From: Greg Kroah-Hartman Date: Mon, 27 Oct 2025 07:46:08 +0000 (+0100) Subject: 6.17-stable patches X-Git-Tag: v5.4.301~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f7747336593e73916cb50e8c83c82ac18da9a3f8;p=thirdparty%2Fkernel%2Fstable-queue.git 6.17-stable patches added patches: binder-remove-invalid-inc-weak-check.patch comedi-fix-divide-by-zero-in-comedi_buf_munge.patch dt-bindings-serial-sh-sci-fix-r8a78000-interrupts.patch dt-bindings-usb-dwc3-imx8mp-dma-range-is-required-only-for-imx8mp.patch dt-bindings-usb-qcom-snps-dwc3-fix-bindings-for-x1e80100.patch mei-me-add-wildcat-lake-p-did.patch misc-fastrpc-fix-dma_buf-object-leak-in-fastrpc_map_lookup.patch most-usb-fix-use-after-free-in-hdm_disconnect.patch most-usb-hdm_probe-fix-calling-put_device-before-device-initialization.patch nvmem-rcar-efuse-add-missing-module_device_table.patch objtool-rust-add-one-more-noreturn-rust-function.patch serial-8250_dw-handle-reset-control-deassert-error.patch serial-8250_exar-add-support-for-advantech-2-port-card-with-device-id-0x0018.patch serial-8250_mtk-enable-baud-clock-and-manage-in-runtime-pm.patch serial-sc16is7xx-remove-useless-enable-of-enhanced-features.patch staging-gpib-fix-device-reference-leak-in-fmh_gpib-driver.patch staging-gpib-fix-no-eoi-on-1-and-2-byte-writes.patch staging-gpib-fix-sending-clear-and-trigger-events.patch staging-gpib-return-eintr-on-device-clear.patch tcpm-switch-check-for-role_sw-device-with-fw_node.patch tty-serial-sh-sci-fix-rsci-fifo-overrun-handling.patch usb-core-quirks-add-huawei-me906s-to-wakeup-quirk.patch usb-raw-gadget-do-not-limit-transfer-length.patch usb-serial-option-add-quectel-rg255c.patch usb-serial-option-add-telit-fn920c04-ecm-compositions.patch usb-serial-option-add-unisoc-uis7720.patch x86-microcode-fix-entrysign-revision-check-for-zen1-naples.patch xhci-dbc-enable-back-dbc-in-resume-if-it-was-enabled-before-suspend.patch xhci-dbc-fix-bogus-1024-byte-prefix-if-ttydbc-read-races-with-stall-event.patch --- diff --git a/queue-6.17/binder-remove-invalid-inc-weak-check.patch b/queue-6.17/binder-remove-invalid-inc-weak-check.patch new file mode 100644 index 0000000000..62690d39b9 --- /dev/null +++ b/queue-6.17/binder-remove-invalid-inc-weak-check.patch @@ -0,0 +1,55 @@ +From d90eeb8ecd227c204ab6c34a17b372bd950b7aa2 Mon Sep 17 00:00:00 2001 +From: Alice Ryhl +Date: Wed, 15 Oct 2025 14:26:55 +0000 +Subject: binder: remove "invalid inc weak" check + +From: Alice Ryhl + +commit d90eeb8ecd227c204ab6c34a17b372bd950b7aa2 upstream. + +There are no scenarios where a weak increment is invalid on binder_node. +The only possible case where it could be invalid is if the kernel +delivers BR_DECREFS to the process that owns the node, and then +increments the weak refcount again, effectively "reviving" a dead node. + +However, that is not possible: when the BR_DECREFS command is delivered, +the kernel removes and frees the binder_node. The fact that you were +able to call binder_inc_node_nilocked() implies that the node is not yet +destroyed, which implies that BR_DECREFS has not been delivered to +userspace, so incrementing the weak refcount is valid. + +Note that it's currently possible to trigger this condition if the owner +calls BINDER_THREAD_EXIT while node->has_weak_ref is true. This causes +BC_INCREFS on binder_ref instances to fail when they should not. + +Cc: stable@vger.kernel.org +Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") +Reported-by: Yu-Ting Tseng +Signed-off-by: Alice Ryhl +Link: https://patch.msgid.link/20251015-binder-weak-inc-v1-1-7914b092c371@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/android/binder.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -850,17 +850,8 @@ static int binder_inc_node_nilocked(stru + } else { + if (!internal) + node->local_weak_refs++; +- if (!node->has_weak_ref && list_empty(&node->work.entry)) { +- if (target_list == NULL) { +- pr_err("invalid inc weak node for %d\n", +- node->debug_id); +- return -EINVAL; +- } +- /* +- * See comment above +- */ ++ if (!node->has_weak_ref && target_list && list_empty(&node->work.entry)) + binder_enqueue_work_ilocked(&node->work, target_list); +- } + } + return 0; + } diff --git a/queue-6.17/comedi-fix-divide-by-zero-in-comedi_buf_munge.patch b/queue-6.17/comedi-fix-divide-by-zero-in-comedi_buf_munge.patch new file mode 100644 index 0000000000..dd7402c047 --- /dev/null +++ b/queue-6.17/comedi-fix-divide-by-zero-in-comedi_buf_munge.patch @@ -0,0 +1,45 @@ +From 87b318ba81dda2ee7b603f4f6c55e78ec3e95974 Mon Sep 17 00:00:00 2001 +From: Deepanshu Kartikey +Date: Wed, 24 Sep 2025 15:56:39 +0530 +Subject: comedi: fix divide-by-zero in comedi_buf_munge() + +From: Deepanshu Kartikey + +commit 87b318ba81dda2ee7b603f4f6c55e78ec3e95974 upstream. + +The comedi_buf_munge() function performs a modulo operation +`async->munge_chan %= async->cmd.chanlist_len` without first +checking if chanlist_len is zero. If a user program submits a command with +chanlist_len set to zero, this causes a divide-by-zero error when the device +processes data in the interrupt handler path. + +Add a check for zero chanlist_len at the beginning of the +function, similar to the existing checks for !map and +CMDF_RAWDATA flag. When chanlist_len is zero, update +munge_count and return early, indicating the data was +handled without munging. + +This prevents potential kernel panics from malformed user commands. + +Reported-by: syzbot+f6c3c066162d2c43a66c@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=f6c3c066162d2c43a66c +Cc: stable@vger.kernel.org +Signed-off-by: Deepanshu Kartikey +Reviewed-by: Ian Abbott +Link: https://patch.msgid.link/20250924102639.1256191-1-kartikey406@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/comedi/comedi_buf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/comedi/comedi_buf.c ++++ b/drivers/comedi/comedi_buf.c +@@ -317,7 +317,7 @@ static unsigned int comedi_buf_munge(str + unsigned int count = 0; + const unsigned int num_sample_bytes = comedi_bytes_per_sample(s); + +- if (!s->munge || (async->cmd.flags & CMDF_RAWDATA)) { ++ if (!s->munge || (async->cmd.flags & CMDF_RAWDATA) || async->cmd.chanlist_len == 0) { + async->munge_count += num_bytes; + return num_bytes; + } diff --git a/queue-6.17/dt-bindings-serial-sh-sci-fix-r8a78000-interrupts.patch b/queue-6.17/dt-bindings-serial-sh-sci-fix-r8a78000-interrupts.patch new file mode 100644 index 0000000000..a3547709d9 --- /dev/null +++ b/queue-6.17/dt-bindings-serial-sh-sci-fix-r8a78000-interrupts.patch @@ -0,0 +1,38 @@ +From ea9f6d316782bf36141df764634a53d085061091 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Wed, 8 Oct 2025 12:50:36 +0200 +Subject: dt-bindings: serial: sh-sci: Fix r8a78000 interrupts + +From: Geert Uytterhoeven + +commit ea9f6d316782bf36141df764634a53d085061091 upstream. + +The SCIF instances on R-Car Gen5 have a single interrupt, just like on +other R-Car SoCs. + +Fixes: 6ac1d60473727931 ("dt-bindings: serial: sh-sci: Document r8a78000 bindings") +Cc: stable +Signed-off-by: Geert Uytterhoeven +Acked-by: Kuninori Morimoto +Acked-by: Conor Dooley +Link: https://patch.msgid.link/09bc9881b31bdb948ce8b69a2b5acf633f5505a4.1759920441.git.geert+renesas@glider.be +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/serial/renesas,scif.yaml | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Documentation/devicetree/bindings/serial/renesas,scif.yaml b/Documentation/devicetree/bindings/serial/renesas,scif.yaml +index e925cd4c3ac8..72483bc3274d 100644 +--- a/Documentation/devicetree/bindings/serial/renesas,scif.yaml ++++ b/Documentation/devicetree/bindings/serial/renesas,scif.yaml +@@ -197,6 +197,7 @@ allOf: + - renesas,rcar-gen2-scif + - renesas,rcar-gen3-scif + - renesas,rcar-gen4-scif ++ - renesas,rcar-gen5-scif + then: + properties: + interrupts: +-- +2.51.1 + diff --git a/queue-6.17/dt-bindings-usb-dwc3-imx8mp-dma-range-is-required-only-for-imx8mp.patch b/queue-6.17/dt-bindings-usb-dwc3-imx8mp-dma-range-is-required-only-for-imx8mp.patch new file mode 100644 index 0000000000..f086d366ec --- /dev/null +++ b/queue-6.17/dt-bindings-usb-dwc3-imx8mp-dma-range-is-required-only-for-imx8mp.patch @@ -0,0 +1,48 @@ +From 268eb6fb908bc82ce479e4dba9a2cad11f536c9c Mon Sep 17 00:00:00 2001 +From: Xu Yang +Date: Fri, 19 Sep 2025 14:25:34 +0800 +Subject: dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp + +From: Xu Yang + +commit 268eb6fb908bc82ce479e4dba9a2cad11f536c9c upstream. + +Only i.MX8MP need dma-range property to let USB controller work properly. +Remove dma-range from required list and add limitation for imx8mp. + +Fixes: d2a704e29711 ("dt-bindings: usb: dwc3-imx8mp: add imx8mp dwc3 glue bindings") +Cc: stable +Reviewed-by: Jun Li +Signed-off-by: Xu Yang +Reviewed-by: Frank Li +Acked-by: Conor Dooley +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml ++++ b/Documentation/devicetree/bindings/usb/fsl,imx8mp-dwc3.yaml +@@ -89,13 +89,21 @@ required: + - reg + - "#address-cells" + - "#size-cells" +- - dma-ranges + - ranges + - clocks + - clock-names + - interrupts + - power-domains + ++allOf: ++ - if: ++ properties: ++ compatible: ++ const: fsl,imx8mp-dwc3 ++ then: ++ required: ++ - dma-ranges ++ + additionalProperties: false + + examples: diff --git a/queue-6.17/dt-bindings-usb-qcom-snps-dwc3-fix-bindings-for-x1e80100.patch b/queue-6.17/dt-bindings-usb-qcom-snps-dwc3-fix-bindings-for-x1e80100.patch new file mode 100644 index 0000000000..2f2e6686ef --- /dev/null +++ b/queue-6.17/dt-bindings-usb-qcom-snps-dwc3-fix-bindings-for-x1e80100.patch @@ -0,0 +1,51 @@ +From 51cb04abd39097209b871e95ffa7e8584ce7dcba Mon Sep 17 00:00:00 2001 +From: Krishna Kurapati +Date: Mon, 13 Oct 2025 09:29:20 +0530 +Subject: dt-bindings: usb: qcom,snps-dwc3: Fix bindings for X1E80100 + +From: Krishna Kurapati + +commit 51cb04abd39097209b871e95ffa7e8584ce7dcba upstream. + +Add the missing multiport controller binding to target list. + +Fix minItems for interrupt-names to avoid the following error on High +Speed controller: + +usb@a200000: interrupt-names: ['dwc_usb3', 'pwr_event', 'dp_hs_phy_irq', 'dm_hs_phy_irq'] is too short + +Fixes: 6e762f7b8edc ("dt-bindings: usb: Introduce qcom,snps-dwc3") +Cc: stable@vger.kernel.org +Signed-off-by: Krishna Kurapati +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/usb/qcom,snps-dwc3.yaml | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/Documentation/devicetree/bindings/usb/qcom,snps-dwc3.yaml b/Documentation/devicetree/bindings/usb/qcom,snps-dwc3.yaml +index dfd084ed9024..d49a58d5478f 100644 +--- a/Documentation/devicetree/bindings/usb/qcom,snps-dwc3.yaml ++++ b/Documentation/devicetree/bindings/usb/qcom,snps-dwc3.yaml +@@ -68,6 +68,7 @@ properties: + - qcom,sm8550-dwc3 + - qcom,sm8650-dwc3 + - qcom,x1e80100-dwc3 ++ - qcom,x1e80100-dwc3-mp + - const: qcom,snps-dwc3 + + reg: +@@ -460,8 +461,10 @@ allOf: + then: + properties: + interrupts: ++ minItems: 4 + maxItems: 5 + interrupt-names: ++ minItems: 4 + items: + - const: dwc_usb3 + - const: pwr_event +-- +2.51.1 + diff --git a/queue-6.17/mei-me-add-wildcat-lake-p-did.patch b/queue-6.17/mei-me-add-wildcat-lake-p-did.patch new file mode 100644 index 0000000000..91ec0c0692 --- /dev/null +++ b/queue-6.17/mei-me-add-wildcat-lake-p-did.patch @@ -0,0 +1,44 @@ +From 410d6c2ad4d1a88efa0acbb9966693725b564933 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Thu, 16 Oct 2025 15:59:12 +0300 +Subject: mei: me: add wildcat lake P DID + +From: Alexander Usyskin + +commit 410d6c2ad4d1a88efa0acbb9966693725b564933 upstream. + +Add Wildcat Lake P device id. + +Cc: stable@vger.kernel.org +Co-developed-by: Tomas Winkler +Signed-off-by: Tomas Winkler +Signed-off-by: Alexander Usyskin +Link: https://patch.msgid.link/20251016125912.2146136-1-alexander.usyskin@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mei/hw-me-regs.h | 2 ++ + drivers/misc/mei/pci-me.c | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -120,6 +120,8 @@ + #define MEI_DEV_ID_PTL_H 0xE370 /* Panther Lake H */ + #define MEI_DEV_ID_PTL_P 0xE470 /* Panther Lake P */ + ++#define MEI_DEV_ID_WCL_P 0x4D70 /* Wildcat Lake P */ ++ + /* + * MEI HW Section + */ +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -127,6 +127,8 @@ static const struct pci_device_id mei_me + {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_H, MEI_ME_PCH15_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_P, MEI_ME_PCH15_CFG)}, + ++ {MEI_PCI_DEVICE(MEI_DEV_ID_WCL_P, MEI_ME_PCH15_CFG)}, ++ + /* required last entry */ + {0, } + }; diff --git a/queue-6.17/misc-fastrpc-fix-dma_buf-object-leak-in-fastrpc_map_lookup.patch b/queue-6.17/misc-fastrpc-fix-dma_buf-object-leak-in-fastrpc_map_lookup.patch new file mode 100644 index 0000000000..555fc868a9 --- /dev/null +++ b/queue-6.17/misc-fastrpc-fix-dma_buf-object-leak-in-fastrpc_map_lookup.patch @@ -0,0 +1,39 @@ +From fff111bf45cbeeb659324316d68554e35d350092 Mon Sep 17 00:00:00 2001 +From: Junhao Xie +Date: Fri, 17 Oct 2025 16:39:06 +0800 +Subject: misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup + +From: Junhao Xie + +commit fff111bf45cbeeb659324316d68554e35d350092 upstream. + +In fastrpc_map_lookup, dma_buf_get is called to obtain a reference to +the dma_buf for comparison purposes. However, this reference is never +released when the function returns, leading to a dma_buf memory leak. + +Fix this by adding dma_buf_put before returning from the function, +ensuring that the temporarily acquired reference is properly released +regardless of whether a matching map is found. + +Fixes: 9031626ade38 ("misc: fastrpc: Fix fastrpc_map_lookup operation") +Cc: stable@kernel.org +Signed-off-by: Junhao Xie +Tested-by: Xilin Wu +Link: https://lore.kernel.org/stable/48B368FB4C7007A7%2B20251017083906.3259343-1-bigfoot%40radxa.com +Link: https://patch.msgid.link/48B368FB4C7007A7+20251017083906.3259343-1-bigfoot@radxa.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -384,6 +384,8 @@ static int fastrpc_map_lookup(struct fas + } + spin_unlock(&fl->lock); + ++ dma_buf_put(buf); ++ + return ret; + } + diff --git a/queue-6.17/most-usb-fix-use-after-free-in-hdm_disconnect.patch b/queue-6.17/most-usb-fix-use-after-free-in-hdm_disconnect.patch new file mode 100644 index 0000000000..1be4de1630 --- /dev/null +++ b/queue-6.17/most-usb-fix-use-after-free-in-hdm_disconnect.patch @@ -0,0 +1,66 @@ +From 4b1270902609ef0d935ed2faa2ea6d122bd148f5 Mon Sep 17 00:00:00 2001 +From: Victoria Votokina +Date: Fri, 10 Oct 2025 13:52:40 +0300 +Subject: most: usb: Fix use-after-free in hdm_disconnect + +From: Victoria Votokina + +commit 4b1270902609ef0d935ed2faa2ea6d122bd148f5 upstream. + +hdm_disconnect() calls most_deregister_interface(), which eventually +unregisters the MOST interface device with device_unregister(iface->dev). +If that drops the last reference, the device core may call release_mdev() +immediately while hdm_disconnect() is still executing. + +The old code also freed several mdev-owned allocations in +hdm_disconnect() and then performed additional put_device() calls. +Depending on refcount order, this could lead to use-after-free or +double-free when release_mdev() ran (or when unregister paths also +performed puts). + +Fix by moving the frees of mdev-owned allocations into release_mdev(), +so they happen exactly once when the device is truly released, and by +dropping the extra put_device() calls in hdm_disconnect() that are +redundant after device_unregister() and most_deregister_interface(). + +This addresses the KASAN slab-use-after-free reported by syzbot in +hdm_disconnect(). See report and stack traces in the bug link below. + +Reported-by: syzbot+916742d5d24f6c254761@syzkaller.appspotmail.com +Cc: stable +Closes: https://syzkaller.appspot.com/bug?extid=916742d5d24f6c254761 +Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver") +Signed-off-by: Victoria Votokina +Link: https://patch.msgid.link/20251010105241.4087114-2-Victoria.Votokina@kaspersky.