7 @@ void tb_switch_suspend(struct tb_switch + flags |= TB_WAKE_ON_USB4 | TB_WAKE_ON_USB3 | TB_WAKE_ON_PCIE; + } + +- tb_switch_set_wake(sw, flags); ++ tb_switch_set_wake(sw, flags, runtime); + + if (tb_switch_is_usb4(sw)) + usb4_switch_set_sleep(sw); +--- a/drivers/thunderbolt/tb.h ++++ b/drivers/thunderbolt/tb.h +@@ -1304,7 +1304,7 @@ int usb4_switch_read_uid(struct tb_switc + int usb4_switch_drom_read(struct tb_switch *sw, unsigned int address, void *buf, + size_t size); + bool usb4_switch_lane_bonding_possible(struct tb_switch *sw); +-int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags); ++int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags, bool runtime); + int usb4_switch_set_sleep(struct tb_switch *sw); + int usb4_switch_nvm_sector_size(struct tb_switch *sw); + int usb4_switch_nvm_read(struct tb_switch *sw, unsigned int address, void *buf, +--- a/drivers/thunderbolt/usb4.c ++++ b/drivers/thunderbolt/usb4.c +@@ -403,12 +403,12 @@ bool usb4_switch_lane_bonding_possible(s + * usb4_switch_set_wake() - Enabled/disable wake + * @sw: USB4 router + * @flags: Wakeup flags (%0 to disable) ++ * @runtime: Wake is being programmed during system runtime + * + * Enables/disables router to wake up from sleep. + */ +-int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags) ++int usb4_switch_set_wake(struct tb_switch *sw, unsigned int flags, bool runtime) + { +- struct usb4_port *usb4; + struct tb_port *port; + u64 route = tb_route(sw); + u32 val; +@@ -438,13 +438,11 @@ int usb4_switch_set_wake(struct tb_switc + val |= PORT_CS_19_WOU4; + } else { + bool configured = val & PORT_CS_19_PC; +- usb4 = port->usb4; ++ bool wakeup = runtime || device_may_wakeup(&port->usb4->dev); + +- if (((flags & TB_WAKE_ON_CONNECT) && +- device_may_wakeup(&usb4->dev)) && !configured) ++ if ((flags & TB_WAKE_ON_CONNECT) && wakeup && !configured) + val |= PORT_CS_19_WOC; +- if (((flags & TB_WAKE_ON_DISCONNECT) && +- device_may_wakeup(&usb4->dev)) && configured) ++ if ((flags & TB_WAKE_ON_DISCONNECT) && wakeup && configured) + val |= PORT_CS_19_WOD; + if ((flags & TB_WAKE_ON_USB4) && configured) + val |= PORT_CS_19_WOU4; diff --git a/queue-6.15/tools-hv-fcopy-fix-irregularities-with-size-of-ring-buffer.patch b/queue-6.15/tools-hv-fcopy-fix-irregularities-with-size-of-ring-buffer.patch new file mode 100644 index 0000000000..529707c86a --- /dev/null +++ b/queue-6.15/tools-hv-fcopy-fix-irregularities-with-size-of-ring-buffer.patch @@ -0,0 +1,180 @@ +From a4131a50d072b369bfed0b41e741c41fd8048641 Mon Sep 17 00:00:00 2001 +From: Naman Jain +Date: Fri, 11 Jul 2025 11:38:46 +0530 +Subject: tools/hv: fcopy: Fix irregularities with size of ring buffer + +From: Naman Jain + +commit a4131a50d072b369bfed0b41e741c41fd8048641 upstream. + +Size of ring buffer, as defined in uio_hv_generic driver, is no longer +fixed to 16 KB. This creates a problem in fcopy, since this size was +hardcoded. With the change in place to make ring sysfs node actually +reflect the size of underlying ring buffer, it is safe to get the size +of ring sysfs file and use it for ring buffer size in fcopy daemon. +Fix the issue of disparity in ring buffer size, by making it dynamic +in fcopy uio daemon. + +Cc: stable@vger.kernel.org +Fixes: 0315fef2aff9 ("uio_hv_generic: Align ring size to system page") +Signed-off-by: Naman Jain +Reviewed-by: Saurabh Sengar +Reviewed-by: Long Li +Link: https://lore.kernel.org/r/20250711060846.9168-1-namjain@linux.microsoft.com +Signed-off-by: Wei Liu +Message-ID: <20250711060846.9168-1-namjain@linux.microsoft.com> +Signed-off-by: Greg Kroah-Hartman +--- + tools/hv/hv_fcopy_uio_daemon.c | 91 ++++++++++++++++++++++++++++++++++++----- + 1 file changed, 81 insertions(+), 10 deletions(-) + +--- a/tools/hv/hv_fcopy_uio_daemon.c ++++ b/tools/hv/hv_fcopy_uio_daemon.c +@@ -35,7 +35,10 @@ + #define WIN8_SRV_MINOR 1 + #define WIN8_SRV_VERSION (WIN8_SRV_MAJOR << 16 | WIN8_SRV_MINOR) + +-#define FCOPY_UIO "/sys/bus/vmbus/devices/eb765408-105f-49b6-b4aa-c123b64d17d4/uio" ++#define FCOPY_DEVICE_PATH(subdir) \ ++ "/sys/bus/vmbus/devices/eb765408-105f-49b6-b4aa-c123b64d17d4/" #subdir ++#define FCOPY_UIO_PATH FCOPY_DEVICE_PATH(uio) ++#define FCOPY_CHANNELS_PATH FCOPY_DEVICE_PATH(channels) + + #define FCOPY_VER_COUNT 1 + static const int fcopy_versions[] = { +@@ -47,9 +50,62 @@ static const int fw_versions[] = { + UTIL_FW_VERSION + }; + +-#define HV_RING_SIZE 0x4000 /* 16KB ring buffer size */ ++static uint32_t get_ring_buffer_size(void) ++{ ++ char ring_path[PATH_MAX]; ++ DIR *dir; ++ struct dirent *entry; ++ struct stat st; ++ uint32_t ring_size = 0; ++ int retry_count = 0; + +-static unsigned char desc[HV_RING_SIZE]; ++ /* Find the channel directory */ ++ dir = opendir(FCOPY_CHANNELS_PATH); ++ if (!dir) { ++ usleep(100 * 1000); /* Avoid race with kernel, wait 100ms and retry once */ ++ dir = opendir(FCOPY_CHANNELS_PATH); ++ if (!dir) { ++ syslog(LOG_ERR, "Failed to open channels directory: %s", strerror(errno)); ++ return 0; ++ } ++ } ++ ++retry_once: ++ while ((entry = readdir(dir)) != NULL) { ++ if (entry->d_type == DT_DIR && strcmp(entry->d_name, ".") != 0 && ++ strcmp(entry->d_name, "..") != 0) { ++ snprintf(ring_path, sizeof(ring_path), "%s/%s/ring", ++ FCOPY_CHANNELS_PATH, entry->d_name); ++ ++ if (stat(ring_path, &st) == 0) { ++ /* ++ * stat returns size of Tx, Rx rings combined, ++ * so take half of it for individual ring size. ++ */ ++ ring_size = (uint32_t)st.st_size / 2; ++ syslog(LOG_INFO, "Ring buffer size from %s: %u bytes", ++ ring_path, ring_size); ++ break; ++ } ++ } ++ } ++ ++ if (!ring_size && retry_count == 0) { ++ retry_count = 1; ++ rewinddir(dir); ++ usleep(100 * 1000); /* Wait 100ms and retry once */ ++ goto retry_once; ++ } ++ ++ closedir(dir); ++ ++ if (!ring_size) ++ syslog(LOG_ERR, "Could not determine ring size"); ++ ++ return ring_size; ++} ++ ++static unsigned char *desc; + + static int target_fd; + static char target_fname[PATH_MAX]; +@@ -406,7 +462,7 @@ int main(int argc, char *argv[]) + int daemonize = 1, long_index = 0, opt, ret = -EINVAL; + struct vmbus_br txbr, rxbr; + void *ring; +- uint32_t len = HV_RING_SIZE; ++ uint32_t ring_size, len; + char uio_name[NAME_MAX] = {0}; + char uio_dev_path[PATH_MAX] = {0}; + +@@ -437,7 +493,20 @@ int main(int argc, char *argv[]) + openlog("HV_UIO_FCOPY", 0, LOG_USER); + syslog(LOG_INFO, "starting; pid is:%d", getpid()); + +- fcopy_get_first_folder(FCOPY_UIO, uio_name); ++ ring_size = get_ring_buffer_size(); ++ if (!ring_size) { ++ ret = -ENODEV; ++ goto exit; ++ } ++ ++ desc = malloc(ring_size * sizeof(unsigned char)); ++ if (!desc) { ++ syslog(LOG_ERR, "malloc failed for desc buffer"); ++ ret = -ENOMEM; ++ goto exit; ++ } ++ ++ fcopy_get_first_folder(FCOPY_UIO_PATH, uio_name); + snprintf(uio_dev_path, sizeof(uio_dev_path), "/dev/%s", uio_name); + fcopy_fd = open(uio_dev_path, O_RDWR); + +@@ -445,17 +514,17 @@ int main(int argc, char *argv[]) + syslog(LOG_ERR, "open %s failed; error: %d %s", + uio_dev_path, errno, strerror(errno)); + ret = fcopy_fd; +- goto exit; ++ goto free_desc; + } + +- ring = vmbus_uio_map(&fcopy_fd, HV_RING_SIZE); ++ ring = vmbus_uio_map(&fcopy_fd, ring_size); + if (!ring) { + ret = errno; + syslog(LOG_ERR, "mmap ringbuffer failed; error: %d %s", ret, strerror(ret)); + goto close; + } +- vmbus_br_setup(&txbr, ring, HV_RING_SIZE); +- vmbus_br_setup(&rxbr, (char *)ring + HV_RING_SIZE, HV_RING_SIZE); ++ vmbus_br_setup(&txbr, ring, ring_size); ++ vmbus_br_setup(&rxbr, (char *)ring + ring_size, ring_size); + + rxbr.vbr->imask = 0; + +@@ -472,7 +541,7 @@ int main(int argc, char *argv[]) + goto close; + } + +- len = HV_RING_SIZE; ++ len = ring_size; + ret = rte_vmbus_chan_recv_raw(&rxbr, desc, &len); + if (unlikely(ret <= 0)) { + /* This indicates a failure to communicate (or worse) */ +@@ -492,6 +561,8 @@ int main(int argc, char *argv[]) + } + close: + close(fcopy_fd); ++free_desc: ++ free(desc); + exit: + return ret; + } diff --git a/queue-6.15/tracing-add-down_write-trace_event_sem-when-adding-trace-event.patch b/queue-6.15/tracing-add-down_write-trace_event_sem-when-adding-trace-event.patch new file mode 100644 index 0000000000..94a2ab3877 --- /dev/null +++ b/queue-6.15/tracing-add-down_write-trace_event_sem-when-adding-trace-event.patch @@ -0,0 +1,61 @@ +From b5e8acc14dcb314a9b61ff19dcd9fdd0d88f70df Mon Sep 17 00:00:00 2001 +From: Steven Rostedt +Date: Fri, 18 Jul 2025 22:31:58 -0400 +Subject: tracing: Add down_write(trace_event_sem) when adding trace event +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steven Rostedt + +commit b5e8acc14dcb314a9b61ff19dcd9fdd0d88f70df upstream. + +When a module is loaded, it adds trace events defined by the module. It +may also need to modify the modules trace printk formats to replace enum +names with their values. + +If two modules are loaded at the same time, the adding of the event to the +ftrace_events list can corrupt the walking of the list in the code that is +modifying the printk format strings and crash the kernel. + +The addition of the event should take the trace_event_sem for write while +it adds the new event. + +Also add a lockdep_assert_held() on that semaphore in +__trace_add_event_dirs() as it iterates the list. + +Cc: stable@vger.kernel.org +Cc: Mathieu Desnoyers +Acked-by: Masami Hiramatsu (Google) +Link: https://lore.kernel.org/20250718223158.799bfc0c@batman.local.home +Reported-by: Fusheng Huang(黄富生) +Closes: https://lore.kernel.org/all/20250717105007.46ccd18f@batman.local.home/ +Fixes: 110bf2b764eb6 ("tracing: add protection around module events unload") +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -3125,7 +3125,10 @@ __register_event(struct