--- /dev/null
+From d90eeb8ecd227c204ab6c34a17b372bd950b7aa2 Mon Sep 17 00:00:00 2001
+From: Alice Ryhl <aliceryhl@google.com>
+Date: Wed, 15 Oct 2025 14:26:55 +0000
+Subject: binder: remove "invalid inc weak" check
+
+From: Alice Ryhl <aliceryhl@google.com>
+
+commit d90eeb8ecd227c204ab6c34a17b372bd950b7aa2 upstream.
+
+There are no scenarios where a weak increment is invalid on binder_node.
+The only possible case where it could be invalid is if the kernel
+delivers BR_DECREFS to the process that owns the node, and then
+increments the weak refcount again, effectively "reviving" a dead node.
+
+However, that is not possible: when the BR_DECREFS command is delivered,
+the kernel removes and frees the binder_node. The fact that you were
+able to call binder_inc_node_nilocked() implies that the node is not yet
+destroyed, which implies that BR_DECREFS has not been delivered to
+userspace, so incrementing the weak refcount is valid.
+
+Note that it's currently possible to trigger this condition if the owner
+calls BINDER_THREAD_EXIT while node->has_weak_ref is true. This causes
+BC_INCREFS on binder_ref instances to fail when they should not.
+
+Cc: stable@vger.kernel.org
+Fixes: 457b9a6f09f0 ("Staging: android: add binder driver")
+Reported-by: Yu-Ting Tseng <yutingtseng@google.com>
+Signed-off-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20251015-binder-weak-inc-v1-1-7914b092c371@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/android/binder.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -846,17 +846,8 @@ static int binder_inc_node_nilocked(stru
+ } else {
+ if (!internal)
+ node->local_weak_refs++;
+- if (!node->has_weak_ref && list_empty(&node->work.entry)) {
+- if (target_list == NULL) {
+- pr_err("invalid inc weak node for %d\n",
+- node->debug_id);
+- return -EINVAL;
+- }
+- /*
+- * See comment above
+- */
++ if (!node->has_weak_ref && target_list && list_empty(&node->work.entry))
+ binder_enqueue_work_ilocked(&node->work, target_list);
+- }
+ }
+ return 0;
+ }
--- /dev/null
+From 87b318ba81dda2ee7b603f4f6c55e78ec3e95974 Mon Sep 17 00:00:00 2001
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+Date: Wed, 24 Sep 2025 15:56:39 +0530
+Subject: comedi: fix divide-by-zero in comedi_buf_munge()
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+commit 87b318ba81dda2ee7b603f4f6c55e78ec3e95974 upstream.
+
+The comedi_buf_munge() function performs a modulo operation
+`async->munge_chan %= async->cmd.chanlist_len` without first
+checking if chanlist_len is zero. If a user program submits a command with
+chanlist_len set to zero, this causes a divide-by-zero error when the device
+processes data in the interrupt handler path.
+
+Add a check for zero chanlist_len at the beginning of the
+function, similar to the existing checks for !map and
+CMDF_RAWDATA flag. When chanlist_len is zero, update
+munge_count and return early, indicating the data was
+handled without munging.
+
+This prevents potential kernel panics from malformed user commands.
+
+Reported-by: syzbot+f6c3c066162d2c43a66c@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=f6c3c066162d2c43a66c
+Cc: stable@vger.kernel.org
+Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
+Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
+Link: https://patch.msgid.link/20250924102639.1256191-1-kartikey406@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/comedi/comedi_buf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/comedi/comedi_buf.c
++++ b/drivers/comedi/comedi_buf.c
+@@ -368,7 +368,7 @@ static unsigned int comedi_buf_munge(str
+ unsigned int count = 0;
+ const unsigned int num_sample_bytes = comedi_bytes_per_sample(s);
+
+- if (!s->munge || (async->cmd.flags & CMDF_RAWDATA)) {
++ if (!s->munge || (async->cmd.flags & CMDF_RAWDATA) || async->cmd.chanlist_len == 0) {
+ async->munge_count += num_bytes;
+ return num_bytes;
+ }
--- /dev/null
+From 268eb6fb908bc82ce479e4dba9a2cad11f536c9c Mon Sep 17 00:00:00 2001
+From: Xu Yang <xu.yang_2@nxp.com>
+Date: Fri, 19 Sep 2025 14:25:34 +0800
+Subject: dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+commit 268eb6fb908bc82ce479e4dba9a2cad11f536c9c upstream.
+
+Only i.MX8MP need dma-range property to let USB controller work properly.
+Remove dma-range from required list and add limitation for imx8mp.
+
+Fixes: d2a704e29711 ("dt-bindings: usb: dwc3-imx8mp: add imx8mp dwc3 glue bindings")
+Cc: stable <stable@kernel.org>
+Reviewed-by: Jun Li <jun.li@nxp.com>
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml
++++ b/Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml
+@@ -85,13 +85,21 @@ required:
+ - reg
+ - "#address-cells"
+ - "#size-cells"
+- - dma-ranges
+ - ranges
+ - clocks
+ - clock-names
+ - interrupts
+ - power-domains
+
++allOf:
++ - if:
++ properties:
++ compatible:
++ const: fsl,imx8mp-dwc3
++ then:
++ required:
++ - dma-ranges
++
+ additionalProperties: false
+
+ examples:
--- /dev/null
+From 410d6c2ad4d1a88efa0acbb9966693725b564933 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Thu, 16 Oct 2025 15:59:12 +0300
+Subject: mei: me: add wildcat lake P DID
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 410d6c2ad4d1a88efa0acbb9966693725b564933 upstream.
