From: Greg Kroah-Hartman Date: Tue, 23 Apr 2024 13:02:44 +0000 (-0700) Subject: 6.1-stable patches X-Git-Tag: v5.15.157~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=352bb9f58a12a337e6af954bd14b17bb7a0f3108;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: arm64-hibernate-fix-level3-translation-fault-in-swsusp_save.patch fs-sysfs-fix-reference-leak-in-sysfs_break_active_protection.patch init-main.c-fix-potential-static_command_line-memory-overflow.patch kvm-x86-pmu-disable-support-for-adaptive-pebs.patch kvm-x86-pmu-do-not-mask-lvtpc-when-handling-a-pmi-on-amd-platforms.patch kvm-x86-snapshot-if-a-vcpu-s-vendor-model-is-amd-vs.-intel-compatible.patch mei-me-disable-rpl-s-on-sps-and-ign-firmwares.patch mm-memory-failure-fix-deadlock-when-hugetlb_optimize_vmemmap-is-enabled.patch revert-usb-cdc-wdm-close-race-between-read-and-workqueue.patch serial-mxs-auart-add-spinlock-around-changing-cts-state.patch serial-pmac_zilog-remove-flawed-mitigation-for-rx-irq-flood.patch serial-stm32-reset-.throttled-state-in-.startup.patch serial-stm32-return-irq_none-in-the-isr-if-no-handling-happend.patch speakup-avoid-crash-on-very-long-word.patch usb-disable-usb3-lpm-at-shutdown.patch usb-dwc2-host-fix-dereference-issue-in-ddma-completion-flow.patch usb-gadget-f_ncm-fix-uaf-ncm-object-at-re-bind-after-usb-ep-transport-error.patch usb-serial-option-add-fibocom-fm135-gl-variants.patch usb-serial-option-add-lonsung-u8300-u9300-product.patch usb-serial-option-add-rolling-rw101-gl-and-rw135-gl-support.patch usb-serial-option-add-support-for-fibocom-fm650-fg650.patch usb-serial-option-add-telit-fn920c04-rmnet-compositions.patch usb-serial-option-support-quectel-em060k-sub-models.patch --- diff --git a/queue-6.1/arm64-hibernate-fix-level3-translation-fault-in-swsusp_save.patch b/queue-6.1/arm64-hibernate-fix-level3-translation-fault-in-swsusp_save.patch new file mode 100644 index 00000000000..8a29fa272f4 --- /dev/null +++ b/queue-6.1/arm64-hibernate-fix-level3-translation-fault-in-swsusp_save.patch @@ -0,0 +1,96 @@ +From 50449ca66cc5a8cbc64749cf4b9f3d3fc5f4b457 Mon Sep 17 00:00:00 2001 +From: Yaxiong Tian +Date: Wed, 17 Apr 2024 10:52:48 +0800 +Subject: arm64: hibernate: Fix level3 translation fault in swsusp_save() + +From: Yaxiong Tian + +commit 50449ca66cc5a8cbc64749cf4b9f3d3fc5f4b457 upstream. + +On arm64 machines, swsusp_save() faults if it attempts to access +MEMBLOCK_NOMAP memory ranges. This can be reproduced in QEMU using UEFI +when booting with rodata=off debug_pagealloc=off and CONFIG_KFENCE=n: + + Unable to handle kernel paging request at virtual address ffffff8000000000 + Mem abort info: + ESR = 0x0000000096000007 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x07: level 3 translation fault + Data abort info: + ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 + CM = 0, WnR = 0, TnD = 0, TagAccess = 0 + GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 + swapper pgtable: 4k pages, 39-bit VAs, pgdp=00000000eeb0b000 + [ffffff8000000000] pgd=180000217fff9803, p4d=180000217fff9803, pud=180000217fff9803, pmd=180000217fff8803, pte=0000000000000000 + Internal error: Oops: 0000000096000007 [#1] SMP + Internal error: Oops: 0000000096000007 [#1] SMP + Modules linked in: xt_multiport ipt_REJECT nf_reject_ipv4 xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_filter bpfilter rfkill at803x snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg dwmac_generic stmmac_platform snd_hda_codec stmmac joydev pcs_xpcs snd_hda_core phylink ppdev lp parport ramoops reed_solomon ip_tables x_tables nls_iso8859_1 vfat multipath linear amdgpu amdxcp drm_exec gpu_sched drm_buddy hid_generic usbhid hid radeon video drm_suballoc_helper drm_ttm_helper ttm i2c_algo_bit drm_display_helper cec drm_kms_helper drm + CPU: 0 PID: 3663 Comm: systemd-sleep Not tainted 6.6.2+ #76 + Source Version: 4e22ed63a0a48e7a7cff9b98b7806d8d4add7dc0 + Hardware name: Greatwall GW-XXXXXX-XXX/GW-XXXXXX-XXX, BIOS KunLun BIOS V4.0 01/19/2021 + pstate: 600003c5 (nZCv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : swsusp_save+0x280/0x538 + lr : swsusp_save+0x280/0x538 + sp : ffffffa034a3fa40 + x29: ffffffa034a3fa40 x28: ffffff8000001000 x27: 0000000000000000 + x26: ffffff8001400000 x25: ffffffc08113e248 x24: 0000000000000000 + x23: 0000000000080000 x22: ffffffc08113e280 x21: 00000000000c69f2 + x20: ffffff8000000000 x19: ffffffc081ae2500 x18: 0000000000000000 + x17: 6666662074736420 x16: 3030303030303030 x15: 3038666666666666 + x14: 0000000000000b69 x13: ffffff9f89088530 x12: 00000000ffffffea + x11: 00000000ffff7fff x10: 00000000ffff7fff x9 : ffffffc08193f0d0 + x8 : 00000000000bffe8 x7 : c0000000ffff7fff x6 : 0000000000000001 + x5 : ffffffa0fff09dc8 x4 : 0000000000000000 x3 : 0000000000000027 + x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000004e + Call trace: + swsusp_save+0x280/0x538 + swsusp_arch_suspend+0x148/0x190 + hibernation_snapshot+0x240/0x39c + hibernate+0xc4/0x378 + state_store+0xf0/0x10c + kobj_attr_store+0x14/0x24 + +The reason is swsusp_save() -> copy_data_pages() -> page_is_saveable() +-> kernel_page_present() assuming that a page is always present when +can_set_direct_map() is false (all of rodata_full, +debug_pagealloc_enabled() and arm64_kfence_can_set_direct_map() false), +irrespective of the MEMBLOCK_NOMAP ranges. Such MEMBLOCK_NOMAP regions +should not be saved during hibernation. + +This problem was introduced by changes to the pfn_valid() logic in +commit a7d9f306ba70 ("arm64: drop pfn_valid_within() and simplify +pfn_valid()"). + +Similar to other architectures, drop the !can_set_direct_map() check in +kernel_page_present() so that page_is_savable() skips such pages. + +Fixes: a7d9f306ba70 ("arm64: drop pfn_valid_within() and simplify pfn_valid()") +Cc: # 5.14.x +Suggested-by: Mike Rapoport +Suggested-by: Catalin Marinas +Co-developed-by: xiongxin +Signed-off-by: xiongxin +Signed-off-by: Yaxiong Tian +Acked-by: Mike Rapoport (IBM) +Link: https://lore.kernel.org/r/20240417025248.386622-1-tianyaxiong@kylinos.cn +[catalin.marinas@arm.com: rework commit message] +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/mm/pageattr.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/arch/arm64/mm/pageattr.c ++++ b/arch/arm64/mm/pageattr.c +@@ -220,9 +220,6 @@ bool kernel_page_present(struct page *pa + pte_t *ptep; + unsigned long addr = (unsigned long)page_address(page); + +- if (!can_set_direct_map()) +- return true; +- + pgdp = pgd_offset_k(addr); + if (pgd_none(READ_ONCE(*pgdp))) + return false; diff --git a/queue-6.1/fs-sysfs-fix-reference-leak-in-sysfs_break_active_protection.patch b/queue-6.1/fs-sysfs-fix-reference-leak-in-sysfs_break_active_protection.patch new file mode 100644 index 00000000000..268d975e22d --- /dev/null +++ b/queue-6.1/fs-sysfs-fix-reference-leak-in-sysfs_break_active_protection.patch @@ -0,0 +1,42 @@ +From a90bca2228c0646fc29a72689d308e5fe03e6d78 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 13 Mar 2024 17:43:41 -0400 +Subject: fs: sysfs: Fix reference leak in sysfs_break_active_protection() + +From: Alan Stern + +commit a90bca2228c0646fc29a72689d308e5fe03e6d78 upstream. + +The sysfs_break_active_protection() routine has an obvious reference +leak in its error path. If the call to kernfs_find_and_get() fails then +kn will be NULL, so the companion sysfs_unbreak_active_protection() +routine won't get called (and would only cause an access violation by +trying to dereference kn->parent if it was called). As a result, the +reference to kobj acquired at the start of the function will never be +released. + +Fix the leak by adding an explicit kobject_put() call when kn is NULL. + +Signed-off-by: Alan Stern +Fixes: 2afc9166f79b ("scsi: sysfs: Introduce sysfs_{un,}break_active_protection()") +Cc: Bart Van Assche +Cc: stable@vger.kernel.org +Reviewed-by: Bart Van Assche +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/8a4d3f0f-c5e3-4b70-a188-0ca433f9e6f9@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +--- + fs/sysfs/file.