From 69caf67879a8f2c75b2290d5c0139e4182ad2825 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 27 Oct 2025 08:45:30 +0100 Subject: [PATCH] 5.10-stable patches added patches: binder-remove-invalid-inc-weak-check.patch comedi-fix-divide-by-zero-in-comedi_buf_munge.patch mei-me-add-wildcat-lake-p-did.patch most-usb-fix-use-after-free-in-hdm_disconnect.patch most-usb-hdm_probe-fix-calling-put_device-before-device-initialization.patch serial-8250_exar-add-support-for-advantech-2-port-card-with-device-id-0x0018.patch usb-core-quirks-add-huawei-me906s-to-wakeup-quirk.patch usb-raw-gadget-do-not-limit-transfer-length.patch usb-serial-option-add-quectel-rg255c.patch usb-serial-option-add-telit-fn920c04-ecm-compositions.patch usb-serial-option-add-unisoc-uis7720.patch xhci-dbc-enable-back-dbc-in-resume-if-it-was-enabled-before-suspend.patch --- ...binder-remove-invalid-inc-weak-check.patch | 55 +++++++++++ ...x-divide-by-zero-in-comedi_buf_munge.patch | 45 +++++++++ .../mei-me-add-wildcat-lake-p-did.patch | 44 +++++++++ ...fix-use-after-free-in-hdm_disconnect.patch | 66 +++++++++++++ ..._device-before-device-initialization.patch | 41 ++++++++ ...ch-2-port-card-with-device-id-0x0018.patch | 56 +++++++++++ queue-5.10/series | 12 +++ ...ks-add-huawei-me906s-to-wakeup-quirk.patch | 33 +++++++ ...-gadget-do-not-limit-transfer-length.patch | 39 ++++++++ ...usb-serial-option-add-quectel-rg255c.patch | 63 ++++++++++++ ...-add-telit-fn920c04-ecm-compositions.patch | 95 +++++++++++++++++++ ...usb-serial-option-add-unisoc-uis7720.patch | 73 ++++++++++++++ ...ume-if-it-was-enabled-before-suspend.patch | 50 ++++++++++ 13 files changed, 672 insertions(+) create mode 100644 queue-5.10/binder-remove-invalid-inc-weak-check.patch create mode 100644 queue-5.10/comedi-fix-divide-by-zero-in-comedi_buf_munge.patch create mode 100644 queue-5.10/mei-me-add-wildcat-lake-p-did.patch create mode 100644 queue-5.10/most-usb-fix-use-after-free-in-hdm_disconnect.patch create mode 100644 queue-5.10/most-usb-hdm_probe-fix-calling-put_device-before-device-initialization.patch create mode 100644 queue-5.10/serial-8250_exar-add-support-for-advantech-2-port-card-with-device-id-0x0018.patch create mode 100644 queue-5.10/usb-core-quirks-add-huawei-me906s-to-wakeup-quirk.patch create mode 100644 queue-5.10/usb-raw-gadget-do-not-limit-transfer-length.patch create mode 100644 queue-5.10/usb-serial-option-add-quectel-rg255c.patch create mode 100644 queue-5.10/usb-serial-option-add-telit-fn920c04-ecm-compositions.patch create mode 100644 queue-5.10/usb-serial-option-add-unisoc-uis7720.patch create mode 100644 queue-5.10/xhci-dbc-enable-back-dbc-in-resume-if-it-was-enabled-before-suspend.patch diff --git a/queue-5.10/binder-remove-invalid-inc-weak-check.patch b/queue-5.10/binder-remove-invalid-inc-weak-check.patch new file mode 100644 index 0000000000..b181cdc541 --- /dev/null +++ b/queue-5.10/binder-remove-invalid-inc-weak-check.patch @@ -0,0 +1,55 @@ +From d90eeb8ecd227c204ab6c34a17b372bd950b7aa2 Mon Sep 17 00:00:00 2001 +From: Alice Ryhl +Date: Wed, 15 Oct 2025 14:26:55 +0000 +Subject: binder: remove "invalid inc weak" check + +From: Alice Ryhl + +commit d90eeb8ecd227c204ab6c34a17b372bd950b7aa2 upstream. + +There are no scenarios where a weak increment is invalid on binder_node. +The only possible case where it could be invalid is if the kernel +delivers BR_DECREFS to the process that owns the node, and then +increments the weak refcount again, effectively "reviving" a dead node. + +However, that is not possible: when the BR_DECREFS command is delivered, +the kernel removes and frees the binder_node. The fact that you were +able to call binder_inc_node_nilocked() implies that the node is not yet +destroyed, which implies that BR_DECREFS has not been delivered to +userspace, so incrementing the weak refcount is valid. + +Note that it's currently possible to trigger this condition if the owner +calls BINDER_THREAD_EXIT while node->has_weak_ref is true. This causes +BC_INCREFS on binder_ref instances to fail when they should not. + +Cc: stable@vger.kernel.org +Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") +Reported-by: Yu-Ting Tseng +Signed-off-by: Alice Ryhl +Link: https://patch.msgid.link/20251015-binder-weak-inc-v1-1-7914b092c371@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/android/binder.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -1204,17 +1204,8 @@ static int binder_inc_node_nilocked(stru + } else { + if (!internal) + node->local_weak_refs++; +- if (!node->has_weak_ref && list_empty(&node->work.entry)) { +- if (target_list == NULL) { +- pr_err("invalid inc weak node for %d\n", +- node->debug_id); +- return -EINVAL; +- } +- /* +- * See comment above +- */ ++ if (!node->has_weak_ref && target_list && list_empty(&node->work.entry)) + binder_enqueue_work_ilocked(&node->work, target_list); +- } + } + return 0; + } diff --git a/queue-5.10/comedi-fix-divide-by-zero-in-comedi_buf_munge.patch b/queue-5.10/comedi-fix-divide-by-zero-in-comedi_buf_munge.patch new file mode 100644 index 0000000000..f7582895b4 --- /dev/null +++ b/queue-5.10/comedi-fix-divide-by-zero-in-comedi_buf_munge.patch @@ -0,0 +1,45 @@ +From 87b318ba81dda2ee7b603f4f6c55e78ec3e95974 Mon Sep 17 00:00:00 2001 +From: Deepanshu Kartikey +Date: Wed, 24 Sep 2025 15:56:39 +0530 +Subject: comedi: fix divide-by-zero in comedi_buf_munge() + +From: Deepanshu Kartikey + +commit 87b318ba81dda2ee7b603f4f6c55e78ec3e95974 upstream. + +The comedi_buf_munge() function performs a modulo operation +`async->munge_chan %= async->cmd.chanlist_len` without first +checking if chanlist_len is zero. If a user program submits a command with +chanlist_len set to zero, this causes a divide-by-zero error when the device +processes data in the interrupt handler path. + +Add a check for zero chanlist_len at the beginning of the +function, similar to the existing checks for !map and +CMDF_RAWDATA flag. When chanlist_len is zero, update +munge_count and return early, indicating the data was +handled without munging. + +This prevents potential kernel panics from malformed user commands. + +Reported-by: syzbot+f6c3c066162d2c43a66c@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=f6c3c066162d2c43a66c +Cc: stable@vger.kernel.org +Signed-off-by: Deepanshu Kartikey +Reviewed-by: Ian Abbott +Link: https://patch.msgid.link/20250924102639.1256191-1-kartikey406@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/comedi/comedi_buf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/comedi/comedi_buf.c ++++ b/drivers/staging/comedi/comedi_buf.c +@@ -369,7 +369,7 @@ static unsigned int comedi_buf_munge(str + unsigned int count = 0; + const unsigned int num_sample_bytes = comedi_bytes_per_sample(s); + +- if (!s->munge || (async->cmd.flags & CMDF_RAWDATA)) { ++ if (!s->munge || (async->cmd.flags & CMDF_RAWDATA) || async->cmd.chanlist_len == 0) { + async->munge_count += num_bytes; + count = num_bytes; + } else { diff --git a/queue-5.10/mei-me-add-wildcat-lake-p-did.patch b/queue-5.10/mei-me-add-wildcat-lake-p-did.patch new file mode 100644 index 0000000000..012bc0199f --- /dev/null +++ b/queue-5.10/mei-me-add-wildcat-lake-p-did.patch @@ -0,0 +1,44 @@ +From 410d6c2ad4d1a88efa0acbb9966693725b564933 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Thu, 16 Oct 2025 15:59:12 +0300 +Subject: mei: me: add wildcat lake P DID + +From: Alexander Usyskin + +commit 410d6c2ad4d1a88efa0acbb9966693725b564933 