+
+Add Wildcat Lake P device id.
+
+Cc: stable@vger.kernel.org
+Co-developed-by: Tomas Winkler <tomasw@gmail.com>
+Signed-off-by: Tomas Winkler <tomasw@gmail.com>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Link: https://patch.msgid.link/20251016125912.2146136-1-alexander.usyskin@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/mei/hw-me-regs.h | 2 ++
+ drivers/misc/mei/pci-me.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -120,6 +120,8 @@
+ #define MEI_DEV_ID_PTL_H 0xE370 /* Panther Lake H */
+ #define MEI_DEV_ID_PTL_P 0xE470 /* Panther Lake P */
+
++#define MEI_DEV_ID_WCL_P 0x4D70 /* Wildcat Lake P */
++
+ /*
+ * MEI HW Section
+ */
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -127,6 +127,8 @@ static const struct pci_device_id mei_me
+ {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_H, MEI_ME_PCH15_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_P, MEI_ME_PCH15_CFG)},
+
++ {MEI_PCI_DEVICE(MEI_DEV_ID_WCL_P, MEI_ME_PCH15_CFG)},
++
+ /* required last entry */
+ {0, }
+ };
--- /dev/null
+From fff111bf45cbeeb659324316d68554e35d350092 Mon Sep 17 00:00:00 2001
+From: Junhao Xie <bigfoot@radxa.com>
+Date: Fri, 17 Oct 2025 16:39:06 +0800
+Subject: misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
+
+From: Junhao Xie <bigfoot@radxa.com>
+
+commit fff111bf45cbeeb659324316d68554e35d350092 upstream.
+
+In fastrpc_map_lookup, dma_buf_get is called to obtain a reference to
+the dma_buf for comparison purposes. However, this reference is never
+released when the function returns, leading to a dma_buf memory leak.
+
+Fix this by adding dma_buf_put before returning from the function,
+ensuring that the temporarily acquired reference is properly released
+regardless of whether a matching map is found.
+
+Fixes: 9031626ade38 ("misc: fastrpc: Fix fastrpc_map_lookup operation")
+Cc: stable@kernel.org
+Signed-off-by: Junhao Xie <bigfoot@radxa.com>
+Tested-by: Xilin Wu <sophon@radxa.com>
+Link: https://lore.kernel.org/stable/48B368FB4C7007A7%2B20251017083906.3259343-1-bigfoot%40radxa.com
+Link: https://patch.msgid.link/48B368FB4C7007A7+20251017083906.3259343-1-bigfoot@radxa.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/fastrpc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/misc/fastrpc.c
++++ b/drivers/misc/fastrpc.c
+@@ -384,6 +384,8 @@ static int fastrpc_map_lookup(struct fas
+ }
+ spin_unlock(&fl->lock);
+
++ dma_buf_put(buf);
++
+ return ret;
+ }
+
--- /dev/null
+From 4b1270902609ef0d935ed2faa2ea6d122bd148f5 Mon Sep 17 00:00:00 2001
+From: Victoria Votokina <Victoria.Votokina@kaspersky.com>
+Date: Fri, 10 Oct 2025 13:52:40 +0300
+Subject: most: usb: Fix use-after-free in hdm_disconnect
+
+From: Victoria Votokina <Victoria.Votokina@kaspersky.com>
+
+commit 4b1270902609ef0d935ed2faa2ea6d122bd148f5 upstream.
+
+hdm_disconnect() calls most_deregister_interface(), which eventually
+unregisters the MOST interface device with device_unregister(iface->dev).
+If that drops the last reference, the device core may call release_mdev()
+immediately while hdm_disconnect() is still executing.
+
+The old code also freed several mdev-owned allocations in
+hdm_disconnect() and then performed additional put_device() calls.
+Depending on refcount order, this could lead to use-after-free or
+double-free when release_mdev() ran (or when unregister paths also
+performed puts).
+
+Fix by moving the frees of mdev-owned allocations into release_mdev(),
+so they happen exactly once when the device is truly released, and by
+dropping the extra put_device() calls in hdm_disconnect() that are
+redundant after device_unregister() and most_deregister_interface().
+
+This addresses the KASAN slab-use-after-free reported by syzbot in
+hdm_disconnect(). See report and stack traces in the bug link below.