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/sysfs/file.c ++++ b/fs/sysfs/file.c +@@ -450,6 +450,8 @@ struct kernfs_node *sysfs_break_active_p + kn = kernfs_find_and_get(kobj->sd, attr->name); + if (kn) + kernfs_break_active_protection(kn); ++ else ++ kobject_put(kobj); + return kn; + } + EXPORT_SYMBOL_GPL(sysfs_break_active_protection); diff --git a/queue-6.1/init-main.c-fix-potential-static_command_line-memory-overflow.patch b/queue-6.1/init-main.c-fix-potential-static_command_line-memory-overflow.patch new file mode 100644 index 00000000000..3dc9c661676 --- /dev/null +++ b/queue-6.1/init-main.c-fix-potential-static_command_line-memory-overflow.patch @@ -0,0 +1,43 @@ +From 46dad3c1e57897ab9228332f03e1c14798d2d3b9 Mon Sep 17 00:00:00 2001 +From: Yuntao Wang +Date: Fri, 12 Apr 2024 16:17:32 +0800 +Subject: init/main.c: Fix potential static_command_line memory overflow + +From: Yuntao Wang + +commit 46dad3c1e57897ab9228332f03e1c14798d2d3b9 upstream. + +We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for +static_command_line, but the strings copied into static_command_line are +extra_command_line and command_line, rather than extra_command_line and +boot_command_line. + +When strlen(command_line) > strlen(boot_command_line), static_command_line +will overflow. + +This patch just recovers strlen(command_line) which was miss-consolidated +with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add +checks for the return value of memblock_alloc*()") + +Link: https://lore.kernel.org/all/20240412081733.35925-2-ytcoode@gmail.com/ + +Fixes: f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()") +Cc: stable@vger.kernel.org +Signed-off-by: Yuntao Wang +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Greg Kroah-Hartman +--- + init/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/init/main.c ++++ b/init/main.c +@@ -633,6 +633,8 @@ static void __init setup_command_line(ch + if (!saved_command_line) + panic("%s: Failed to allocate %zu bytes\n", __func__, len + ilen); + ++ len = xlen + strlen(command_line) + 1; ++ + static_command_line = memblock_alloc(len, SMP_CACHE_BYTES); + if (!static_command_line) + panic("%s: Failed to allocate %zu bytes\n", __func__, len); diff --git a/queue-6.1/kvm-x86-pmu-disable-support-for-adaptive-pebs.patch b/queue-6.1/kvm-x86-pmu-disable-support-for-adaptive-pebs.patch new file mode 100644 index 00000000000..ca06412a0af --- /dev/null +++ b/queue-6.1/kvm-x86-pmu-disable-support-for-adaptive-pebs.patch @@ -0,0 +1,104 @@ +From 9e985cbf2942a1bb8fcef9adc2a17d90fd7ca8ee Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Wed, 6 Mar 2024 16:58:33 -0800 +Subject: KVM: x86/pmu: Disable support for adaptive PEBS + +From: Sean Christopherson + +commit 9e985cbf2942a1bb8fcef9adc2a17d90fd7ca8ee upstream. + +Drop support for virtualizing adaptive PEBS, as KVM's implementation is +architecturally broken without an obvious/easy path forward, and because +exposing adaptive PEBS can leak host LBRs to the guest, i.e. can leak +host kernel addresses to the guest. + +Bug #1 is that KVM doesn't account for the upper 32 bits of +IA32_FIXED_CTR_CTRL when (re)programming fixed counters, e.g +fixed_ctrl_field() drops the upper bits, reprogram_fixed_counters() +stores local variables as u8s and truncates the upper bits too, etc. + +Bug #2 is that, because KVM _always_ sets precise_ip to a non-zero value +for PEBS events, perf will _always_ generate an adaptive record, even if +the guest requested a basic record. Note, KVM will also enable adaptive +PEBS in individual *counter*, even if adaptive PEBS isn't exposed to the +guest, but this is benign as MSR_PEBS_DATA_CFG is guaranteed to be zero, +i.e. the guest will only ever see Basic records. + +Bug #3 is in perf. intel_pmu_disable_fixed() doesn't clear the upper +bits either, i.e. leaves ICL_FIXED_0_ADAPTIVE set, and +intel_pmu_enable_fixed() effectively doesn't clear ICL_FIXED_0_ADAPTIVE +either. I.e. perf _always_ enables ADAPTIVE counters, regardless of what +KVM requests. + +Bug #4 is that adaptive PEBS *might* effectively bypass event filters set +by the host, as "Updated Memory Access Info Group" records information +that might be disallowed by userspace via KVM_SET_PMU_EVENT_FILTER. + +Bug #5 is