trace_event_call + if (ret < 0) + return ret; + ++ down_write(&trace_event_sem); + list_add(&call->list, &ftrace_events); ++ up_write(&trace_event_sem); ++ + if (call->flags & TRACE_EVENT_FL_DYNAMIC) + atomic_set(&call->refcnt, 0); + else +@@ -3739,6 +3742,8 @@ __trace_add_event_dirs(struct trace_arra + struct trace_event_call *call; + int ret; + ++ lockdep_assert_held(&trace_event_sem); ++ + list_for_each_entry(call, &ftrace_events, list) { + ret = __trace_add_new_event(call, tr); + if (ret < 0) diff --git a/queue-6.15/tracing-osnoise-fix-crash-in-timerlat_dump_stack.patch b/queue-6.15/tracing-osnoise-fix-crash-in-timerlat_dump_stack.patch new file mode 100644 index 0000000000..8624031e12 --- /dev/null +++ b/queue-6.15/tracing-osnoise-fix-crash-in-timerlat_dump_stack.patch @@ -0,0 +1,72 @@ +From 85a3bce695b361d85fc528e6fbb33e4c8089c806 Mon Sep 17 00:00:00 2001 +From: Tomas Glozar +Date: Wed, 16 Jul 2025 16:36:01 +0200 +Subject: tracing/osnoise: Fix crash in timerlat_dump_stack() + +From: Tomas Glozar + +commit 85a3bce695b361d85fc528e6fbb33e4c8089c806 upstream. + +We have observed kernel panics when using timerlat with stack saving, +with the following dmesg output: + +memcpy: detected buffer overflow: 88 byte write of buffer size 0 +WARNING: CPU: 2 PID: 8153 at lib/string_helpers.c:1032 __fortify_report+0x55/0xa0 +CPU: 2 UID: 0 PID: 8153 Comm: timerlatu/2 Kdump: loaded Not tainted 6.15.3-200.fc42.x86_64 #1 PREEMPT(lazy) +Call Trace: + + ? trace_buffer_lock_reserve+0x2a/0x60 + __fortify_panic+0xd/0xf + __timerlat_dump_stack.cold+0xd/0xd + timerlat_dump_stack.part.0+0x47/0x80 + timerlat_fd_read+0x36d/0x390 + vfs_read+0xe2/0x390 + ? syscall_exit_to_user_mode+0x1d5/0x210 + ksys_read+0x73/0xe0 + do_syscall_64+0x7b/0x160 + ? exc_page_fault+0x7e/0x1a0 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +__timerlat_dump_stack() constructs the ftrace stack entry like this: + +struct stack_entry *entry; +... +memcpy(&entry->caller, fstack->calls, size); +entry->size = fstack->nr_entries; + +Since commit e7186af7fb26 ("tracing: Add back FORTIFY_SOURCE logic to +kernel_stack event structure"), struct stack_entry marks its caller +field with __counted_by(size). At the time of the memcpy, entry->size +contains garbage from the ringbuffer, which under some circumstances is +zero, triggering a kernel panic by buffer overflow. + +Populate the size field before the memcpy so that the out-of-bounds +check knows the correct size. This is analogous to +__ftrace_trace_stack(). + +Cc: stable@vger.kernel.org +Cc: John Kacur +Cc: Luis Goncalves +Cc: Attila Fazekas +Link: https://lore.kernel.org/20250716143601.7313-1-tglozar@redhat.com +Fixes: e7186af7fb26 ("tracing: Add back FORTIFY_SOURCE logic to kernel_stack event structure") +Signed-off-by: Tomas Glozar +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_osnoise.