+
+Reported-by: syzbot+916742d5d24f6c254761@syzkaller.appspotmail.com
+Cc: stable <stable@kernel.org>
+Closes: https://syzkaller.appspot.com/bug?extid=916742d5d24f6c254761
+Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver")
+Signed-off-by: Victoria Votokina <Victoria.Votokina@kaspersky.com>
+Link: https://patch.msgid.link/20251010105241.4087114-2-Victoria.Votokina@kaspersky.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/most/most_usb.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/most/most_usb.c
++++ b/drivers/most/most_usb.c
+@@ -929,6 +929,10 @@ static void release_mdev(struct device *
+ {
+ struct most_dev *mdev = to_mdev_from_dev(dev);
+
++ kfree(mdev->busy_urbs);
++ kfree(mdev->cap);
++ kfree(mdev->conf);
++ kfree(mdev->ep_address);
+ kfree(mdev);
+ }
+ /**
+@@ -1121,13 +1125,6 @@ static void hdm_disconnect(struct usb_in
+ if (mdev->dci)
+ device_unregister(&mdev->dci->dev);
+ most_deregister_interface(&mdev->iface);
+-
+- kfree(mdev->busy_urbs);
+- kfree(mdev->cap);
+- kfree(mdev->conf);
+- kfree(mdev->ep_address);
+- put_device(&mdev->dci->dev);
+- put_device(&mdev->dev);
+ }
+
+ static int hdm_suspend(struct usb_interface *interface, pm_message_t message)
--- /dev/null
+From a8cc9e5fcb0e2eef21513a4fec888f5712cb8162 Mon Sep 17 00:00:00 2001
+From: Victoria Votokina <Victoria.Votokina@kaspersky.com>
+Date: Fri, 10 Oct 2025 13:52:41 +0300
+Subject: most: usb: hdm_probe: Fix calling put_device() before device initialization
+
+From: Victoria Votokina <Victoria.Votokina@kaspersky.com>
+
+commit a8cc9e5fcb0e2eef21513a4fec888f5712cb8162 upstream.
+
+The early error path in hdm_probe() can jump to err_free_mdev before
+&mdev->dev has been initialized with device_initialize(). Calling
+put_device(&mdev->dev) there triggers a device core WARN and ends up
+invoking kref_put(&kobj->kref, kobject_release) on an uninitialized
+kobject.
+
+In this path the private struct was only kmalloc'ed and the intended
+release is effectively kfree(mdev) anyway, so free it directly instead
+of calling put_device() on an uninitialized device.
+
+This removes the WARNING and fixes the pre-initialization error path.
+
+Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Victoria Votokina <Victoria.Votokina@kaspersky.com>
+Link: https://patch.msgid.link/20251010105241.4087114-3-Victoria.Votokina@kaspersky.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/most/most_usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/most/most_usb.c
++++ b/drivers/most/most_usb.c
+@@ -1097,7 +1097,7 @@ err_free_cap:
+ err_free_conf:
+ kfree(mdev->conf);
+ err_free_mdev:
+- put_device(&mdev->dev);
++ kfree(mdev);
+ return ret;
+ }
+
--- /dev/null
+From dbdf2a7feb422f9bacfd12774e624cf26f503eb0 Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Mon, 20 Oct 2025 04:07:14 +0200
+Subject: objtool/rust: add one more `noreturn` Rust function
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+commit dbdf2a7feb422f9bacfd12774e624cf26f503eb0 upstream.
+
+Between Rust 1.79 and 1.86, under `CONFIG_RUST_KERNEL_DOCTESTS=y`,
+`objtool` may report:
+
+ rust/doctests_kernel_generated.o: warning: objtool:
+ rust_doctest_kernel_alloc_kbox_rs_13() falls through to next
+ function rust_doctest_kernel_alloc_kvec_rs_0()
+
+(as well as in rust_doctest_kernel_alloc_kvec_rs_0) due to calls to the
+`noreturn` symbol:
+
+ core::option::expect_failed
+
+from code added in commits 779db37373a3 ("rust: alloc: kvec: implement
+AsPageIter for VVec") and 671618432f46 ("rust: alloc: kbox: implement
+AsPageIter for VBox").
+
+Thus add the mangled one to the list so that `objtool` knows it is
+actually `noreturn`.
+
+This can be reproduced as well in other versions by tweaking the code,
+such as the latest stable Rust (1.90.0).
+
+Stable does not have code that triggers this, but it could have it in
+the future. Downstream forks could too. Thus tag it for backport.
+
+See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions")
+for more details.
+
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Cc: stable@vger.kernel.org # Needed in 6.12.y and later.
+Link: https://patch.msgid.link/20251020020714.2511718-1-ojeda@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/objtool/check.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -209,6 +209,7 @@ static bool is_rust_noreturn(const struc
+ * these come from the Rust standard library).
+ */
+ return str_ends_with(func->name, "_4core5sliceSp15copy_from_slice17len_mismatch_fail") ||
++ str_ends_with(func->name, "_4core6option13expect_failed") ||
+ str_ends_with(func->name, "_4core6option13unwrap_failed") ||
+ str_ends_with(func->name, "_4core6result13unwrap_failed") ||
+ str_ends_with(func->name, "_4core9panicking5panic") ||
--- /dev/null
+From daeb4037adf7d3349b4a1fb792f4bc9824686a4b Mon Sep 17 00:00:00 2001
+From: Artem Shimko <a.shimko.dev@gmail.com>
+Date: Sun, 19 Oct 2025 12:51:31 +0300
+Subject: serial: 8250_dw: handle reset control deassert error
+
+From: Artem Shimko <a.shimko.dev@gmail.com>
+
+commit daeb4037adf7d3349b4a1fb792f4bc9824686a4b upstream.
+
+Check the return value of reset_control_deassert() in the probe
+function to prevent continuing probe when reset deassertion fails.
+
+Previously, reset_control_deassert() was called without checking its
+return value, which could lead to probe continuing even when the
+device reset wasn't properly deasserted.