upstream. + +Add Wildcat Lake P device id. + +Cc: stable@vger.kernel.org +Co-developed-by: Tomas Winkler +Signed-off-by: Tomas Winkler +Signed-off-by: Alexander Usyskin +Link: https://patch.msgid.link/20251016125912.2146136-1-alexander.usyskin@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mei/hw-me-regs.h | 2 ++ + drivers/misc/mei/pci-me.c | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -120,6 +120,8 @@ + #define MEI_DEV_ID_PTL_H 0xE370 /* Panther Lake H */ + #define MEI_DEV_ID_PTL_P 0xE470 /* Panther Lake P */ + ++#define MEI_DEV_ID_WCL_P 0x4D70 /* Wildcat Lake P */ ++ + /* + * MEI HW Section + */ +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -126,6 +126,8 @@ static const struct pci_device_id mei_me + {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_H, MEI_ME_PCH15_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_P, MEI_ME_PCH15_CFG)}, + ++ {MEI_PCI_DEVICE(MEI_DEV_ID_WCL_P, MEI_ME_PCH15_CFG)}, ++ + /* required last entry */ + {0, } + }; diff --git a/queue-5.10/most-usb-fix-use-after-free-in-hdm_disconnect.patch b/queue-5.10/most-usb-fix-use-after-free-in-hdm_disconnect.patch new file mode 100644 index 0000000000..1be4de1630 --- /dev/null +++ b/queue-5.10/most-usb-fix-use-after-free-in-hdm_disconnect.patch @@ -0,0 +1,66 @@ +From 4b1270902609ef0d935ed2faa2ea6d122bd148f5 Mon Sep 17 00:00:00 2001 +From: Victoria Votokina +Date: Fri, 10 Oct 2025 13:52:40 +0300 +Subject: most: usb: Fix use-after-free in hdm_disconnect + +From: Victoria Votokina + +commit 4b1270902609ef0d935ed2faa2ea6d122bd148f5 upstream. + +hdm_disconnect() calls most_deregister_interface(), which eventually +unregisters the MOST interface device with device_unregister(iface->dev). +If that drops the last reference, the device core may call release_mdev() +immediately while hdm_disconnect() is still executing. + +The old code also freed several mdev-owned allocations in +hdm_disconnect() and then performed additional put_device() calls. +Depending on refcount order, this could lead to use-after-free or +double-free when release_mdev() ran (or when unregister paths also +performed puts). + +Fix by moving the frees of mdev-owned allocations into release_mdev(), +so they happen exactly once when the device is truly released, and by +dropping the extra put_device() calls in hdm_disconnect() that are +redundant after device_unregister() and most_deregister_interface(). + +This addresses the KASAN slab-use-after-free reported by syzbot in +hdm_disconnect(). See report and stack traces in the bug link below. + +Reported-by: syzbot+916742d5d24f6c254761@syzkaller.appspotmail.com +Cc: stable +Closes: https://syzkaller.appspot.com/bug?extid=916742d5d24f6c254761 +Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver") +Signed-off-by: Victoria Votokina +Link: https://patch.msgid.link/20251010105241.4087114-2-Victoria.Votokina@kaspersky.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/most/most_usb.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/most/most_usb.c ++++ b/drivers/most/most_usb.c +@@ -929,6 +929,10 @@ static void release_mdev(struct device * + { + struct most_dev *mdev = to_mdev_from_dev(dev); + ++ kfree(mdev->busy_urbs); ++ kfree(mdev->cap); ++ kfree(mdev->conf); ++ kfree(mdev->ep_address); + kfree(mdev); + } + /** +@@ -1121,13 +1125,6 @@ static void hdm_disconnect(struct usb_in + if (mdev->dci) + device_unregister(&mdev->dci->dev); + most_deregister_interface(&mdev->iface); +- +- kfree(mdev->busy_urbs); +- kfree(mdev->cap); +- kfree(mdev->conf); +- kfree(mdev->ep_address); +- put_device(&mdev->dci->dev); +- put_device(&mdev->dev); + } + + static int hdm_suspend(struct usb_interface *interface, pm_message_t message) diff --git