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/trace/trace_osnoise.c ++++ b/kernel/trace/trace_osnoise.c +@@ -637,8 +637,8 @@ __timerlat_dump_stack(struct trace_buffe + + entry = ring_buffer_event_data(event); + +- memcpy(&entry->caller, fstack->calls, size); + entry->size = fstack->nr_entries; ++ memcpy(&entry->caller, fstack->calls, size); + + trace_buffer_unlock_commit_nostack(buffer, event); + } diff --git a/queue-6.15/tracing-probes-avoid-using-params-uninitialized-in-parse_btf_arg.patch b/queue-6.15/tracing-probes-avoid-using-params-uninitialized-in-parse_btf_arg.patch new file mode 100644 index 0000000000..510e15c580 --- /dev/null +++ b/queue-6.15/tracing-probes-avoid-using-params-uninitialized-in-parse_btf_arg.patch @@ -0,0 +1,44 @@ +From 1ed171a3afe81531b3ace96bd151a372dda3ee25 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Tue, 15 Jul 2025 20:19:44 -0700 +Subject: tracing/probes: Avoid using params uninitialized in parse_btf_arg() + +From: Nathan Chancellor + +commit 1ed171a3afe81531b3ace96bd151a372dda3ee25 upstream. + +After a recent change in clang to strengthen uninitialized warnings [1], +it points out that in one of the error paths in parse_btf_arg(), params +is used uninitialized: + + kernel/trace/trace_probe.c:660:19: warning: variable 'params' is uninitialized when used here [-Wuninitialized] + 660 | return PTR_ERR(params); + | ^~~~~~ + +Match many other NO_BTF_ENTRY error cases and return -ENOENT, clearing +up the warning. + +Link: https://lore.kernel.org/all/20250715-trace_probe-fix-const-uninit-warning-v1-1-98960f91dd04@kernel.org/ + +Cc: stable@vger.kernel.org +Closes: https://github.com/ClangBuiltLinux/linux/issues/2110 +Fixes: d157d7694460 ("tracing/probes: Support BTF field access from $retval") +Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1] +Signed-off-by: Nathan Chancellor +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_probe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -657,7 +657,7 @@ static int parse_btf_arg(char *varname, + ret = query_btf_context(ctx); + if (ret < 0 || ctx->nr_params == 0) { + trace_probe_log_err(ctx->offset, NO_BTF_ENTRY); +- return PTR_ERR(params); ++ return -ENOENT; + } + } + params = ctx->params; diff --git a/queue-6.15/usb-dwc2-gadget-fix-enter-to-hibernation-for-utmi-phy.patch b/queue-6.15/usb-dwc2-gadget-fix-enter-to-hibernation-for-utmi-phy.patch new file mode 100644 index 0000000000..8b0a2b323e --- /dev/null +++ b/queue-6.15/usb-dwc2-gadget-fix-enter-to-hibernation-for-utmi-phy.patch @@ -0,0 +1,73 @@ +From 5724ff190b22bd04fcfd7287a39c6e5494e40f0b Mon Sep 17 00:00:00 2001 +From: Minas Harutyunyan +Date: Mon, 7 Jul 2025 09:54:19 +0000 +Subject: usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY + +From: Minas Harutyunyan + +commit 5724ff190b22bd04fcfd7287a39c6e5494e40f0b upstream. + +For UTMI+ PHY, according to programming guide, first should be set +PMUACTV bit then STOPPCLK bit. Otherwise, when the device issues +Remote Wakeup, then host notices disconnect instead. +For ULPI PHY, above mentioned bits must be set in reversed order: +STOPPCLK then PMUACTV. + +Fixes: 4483ef3c1685 ("usb: dwc2: Add hibernation updates for ULPI PHY") +Cc: stable +Signed-off-by: Minas Harutyunyan +Link: https://lore.kernel.org/r/692110d3c3d9bb2a91cedf24528a7710adc55452.1751881374.git.Minas.Harutyunyan@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/gadget.c | 38 ++++++++++++++++++++++++++------------ + 1 file changed, 26 insertions(+), 12 deletions(-) + +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -5389,20 +5389,34 @@ int