+
+The fix checks the return value and returns an error with dev_err_probe()
+if reset deassertion fails, providing better error handling and
+diagnostics.
+
+Fixes: acbdad8dd1ab ("serial: 8250_dw: simplify optional reset handling")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Artem Shimko <a.shimko.dev@gmail.com>
+Link: https://patch.msgid.link/20251019095131.252848-1-a.shimko.dev@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_dw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -620,7 +620,9 @@ static int dw8250_probe(struct platform_
+ if (IS_ERR(data->rst))
+ return PTR_ERR(data->rst);
+
+- reset_control_deassert(data->rst);
++ err = reset_control_deassert(data->rst);
++ if (err)
++ return dev_err_probe(dev, err, "failed to deassert resets\n");
+
+ err = devm_add_action_or_reset(dev, dw8250_reset_control_assert, data->rst);
+ if (err)
--- /dev/null
+From e7cbce761fe3fcbcb49bcf30d4f8ca5e1a9ee2a0 Mon Sep 17 00:00:00 2001
+From: Florian Eckert <fe@dev.tdt.de>
+Date: Wed, 24 Sep 2025 15:41:15 +0200
+Subject: serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018
+
+From: Florian Eckert <fe@dev.tdt.de>
+
+commit e7cbce761fe3fcbcb49bcf30d4f8ca5e1a9ee2a0 upstream.
+
+The Advantech 2-port serial card with PCI vendor=0x13fe and device=0x0018
+has a 'XR17V35X' chip installed on the circuit board. Therefore, this
+driver can be used instead of theu outdated out-of-tree driver from the
+manufacturer.
+
+Signed-off-by: Florian Eckert <fe@dev.tdt.de>
+Cc: stable <stable@kernel.org>
+Link: https://patch.msgid.link/20250924134115.2667650-1-fe@dev.tdt.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_exar.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_exar.c
++++ b/drivers/tty/serial/8250/8250_exar.c
+@@ -39,6 +39,8 @@
+ #define PCI_DEVICE_ID_ACCESSIO_COM_4SM 0x10db
+ #define PCI_DEVICE_ID_ACCESSIO_COM_8SM 0x10ea
+
++#define PCI_DEVICE_ID_ADVANTECH_XR17V352 0x0018
++
+ #define PCI_DEVICE_ID_COMMTECH_4224PCI335 0x0002
+ #define PCI_DEVICE_ID_COMMTECH_4222PCI335 0x0004
+ #define PCI_DEVICE_ID_COMMTECH_2324PCI335 0x000a
+@@ -1678,6 +1680,12 @@ static const struct exar8250_board pbn_f
+ .exit = pci_xr17v35x_exit,
+ };
+
++static const struct exar8250_board pbn_adv_XR17V352 = {
++ .num_ports = 2,
++ .setup = pci_xr17v35x_setup,
++ .exit = pci_xr17v35x_exit,
++};
++
+ static const struct exar8250_board pbn_exar_XR17V4358 = {
+ .num_ports = 12,
+ .setup = pci_xr17v35x_setup,
+@@ -1752,6 +1760,9 @@ static const struct pci_device_id exar_p
+ USR_DEVICE(XR17C152, 2980, pbn_exar_XR17C15x),
+ USR_DEVICE(XR17C152, 2981, pbn_exar_XR17C15x),
+
++ /* ADVANTECH devices */
++ EXAR_DEVICE(ADVANTECH, XR17V352, pbn_adv_XR17V352),
++
+ /* Exar Corp. XR17C15[248] Dual/Quad/Octal UART */
+ EXAR_DEVICE(EXAR, XR17C152, pbn_exar_XR17C15x),
+ EXAR_DEVICE(EXAR, XR17C154, pbn_exar_XR17C15x),
--- /dev/null
+From d518314a1fa4e980a227d1b2bda1badf433cb932 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Tue, 16 Sep 2025 22:37:27 +0100
+Subject: serial: 8250_mtk: Enable baud clock and manage in runtime PM
+
+From: Daniel Golle <daniel@makrotopia.org>
+
+commit d518314a1fa4e980a227d1b2bda1badf433cb932 upstream.
+
+Some MediaTek SoCs got a gated UART baud clock, which currently gets
+disabled as the clk subsystem believes it would be unused. This results in
+the uart freezing right after "clk: Disabling unused clocks" on those
+platforms.
+
+Request the baud clock to be prepared and enabled during probe, and to
+restore run-time power management capabilities to what it was before commit
+e32a83c70cf9 ("serial: 8250-mtk: modify mtk uart power and clock
+management") disable and unprepare the baud clock when suspending the UART,
+prepare and enable it again when resuming it.