that KVM doesn't ensure LBR MSRs hold guest values (or at least +zeros) when entering a vCPU with adaptive PEBS, which allows the guest +to read host LBRs, i.e. host RIPs/addresses, by enabling "LBR Entries" +records. + +Disable adaptive PEBS support as an immediate fix due to the severity of +the LBR leak in particular, and because fixing all of the bugs will be +non-trivial, e.g. not suitable for backporting to stable kernels. + +Note! This will break live migration, but trying to make KVM play nice +with live migration would be quite complicated, wouldn't be guaranteed to +work (i.e. KVM might still kill/confuse the guest), and it's not clear +that there are any publicly available VMMs that support adaptive PEBS, +let alone live migrate VMs that support adaptive PEBS, e.g. QEMU doesn't +support PEBS in any capacity. + +Link: https://lore.kernel.org/all/20240306230153.786365-1-seanjc@google.com +Link: https://lore.kernel.org/all/ZeepGjHCeSfadANM@google.com +Fixes: c59a1f106f5c ("KVM: x86/pmu: Add IA32_PEBS_ENABLE MSR emulation for extended PEBS") +Cc: stable@vger.kernel.org +Cc: Like Xu +Cc: Mingwei Zhang +Cc: Zhenyu Wang +Cc: Zhang Xiong +Cc: Lv Zhiyuan +Cc: Dapeng Mi +Cc: Jim Mattson +Acked-by: Like Xu +Link: https://lore.kernel.org/r/20240307005833.827147-1-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/vmx/vmx.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -7742,8 +7742,28 @@ static u64 vmx_get_perf_capabilities(voi + + if (vmx_pebs_supported()) { + perf_cap |= host_perf_cap & PERF_CAP_PEBS_MASK; +- if ((perf_cap & PERF_CAP_PEBS_FORMAT) < 4) +- perf_cap &= ~PERF_CAP_PEBS_BASELINE; ++ ++ /* ++ * Disallow adaptive PEBS as it is functionally broken, can be ++ * used by the guest to read *host* LBRs, and can be used to ++ * bypass userspace event filters. To correctly and safely ++ * support adaptive PEBS, KVM needs to: ++ * ++ * 1. Account for the ADAPTIVE flag when (re)programming fixed ++ * counters. ++ * ++ * 2. Gain support from perf (or take direct control of counter ++ * programming) to support events without adaptive PEBS ++ * enabled for the hardware counter. ++ * ++ * 3. Ensure LBR MSRs cannot hold host data on VM-Entry with ++ * adaptive PEBS enabled and MSR_PEBS_DATA_CFG.LBRS=1. ++ * ++ * 4. Document which PMU events are effectively exposed to the ++ * guest via adaptive PEBS, and make adaptive PEBS mutually ++ * exclusive with KVM_SET_PMU_EVENT_FILTER if necessary. ++ */ ++ perf_cap &= ~PERF_CAP_PEBS_BASELINE; + } + + return perf_cap; diff --git a/queue-6.1/kvm-x86-pmu-do-not-mask-lvtpc-when-handling-a-pmi-on-amd-platforms.patch b/queue-6.1/kvm-x86-pmu-do-not-mask-lvtpc-when-handling-a-pmi-on-amd-platforms.patch new file mode 100644 index 00000000000..5a6003fe40c --- /dev/null +++ b/queue-6.1/kvm-x86-pmu-do-not-mask-lvtpc-when-handling-a-pmi-on-amd-platforms.patch @@ -0,0 +1,58 @@ +From 49ff3b4aec51e3abfc9369997cc603319b02af9a Mon Sep 17 00:00:00 2001 +From: Sandipan Das +Date: Fri, 5 Apr 2024 16:55:55 -0700 +Subject: KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms + +From: Sandipan Das + +commit 49ff3b4aec51e3abfc9369997cc603319b02af9a upstream. + +On AMD and Hygon platforms, the local APIC does not automatically set +the mask bit of the LVTPC register when handling a PMI and there is +no need to clear it in the kernel's PMI handler. + +For guests, the mask bit is currently set by kvm_apic_local_deliver() +and unless it is cleared by the guest kernel's PMI handler, PMIs stop +arriving and break use-cases like sampling with perf record. + +This does not affect non-PerfMonV2 guests because PMIs are handled in +the guest kernel by x86_pmu_handle_irq() which always clears the LVTPC +mask bit irrespective of the vendor. + +Before: + + $ perf record -e cycles:u true + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.001 MB perf.data (1 samples) ] + +After: + + $ perf record -e cycles:u true + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.002 MB perf.data (19 samples) ] + +Fixes: a16eb25b09c0 ("KVM: x86: Mask LVTPC when handling a PMI") +Cc: stable@vger.kernel.org +Signed-off-by: Sandipan Das +Reviewed-by: Jim Mattson +[sean: use is_intel_compatible instead of !is_amd_or_hygon()] +Signed-off-by: Sean Christopherson +Message-ID: <20240405235603.1173076-3-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/lapic.