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/most/most_usb.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/most/most_usb.c ++++ b/drivers/most/most_usb.c +@@ -929,6 +929,10 @@ static void release_mdev(struct device * + { + struct most_dev *mdev = to_mdev_from_dev(dev); + ++ kfree(mdev->busy_urbs); ++ kfree(mdev->cap); ++ kfree(mdev->conf); ++ kfree(mdev->ep_address); + kfree(mdev); + } + /** +@@ -1121,13 +1125,6 @@ static void hdm_disconnect(struct usb_in + if (mdev->dci) + device_unregister(&mdev->dci->dev); + most_deregister_interface(&mdev->iface); +- +- kfree(mdev->busy_urbs); +- kfree(mdev->cap); +- kfree(mdev->conf); +- kfree(mdev->ep_address); +- put_device(&mdev->dci->dev); +- put_device(&mdev->dev); + } + + static int hdm_suspend(struct usb_interface *interface, pm_message_t message) diff --git a/queue-6.17/most-usb-hdm_probe-fix-calling-put_device-before-device-initialization.patch b/queue-6.17/most-usb-hdm_probe-fix-calling-put_device-before-device-initialization.patch new file mode 100644 index 0000000000..cee4f7bd70 --- /dev/null +++ b/queue-6.17/most-usb-hdm_probe-fix-calling-put_device-before-device-initialization.patch @@ -0,0 +1,41 @@ +From a8cc9e5fcb0e2eef21513a4fec888f5712cb8162 Mon Sep 17 00:00:00 2001 +From: Victoria Votokina +Date: Fri, 10 Oct 2025 13:52:41 +0300 +Subject: most: usb: hdm_probe: Fix calling put_device() before device initialization + +From: Victoria Votokina + +commit a8cc9e5fcb0e2eef21513a4fec888f5712cb8162 upstream. + +The early error path in hdm_probe() can jump to err_free_mdev before +&mdev->dev has been initialized with device_initialize(). Calling +put_device(&mdev->dev) there triggers a device core WARN and ends up +invoking kref_put(&kobj->kref, kobject_release) on an uninitialized +kobject. + +In this path the private struct was only kmalloc'ed and the intended +release is effectively kfree(mdev) anyway, so free it directly instead +of calling put_device() on an uninitialized device. + +This removes the WARNING and fixes the pre-initialization error path. + +Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver") +Cc: stable +Signed-off-by: Victoria Votokina +Link: https://patch.msgid.link/20251010105241.4087114-3-Victoria.Votokina@kaspersky.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/most/most_usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/most/most_usb.c ++++ b/drivers/most/most_usb.c +@@ -1097,7 +1097,7 @@ err_free_cap: + err_free_conf: + kfree(mdev->conf); + err_free_mdev: +- put_device(&mdev->dev); ++ kfree(mdev); + return ret; + } + diff --git a/queue-6.17/nvmem-rcar-efuse-add-missing-module_device_table.patch b/queue-6.17/nvmem-rcar-efuse-add-missing-module_device_table.patch new file mode 100644 index 0000000000..4020c321bc --- /dev/null +++ b/queue-6.17/nvmem-rcar-efuse-add-missing-module_device_table.patch @@ -0,0 +1,33 @@ +From 7959ffbec062c35bda02aa635d21ac45dbfacd80 Mon Sep 17 00:00:00 2001 +From: Cosmin Tanislav +Date: Fri, 19 Sep 2025 17:28:53 +0300 +Subject: nvmem: rcar-efuse: add missing MODULE_DEVICE_TABLE + +From: Cosmin Tanislav + +commit 7959ffbec062c35bda02aa635d21ac45dbfacd80 upstream. + +The nvmem-rcar-efuse driver can be compiled as a module. Add missing +MODULE_DEVICE_TABLE so it can be matched by modalias and automatically +loaded by udev. + +Cc: stable@vger.kernel.org +Fixes: 1530b923a514 ("nvmem: Add R-Car E-FUSE driver") +Signed-off-by: Cosmin Tanislav +Reviewed-by: Geert Uytterhoeven +Link: https://patch.msgid.link/20250919142856.2313927-1-cosmin-gabriel.tanislav.xa@renesas.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/rcar-efuse.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/nvmem/rcar-efuse.c ++++ b/drivers/nvmem/rcar-efuse.c +@@ -127,6 +127,7 @@ static const struct of_device_id rcar_fu + { .compatible = "renesas,r8a779h0-otp", .data = &rcar_fuse_v4m }, + { /* sentinel */ } + }; ++MODULE_DEVICE_TABLE(of, rcar_fuse_match); + + static struct platform_driver rcar_fuse_driver = { + .probe = rcar_fuse_probe, diff --git a/queue-6.17/objtool-rust-add-one-more-noreturn-rust-function.patch b/queue-6.17/objtool-rust-add-one-more-noreturn-rust-function.patch new file mode 100644 index 0000000000..fdc70f1952 --- /dev/null +++ b/queue-6.17/objtool-rust-add-one-more-noreturn-rust-function.patch @@ -0,0 +1,57 @@ +From dbdf2a7feb422f9bacfd12774e624cf26f503eb0 Mon Sep 17 00:00:00 2001 +From: Miguel Ojeda +Date: Mon, 20 Oct 2025 04:07:14 +0200 +Subject: objtool/rust: add one more `noreturn` Rust function + +From: Miguel Ojeda + +commit dbdf2a7feb422f9bacfd12774e624cf26f503eb0 upstream. + +Between Rust 1.79 and 1.86, under `CONFIG_RUST_KERNEL_DOCTESTS=y`, +`objtool` may report: + + rust/doctests_kernel_generated.o: warning: objtool: + rust_doctest_kernel_alloc_kbox_rs_13() falls through to next + function rust_doctest_kernel_alloc_kvec_rs_0() + +(as well as in rust_doctest_kernel_alloc_kvec_rs_0) due to calls to the +`noreturn` symbol: + + core::option::expect_failed + +from code added in commits 779db37373a3 ("rust: alloc: kvec: implement +AsPageIter for VVec") and 671618432f46 ("rust: alloc: kbox: implement +AsPageIter for VBox"). + +Thus add the mangled one to the list so that `objtool` knows it is +actually `noreturn`. + +This can be reproduced as well in other versions by tweaking the code, +such as the latest stable Rust (1.90.0). + +Stable does not have code that triggers this, but it could have it in +the future. Downstream forks could too. Thus tag it for backport. + +See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions") +for more details. + +Signed-off-by: Miguel Ojeda +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Alice Ryhl +Cc: stable@vger.kernel.org # Needed in 6.12.y and later. +Link: https://patch.msgid.link/20251020020714.2511718-1-ojeda@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + tools/objtool/check.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -217,6 +217,7 @@ static bool is_rust_noreturn(const struc + * these come from the Rust standard library). + */ + return str_ends_with(func->name, "_4core5sliceSp15copy_from_slice17len_mismatch_fail") || ++ str_ends_with(func->name, "_4core6option13expect_failed") || + str_ends_with(func->name, "_4core6option13unwrap_failed") || + str_ends_with(func->name, "_4core6result13unwrap_failed") || + str_ends_with(func->name, "_4core9panicking5panic") || diff --git a/queue-6.17/serial-8250_dw-handle-reset-control-deassert-error.patch b/queue-6.17/serial-8250_dw-handle-reset-control-deassert-error.patch new file mode 100644 index 0000000000..d3ca1ed16b --- /dev/null +++ b/queue-6.17/serial-8250_dw-handle-reset-control-deassert-error.patch @@ -0,0 +1,42 @@ +From daeb4037adf7d3349b4a1fb792f4bc9824686a4b Mon Sep 17 00:00:00 2001 +From: Artem Shimko +Date: Sun, 19 Oct 2025 12:51:31 +0300 +Subject: serial: 8250_dw: handle reset control deassert error + +From: Artem Shimko + +commit daeb4037adf7d3349b4a1fb792f4bc9824686a4b upstream. + +Check the return value of reset_control_deassert() in the probe +function to prevent continuing probe when reset deassertion fails. + +Previously, reset_control_deassert() was called without checking its +return value, which could lead to probe continuing even when the +device reset wasn't properly deasserted. + +The fix checks the return value and returns an error with dev_err_probe() +if reset deassertion fails, providing better error handling and +diagnostics. + +Fixes: acbdad8dd1ab ("serial: 8250_dw: simplify optional reset handling") +Cc: stable +Signed-off-by: Artem Shimko +Link: https://patch.msgid.link/20251019095131.252848-1-a.shimko.dev@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_dw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -635,7 +635,9 @@ static int dw8250_probe(struct platform_ + if (IS_ERR(data->rst)) + return PTR_ERR(data->rst); + +- reset_control_deassert(data->rst); ++ err = reset_control_deassert(data->rst); ++ if (err) ++ return dev_err_probe(dev, err, "failed to deassert resets\n"); + + err = devm_add_action_or_reset(dev, dw8250_reset_control_assert, data->rst); + if (err) diff --git a/queue-6.17/serial-8250_exar-add-support-for-advantech-2-port-card-with-device-id-0x0018.patch b/queue-6.17/serial-8250_exar-add-support-for-advantech-2-port-card-with-device-id-0x0018.patch new file mode 100644 index 0000000000..2ace716a9e --- /dev/null +++ b/queue-6.17/serial-8250_exar-add-support-for-advantech-2-port-card-with-device-id-0x0018.patch @@ -0,0 +1,56 @@ +From e7cbce761fe3fcbcb49bcf30d4f8ca5e1a9ee2a0 Mon Sep 17 00:00:00 2001 +From: Florian Eckert +Date: Wed, 24 Sep 2025 15:41:15 +0200 +Subject: serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 + +From: Florian Eckert + +commit e7cbce761fe3fcbcb49bcf30d4f8ca5e1a9ee2a0 upstream. + +The Advantech 2-port serial card with PCI vendor=0x13fe and device=0x0018 +has a 'XR17V35X' chip installed on the circuit board. Therefore, this +driver can be used instead of theu outdated out-of-tree driver from the +manufacturer. + +Signed-off-by: Florian Eckert +Cc: stable +Link: https://patch.msgid.link/20250924134115.2667650-1-fe@dev.tdt.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_exar.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -40,6 +40,8 @@ + #define PCI_DEVICE_ID_ACCESSIO_COM_4SM 0x10db + #define PCI_DEVICE_ID_ACCESSIO_COM_8SM 0x10ea + ++#define PCI_DEVICE_ID_ADVANTECH_XR17V352 0x0018 ++ + #define PCI_DEVICE_ID_COMMTECH_4224PCI335 0x0002 + #define PCI_DEVICE_ID_COMMTECH_4222PCI335 0x0004 + #define PCI_DEVICE_ID_COMMTECH_2324PCI335 0x000a +@@ -1622,6 +1624,12 @@ static const struct exar8250_board pbn_f + .exit = pci_xr17v35x_exit, + }; + ++static const struct exar8250_board pbn_adv_XR17V352 = { ++ .num_ports = 2, ++ .setup = pci_xr17v35x_setup, ++ .exit = pci_xr17v35x_exit, ++}; ++ + static const struct exar8250_board pbn_exar_XR17V4358 = { + .num_ports = 12, + .setup = pci_xr17v35x_setup, +@@ -1696,6 +1704,9 @@ static const struct pci_device_id exar_p + USR_DEVICE(XR17C152, 2980, pbn_exar_XR17C15x), + USR_DEVICE(XR17C152, 2981, pbn_exar_XR17C15x), + ++ /* ADVANTECH devices */ ++ EXAR_DEVICE(ADVANTECH, XR17V352, pbn_adv_XR17V352), ++ + /* Exar Corp. XR17C15[248] Dual/Quad/Octal UART */ + EXAR_DEVICE(EXAR, XR17C152, pbn_exar_XR17C15x), + EXAR_DEVICE(EXAR, XR17C154, pbn_exar_XR17C15x), diff --git a/queue-6.17/serial-8250_mtk-enable-baud-clock-and-manage-in-runtime-pm.patch b/queue-6.17/serial-8250_mtk-enable-baud-clock-and-manage-in-runtime-pm.patch new file mode 100644 index 0000000000..2a5f4930e2 --- /dev/null +++ b/queue-6.17/serial-8250_mtk-enable-baud-clock-and-manage-in-runtime-pm.patch @@ -0,0 +1,65 @@ +From d518314a1fa4e980a227d1b2bda1badf433cb932 Mon Sep 17 00:00:00 2001 +From: Daniel Golle +Date: Tue, 16 Sep 2025 22:37:27 +0100 +Subject: serial: 8250_mtk: Enable baud clock and manage in runtime PM + +From: Daniel Golle + +commit d518314a1fa4e980a227d1b2bda1badf433cb932 upstream. + +Some MediaTek SoCs got a gated UART baud clock, which currently gets +disabled as the clk subsystem believes it would be unused. This results in +the uart freezing right after "clk: Disabling unused clocks" on those +platforms. + +Request the baud clock to be prepared and enabled during probe, and to +restore run-time power management capabilities to what it was before commit +e32a83c70cf9 ("serial: 8250-mtk: modify mtk uart power and clock +management") disable and unprepare the baud clock when suspending the UART, +prepare and enable it again when resuming it. + +Fixes: e32a83c70cf9 ("serial: 8250-mtk: modify mtk uart power and clock management") +Fixes: b6c7ff2693ddc ("serial: 8250_mtk: Simplify clock sequencing and runtime PM") +Cc: stable +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Daniel Golle +Link: https://patch.msgid.link/de5197ccc31e1dab0965cabcc11ca92e67246cf6.1758058441.git.daniel@makrotopia.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_mtk.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/8250/8250_mtk.c ++++ b/drivers/tty/serial/8250/8250_mtk.c +@@ -435,6 +435,7 @@ static int __maybe_unused mtk8250_runtim + while + (serial_in(up, MTK_UART_DEBUG0)); + ++ clk_disable_unprepare(data->uart_clk); + clk_disable_unprepare(data->bus_clk); + + return 0; +@@ -445,6 +446,7 @@ static int __maybe_unused mtk8250_runtim + struct mtk8250_data *data = dev_get_drvdata(dev); + + clk_prepare_enable(data->bus_clk); ++ clk_prepare_enable(data->uart_clk); + + return 0; + } +@@ -475,13 +477,13 @@ static int mtk8250_probe_of(struct platf + int dmacnt; + #endif + +- data->uart_clk = devm_clk_get(&pdev->dev, "baud"); ++ data->uart_clk = devm_clk_get_enabled(&pdev->dev, "baud"); + if (IS_ERR(data->uart_clk)) { + /* + * For compatibility with older device trees try unnamed + * clk when no baud clk can be found. + */ +- data->uart_clk = devm_clk_get(&pdev->dev, NULL); ++ data->uart_clk = devm_clk_get_enabled(&pdev->dev, NULL); + if (IS_ERR(data->uart_clk)) { + dev_warn(&pdev->dev, "Can't get uart clock\n"); + return PTR_ERR(data->uart_clk); diff --git a/queue-6.17/serial-sc16is7xx-remove-useless-enable-of-enhanced-features.patch b/queue-6.17/serial-sc16is7xx-remove-useless-enable-of-enhanced-features.patch new file mode 100644 index 0000000000..16da3b6890 --- /dev/null +++ b/queue-6.17/serial-sc16is7xx-remove-useless-enable-of-enhanced-features.patch @@ -0,0 +1,42 @@ +From 1c05bf6c0262f946571a37678250193e46b1ff0f Mon Sep 17 00:00:00 2001 +From: Hugo Villeneuve +Date: Mon, 6 Oct 2025 10:20:02 -0400 +Subject: serial: sc16is7xx: remove useless enable of enhanced features + +From: Hugo Villeneuve + +commit 1c05bf6c0262f946571a37678250193e46b1ff0f upstream. + +Commit 43c51bb573aa ("sc16is7xx: make sure device is in suspend once +probed") permanently enabled access to the enhanced features in +sc16is7xx_probe(), and it is never disabled after that. + +Therefore, remove re-enable of enhanced features in +sc16is7xx_set_baud(). This eliminates a potential useless read + write +cycle each time the baud rate is reconfigured. + +Fixes: 43c51bb573aa ("sc16is7xx: make sure device is in suspend once probed") +Cc: stable +Signed-off-by: Hugo Villeneuve +Link: https://patch.msgid.link/20251006142002.177475-1-hugo@hugovil.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/sc16is7xx.c | 7 ------- + 1 file changed, 7 deletions(-) + +--- a/drivers/tty/serial/sc16is7xx.c ++++ b/drivers/tty/serial/sc16is7xx.c +@@ -588,13 +588,6 @@ static int sc16is7xx_set_baud(struct uar + div /= prescaler; + } + +- /* Enable enhanced features */ +- sc16is7xx_efr_lock(port); +- sc16is7xx_port_update(port, SC16IS7XX_EFR_REG, +- SC16IS7XX_EFR_ENABLE_BIT, +- SC16IS7XX_EFR_ENABLE_BIT); +- sc16is7xx_efr_unlock(port); +- + /* If bit MCR_CLKSEL is set, the divide by 4 prescaler is activated. */ + sc16is7xx_port_update(port, SC16IS7XX_MCR_REG, + SC16IS7XX_MCR_CLKSEL_BIT, diff --git a/queue-6.17/series b/queue-6.17/series index baf2525762..44480507fe 100644 --- a/queue-6.17/series +++ b/queue-6.17/series @@ -146,3 +146,32 @@ block-require-lba-dma_alignment-when-using-pi.patch gpio-ljca-fix-duplicated-irq-mapping.patch io_uring-correct-__must_hold-annotation-in-io_instal.patch sched-remove-never-used-code-in-mm_cid_get.patch +usb-serial-option-add-unisoc-uis7720.patch +usb-serial-option-add-quectel-rg255c.patch +usb-serial-option-add-telit-fn920c04-ecm-compositions.patch +usb-core-quirks-add-huawei-me906s-to-wakeup-quirk.patch +usb-raw-gadget-do-not-limit-transfer-length.patch +xhci-dbc-enable-back-dbc-in-resume-if-it-was-enabled-before-suspend.patch +xhci-dbc-fix-bogus-1024-byte-prefix-if-ttydbc-read-races-with-stall-event.patch +x86-microcode-fix-entrysign-revision-check-for-zen1-naples.patch +binder-remove-invalid-inc-weak-check.patch +comedi-fix-divide-by-zero-in-comedi_buf_munge.patch +mei-me-add-wildcat-lake-p-did.patch +objtool-rust-add-one-more-noreturn-rust-function.patch +nvmem-rcar-efuse-add-missing-module_device_table.patch +misc-fastrpc-fix-dma_buf-object-leak-in-fastrpc_map_lookup.patch +most-usb-fix-use-after-free-in-hdm_disconnect.patch +most-usb-hdm_probe-fix-calling-put_device-before-device-initialization.patch +tcpm-switch-check-for-role_sw-device-with-fw_node.patch +tty-serial-sh-sci-fix-rsci-fifo-overrun-handling.patch +dt-bindings-serial-sh-sci-fix-r8a78000-interrupts.patch +dt-bindings-usb-dwc3-imx8mp-dma-range-is-required-only-for-imx8mp.patch +dt-bindings-usb-qcom-snps-dwc3-fix-bindings-for-x1e80100.patch +serial-8250_dw-handle-reset-control-deassert-error.patch +serial-8250_exar-add-support-for-advantech-2-port-card-with-device-id-0x0018.patch +serial-8250_mtk-enable-baud-clock-and-manage-in-runtime-pm.patch +serial-sc16is7xx-remove-useless-enable-of-enhanced-features.patch +staging-gpib-fix-device-reference-leak-in-fmh_gpib-driver.patch +staging-gpib-fix-no-eoi-on-1-and-2-byte-writes.patch +staging-gpib-return-eintr-on-device-clear.patch +staging-gpib-fix-sending-clear-and-trigger-events.patch diff --git a/queue-6.17/staging-gpib-fix-device-reference-leak-in-fmh_gpib-driver.patch b/queue-6.17/staging-gpib-fix-device-reference-leak-in-fmh_gpib-driver.patch new file mode 100644 index 0000000000..003fcd19d1 --- /dev/null +++ b/queue-6.17/staging-gpib-fix-device-reference-leak-in-fmh_gpib-driver.patch @@ -0,0 +1,41 @@ +From b1aabb8ef09b4cf0cc0c92ca9dfd19482f3192c1 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Tue, 23 Sep 2025 09:36:03 +0800 +Subject: staging: gpib: Fix device reference leak in fmh_gpib driver + +From: Ma Ke + +commit b1aabb8ef09b4cf0cc0c92ca9dfd19482f3192c1 upstream. + +The fmh_gpib driver contains a device reference count leak in +fmh_gpib_attach_impl() where driver_find_device() increases the +reference count of the device by get_device() when matching but this +reference is not properly decreased. Add put_device() in +fmh_gpib_detach(), which ensures that the reference count of the +device is correctly managed. + +Found by code review. + +Cc: stable +Fixes: 8e4841a0888c ("staging: gpib: Add Frank Mori Hess FPGA PCI GPIB driver") +Signed-off-by: Ma Ke +Reviewed-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/gpib/fmh_gpib/fmh_gpib.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/staging/gpib/fmh_gpib/fmh_gpib.c ++++ b/drivers/staging/gpib/fmh_gpib/fmh_gpib.c +@@ -1517,6 +1517,11 @@ void fmh_gpib_detach(struct gpib_board * + resource_size(e_priv->gpib_iomem_res)); + } + fmh_gpib_generic_detach(board); ++ ++ if (board->dev) { ++ put_device(board->dev); ++ board->dev = NULL; ++ } + } + + static int fmh_gpib_pci_attach_impl(struct gpib_board *board, diff --git a/queue-6.17/staging-gpib-fix-no-eoi-on-1-and-2-byte-writes.patch b/queue-6.17/staging-gpib-fix-no-eoi-on-1-and-2-byte-writes.patch new file mode 100644 index 0000000000..c0c37616ec --- /dev/null +++ b/queue-6.17/staging-gpib-fix-no-eoi-on-1-and-2-byte-writes.patch @@ -0,0 +1,78 @@ +From d3c4c1f29aadccf2f43530bfa1e60a6d8030fd4a Mon Sep 17 00:00:00 2001 +From: Dave Penkler +Date: Sun, 28 Sep 2025 11:18:18 +0200 +Subject: staging: gpib: Fix no EOI on 1 and 2 byte writes + +From: Dave Penkler + +commit d3c4c1f29aadccf2f43530bfa1e60a6d8030fd4a upstream. + +EOI (End Or Identify) is a hardware line on the GPIB bus that can be +asserted with the last byte of a message to indicate the end of the +transfer to the receiving device. + +In this driver, a write with send_eoi true is done in 3 parts: + Send first byte directly + Send remaining but 1 bytes using the fifo + Send the last byte directly with EOI asserted + +The first byte in a write is always sent by writing to the tms9914 +chip directly to setup for the subsequent fifo transfer. We were not +checking for a 1 byte write with send_eoi true resulting in EOI not +being asserted. Since the fifo transfer was not executed +(fifotransfersize == 0) the retval in the test after the fifo transfer +code was still 1 from the preceding direct write. This caused it to +return without executing the final direct write which would have sent +an unsollicited extra byte. + +For a 2 byte message the first byte was sent directly. But since the +fifo transfer was not executed (fifotransfersize == 1) and the retval +in the test after the fifo transfer code was still 1 from the +preceding first byte write it returned before the final direct byte +write with send_eoi true. The second byte was then sent as a separate +1 byte write to complete the 2 byte write count again without EOI +being asserted as above. + +Only send the first byte directly if more than 1 byte is to be +transferred with send_eoi true. + +Also check for retval < 0 for the error return in case the fifo code +is not used (1 or 2 byte message with send_eoi true). + +Fixes: 09a4655ee1eb ("staging: gpib: Add HP/Agilent/Keysight 8235xx PCI GPIB driver") +Cc: stable +Tested-by: Dave Penkler +Signed-off-by: Dave Penkler +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/gpib/agilent_82350b/agilent_82350b.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/staging/gpib/agilent_82350b/agilent_82350b.c ++++ b/drivers/staging/gpib/agilent_82350b/agilent_82350b.c +@@ -182,10 +182,12 @@ static int agilent_82350b_accel_write(st + return retval; + #endif + +- retval = agilent_82350b_write(board, buffer, 1, 0, &num_bytes); +- *bytes_written += num_bytes; +- if (retval < 0) +- return retval; ++ if (fifotransferlength > 0) { ++ retval = agilent_82350b_write(board, buffer, 1, 0, &num_bytes); ++ *bytes_written += num_bytes; ++ if (retval < 0) ++ return retval; ++ } + + write_byte(tms_priv, tms_priv->imr0_bits & ~HR_BOIE, IMR0); + for (i = 1; i < fifotransferlength;) { +@@ -217,7 +219,7 @@ static int agilent_82350b_accel_write(st + break; + } + write_byte(tms_priv, tms_priv->imr0_bits, IMR0); +- if (retval) ++ if (retval < 0) + return retval; + + if (send_eoi) { diff --git a/queue-6.17/staging-gpib-fix-sending-clear-and-trigger-events.patch b/queue-6.17/staging-gpib-fix-sending-clear-and-trigger-events.patch new file mode 100644 index 0000000000..6b5167a3b5 --- /dev/null +++ b/queue-6.17/staging-gpib-fix-sending-clear-and-trigger-events.patch @@ -0,0 +1,50 @@ +From 92a2b74a6b5a5d9b076cd9aa75e63c6461cbd073 Mon Sep 17 00:00:00 2001 +From: Dave Penkler +Date: Sun, 28 Sep 2025 13:33:58 +0200 +Subject: staging: gpib: Fix sending clear and trigger events + +From: Dave Penkler + +commit 92a2b74a6b5a5d9b076cd9aa75e63c6461cbd073 upstream. + +This driver was not sending device clear or trigger events when the +board entered the DCAS or DTAS state respectively in device mode. + +DCAS is the Device Clear Active State which is entered on receiving a +selective device clear message (SDC) or universal device clear message +(DCL) from the controller in charge. + +DTAS is the Device Trigger Active State which is entered on receiving +a group execute trigger (GET) message from the controller. + +In order for an application, implementing a particular device, to +detect when one of these states is entered the driver needs to send +the appropriate event. + +Send the appropriate gpib_event when DCAS or DTAS is set in the +reported status word. This sets the DCAS or DTAS bits in the board's +status word which can be monitored by the application. + +Fixes: 4e127de14fa7 ("staging: gpib: Add National Instruments USB GPIB driver") +Cc: stable +Tested-by: Dave Penkler +Signed-off-by: Dave Penkler +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/gpib/ni_usb/ni_usb_gpib.