+
+Fixes: e32a83c70cf9 ("serial: 8250-mtk: modify mtk uart power and clock management")
+Fixes: b6c7ff2693ddc ("serial: 8250_mtk: Simplify clock sequencing and runtime PM")
+Cc: stable <stable@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Link: https://patch.msgid.link/de5197ccc31e1dab0965cabcc11ca92e67246cf6.1758058441.git.daniel@makrotopia.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_mtk.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/8250/8250_mtk.c
++++ b/drivers/tty/serial/8250/8250_mtk.c
+@@ -435,6 +435,7 @@ static int __maybe_unused mtk8250_runtim
+ while
+ (serial_in(up, MTK_UART_DEBUG0));
+
++ clk_disable_unprepare(data->uart_clk);
+ clk_disable_unprepare(data->bus_clk);
+
+ return 0;
+@@ -445,6 +446,7 @@ static int __maybe_unused mtk8250_runtim
+ struct mtk8250_data *data = dev_get_drvdata(dev);
+
+ clk_prepare_enable(data->bus_clk);
++ clk_prepare_enable(data->uart_clk);
+
+ return 0;
+ }
+@@ -475,13 +477,13 @@ static int mtk8250_probe_of(struct platf
+ int dmacnt;
+ #endif
+
+- data->uart_clk = devm_clk_get(&pdev->dev, "baud");
++ data->uart_clk = devm_clk_get_enabled(&pdev->dev, "baud");
+ if (IS_ERR(data->uart_clk)) {
+ /*
+ * For compatibility with older device trees try unnamed
+ * clk when no baud clk can be found.
+ */
+- data->uart_clk = devm_clk_get(&pdev->dev, NULL);
++ data->uart_clk = devm_clk_get_enabled(&pdev->dev, NULL);
+ if (IS_ERR(data->uart_clk)) {
+ dev_warn(&pdev->dev, "Can't get uart clock\n");
+ return PTR_ERR(data->uart_clk);
--- /dev/null
+From 1c05bf6c0262f946571a37678250193e46b1ff0f Mon Sep 17 00:00:00 2001
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Date: Mon, 6 Oct 2025 10:20:02 -0400
+Subject: serial: sc16is7xx: remove useless enable of enhanced features
+
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+
+commit 1c05bf6c0262f946571a37678250193e46b1ff0f upstream.
+
+Commit 43c51bb573aa ("sc16is7xx: make sure device is in suspend once
+probed") permanently enabled access to the enhanced features in
+sc16is7xx_probe(), and it is never disabled after that.
+
+Therefore, remove re-enable of enhanced features in
+sc16is7xx_set_baud(). This eliminates a potential useless read + write
+cycle each time the baud rate is reconfigured.
+
+Fixes: 43c51bb573aa ("sc16is7xx: make sure device is in suspend once probed")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Link: https://patch.msgid.link/20251006142002.177475-1-hugo@hugovil.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/sc16is7xx.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -585,13 +585,6 @@ static int sc16is7xx_set_baud(struct uar
+ div /= prescaler;
+ }
+
+- /* Enable enhanced features */
+- sc16is7xx_efr_lock(port);
+- sc16is7xx_port_update(port, SC16IS7XX_EFR_REG,
+- SC16IS7XX_EFR_ENABLE_BIT,
+- SC16IS7XX_EFR_ENABLE_BIT);
+- sc16is7xx_efr_unlock(port);
+-
+ /* If bit MCR_CLKSEL is set, the divide by 4 prescaler is activated. */
+ sc16is7xx_port_update(port, SC16IS7XX_MCR_REG,
+ SC16IS7XX_MCR_CLKSEL_BIT,
io_uring-sqpoll-be-smarter-on-when-to-update-the-stime-usage.patch
bluetooth-btintel-add-dsbr-support-for-blazariw-blazaru-and-gap.patch
platform-x86-amd-hsmp-ensure-sock-metric_tbl_addr-is-non-null.patch
+usb-serial-option-add-unisoc-uis7720.patch
+usb-serial-option-add-quectel-rg255c.patch
+usb-serial-option-add-telit-fn920c04-ecm-compositions.patch
+usb-core-quirks-add-huawei-me906s-to-wakeup-quirk.patch
+usb-raw-gadget-do-not-limit-transfer-length.patch
+xhci-dbc-enable-back-dbc-in-resume-if-it-was-enabled-before-suspend.patch
+xhci-dbc-fix-bogus-1024-byte-prefix-if-ttydbc-read-races-with-stall-event.patch
+x86-microcode-fix-entrysign-revision-check-for-zen1-naples.patch
+binder-remove-invalid-inc-weak-check.patch
+comedi-fix-divide-by-zero-in-comedi_buf_munge.patch
+mei-me-add-wildcat-lake-p-did.patch
+objtool-rust-add-one-more-noreturn-rust-function.patch
+misc-fastrpc-fix-dma_buf-object-leak-in-fastrpc_map_lookup.patch
+most-usb-fix-use-after-free-in-hdm_disconnect.patch
+most-usb-hdm_probe-fix-calling-put_device-before-device-initialization.patch
+tcpm-switch-check-for-role_sw-device-with-fw_node.patch
+dt-bindings-usb-dwc3-imx8mp-dma-range-is-required-only-for-imx8mp.patch
+serial-8250_dw-handle-reset-control-deassert-error.patch
+serial-8250_exar-add-support-for-advantech-2-port-card-with-device-id-0x0018.patch
+serial-8250_mtk-enable-baud-clock-and-manage-in-runtime-pm.patch
+serial-sc16is7xx-remove-useless-enable-of-enhanced-features.patch
--- /dev/null
+From 2d8713f807a49b8a67c221670e50ae04967e915d Mon Sep 17 00:00:00 2001
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Date: Mon, 13 Oct 2025 11:43:40 +0200
+Subject: tcpm: switch check for role_sw device with fw_node
+
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+
+commit 2d8713f807a49b8a67c221670e50ae04967e915d upstream.