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2548,7 +2548,8 @@ int kvm_apic_local_deliver(struct kvm_la + trig_mode = reg & APIC_LVT_LEVEL_TRIGGER; + + r = __apic_accept_irq(apic, mode, vector, 1, trig_mode, NULL); +- if (r && lvt_type == APIC_LVTPC) ++ if (r && lvt_type == APIC_LVTPC && ++ guest_cpuid_is_intel_compatible(apic->vcpu)) + kvm_lapic_set_reg(apic, APIC_LVTPC, reg | APIC_LVT_MASKED); + return r; + } diff --git a/queue-6.1/kvm-x86-snapshot-if-a-vcpu-s-vendor-model-is-amd-vs.-intel-compatible.patch b/queue-6.1/kvm-x86-snapshot-if-a-vcpu-s-vendor-model-is-amd-vs.-intel-compatible.patch new file mode 100644 index 00000000000..07579fd8ed1 --- /dev/null +++ b/queue-6.1/kvm-x86-snapshot-if-a-vcpu-s-vendor-model-is-amd-vs.-intel-compatible.patch @@ -0,0 +1,112 @@ +From fd706c9b1674e2858766bfbf7430534c2b26fbef Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Fri, 5 Apr 2024 16:55:54 -0700 +Subject: KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible + +From: Sean Christopherson + +commit fd706c9b1674e2858766bfbf7430534c2b26fbef upstream. + +Add kvm_vcpu_arch.is_amd_compatible to cache if a vCPU's vendor model is +compatible with AMD, i.e. if the vCPU vendor is AMD or Hygon, along with +helpers to check if a vCPU is compatible AMD vs. Intel. To handle Intel +vs. AMD behavior related to masking the LVTPC entry, KVM will need to +check for vendor compatibility on every PMI injection, i.e. querying for +AMD will soon be a moderately hot path. + +Note! This subtly (or maybe not-so-subtly) makes "Intel compatible" KVM's +default behavior, both if userspace omits (or never sets) CPUID 0x0 and if +userspace sets a completely unknown vendor. One could argue that KVM +should treat such vCPUs as not being compatible with Intel *or* AMD, but +that would add useless complexity to KVM. + +KVM needs to do *something* in the face of vendor specific behavior, and +so unless KVM conjured up a magic third option, choosing to treat unknown +vendors as neither Intel nor AMD means that checks on AMD compatibility +would yield Intel behavior, and checks for Intel compatibility would yield +AMD behavior. And that's far worse as it would effectively yield random +behavior depending on whether KVM checked for AMD vs. Intel vs. !AMD vs. +!Intel. And practically speaking, all x86 CPUs follow either Intel or AMD +architecture, i.e. "supporting" an unknown third architecture adds no +value. + +Deliberately don't convert any of the existing guest_cpuid_is_intel() +checks, as the Intel side of things is messier due to some flows explicitly +checking for exactly vendor==Intel, versus some flows assuming anything +that isn't "AMD compatible" gets Intel behavior. The Intel code will be +cleaned up in the future. + +Cc: stable@vger.kernel.org +Signed-off-by: Sean Christopherson +Message-ID: <20240405235603.1173076-2-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/kvm_host.h | 1 + + arch/x86/kvm/cpuid.c | 1 + + arch/x86/kvm/cpuid.h | 10 ++++++++++ + arch/x86/kvm/mmu/mmu.c | 2 +- + arch/x86/kvm/x86.c | 2 +- + 5 files changed, 14 insertions(+), 2 deletions(-) + +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -773,6 +773,7 @@ struct kvm_vcpu_arch { + int cpuid_nent; + struct kvm_cpuid_entry2 *cpuid_entries; + u32 kvm_cpuid_base; ++ bool is_amd_compatible; + + u64 reserved_gpa_bits; + int maxphyaddr; +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -340,6 +340,7 @@ static void kvm_vcpu_after_set_cpuid(str + + kvm_update_pv_runtime(vcpu); + ++ vcpu->arch.is_amd_compatible = guest_cpuid_is_amd_or_hygon(vcpu); + vcpu->arch.maxphyaddr = cpuid_query_maxphyaddr(vcpu); + vcpu->arch.reserved_gpa_bits = kvm_vcpu_reserved_gpa_bits_raw(vcpu); + +--- a/arch/x86/kvm/cpuid.h ++++ b/arch/x86/kvm/cpuid.h +@@ -125,6 +125,16 @@ static inline bool guest_cpuid_is_intel( + return best && is_guest_vendor_intel(best->ebx, best->ecx, best->edx); + } + ++static inline bool guest_cpuid_is_amd_compatible(struct kvm_vcpu *vcpu) ++{ ++ return vcpu->arch.is_amd_compatible; ++} ++ ++static inline bool guest_cpuid_is_intel_compatible(struct kvm_vcpu *vcpu) ++{ ++ return !guest_cpuid_is_amd_compatible(vcpu); ++} ++ + static inline int guest_cpuid_family(struct kvm_vcpu *vcpu) + { + struct kvm_cpuid_entry2 *best; +--- a/arch/x86/kvm/mmu/mmu.c ++++ b/arch/x86/kvm/mmu/mmu.c +@@ -4649,7 +4649,7 @@ static void reset_guest_rsvds_bits_mask( + context->cpu_role.base.level, is_efer_nx(context), + guest_can_use_gbpages(vcpu), + is_cr4_pse(context), +- guest_cpuid_is_amd_or_hygon(vcpu)); ++ guest_cpuid_is_amd_compatible(vcpu)); + } + + static void +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -3278,7 +3278,7 @@ static bool is_mci_status_msr(u32 msr) + static bool can_set_mci_status(struct kvm_vcpu *vcpu) + { + /* McStatusWrEn enabled? */ +- if (guest_cpuid_is_amd_or_hygon(vcpu)) ++ if (guest_cpuid_is_amd_compatible(vcpu)) + return !!(vcpu->arch.msr_hwcr & BIT_ULL(18)); + + return false; diff --git a/queue-6.1/mei-me-disable-rpl-s-on-sps-and-ign-firmwares.patch b/queue-6.1/mei-me-disable-rpl-s-on-sps-and-ign-firmwares.patch new file mode 100644 index 00000000000..f063f92617c --- /dev/null +++ b/queue-6.1/mei-me-disable-rpl-s-on-sps-and-ign-firmwares.patch @@ -0,0 +1,34 @@ +From 0dc04112bee6fdd6eb847ccb32214703022c0269 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Tue, 12 Mar 2024 07:19:58 +0200 +Subject: mei: me: disable RPL-S on SPS and IGN firmwares + +From: Alexander Usyskin + +commit 0dc04112bee6fdd6eb847ccb32214703022c0269 upstream. + +Extend the quirk to disable MEI interface on Intel PCH Ignition (IGN) +and SPS firmwares for RPL-S devices. These firmwares do not support +the MEI protocol. + +Fixes: 3ed8c7d39cfe ("mei: me: add raptor lake point S DID") +Cc: stable@vger.kernel.org +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Link: https://lore.kernel.org/r/20240312051958.118478-1-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mei/pci-me.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -116,7 +116,7 @@ static const struct pci_device_id mei_me + {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_P, MEI_ME_PCH15_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_N, MEI_ME_PCH15_CFG)}, + +- {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_CFG)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_SPS_CFG)}, + + {MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_ARL_S, MEI_ME_PCH15_CFG)}, diff --git a/queue-6.1/mm-memory-failure-fix-deadlock-when-hugetlb_optimize_vmemmap-is-enabled.patch b/queue-6.1/mm-memory-failure-fix-deadlock-when-hugetlb_optimize_vmemmap-is-enabled.patch new file mode 100644 index 00000000000..9f49825e44e --- /dev/null +++ b/queue-6.1/mm-memory-failure-fix-deadlock-when-hugetlb_optimize_vmemmap-is-enabled.patch @@ -0,0 +1,167 @@ +From 1983184c22dd84a4d95a71e5c6775c2638557dc7 Mon Sep 17 00:00:00 2001 +From: Miaohe Lin +Date: Sun, 7 Apr 2024 16:54:56 +0800 +Subject: mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled + +From: Miaohe Lin + +commit 1983184c22dd84a4d95a71e5c6775c2638557dc7 upstream. + +When I did hard offline test with hugetlb pages, below deadlock occurs: + +====================================================== +WARNING: possible circular locking dependency detected +6.8.0-11409-gf6cef5f8c37f #1 Not tainted +------------------------------------------------------ +bash/46904 is trying to acquire lock: +ffffffffabe68910 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_slow_dec+0x16/0x60 + +but task is already holding lock: +ffffffffabf92ea8 (pcp_batch_high_lock){+.+.}-{3:3}, at: zone_pcp_disable+0x16/0x40 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (pcp_batch_high_lock){+.+.