dwc2_gadget_enter_hibernation(struct + if (gusbcfg & GUSBCFG_ULPI_UTMI_SEL) { + /* ULPI interface */ + gpwrdn |= GPWRDN_ULPI_LATCH_EN_DURING_HIB_ENTRY; +- } +- dwc2_writel(hsotg, gpwrdn, GPWRDN); +- udelay(10); ++ dwc2_writel(hsotg, gpwrdn, GPWRDN); ++ udelay(10); ++ ++ /* Suspend the Phy Clock */ ++ pcgcctl = dwc2_readl(hsotg, PCGCTL); ++ pcgcctl |= PCGCTL_STOPPCLK; ++ dwc2_writel(hsotg, pcgcctl, PCGCTL); ++ udelay(10); + +- /* Suspend the Phy Clock */ +- pcgcctl = dwc2_readl(hsotg, PCGCTL); +- pcgcctl |= PCGCTL_STOPPCLK; +- dwc2_writel(hsotg, pcgcctl, PCGCTL); +- udelay(10); ++ gpwrdn = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn |= GPWRDN_PMUACTV; ++ dwc2_writel(hsotg, gpwrdn, GPWRDN); ++ udelay(10); ++ } else { ++ /* UTMI+ Interface */ ++ dwc2_writel(hsotg, gpwrdn, GPWRDN); ++ udelay(10); + +- gpwrdn = dwc2_readl(hsotg, GPWRDN); +- gpwrdn |= GPWRDN_PMUACTV; +- dwc2_writel(hsotg, gpwrdn, GPWRDN); +- udelay(10); ++ gpwrdn = dwc2_readl(hsotg, GPWRDN); ++ gpwrdn |= GPWRDN_PMUACTV; ++ dwc2_writel(hsotg, gpwrdn, GPWRDN); ++ udelay(10); ++ ++ pcgcctl = dwc2_readl(hsotg, PCGCTL); ++ pcgcctl |= PCGCTL_STOPPCLK; ++ dwc2_writel(hsotg, pcgcctl, PCGCTL); ++ udelay(10); ++ } + + /* Set flag to indicate that we are in hibernation */ + hsotg->hibernated = 1; diff --git a/queue-6.15/usb-gadget-configfs-fix-oob-read-on-empty-string-write.patch b/queue-6.15/usb-gadget-configfs-fix-oob-read-on-empty-string-write.patch new file mode 100644 index 0000000000..f5d2a1f129 --- /dev/null +++ b/queue-6.15/usb-gadget-configfs-fix-oob-read-on-empty-string-write.patch @@ -0,0 +1,45 @@ +From 3014168731b7930300aab656085af784edc861f6 Mon Sep 17 00:00:00 2001 +From: Xinyu Liu <1171169449@qq.com> +Date: Wed, 9 Jul 2025 11:55:33 +0800 +Subject: usb: gadget: configfs: Fix OOB read on empty string write + +From: Xinyu Liu <1171169449@qq.com> + +commit 3014168731b7930300aab656085af784edc861f6 upstream. + +When writing an empty string to either 'qw_sign' or 'landingPage' +sysfs attributes, the store functions attempt to access page[l - 1] +before validating that the length 'l' is greater than zero. + +This patch fixes the vulnerability by adding a check at the beginning +of os_desc_qw_sign_store() and webusb_landingPage_store() to handle +the zero-length input case gracefully by returning immediately. + +Signed-off-by: Xinyu Liu +Cc: stable +Link: https://lore.kernel.org/r/tencent_B1C9481688D0E95E7362AB2E999DE8048207@qq.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/configfs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -1065,6 +1065,8 @@ static ssize_t webusb_landingPage_store( + unsigned int bytes_to_strip = 0; + int l = len; + ++ if (!len) ++ return len; + if (page[l - 1] == '\n') { + --l; + ++bytes_to_strip; +@@ -1188,6 +1190,8 @@ static ssize_t os_desc_qw_sign_store(str + struct gadget_info *gi = os_desc_item_to_gadget_info(item); + int res, l; + ++ if (!len) ++ return len; + l = min_t(int, len, OS_STRING_QW_SIGN_LEN >> 1); + if (page[l - 1] == '\n') + --l; diff --git a/queue-6.15/usb-musb-fix-gadget-state-on-disconnect.patch b/queue-6.15/usb-musb-fix-gadget-state-on-disconnect.patch new file mode 100644 index 0000000000..4c9ba6e882 --- /dev/null +++ b/queue-6.15/usb-musb-fix-gadget-state-on-disconnect.patch @@ -0,0 +1,53 @@ +From 67a59f82196c8c4f50c83329f0577acfb1349b50 Mon Sep 17 00:00:00 2001 +From: Drew Hamilton +Date: Tue, 1 Jul 2025 11:41:26 -0400 +Subject: usb: musb: fix gadget state on disconnect + +From: Drew Hamilton + +commit 67a59f82196c8c4f50c83329f0577acfb1349b50 upstream. + +When unplugging the USB cable or disconnecting a gadget in usb peripheral mode with +echo "" > /sys/kernel/config/usb_gadget//UDC, +/sys/class/udc/musb-hdrc.0/state does not change from USB_STATE_CONFIGURED. + +Testing on dwc2/3 shows they both update the state to USB_STATE_NOTATTACHED. + +Add calls to usb_gadget_set_state in musb_g_disconnect and musb_gadget_stop +to fix both cases. + +Fixes: 49401f4169c0 ("usb: gadget: introduce gadget state tracking") +Cc: stable@vger.kernel.org +Co-authored-by: Yehowshua Immanuel +Signed-off-by: Yehowshua Immanuel +Signed-off-by: Drew Hamilton +Link: https://lore.kernel.org/r/20250701154126.8543-1-drew.hamilton@zetier.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/musb/musb_gadget.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c +index 6869c58367f2..caf4d4cd4b75 100644 +--- a/drivers/usb/musb/musb_gadget.c ++++ b/drivers/usb/musb/musb_gadget.c +@@ -1913,6 +1913,7 @@ static int musb_gadget_stop(struct usb_gadget *g) + * gadget driver here and have everything work; + * that currently misbehaves. + */ ++ usb_gadget_set_state(g, USB_STATE_NOTATTACHED); + + /* Force check of devctl register for PM runtime */ + pm_runtime_mark_last_busy(musb->controller); +@@ -2019,6 +2020,7 @@ void musb_g_disconnect(struct musb *musb) + case OTG_STATE_B_PERIPHERAL: + case OTG_STATE_B_IDLE: + musb_set_state(musb, OTG_STATE_B_IDLE); ++ usb_gadget_set_state(&musb->g, USB_STATE_NOTATTACHED); + break; + case OTG_STATE_B_SRP_INIT: + break; +-- +2.50.1 + diff --git a/queue-6.15/usb-serial-ftdi_sio-add-support-for-ndi-emguide-gemini.patch b/queue-6.15/usb-serial-ftdi_sio-add-support-for-ndi-emguide-gemini.patch new file mode 100644 index 0000000000..d788382d47 --- /dev/null +++ b/queue-6.15/usb-serial-ftdi_sio-add-support-for-ndi-emguide-gemini.patch @@ -0,0 +1,46 @@ +From c980666b6958d9a841597331b38115a29a32250e Mon Sep 17 00:00:00 2001 +From: "Ryan Mann (NDI)" +Date: Thu, 10 Jul 2025 13:08:00 +0000 +Subject: USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI + +From: Ryan Mann (NDI) + +commit c980666b6958d9a841597331b38115a29a32250e upstream. + +NDI (Northern Digital Inc.) is introducing a new product called the +EMGUIDE GEMINI that will use an FTDI chip for USB serial communications. +Add the NDI EMGUIDE GEMINI product ID that uses the NDI Vendor ID +rather than the FTDI Vendor ID, unlike older products. + +Signed-off-by: Ryan Mann +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio_ids.h | 3 +++ + 2 files changed, 5 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -803,6 +803,8 @@ static const struct usb_device_id id_tab + .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID), + .