+
+When there is no port entry in the tcpci entry itself, the driver will
+trigger an error message "OF: graph: no port node found in /...../typec" .
+
+It is documented that the dts node should contain an connector entry
+with ports and several port pointing to devices with usb-role-switch
+property set. Only when those connector entry is missing, it should
+check for port entries in the main node.
+
+We switch the search order for looking after ports, which will avoid the
+failure message while there are explicit connector entries.
+
+Fixes: d56de8c9a17d ("usb: typec: tcpm: try to get role switch from tcpc fwnode")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
+Link: https://patch.msgid.link/20251013-b4-ml-topic-tcpm-v2-1-63c9b2ab8a0b@pengutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -7696,9 +7696,9 @@ struct tcpm_port *tcpm_register_port(str
+
+ port->partner_desc.identity = &port->partner_ident;
+
+- port->role_sw = usb_role_switch_get(port->dev);
++ port->role_sw = fwnode_usb_role_switch_get(tcpc->fwnode);
+ if (!port->role_sw)
+- port->role_sw = fwnode_usb_role_switch_get(tcpc->fwnode);
++ port->role_sw = usb_role_switch_get(port->dev);
+ if (IS_ERR(port->role_sw)) {
+ err = PTR_ERR(port->role_sw);
+ goto out_destroy_wq;
--- /dev/null
+From dfc2cf4dcaa03601cd4ca0f7def88b2630fca6ab Mon Sep 17 00:00:00 2001
+From: Tim Guttzeit <t.guttzeit@tuxedocomputers.com>
+Date: Mon, 20 Oct 2025 15:39:04 +0200
+Subject: usb/core/quirks: Add Huawei ME906S to wakeup quirk
+
+From: Tim Guttzeit <t.guttzeit@tuxedocomputers.com>
+
+commit dfc2cf4dcaa03601cd4ca0f7def88b2630fca6ab upstream.
+
+The list of Huawei LTE modules needing the quirk fixing spurious wakeups
+was missing the IDs of the Huawei ME906S module, therefore suspend did not
+work.
+
+Cc: stable <stable@kernel.org>
+Signed-off-by: Tim Guttzeit <t.guttzeit@tuxedocomputers.com>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20251020134304.35079-1-wse@tuxedocomputers.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -464,6 +464,8 @@ static const struct usb_device_id usb_qu
+ /* Huawei 4G LTE module */
+ { USB_DEVICE(0x12d1, 0x15bb), .driver_info =
+ USB_QUIRK_DISCONNECT_SUSPEND },
++ { USB_DEVICE(0x12d1, 0x15c1), .driver_info =
++ USB_QUIRK_DISCONNECT_SUSPEND },
+ { USB_DEVICE(0x12d1, 0x15c3), .driver_info =
+ USB_QUIRK_DISCONNECT_SUSPEND },
+
--- /dev/null
+From 37b9dd0d114a0e38c502695e30f55a74fb0c37d0 Mon Sep 17 00:00:00 2001
+From: Andrey Konovalov <andreyknvl@gmail.com>
+Date: Wed, 22 Oct 2025 00:25:45 +0200
+Subject: usb: raw-gadget: do not limit transfer length
+
+From: Andrey Konovalov <andreyknvl@gmail.com>
+
+commit 37b9dd0d114a0e38c502695e30f55a74fb0c37d0 upstream.
+
+Drop the check on the maximum transfer length in Raw Gadget for both
+control and non-control transfers.
+
+Limiting the transfer length causes a problem with emulating USB devices
+whose full configuration descriptor exceeds PAGE_SIZE in length.
+
+Overall, there does not appear to be any reason to enforce any kind of
+transfer length limit on the Raw Gadget side for either control or
+non-control transfers, so let's just drop the related check.
+
+Cc: stable <stable@kernel.org>
+Fixes: f2c2e717642c ("usb: gadget: add raw-gadget interface")
+Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com>
+Link: https://patch.msgid.link/a6024e8eab679043e9b8a5defdb41c4bda62f02b.1761085528.git.andreyknvl@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/legacy/raw_gadget.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/usb/gadget/legacy/raw_gadget.c
++++ b/drivers/usb/gadget/legacy/raw_gadget.c
+@@ -667,8 +667,6 @@ static void *raw_alloc_io_data(struct us
+ return ERR_PTR(-EINVAL);
+ if (!usb_raw_io_flags_valid(io->flags))
+ return ERR_PTR(-EINVAL);
+- if (io->length > PAGE_SIZE)
+- return ERR_PTR(-EINVAL);
+ if (get_from_user)
+ data = memdup_user(ptr + sizeof(*io), io->length);
+ else {
--- /dev/null
+From 89205c60c0fc96b73567a2e9fe27ee3f59d01193 Mon Sep 17 00:00:00 2001
+From: Reinhard Speyerer <rspmn@arcor.de>
+Date: Wed, 22 Oct 2025 16:17:26 +0200
+Subject: USB: serial: option: add Quectel RG255C
+
+From: Reinhard Speyerer <rspmn@arcor.de>
+
+commit 89205c60c0fc96b73567a2e9fe27ee3f59d01193 upstream.