}-{3:3}: + __mutex_lock+0x6c/0x770 + page_alloc_cpu_online+0x3c/0x70 + cpuhp_invoke_callback+0x397/0x5f0 + __cpuhp_invoke_callback_range+0x71/0xe0 + _cpu_up+0xeb/0x210 + cpu_up+0x91/0xe0 + cpuhp_bringup_mask+0x49/0xb0 + bringup_nonboot_cpus+0xb7/0xe0 + smp_init+0x25/0xa0 + kernel_init_freeable+0x15f/0x3e0 + kernel_init+0x15/0x1b0 + ret_from_fork+0x2f/0x50 + ret_from_fork_asm+0x1a/0x30 + +-> #0 (cpu_hotplug_lock){++++}-{0:0}: + __lock_acquire+0x1298/0x1cd0 + lock_acquire+0xc0/0x2b0 + cpus_read_lock+0x2a/0xc0 + static_key_slow_dec+0x16/0x60 + __hugetlb_vmemmap_restore_folio+0x1b9/0x200 + dissolve_free_huge_page+0x211/0x260 + __page_handle_poison+0x45/0xc0 + memory_failure+0x65e/0xc70 + hard_offline_page_store+0x55/0xa0 + kernfs_fop_write_iter+0x12c/0x1d0 + vfs_write+0x387/0x550 + ksys_write+0x64/0xe0 + do_syscall_64+0xca/0x1e0 + entry_SYSCALL_64_after_hwframe+0x6d/0x75 + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(pcp_batch_high_lock); + lock(cpu_hotplug_lock); + lock(pcp_batch_high_lock); + rlock(cpu_hotplug_lock); + + *** DEADLOCK *** + +5 locks held by bash/46904: + #0: ffff98f6c3bb23f0 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x64/0xe0 + #1: ffff98f6c328e488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0xf8/0x1d0 + #2: ffff98ef83b31890 (kn->active#113){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x100/0x1d0 + #3: ffffffffabf9db48 (mf_mutex){+.+.}-{3:3}, at: memory_failure+0x44/0xc70 + #4: ffffffffabf92ea8 (pcp_batch_high_lock){+.+.}-{3:3}, at: zone_pcp_disable+0x16/0x40 + +stack backtrace: +CPU: 10 PID: 46904 Comm: bash Kdump: loaded Not tainted 6.8.0-11409-gf6cef5f8c37f #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 +Call Trace: + + dump_stack_lvl+0x68/0xa0 + check_noncircular+0x129/0x140 + __lock_acquire+0x1298/0x1cd0 + lock_acquire+0xc0/0x2b0 + cpus_read_lock+0x2a/0xc0 + static_key_slow_dec+0x16/0x60 + __hugetlb_vmemmap_restore_folio+0x1b9/0x200 + dissolve_free_huge_page+0x211/0x260 + __page_handle_poison+0x45/0xc0 + memory_failure+0x65e/0xc70 + hard_offline_page_store+0x55/0xa0 + kernfs_fop_write_iter+0x12c/0x1d0 + vfs_write+0x387/0x550 + ksys_write+0x64/0xe0 + do_syscall_64+0xca/0x1e0 + entry_SYSCALL_64_after_hwframe+0x6d/0x75 +RIP: 0033:0x7fc862314887 +Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 +RSP: 002b:00007fff19311268 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007fc862314887 +RDX: 000000000000000c RSI: 000056405645fe10 RDI: 0000000000000001 +RBP: 000056405645fe10 R08: 00007fc8623d1460 R09: 000000007fffffff +R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c +R13: 00007fc86241b780 R14: 00007fc862417600 R15: 00007fc862416a00 + +In short, below scene breaks the lock dependency chain: + + memory_failure + __page_handle_poison + zone_pcp_disable -- lock(pcp_batch_high_lock) + dissolve_free_huge_page + __hugetlb_vmemmap_restore_folio + static_key_slow_dec + cpus_read_lock -- rlock(cpu_hotplug_lock) + +Fix this by calling drain_all_pages() instead. + +This issue won't occur until commit a6b40850c442 ("mm: hugetlb: replace +hugetlb_free_vmemmap_enabled with a static_key"). As it introduced +rlock(cpu_hotplug_lock) in dissolve_free_huge_page() code path while +lock(pcp_batch_high_lock) is already in the __page_handle_poison(). + +[linmiaohe@huawei.com: extend comment per Oscar] +[akpm@linux-foundation.org: reflow block comment] +Link: https://lkml.kernel.org/r/20240407085456.2798193-1-linmiaohe@huawei.com +Fixes: a6b40850c442 ("mm: hugetlb: replace hugetlb_free_vmemmap_enabled with a static_key") +Signed-off-by: Miaohe Lin +Acked-by: Oscar Salvador +Reviewed-by: Jane Chu +Cc: Naoya Horiguchi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/memory-failure.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -84,11 +84,23 @@ static int __page_handle_poison(struct p + { + int ret; + +- zone_pcp_disable(page_zone(page)); ++ /* ++ * zone_pcp_disable() can't be used here. It will ++ * hold pcp_batch_high_lock and dissolve_free_huge_page() might hold ++ * cpu_hotplug_lock via static_key_slow_dec() when hugetlb vmemmap ++ * optimization is enabled. This will break current lock dependency ++ * chain and leads to deadlock. ++ * Disabling pcp before dissolving the page was a deterministic ++ * approach because we made sure that those pages cannot end up in any ++ * PCP list. Draining