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c ++++ b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c +@@ -327,7 +327,10 @@ static void ni_usb_soft_update_status(st + board->status &= ~clear_mask; + board->status &= ~ni_usb_ibsta_mask; + board->status |= ni_usb_ibsta & ni_usb_ibsta_mask; +- //FIXME should generate events on DTAS and DCAS ++ if (ni_usb_ibsta & DCAS) ++ push_gpib_event(board, EVENT_DEV_CLR); ++ if (ni_usb_ibsta & DTAS) ++ push_gpib_event(board, EVENT_DEV_TRG); + + spin_lock_irqsave(&board->spinlock, flags); + /* remove set status bits from monitored set why ?***/ diff --git a/queue-6.17/staging-gpib-return-eintr-on-device-clear.patch b/queue-6.17/staging-gpib-return-eintr-on-device-clear.patch new file mode 100644 index 0000000000..7e71d36bef --- /dev/null +++ b/queue-6.17/staging-gpib-return-eintr-on-device-clear.patch @@ -0,0 +1,41 @@ +From aaf2af1ed147ef49be65afb541a67255e9f60d15 Mon Sep 17 00:00:00 2001 +From: Dave Penkler +Date: Sun, 28 Sep 2025 13:33:59 +0200 +Subject: staging: gpib: Return -EINTR on device clear + +From: Dave Penkler + +commit aaf2af1ed147ef49be65afb541a67255e9f60d15 upstream. + +When the ATN (Attention) line is asserted during a read we get a +NIUSB_ATN_STATE_ERROR during a read. For the controller to send a +device clear it asserts ATN. Normally this is an error but in the case +of a device clear it should be regarded as an interrupt. + +Return -EINTR when the Device Clear Active State (DCAS) is entered +else signal an error with dev_dbg with status instead of just dev_err. + +Signed-off-by: Dave Penkler +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/gpib/ni_usb/ni_usb_gpib.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c ++++ b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c +@@ -694,8 +694,12 @@ static int ni_usb_read(struct gpib_board + */ + break; + case NIUSB_ATN_STATE_ERROR: +- retval = -EIO; +- dev_err(&usb_dev->dev, "read when ATN set\n"); ++ if (status.ibsta & DCAS) { ++ retval = -EINTR; ++ } else { ++ retval = -EIO; ++ dev_dbg(&usb_dev->dev, "read when ATN set stat: 0x%06x\n", status.ibsta); ++ } + break; + case NIUSB_ADDRESSING_ERROR: + retval = -EIO; diff --git a/queue-6.17/tcpm-switch-check-for-role_sw-device-with-fw_node.patch b/queue-6.17/tcpm-switch-check-for-role_sw-device-with-fw_node.patch new file mode 100644 index 0000000000..6badea4367 --- /dev/null +++ b/queue-6.17/tcpm-switch-check-for-role_sw-device-with-fw_node.patch @@ -0,0 +1,45 @@ +From 2d8713f807a49b8a67c221670e50ae04967e915d Mon Sep 17 00:00:00 2001 +From: Michael Grzeschik +Date: Mon, 13 Oct 2025 11:43:40 +0200 +Subject: tcpm: switch check for role_sw device with fw_node + +From: Michael Grzeschik + +commit 2d8713f807a49b8a67c221670e50ae04967e915d upstream. + +When there is no port entry in the tcpci entry itself, the driver will +trigger an error message "OF: graph: no port node found in /...../typec" . + +It is documented that the dts node should contain an connector entry +with ports and several port pointing to devices with usb-role-switch +property set. Only when those connector entry is missing, it should +check for port entries in the main node. + +We switch the search order for looking after ports, which will avoid the +failure message while there are explicit connector entries. + +Fixes: d56de8c9a17d ("usb: typec: tcpm: try to get role switch from tcpc fwnode") +Cc: stable +Signed-off-by: Michael Grzeschik +Reviewed-by: Heikki Krogerus +Reviewed-by: Badhri Jagan Sridharan +Link: https://patch.msgid.link/20251013-b4-ml-topic-tcpm-v2-1-63c9b2ab8a0b@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -7876,9 +7876,9 @@ struct tcpm_port *tcpm_register_port(str + + port->partner_desc.identity = &port->partner_ident; + +- port->role_sw = usb_role_switch_get(port->dev); ++ port->role_sw = fwnode_usb_role_switch_get(tcpc->fwnode); + if (!port->role_sw) +- port->role_sw = fwnode_usb_role_switch_get(tcpc->fwnode); ++ port->role_sw = usb_role_switch_get(port->dev); + if (IS_ERR(port->role_sw)) { + err = PTR_ERR(port->role_sw); + goto out_destroy_wq; diff --git a/queue-6.17/tty-serial-sh-sci-fix-rsci-fifo-overrun-handling.patch b/queue-6.17/tty-serial-sh-sci-fix-rsci-fifo-overrun-handling.patch new file mode 100644 index 0000000000..041b50b7cf --- /dev/null +++ b/queue-6.17/tty-serial-sh-sci-fix-rsci-fifo-overrun-handling.patch @@ -0,0 +1,125 @@ +From ef8fef45c74b5a0059488fda2df65fa133f7d7d0 Mon Sep 17 00:00:00 2001 +From: Cosmin Tanislav +Date: Tue, 23 Sep 2025 18:47:06 +0300 +Subject: tty: serial: sh-sci: fix RSCI FIFO overrun handling + +From: Cosmin Tanislav + +commit ef8fef45c74b5a0059488fda2df65fa133f7d7d0 upstream. + +The receive error handling code is shared between RSCI and all other +SCIF port types, but the RSCI overrun_reg is specified as a memory +offset, while for other SCIF types it is an enum value used to index +into the sci_port_params->regs array, as mentioned above the +sci_serial_in() function. + +For RSCI, the overrun_reg is CSR (0x48), causing the sci_getreg() call +inside the sci_handle_fifo_overrun() function to index outside the +bounds of the regs array, which currently has a size of 20, as specified +by SCI_NR_REGS. + +Because of this, we end up accessing memory outside of RSCI's +rsci_port_params structure, which, when interpreted as a plat_sci_reg, +happens to have a non-zero size, causing the following WARN when +sci_serial_in() is called, as the accidental size does not match the +supported register sizes. + +The existence of the overrun_reg needs to be checked because +SCIx_SH3_SCIF_REGTYPE has overrun_reg set to SCLSR, but SCLSR is not +present in the regs array. + +Avoid calling sci_getreg() for port types which don't use standard +register handling. + +Use the ops->read_reg() and ops->write_reg() functions to properly read +and write registers for RSCI, and change the type of the status variable +to accommodate the 32-bit CSR register. + +sci_getreg() and sci_serial_in() are also called with overrun_reg in the +sci_mpxed_interrupt() interrupt handler, but that code path is not used +for RSCI, as it does not have a muxed interrupt. + +------------[ cut here ]------------ +Invalid register access +WARNING: CPU: 0 PID: 0 at drivers/tty/serial/sh-sci.c:522 sci_serial_in+0x38/0xac +Modules linked in: renesas_usbhs at24 rzt2h_adc industrialio_adc sha256 cfg80211 bluetooth ecdh_generic ecc rfkill fuse drm backlight ipv6 +CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.17.0-rc1+ #30 PREEMPT +Hardware name: Renesas RZ/T2H EVK Board based on r9a09g077m44 (DT) +pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : sci_serial_in+0x38/0xac +lr : sci_serial_in+0x38/0xac +sp : ffff800080003e80 +x29: ffff800080003e80 x28: ffff800082195b80 x27: 000000000000000d +x26: ffff8000821956d0 x25: 0000000000000000 x24: ffff800082195b80 +x23: ffff000180e0d800 x22: 0000000000000010 x21: 0000000000000000 +x20: 0000000000000010 x19: ffff000180e72000 x18: 000000000000000a +x17: ffff8002bcee7000 x16: ffff800080000000 x15: 0720072007200720 +x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 +x11: 0000000000000058 x10: 0000000000000018 x9 : ffff8000821a6a48 +x8 : 0000000000057fa8 x7 : 0000000000000406 x6 : ffff8000821fea48 +x5 : ffff00033ef88408 x4 : ffff8002bcee7000 x3 : ffff800082195b80 +x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff800082195b80 +Call trace: + sci_serial_in+0x38/0xac (P) + sci_handle_fifo_overrun.isra.0+0x70/0x134 + sci_er_interrupt+0x50/0x39c + __handle_irq_event_percpu+0x48/0x140 + handle_irq_event+0x44/0xb0 + handle_fasteoi_irq+0xf4/0x1a0 + handle_irq_desc+0x34/0x58 + generic_handle_domain_irq+0x1c/0x28 + gic_handle_irq+0x4c/0x140 + call_on_irq_stack+0x30/0x48 + do_interrupt_handler+0x80/0x84 + el1_interrupt+0x34/0x68 + el1h_64_irq_handler+0x18/0x24 + el1h_64_irq+0x6c/0x70 + default_idle_call+0x28/0x58 (P) + do_idle+0x1f8/0x250 + cpu_startup_entry+0x34/0x3c + rest_init+0xd8/0xe0 + console_on_rootfs+0x0/0x6c + __primary_switched+0x88/0x90 +---[ end trace 0000000000000000 ]--- + +Cc: stable +Fixes: 0666e3fe95ab ("serial: sh-sci: Add support for RZ/T2H SCI") +Signed-off-by: Cosmin Tanislav +Link: https://patch.msgid.link/20250923154707.1089900-1-cosmin-gabriel.tanislav.xa@renesas.