+
+Add support for Quectel RG255C devices to complement commit 5c964c8a97c1
+("net: usb: qmi_wwan: add Quectel RG255C").
+The composition is DM / NMEA / AT / QMI.
+
+T: Bus=01 Lev=02 Prnt=99 Port=01 Cnt=02 Dev#=110 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=2c7c ProdID=0316 Rev= 5.15
+S: Manufacturer=Quectel
+S: Product=RG255C-GL
+S: SerialNumber=xxxxxxxx
+C:* #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
+E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Signed-off-by: Reinhard Speyerer <rspmn@arcor.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -273,6 +273,7 @@ static void option_instat_callback(struc
+ #define QUECTEL_PRODUCT_EM05CN 0x0312
+ #define QUECTEL_PRODUCT_EM05G_GR 0x0313
+ #define QUECTEL_PRODUCT_EM05G_RS 0x0314
++#define QUECTEL_PRODUCT_RG255C 0x0316
+ #define QUECTEL_PRODUCT_EM12 0x0512
+ #define QUECTEL_PRODUCT_RM500Q 0x0800
+ #define QUECTEL_PRODUCT_RM520N 0x0801
+@@ -1271,6 +1272,9 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0xff, 0x40) },
+
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
--- /dev/null
+From 622865c73ae30f254abdf182f4b66cccbe3e0f10 Mon Sep 17 00:00:00 2001
+From: LI Qingwu <Qing-wu.Li@leica-geosystems.com.cn>
+Date: Thu, 23 Oct 2025 03:44:22 +0000
+Subject: USB: serial: option: add Telit FN920C04 ECM compositions
+
+From: LI Qingwu <Qing-wu.Li@leica-geosystems.com.cn>
+
+commit 622865c73ae30f254abdf182f4b66cccbe3e0f10 upstream.
+
+Add support for the Telit Cinterion FN920C04 module when operating in
+ECM (Ethernet Control Model) mode. The following USB product IDs are
+used by the module when AT#USBCFG is set to 3 or 7.
+
+0x10A3: ECM + tty (NMEA) + tty (DUN) [+ tty (DIAG)]
+T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=10a3 Rev= 5.15
+S: Manufacturer=Telit Cinterion
+S: Product=FN920
+S: SerialNumber=76e7cb38
+C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether
+E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms
+I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+0x10A8: ECM + tty (DUN) + tty (AUX) [+ tty (DIAG)]
+T: Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=10a8 Rev= 5.15
+S: Manufacturer=Telit Cinterion
+S: Product=FN920
+S: SerialNumber=76e7cb38
+C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether
+E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms
+I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Adding these IDs allows the option driver to automatically create the
+corresponding /dev/ttyUSB* ports under ECM mode.
+
+Tested with FN920C04 under ECM configuration (USBCFG=3 and 7).
+
+Signed-off-by: LI Qingwu <Qing-wu.Li@leica-geosystems.com.cn>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1403,10 +1403,14 @@ static const struct usb_device_id option
+ .driver_info = RSVD(0) | NCTRL(3) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a2, 0xff), /* Telit FN920C04 (MBIM) */
+ .driver_info = NCTRL(4) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a3, 0xff), /* Telit FN920C04 (ECM) */
++ .driver_info = NCTRL(4) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff), /* Telit FN20C04 (rmnet) */
+ .driver_info = RSVD(0) | NCTRL(3) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a7, 0xff), /* Telit FN920C04 (MBIM) */
+ .driver_info = NCTRL(4) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a8, 0xff), /* Telit FN920C04 (ECM) */
++ .driver_info = NCTRL(4) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a9, 0xff), /* Telit FN20C04 (rmnet) */
+ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */
--- /dev/null
+From 71c07570b918f000de5d0f7f1bf17a2887e303b5 Mon Sep 17 00:00:00 2001
+From: Renjun Wang <renjunw0@foxmail.com>
+Date: Sun, 19 Oct 2025 18:44:38 +0800
+Subject: USB: serial: option: add UNISOC UIS7720
+
+From: Renjun Wang <renjunw0@foxmail.com>
+
+commit 71c07570b918f000de5d0f7f1bf17a2887e303b5 upstream.
+
+Add support for UNISOC (Spreadtrum) UIS7720 (A7720) module.
+
+T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1782 ProdID=4064 Rev=04.04
+S: Manufacturer=Unisoc-phone
+S: Product=Unisoc-phone
+S: SerialNumber=0123456789ABCDEF
+C: #Ifs= 9 Cfg#= 1 Atr=c0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
+E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+0&1: RNDIS, 2: LOG, 3: DIAG, 4&5: AT Ports, 6&7: AT2 Ports, 8: ADB
+
+Signed-off-by: Renjun Wang <renjunw0@foxmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -617,6 +617,7 @@ static void option_instat_callback(struc
+ #define UNISOC_VENDOR_ID 0x1782
+ /* TOZED LT70-C based on UNISOC SL8563 uses UNISOC's vendor ID */
+ #define TOZED_PRODUCT_LT70C 0x4055
++#define UNISOC_PRODUCT_UIS7720 0x4064
+ /* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */
+ #define LUAT_PRODUCT_AIR720U 0x4e00
+
+@@ -2466,6 +2467,7 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9291, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9291, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, UNISOC_PRODUCT_UIS7720, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) },
+ { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */
+ .driver_info = NCTRL(1) },
--- /dev/null
+From 876f0d43af78639790bee0e57b39d498ae35adcf Mon Sep 17 00:00:00 2001
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Date: Mon, 20 Oct 2025 15:41:24 +0100
+Subject: x86/microcode: Fix Entrysign revision check for Zen1/Naples
+
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+
+commit 876f0d43af78639790bee0e57b39d498ae35adcf upstream.