a/queue-5.10/most-usb-hdm_probe-fix-calling-put_device-before-device-initialization.patch b/queue-5.10/most-usb-hdm_probe-fix-calling-put_device-before-device-initialization.patch new file mode 100644 index 0000000000..cee4f7bd70 --- /dev/null +++ b/queue-5.10/most-usb-hdm_probe-fix-calling-put_device-before-device-initialization.patch @@ -0,0 +1,41 @@ +From a8cc9e5fcb0e2eef21513a4fec888f5712cb8162 Mon Sep 17 00:00:00 2001 +From: Victoria Votokina +Date: Fri, 10 Oct 2025 13:52:41 +0300 +Subject: most: usb: hdm_probe: Fix calling put_device() before device initialization + +From: Victoria Votokina + +commit a8cc9e5fcb0e2eef21513a4fec888f5712cb8162 upstream. + +The early error path in hdm_probe() can jump to err_free_mdev before +&mdev->dev has been initialized with device_initialize(). Calling +put_device(&mdev->dev) there triggers a device core WARN and ends up +invoking kref_put(&kobj->kref, kobject_release) on an uninitialized +kobject. + +In this path the private struct was only kmalloc'ed and the intended +release is effectively kfree(mdev) anyway, so free it directly instead +of calling put_device() on an uninitialized device. + +This removes the WARNING and fixes the pre-initialization error path. + +Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver") +Cc: stable +Signed-off-by: Victoria Votokina +Link: https://patch.msgid.link/20251010105241.4087114-3-Victoria.Votokina@kaspersky.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/most/most_usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/most/most_usb.c ++++ b/drivers/most/most_usb.c +@@ -1097,7 +1097,7 @@ err_free_cap: + err_free_conf: + kfree(mdev->conf); + err_free_mdev: +- put_device(&mdev->dev); ++ kfree(mdev); + return ret; + } + diff --git a/queue-5.10/serial-8250_exar-add-support-for-advantech-2-port-card-with-device-id-0x0018.patch b/queue-5.10/serial-8250_exar-add-support-for-advantech-2-port-card-with-device-id-0x0018.patch new file mode 100644 index 0000000000..37b97339d4 --- /dev/null +++ b/queue-5.10/serial-8250_exar-add-support-for-advantech-2-port-card-with-device-id-0x0018.patch @@ -0,0 +1,56 @@ +From e7cbce761fe3fcbcb49bcf30d4f8ca5e1a9ee2a0 Mon Sep 17 00:00:00 2001 +From: Florian Eckert +Date: Wed, 24 Sep 2025 15:41:15 +0200 +Subject: serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 + +From: Florian Eckert + +commit e7cbce761fe3fcbcb49bcf30d4f8ca5e1a9ee2a0 upstream. + +The Advantech 2-port serial card with PCI vendor=0x13fe and device=0x0018 +has a 'XR17V35X' chip installed on the circuit board. Therefore, this +driver can be used instead of theu outdated out-of-tree driver from the +manufacturer. + +Signed-off-by: Florian Eckert +Cc: stable +Link: https://patch.msgid.link/20250924134115.2667650-1-fe@dev.tdt.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_exar.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -33,6 +33,8 @@ + #define PCI_DEVICE_ID_ACCESSIO_COM_4SM 0x10db + #define PCI_DEVICE_ID_ACCESSIO_COM_8SM 0x10ea + ++#define PCI_DEVICE_ID_ADVANTECH_XR17V352 0x0018 ++ + #define PCI_DEVICE_ID_COMMTECH_4224PCI335 0x0002 + #define PCI_DEVICE_ID_COMMTECH_4222PCI335 0x0004 + #define PCI_DEVICE_ID_COMMTECH_2324PCI335 0x000a +@@ -815,6 +817,12 @@ static const struct exar8250_board pbn_f + .exit = pci_xr17v35x_exit, + }; + ++static const struct exar8250_board pbn_adv_XR17V352 = { ++ .num_ports = 2, ++ .setup = pci_xr17v35x_setup, ++ .exit = pci_xr17v35x_exit, ++}; ++ + static const struct exar8250_board pbn_exar_XR17V4358 = { + .num_ports = 12, + .setup = pci_xr17v35x_setup, +@@ -884,6 +892,9 @@ static const struct pci_device_id exar_p + USR_DEVICE(XR17C152, 2980, pbn_exar_XR17C15x), + USR_DEVICE(XR17C152, 2981, pbn_exar_XR17C15x), + ++ /* ADVANTECH devices */ ++ EXAR_DEVICE(ADVANTECH, XR17V352, pbn_adv_XR17V352), ++ + /* Exar Corp. XR17C15[248] Dual/Quad/Octal UART */ + EXAR_DEVICE(EXAR, XR17C152, pbn_exar_XR17C15x), + EXAR_DEVICE(EXAR, XR17C154, pbn_exar_XR17C15x), diff --git a/queue-5.10/series b/queue-5.10/series index 5ecc4bdcec..3fe8fdb93a 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -288,3 +288,15 @@ risc-v-correctly-print-supported-extensions.patch risc-v-minimal-parser-for-riscv-isa-strings.patch riscv-cpu-add-64bit-hartid-support-on-rv64.patch risc-v-don-t-print-details-of-cpus-disabled-in-dt.patch +usb-serial-option-add-unisoc-uis7720.patch +usb-serial-option-add-quectel-rg255c.patch +usb-serial-option-add-telit-fn920c04-ecm-compositions.patch +usb-core-quirks-add-huawei-me906s-to-wakeup-quirk.patch +usb-raw-gadget-do-not-limit-transfer-length.patch +xhci-dbc-enable-back-dbc-in-resume-if-it-was-enabled-before-suspend.patch +binder-remove-invalid-inc-weak-check.patch +comedi-fix-divide-by-zero-in-comedi_buf_munge.patch +mei-me-add-wildcat-lake-p-did.patch +most-usb-fix-use-after-free-in-hdm_disconnect.patch +most-usb-hdm_probe-fix-calling-put_device-before-device-initialization.patch +serial-8250_exar-add-support-for-advantech-2-port-card-with-device-id-0x0018.patch diff --git a/queue-5.10/usb-core-quirks-add-huawei-me906s-to-wakeup-quirk.patch b/queue-5.10/usb-core-quirks-add-huawei-me906s-to-wakeup-quirk.patch new file mode 100644 index 0000000000..b82a63941d --- /dev/null +++ b/queue-5.10/usb-core-quirks-add-huawei-me906s-to-wakeup-quirk.patch @@ -0,0 +1,33 @@ +From dfc2cf4dcaa03601cd4ca0f7def88b2630fca6ab Mon Sep 17 00:00:00 2001 +From: Tim Guttzeit +Date: Mon, 20 Oct 2025 15:39:04 +0200 +Subject: usb/core/quirks: Add Huawei ME906S to wakeup quirk + +From: Tim Guttzeit + +commit dfc2cf4dcaa03601cd4ca0f7def88b2630fca6ab upstream. + +The list of Huawei LTE modules needing the quirk fixing spurious wakeups +was missing the IDs of the Huawei ME906S module, therefore suspend did not +work. + +Cc: stable +Signed-off-by: Tim Guttzeit +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20251020134304.35079-1-wse@tuxedocomputers.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -462,6 +462,8 @@ static const struct usb_device_id usb_qu + /* Huawei 4G LTE module */ + { USB_DEVICE(0x12d1, 0x15bb), .driver_info = + USB_QUIRK_DISCONNECT_SUSPEND }, ++ { USB_DEVICE(0x12d1, 0x15c1), .driver_info = ++ USB_QUIRK_DISCONNECT_SUSPEND }, + { USB_DEVICE(0x12d1, 0x15c3), .driver_info = + USB_QUIRK_DISCONNECT_SUSPEND }, + diff --git a/queue-5.10/usb-raw-gadget-do-not-limit-transfer-length.patch b/queue-5.10/usb-raw-gadget-do-not-limit-transfer-length.patch new file mode 100644 index 0000000000..bf03fa9bb1 --- /dev/null +++ b/queue-5.10/usb-raw-gadget-do-not-limit-transfer-length.patch @@ -0,0 +1,39 @@ +From 37b9dd0d114a0e38c502695e30f55a74fb0c37d0 Mon Sep 17 00:00:00 2001 +From: Andrey Konovalov +Date: Wed, 22 Oct 2025 00:25:45 +0200 +Subject: usb: raw-gadget: do not limit transfer length + +From: Andrey Konovalov + +commit 37b9dd0d114a0e38c502695e30f55a74fb0c37d0 upstream. + +Drop the check on the maximum transfer length in Raw Gadget for both +control and non-control transfers. + +Limiting the transfer length causes a problem with emulating USB devices +whose full configuration descriptor exceeds PAGE_SIZE in length. + +Overall, there does not appear to be any reason to enforce any kind of +transfer length limit on the Raw Gadget side for either control or +non-control transfers, so let's just drop the related check. + +Cc: stable +Fixes: f2c2e717642c ("usb: gadget: add raw-gadget interface") +Signed-off-by: Andrey Konovalov +Link: https://patch.msgid.link/a6024e8eab679043e9b8a5defdb41c4bda62f02b.1761085528.git.andreyknvl@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/legacy/raw_gadget.