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/sh-sci.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 538b2f991609..62bb62b82cbe 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -1014,16 +1014,18 @@ static int sci_handle_fifo_overrun(struct uart_port *port) + struct sci_port *s = to_sci_port(port); + const struct plat_sci_reg *reg; + int copied = 0; +- u16 status; ++ u32 status; + +- reg = sci_getreg(port, s->params->overrun_reg); +- if (!reg->size) +- return 0; ++ if (s->type != SCI_PORT_RSCI) { ++ reg = sci_getreg(port, s->params->overrun_reg); ++ if (!reg->size) ++ return 0; ++ } + +- status = sci_serial_in(port, s->params->overrun_reg); ++ status = s->ops->read_reg(port, s->params->overrun_reg); + if (status & s->params->overrun_mask) { + status &= ~s->params->overrun_mask; +- sci_serial_out(port, s->params->overrun_reg, status); ++ s->ops->write_reg(port, s->params->overrun_reg, status); + + port->icount.overrun++; + +-- +2.51.1 + diff --git a/queue-6.17/usb-core-quirks-add-huawei-me906s-to-wakeup-quirk.patch b/queue-6.17/usb-core-quirks-add-huawei-me906s-to-wakeup-quirk.patch new file mode 100644 index 0000000000..02b1342b9b --- /dev/null +++ b/queue-6.17/usb-core-quirks-add-huawei-me906s-to-wakeup-quirk.patch @@ -0,0 +1,33 @@ +From dfc2cf4dcaa03601cd4ca0f7def88b2630fca6ab Mon Sep 17 00:00:00 2001 +From: Tim Guttzeit +Date: Mon, 20 Oct 2025 15:39:04 +0200 +Subject: usb/core/quirks: Add Huawei ME906S to wakeup quirk + +From: Tim Guttzeit + +commit dfc2cf4dcaa03601cd4ca0f7def88b2630fca6ab upstream. + +The list of Huawei LTE modules needing the quirk fixing spurious wakeups +was missing the IDs of the Huawei ME906S module, therefore suspend did not +work. + +Cc: stable +Signed-off-by: Tim Guttzeit +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20251020134304.35079-1-wse@tuxedocomputers.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -467,6 +467,8 @@ static const struct usb_device_id usb_qu + /* Huawei 4G LTE module */ + { USB_DEVICE(0x12d1, 0x15bb), .driver_info = + USB_QUIRK_DISCONNECT_SUSPEND }, ++ { USB_DEVICE(0x12d1, 0x15c1), .driver_info = ++ USB_QUIRK_DISCONNECT_SUSPEND }, + { USB_DEVICE(0x12d1, 0x15c3), .driver_info = + USB_QUIRK_DISCONNECT_SUSPEND }, + diff --git a/queue-6.17/usb-raw-gadget-do-not-limit-transfer-length.patch b/queue-6.17/usb-raw-gadget-do-not-limit-transfer-length.patch new file mode 100644 index 0000000000..fcc2062ba7 --- /dev/null +++ b/queue-6.17/usb-raw-gadget-do-not-limit-transfer-length.patch @@ -0,0 +1,39 @@ +From 37b9dd0d114a0e38c502695e30f55a74fb0c37d0 Mon Sep 17 00:00:00 2001 +From: Andrey Konovalov +Date: Wed, 22 Oct 2025 00:25:45 +0200 +Subject: usb: raw-gadget: do not limit transfer length + +From: Andrey Konovalov + +commit 37b9dd0d114a0e38c502695e30f55a74fb0c37d0 upstream. + +Drop the check on the maximum transfer length in Raw Gadget for both +control and non-control transfers. + +Limiting the transfer length causes a problem with emulating USB devices +whose full configuration descriptor exceeds PAGE_SIZE in length. + +Overall, there does not appear to be any reason to enforce any kind of +transfer length limit on the Raw Gadget side for either control or +non-control transfers, so let's just drop the related check. + +Cc: stable +Fixes: f2c2e717642c ("usb: gadget: add raw-gadget interface") +Signed-off-by: Andrey Konovalov +Link: https://patch.msgid.link/a6024e8eab679043e9b8a5defdb41c4bda62f02b.1761085528.git.andreyknvl@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/legacy/raw_gadget.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/usb/gadget/legacy/raw_gadget.c ++++ b/drivers/usb/gadget/legacy/raw_gadget.c +@@ -667,8 +667,6 @@ static void *raw_alloc_io_data(struct us + return ERR_PTR(-EINVAL); + if (!usb_raw_io_flags_valid(io->flags)) + return ERR_PTR(-EINVAL); +- if (io->length > PAGE_SIZE) +- return ERR_PTR(-EINVAL); + if (get_from_user) + data = memdup_user(ptr + sizeof(*io), io->length); + else { diff --git a/queue-6.17/usb-serial-option-add-quectel-rg255c.patch b/queue-6.17/usb-serial-option-add-quectel-rg255c.patch new file mode 100644 index 0000000000..74a7cb2a2c --- /dev/null +++ b/queue-6.17/usb-serial-option-add-quectel-rg255c.patch @@ -0,0 +1,63 @@ +From 89205c60c0fc96b73567a2e9fe27ee3f59d01193 Mon Sep 17 00:00:00 2001 +From: Reinhard Speyerer +Date: Wed, 22 Oct 2025 16:17:26 +0200 +Subject: USB: serial: option: add Quectel RG255C + +From: Reinhard Speyerer + +commit 89205c60c0fc96b73567a2e9fe27ee3f59d01193 upstream. + +Add support for Quectel RG255C devices to complement commit 5c964c8a97c1 +("net: usb: qmi_wwan: add Quectel RG255C"). +The composition is DM / NMEA / AT / QMI. + +T: Bus=01 Lev=02 Prnt=99 Port=01 Cnt=02 Dev#=110 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0316 Rev= 5.15 +S: Manufacturer=Quectel +S: Product=RG255C-GL +S: SerialNumber=xxxxxxxx +C:* #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Reinhard Speyerer +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -273,6 +273,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_EM05CN 0x0312 + #define QUECTEL_PRODUCT_EM05G_GR 0x0313 + #define QUECTEL_PRODUCT_EM05G_RS 0x0314 ++#define QUECTEL_PRODUCT_RG255C 0x0316 + #define QUECTEL_PRODUCT_EM12 0x0512 + #define QUECTEL_PRODUCT_RM500Q 0x0800 + #define QUECTEL_PRODUCT_RM520N 0x0801 +@@ -1271,6 +1272,9 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0xff, 0x40) }, + + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, diff --git a/queue-6.17/usb-serial-option-add-telit-fn920c04-ecm-compositions.patch b/queue-6.17/usb-serial-option-add-telit-fn920c04-ecm-compositions.patch new file mode 100644 index 0000000000..fa92bdd146 --- /dev/null +++ b/queue-6.17/usb-serial-option-add-telit-fn920c04-ecm-compositions.patch @@ -0,0 +1,95 @@ +From 622865c73ae30f254abdf182f4b66cccbe3e0f10 Mon Sep 17 00:00:00 2001 +From: LI Qingwu +Date: Thu, 23 Oct 2025 03:44:22 +0000 +Subject: USB: serial: option: add Telit FN920C04 ECM compositions + +From: LI Qingwu + +commit 622865c73ae30f254abdf182f4b66cccbe3e0f10 upstream. + +Add support for the Telit Cinterion FN920C04 module when operating in +ECM (Ethernet Control Model) mode. The following USB product IDs are +used by the module when AT#USBCFG is set to 3 or 7. + +0x10A3: ECM + tty (NMEA) + tty (DUN) [+ tty (DIAG)] +T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10a3 Rev= 5.15 +S: Manufacturer=Telit Cinterion +S: Product=FN920 +S: SerialNumber=76e7cb38 +C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10A8: ECM + tty (DUN) + tty (AUX) [+ tty (DIAG)] +T: Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10a8 Rev= 5.15 +S: Manufacturer=Telit Cinterion +S: Product=FN920 +S: SerialNumber=76e7cb38 +C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Adding these IDs allows the option driver to automatically create the +corresponding /dev/ttyUSB* ports under ECM mode. + +Tested with FN920C04 under ECM configuration (USBCFG=3 and 7). + +Signed-off-by: LI Qingwu +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1403,10 +1403,14 @@ static const struct usb_device_id option + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a2, 0xff), /* Telit FN920C04 (MBIM) */ + .driver_info = NCTRL(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a3, 0xff), /* Telit FN920C04 (ECM) */ ++ .