+
+... to match AMD's statement here:
+
+https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html
+
+Fixes: 50cef76d5cb0 ("x86/microcode/AMD: Load only SHA256-checksummed patches")
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Cc: <stable@kernel.org>
+Link: https://patch.msgid.link/20251020144124.2930784-1-andrew.cooper3@citrix.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/microcode/amd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/microcode/amd.c
++++ b/arch/x86/kernel/cpu/microcode/amd.c
+@@ -182,7 +182,7 @@ static bool need_sha_check(u32 cur_rev)
+ }
+
+ switch (cur_rev >> 8) {
+- case 0x80012: return cur_rev <= 0x800126f; break;
++ case 0x80012: return cur_rev <= 0x8001277; break;
+ case 0x80082: return cur_rev <= 0x800820f; break;
+ case 0x83010: return cur_rev <= 0x830107c; break;
+ case 0x86001: return cur_rev <= 0x860010e; break;
--- /dev/null
+From 2bbd38fcd29670e46c0fdb9cd0e90507a8a1bf6a Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 14 Oct 2025 01:55:42 +0300
+Subject: xhci: dbc: enable back DbC in resume if it was enabled before suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 2bbd38fcd29670e46c0fdb9cd0e90507a8a1bf6a upstream.
+
+DbC is currently only enabled back if it's in configured state during
+suspend.
+
+If system is suspended after DbC is enabled, but before the device is
+properly enumerated by the host, then DbC would not be enabled back in
+resume.
+
+Always enable DbC back in resume if it's suspended in enabled,
+connected, or configured state
+
+Cc: stable <stable@kernel.org>
+Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver")
+Tested-by: Łukasz Bartosik <ukaszb@chromium.org>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-dbgcap.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -1387,8 +1387,15 @@ int xhci_dbc_suspend(struct xhci_hcd *xh
+ if (!dbc)
+ return 0;
+
+- if (dbc->state == DS_CONFIGURED)
++ switch (dbc->state) {
++ case DS_ENABLED:
++ case DS_CONNECTED:
++ case DS_CONFIGURED:
+ dbc->resume_required = 1;
++ break;
++ default:
++ break;
++ }
+
+ xhci_dbc_stop(dbc);
+
--- /dev/null
+From f3d12ec847b945d5d65846c85f062d07d5e73164 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 14 Oct 2025 01:55:41 +0300
+Subject: xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit f3d12ec847b945d5d65846c85f062d07d5e73164 upstream.
+
+DbC may add 1024 bogus bytes to the beginneing of the receiving endpoint
+if DbC hw triggers a STALL event before any Transfer Blocks (TRBs) for
+incoming data are queued, but driver handles the event after it queued
+the TRBs.
+
+This is possible as xHCI DbC hardware may trigger spurious STALL transfer
+events even if endpoint is empty. The STALL event contains a pointer
+to the stalled TRB, and "remaining" untransferred data length.
+
+As there are no TRBs queued yet the STALL event will just point to first
+TRB position of the empty ring, with '0' bytes remaining untransferred.
+
+DbC driver is polling for events, and may not handle the STALL event
+before /dev/ttyDBC0 is opened and incoming data TRBs are queued.
+
+The DbC event handler will now assume the first queued TRB (length 1024)
+has stalled with '0' bytes remaining untransferred, and copies the data
+
+This race situation can be practically mitigated by making sure the event
+handler handles all pending transfer events when DbC reaches configured
+state, and only then create dev/ttyDbC0, and start queueing transfers.
+The event handler can this way detect the STALL events on empty rings
+and discard them before any transfers are queued.
+
+This does in practice solve the issue, but still leaves a small possible
+gap for the race to trigger.
+We still need a way to distinguish spurious STALLs on empty rings with '0'
+bytes remaing, from actual STALL events with all bytes transmitted.
+
+Cc: stable <stable@kernel.org>
+Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver")
+Tested-by: Łukasz Bartosik <ukaszb@chromium.org>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-dbgcap.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -891,7 +891,8 @@ static enum evtreturn xhci_dbc_do_handle
+ dev_info(dbc->dev, "DbC configured\n");
+ portsc = readl(&dbc->regs->portsc);
+ writel(portsc, &dbc->regs->portsc);
+- return EVT_GSER;
++ ret = EVT_GSER;
++ break;
+ }
+
+ return EVT_DONE;
+@@ -951,7 +952,8 @@ static enum evtreturn xhci_dbc_do_handle
+ break;
+ case TRB_TYPE(TRB_TRANSFER):
+ dbc_handle_xfer_event(dbc, evt);
+- ret = EVT_XFER_DONE;
++ if (ret != EVT_GSER)
++ ret = EVT_XFER_DONE;
+ break;
+ default:
+ break;
projects / thirdparty / kernel / stable-queue.git / commitdiff