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/usb/gadget/legacy/raw_gadget.c ++++ b/drivers/usb/gadget/legacy/raw_gadget.c +@@ -619,8 +619,6 @@ static void *raw_alloc_io_data(struct us + return ERR_PTR(-EINVAL); + if (!usb_raw_io_flags_valid(io->flags)) + return ERR_PTR(-EINVAL); +- if (io->length > PAGE_SIZE) +- return ERR_PTR(-EINVAL); + if (get_from_user) + data = memdup_user(ptr + sizeof(*io), io->length); + else { diff --git a/queue-5.10/usb-serial-option-add-quectel-rg255c.patch b/queue-5.10/usb-serial-option-add-quectel-rg255c.patch new file mode 100644 index 0000000000..74a7cb2a2c --- /dev/null +++ b/queue-5.10/usb-serial-option-add-quectel-rg255c.patch @@ -0,0 +1,63 @@ +From 89205c60c0fc96b73567a2e9fe27ee3f59d01193 Mon Sep 17 00:00:00 2001 +From: Reinhard Speyerer +Date: Wed, 22 Oct 2025 16:17:26 +0200 +Subject: USB: serial: option: add Quectel RG255C + +From: Reinhard Speyerer + +commit 89205c60c0fc96b73567a2e9fe27ee3f59d01193 upstream. + +Add support for Quectel RG255C devices to complement commit 5c964c8a97c1 +("net: usb: qmi_wwan: add Quectel RG255C"). +The composition is DM / NMEA / AT / QMI. + +T: Bus=01 Lev=02 Prnt=99 Port=01 Cnt=02 Dev#=110 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0316 Rev= 5.15 +S: Manufacturer=Quectel +S: Product=RG255C-GL +S: SerialNumber=xxxxxxxx +C:* #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Reinhard Speyerer +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -273,6 +273,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_EM05CN 0x0312 + #define QUECTEL_PRODUCT_EM05G_GR 0x0313 + #define QUECTEL_PRODUCT_EM05G_RS 0x0314 ++#define QUECTEL_PRODUCT_RG255C 0x0316 + #define QUECTEL_PRODUCT_EM12 0x0512 + #define QUECTEL_PRODUCT_RM500Q 0x0800 + #define QUECTEL_PRODUCT_RM520N 0x0801 +@@ -1271,6 +1272,9 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG255C, 0xff, 0xff, 0x40) }, + + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, diff --git a/queue-5.10/usb-serial-option-add-telit-fn920c04-ecm-compositions.patch b/queue-5.10/usb-serial-option-add-telit-fn920c04-ecm-compositions.patch new file mode 100644 index 0000000000..fa92bdd146 --- /dev/null +++ b/queue-5.10/usb-serial-option-add-telit-fn920c04-ecm-compositions.patch @@ -0,0 +1,95 @@ +From 622865c73ae30f254abdf182f4b66cccbe3e0f10 Mon Sep 17 00:00:00 2001 +From: LI Qingwu +Date: Thu, 23 Oct 2025 03:44:22 +0000 +Subject: USB: serial: option: add Telit FN920C04 ECM compositions + +From: LI Qingwu + +commit 622865c73ae30f254abdf182f4b66cccbe3e0f10 upstream. + +Add support for the Telit Cinterion FN920C04 module when operating in +ECM (Ethernet Control Model) mode. The following USB product IDs are +used by the module when AT#USBCFG is set to 3 or 7. + +0x10A3: ECM + tty (NMEA) + tty (DUN) [+ tty (DIAG)] +T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10a3 Rev= 5.15 +S: Manufacturer=Telit Cinterion +S: Product=FN920 +S: SerialNumber=76e7cb38 +C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10A8: ECM + tty (DUN) + tty (AUX) [+ tty (DIAG)] +T: Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10a8 Rev= 5.15 +S: Manufacturer=Telit Cinterion +S: Product=FN920 +S: SerialNumber=76e7cb38 +C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Adding these IDs allows the option driver to automatically create the +corresponding /dev/ttyUSB* ports under ECM mode. + +Tested with FN920C04 under ECM configuration (USBCFG=3 and 7). + +Signed-off-by: LI Qingwu +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1403,10 +1403,14 @@ static const struct usb_device_id option + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a2, 0xff), /* Telit FN920C04 (MBIM) */ + .driver_info = NCTRL(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a3, 0xff), /* Telit FN920C04 (ECM) */ ++ .