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a7, 0xff), /* Telit FN920C04 (MBIM) */ + .driver_info = NCTRL(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a8, 0xff), /* Telit FN920C04 (ECM) */ ++ .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a9, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */ diff --git a/queue-6.17/usb-serial-option-add-unisoc-uis7720.patch b/queue-6.17/usb-serial-option-add-unisoc-uis7720.patch new file mode 100644 index 0000000000..92467ad7cf --- /dev/null +++ b/queue-6.17/usb-serial-option-add-unisoc-uis7720.patch @@ -0,0 +1,73 @@ +From 71c07570b918f000de5d0f7f1bf17a2887e303b5 Mon Sep 17 00:00:00 2001 +From: Renjun Wang +Date: Sun, 19 Oct 2025 18:44:38 +0800 +Subject: USB: serial: option: add UNISOC UIS7720 + +From: Renjun Wang + +commit 71c07570b918f000de5d0f7f1bf17a2887e303b5 upstream. + +Add support for UNISOC (Spreadtrum) UIS7720 (A7720) module. + +T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1782 ProdID=4064 Rev=04.04 +S: Manufacturer=Unisoc-phone +S: Product=Unisoc-phone +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 9 Cfg#= 1 Atr=c0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0&1: RNDIS, 2: LOG, 3: DIAG, 4&5: AT Ports, 6&7: AT2 Ports, 8: ADB + +Signed-off-by: Renjun Wang +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -617,6 +617,7 @@ static void option_instat_callback(struc + #define UNISOC_VENDOR_ID 0x1782 + /* TOZED LT70-C based on UNISOC SL8563 uses UNISOC's vendor ID */ + #define TOZED_PRODUCT_LT70C 0x4055 ++#define UNISOC_PRODUCT_UIS7720 0x4064 + /* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */ + #define LUAT_PRODUCT_AIR720U 0x4e00 + +@@ -2466,6 +2467,7 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9291, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9291, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, UNISOC_PRODUCT_UIS7720, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, + { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */ + .driver_info = NCTRL(1) }, diff --git a/queue-6.17/x86-microcode-fix-entrysign-revision-check-for-zen1-naples.patch b/queue-6.17/x86-microcode-fix-entrysign-revision-check-for-zen1-naples.patch new file mode 100644 index 0000000000..4c78cbb8bc --- /dev/null +++ b/queue-6.17/x86-microcode-fix-entrysign-revision-check-for-zen1-naples.patch @@ -0,0 +1,34 @@ +From 876f0d43af78639790bee0e57b39d498ae35adcf Mon Sep 17 00:00:00 2001 +From: Andrew Cooper +Date: Mon, 20 Oct 2025 15:41:24 +0100 +Subject: x86/microcode: Fix Entrysign revision check for Zen1/Naples + +From: Andrew Cooper + +commit 876f0d43af78639790bee0e57b39d498ae35adcf upstream. + +... to match AMD's statement here: + +https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html + +Fixes: 50cef76d5cb0 ("x86/microcode/AMD: Load only SHA256-checksummed patches") +Signed-off-by: Andrew Cooper +Signed-off-by: Borislav Petkov (AMD) +Cc: +Link: https://patch.msgid.link/20251020144124.2930784-1-andrew.cooper3@citrix.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/microcode/amd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -194,7 +194,7 @@ static bool need_sha_check(u32 cur_rev) + } + + switch (cur_rev >> 8) { +- case 0x80012: return cur_rev <= 0x800126f; break; ++ case 0x80012: return cur_rev <= 0x8001277; break; + case 0x80082: return cur_rev <= 0x800820f; break; + case 0x83010: return cur_rev <= 0x830107c; break; + case 0x86001: return cur_rev <= 0x860010e; break; diff --git a/queue-6.17/xhci-dbc-enable-back-dbc-in-resume-if-it-was-enabled-before-suspend.patch b/queue-6.17/xhci-dbc-enable-back-dbc-in-resume-if-it-was-enabled-before-suspend.patch new file mode 100644 index 0000000000..60702d691c --- /dev/null +++ b/queue-6.17/xhci-dbc-enable-back-dbc-in-resume-if-it-was-enabled-before-suspend.patch @@ -0,0 +1,50 @@ +From 2bbd38fcd29670e46c0fdb9cd0e90507a8a1bf6a Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 14 Oct 2025 01:55:42 +0300 +Subject: xhci: dbc: enable back DbC in resume if it was enabled before suspend +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mathias Nyman + +commit 2bbd38fcd29670e46c0fdb9cd0e90507a8a1bf6a upstream. + +DbC is currently only enabled back if it's in configured state during +suspend. + +If system is suspended after DbC is enabled, but before the device is +properly enumerated by the host, then DbC would not be enabled back in +resume. + +Always enable DbC back in resume if it's suspended in enabled, +connected, or configured state + +Cc: stable +Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") +Tested-by: Łukasz Bartosik +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-dbgcap.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -1390,8 +1390,15 @@ int xhci_dbc_suspend(struct xhci_hcd *xh + if (!dbc) + return 0; + +- if (dbc->state == DS_CONFIGURED) ++ switch (dbc->state) { ++ case DS_ENABLED: ++ case DS_CONNECTED: ++ case DS_CONFIGURED: + dbc->resume_required = 1; ++ break; ++ default: ++ break; ++ } + + xhci_dbc_stop(dbc); + diff --git a/queue-6.17/xhci-dbc-fix-bogus-1024-byte-prefix-if-ttydbc-read-races-with-stall-event.patch b/queue-6.17/xhci-dbc-fix-bogus-1024-byte-prefix-if-ttydbc-read-races-with-stall-event.patch new file mode 100644 index 0000000000..93b3dd5b3b --- /dev/null +++ b/queue-6.17/xhci-dbc-fix-bogus-1024-byte-prefix-if-ttydbc-read-races-with-stall-event.patch @@ -0,0 +1,72 @@ +From f3d12ec847b945d5d65846c85f062d07d5e73164 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 14 Oct 2025 01:55:41 +0300 +Subject: xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mathias Nyman + +commit f3d12ec847b945d5d65846c85f062d07d5e73164 upstream. + +DbC may add 1024 bogus bytes to the beginneing of the receiving endpoint +if DbC hw triggers a STALL event before any Transfer Blocks (TRBs) for +incoming data are queued, but driver handles the event after it queued +the TRBs. + +This is possible as xHCI DbC hardware may trigger spurious STALL transfer +events even if endpoint is empty. The STALL event contains a pointer +to the stalled TRB, and "remaining" untransferred data length. + +As there are no TRBs queued yet the STALL event will just point to first +TRB position of the empty ring, with '0' bytes remaining untransferred. + +DbC driver is polling for events, and may not handle the STALL event +before /dev/ttyDBC0 is opened and incoming data TRBs are queued. + +The DbC event handler will now assume the first queued TRB (length 1024) +has stalled with '0' bytes remaining untransferred, and copies the data + +This race situation can be practically mitigated by making sure the event +handler handles all pending transfer events when DbC reaches configured +state, and only then create dev/ttyDbC0, and start queueing transfers. +The event handler can this way detect the STALL events on empty rings +and discard them before any transfers are queued. + +This does in practice solve the issue, but still leaves a small possible +gap for the race to trigger. +We still need a way to distinguish spurious STALLs on empty rings with '0' +bytes remaing, from actual STALL events with all bytes transmitted. + +Cc: stable +Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") +Tested-by: Łukasz Bartosik +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-dbgcap.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -892,7 +892,8 @@ static enum evtreturn xhci_dbc_do_handle + dev_info(dbc->dev, "DbC configured\n"); + portsc = readl(&dbc->regs->portsc); + writel(portsc, &dbc->regs->portsc); +- return EVT_GSER; ++ ret = EVT_GSER; ++ break; + } + + return EVT_DONE; +@@ -954,7 +955,8 @@ static enum evtreturn xhci_dbc_do_handle + break; + case TRB_TYPE(TRB_TRANSFER): + dbc_handle_xfer_event(dbc, evt); +- ret = EVT_XFER_DONE; ++ if (ret != EVT_GSER) ++ ret = EVT_XFER_DONE; + break; + default: + break;