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, ++ { USB_DEVICE(FTDI_NDI_VID, FTDI_NDI_EMGUIDE_GEMINI_PID), ++ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, + { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, + { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) }, + { USB_DEVICE(FTDI_VID, RTSYSTEMS_USB_VX8_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -204,6 +204,9 @@ + #define FTDI_NDI_FUTURE_3_PID 0xDA73 /* NDI future device #3 */ + #define FTDI_NDI_AURORA_SCU_PID 0xDA74 /* NDI Aurora SCU */ + ++#define FTDI_NDI_VID 0x23F2 ++#define FTDI_NDI_EMGUIDE_GEMINI_PID 0x0003 /* NDI Emguide Gemini */ ++ + /* + * ChamSys Limited (www.chamsys.co.uk) USB wing/interface product IDs + */ diff --git a/queue-6.15/usb-serial-option-add-foxconn-t99w640.patch b/queue-6.15/usb-serial-option-add-foxconn-t99w640.patch new file mode 100644 index 0000000000..f046cdfe2e --- /dev/null +++ b/queue-6.15/usb-serial-option-add-foxconn-t99w640.patch @@ -0,0 +1,60 @@ +From 08f49cdb71f3759368fded4dbc9dde35a404ec2b Mon Sep 17 00:00:00 2001 +From: Slark Xiao +Date: Fri, 20 Jun 2025 11:57:21 +0800 +Subject: USB: serial: option: add Foxconn T99W640 + +From: Slark Xiao + +commit 08f49cdb71f3759368fded4dbc9dde35a404ec2b upstream. + +T99W640 is designed based on Qualconn SDX72 chip. There are 3 +serial ports to be enumerated: Diag, NMEA and AT. + +Test evidence as below: +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=0489 ProdID=e167 Rev=05.15 +S: Manufacturer=QCOM +S: Product=SDXPINNL USB WWAN Adapter +S: SerialNumber=cc1f1d92 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag + +Signed-off-by: Slark Xiao +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2346,6 +2346,8 @@ static const struct usb_device_id option + .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */ + .driver_info = RSVD(5) | RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe167, 0xff), /* Foxconn T99W640 MBIM */ ++ .driver_info = RSVD(3) }, + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, + { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */ diff --git a/queue-6.15/usb-serial-option-add-telit-cinterion-fe910c04-ecm-composition.patch b/queue-6.15/usb-serial-option-add-telit-cinterion-fe910c04-ecm-composition.patch new file mode 100644 index 0000000000..f281a8ef27 --- /dev/null +++ b/queue-6.15/usb-serial-option-add-telit-cinterion-fe910c04-ecm-composition.patch @@ -0,0 +1,57 @@ +From 252f4ac08cd2f16ecd20e4c5e41ac2a17dd86942 Mon Sep 17 00:00:00 2001 +From: Fabio Porcedda +Date: Thu, 10 Jul 2025 14:16:38 +0200 +Subject: USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition + +From: Fabio Porcedda + +commit 252f4ac08cd2f16ecd20e4c5e41ac2a17dd86942 upstream. + +Add Telit Cinterion FE910C04 (ECM) composition: +0x10c7: ECM + tty (AT) + tty (AT) + tty (diag) + +usb-devices output: +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10c7 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE910 +S: SerialNumber=f71b8b32 +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: stable@vger.kernel.org +Signed-off-by: Fabio Porcedda +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1415,6 +1415,9 @@ static const struct usb_device_id option + .driver_info = NCTRL(5) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */ ++ .driver_info = NCTRL(4) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */ + .driver_info = NCTRL(6) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) },