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a7, 0xff), /* Telit FN920C04 (MBIM) */ + .driver_info = NCTRL(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a8, 0xff), /* Telit FN920C04 (ECM) */ ++ .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a9, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */ diff --git a/queue-5.10/usb-serial-option-add-unisoc-uis7720.patch b/queue-5.10/usb-serial-option-add-unisoc-uis7720.patch new file mode 100644 index 0000000000..92467ad7cf --- /dev/null +++ b/queue-5.10/usb-serial-option-add-unisoc-uis7720.patch @@ -0,0 +1,73 @@ +From 71c07570b918f000de5d0f7f1bf17a2887e303b5 Mon Sep 17 00:00:00 2001 +From: Renjun Wang +Date: Sun, 19 Oct 2025 18:44:38 +0800 +Subject: USB: serial: option: add UNISOC UIS7720 + +From: Renjun Wang + +commit 71c07570b918f000de5d0f7f1bf17a2887e303b5 upstream. + +Add support for UNISOC (Spreadtrum) UIS7720 (A7720) module. + +T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1782 ProdID=4064 Rev=04.04 +S: Manufacturer=Unisoc-phone +S: Product=Unisoc-phone +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 9 Cfg#= 1 Atr=c0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0&1: RNDIS, 2: LOG, 3: DIAG, 4&5: AT Ports, 6&7: AT2 Ports, 8: ADB + +Signed-off-by: Renjun Wang +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -617,6 +617,7 @@ static void option_instat_callback(struc + #define UNISOC_VENDOR_ID 0x1782 + /* TOZED LT70-C based on UNISOC SL8563 uses UNISOC's vendor ID */ + #define TOZED_PRODUCT_LT70C 0x4055 ++#define UNISOC_PRODUCT_UIS7720 0x4064 + /* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */ + #define LUAT_PRODUCT_AIR720U 0x4e00 + +@@ -2466,6 +2467,7 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9291, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9291, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, UNISOC_PRODUCT_UIS7720, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, + { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */ + .driver_info = NCTRL(1) }, diff --git a/queue-5.10/xhci-dbc-enable-back-dbc-in-resume-if-it-was-enabled-before-suspend.patch b/queue-5.10/xhci-dbc-enable-back-dbc-in-resume-if-it-was-enabled-before-suspend.patch new file mode 100644 index 0000000000..e9f9983f97 --- /dev/null +++ b/queue-5.10/xhci-dbc-enable-back-dbc-in-resume-if-it-was-enabled-before-suspend.patch @@ -0,0 +1,50 @@ +From 2bbd38fcd29670e46c0fdb9cd0e90507a8a1bf6a Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 14 Oct 2025 01:55:42 +0300 +Subject: xhci: dbc: enable back DbC in resume if it was enabled before suspend +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mathias Nyman + +commit 2bbd38fcd29670e46c0fdb9cd0e90507a8a1bf6a upstream. + +DbC is currently only enabled back if it's in configured state during +suspend. + +If system is suspended after DbC is enabled, but before the device is +properly enumerated by the host, then DbC would not be enabled back in +resume. + +Always enable DbC back in resume if it's suspended in enabled, +connected, or configured state + +Cc: stable +Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") +Tested-by: Łukasz Bartosik +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-dbgcap.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -1147,8 +1147,15 @@ int xhci_dbc_suspend(struct xhci_hcd *xh + if (!dbc) + return 0; + +- if (dbc->state == DS_CONFIGURED) ++ switch (dbc->state) { ++ case DS_ENABLED: ++ case DS_CONNECTED: ++ case DS_CONFIGURED: + dbc->resume_required = 1; ++ break; ++ default: ++ break; ++ } + + xhci_dbc_stop(dbc); + -- 2.47.3