PCP lists expels those pages to the buddy system, ++ * but nothing guarantees that those pages do not get back to a PCP ++ * queue if we need to refill those. ++ */ + ret = dissolve_free_huge_page(page); +- if (!ret) ++ if (!ret) { ++ drain_all_pages(page_zone(page)); + ret = take_page_off_buddy(page); +- zone_pcp_enable(page_zone(page)); ++ } + + return ret; + } diff --git a/queue-6.1/revert-usb-cdc-wdm-close-race-between-read-and-workqueue.patch b/queue-6.1/revert-usb-cdc-wdm-close-race-between-read-and-workqueue.patch new file mode 100644 index 00000000000..41f33fa1366 --- /dev/null +++ b/queue-6.1/revert-usb-cdc-wdm-close-race-between-read-and-workqueue.patch @@ -0,0 +1,50 @@ +From 1607830dadeefc407e4956336d9fcd9e9defd810 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 18 Apr 2024 16:33:28 +0200 +Subject: Revert "usb: cdc-wdm: close race between read and workqueue" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Greg Kroah-Hartman + +commit 1607830dadeefc407e4956336d9fcd9e9defd810 upstream. + +This reverts commit 339f83612f3a569b194680768b22bf113c26a29d. + +It has been found to cause problems in a number of Chromebook devices, +so revert the change until it can be brought back in a safe way. + +Link: https://lore.kernel.org/r/385a3519-b45d-48c5-a6fd-a3fdb6bec92f@chromium.org +Reported-by:: Aleksander Morgado +Fixes: 339f83612f3a ("usb: cdc-wdm: close race between read and workqueue") +Cc: stable +Cc: Oliver Neukum +Cc: Bjørn Mork +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-wdm.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -485,7 +485,6 @@ out_free_mem: + static int service_outstanding_interrupt(struct wdm_device *desc) + { + int rv = 0; +- int used; + + /* submit read urb only if the device is waiting for it */ + if (!desc->resp_count || !--desc->resp_count) +@@ -500,10 +499,7 @@ static int service_outstanding_interrupt + goto out; + } + +- used = test_and_set_bit(WDM_RESPONDING, &desc->flags); +- if (used) +- goto out; +- ++ set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); + rv = usb_submit_urb(desc->response, GFP_KERNEL); + spin_lock_irq(&desc->iuspin); diff --git a/queue-6.1/serial-mxs-auart-add-spinlock-around-changing-cts-state.patch b/queue-6.1/serial-mxs-auart-add-spinlock-around-changing-cts-state.patch new file mode 100644 index 00000000000..645f3fe9f32 --- /dev/null +++ b/queue-6.1/serial-mxs-auart-add-spinlock-around-changing-cts-state.patch @@ -0,0 +1,61 @@ +From 54c4ec5f8c471b7c1137a1f769648549c423c026 Mon Sep 17 00:00:00 2001 +From: Emil Kronborg +Date: Wed, 20 Mar 2024 12:15:36 +0000 +Subject: serial: mxs-auart: add spinlock around changing cts state + +From: Emil Kronborg + +commit 54c4ec5f8c471b7c1137a1f769648549c423c026 upstream. + +The uart_handle_cts_change() function in serial_core expects the caller +to hold uport->lock. For example, I have seen the below kernel splat, +when the Bluetooth driver is loaded on an i.MX28 board. + + [ 85.119255] ------------[ cut here ]------------ + [ 85.124413] WARNING: CPU: 0 PID: 27 at /drivers/tty/serial/serial_core.c:3453 uart_handle_cts_change+0xb4/0xec + [ 85.134694] Modules linked in: hci_uart bluetooth ecdh_generic ecc wlcore_sdio configfs + [ 85.143314] CPU: 0 PID: 27 Comm: kworker/u3:0 Not tainted 6.6.3-00021-gd62a2f068f92 #1 + [ 85.151396] Hardware name: Freescale MXS (Device Tree) + [ 85.156679] Workqueue: hci0 hci_power_on [bluetooth] + (...) + [ 85.191765] uart_handle_cts_change from mxs_auart_irq_handle+0x380/0x3f4 + [ 85.198787] mxs_auart_irq_handle from __handle_irq_event_percpu+0x88/0x210 + (...) + +Cc: stable@vger.kernel.org +Fixes: 4d90bb147ef6 ("serial: core: Document and assert lock requirements for irq helpers") +Reviewed-by: Frank Li +Signed-off-by: Emil Kronborg +Link: https://lore.kernel.org/r/20240320121530.11348-1-emil.kronborg@protonmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/mxs-auart.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/mxs-auart.c ++++ b/drivers/tty/serial/mxs-auart.c +@@ -1094,11 +1094,13 @@ static void mxs_auart_set_ldisc(struct u + + static irqreturn_t mxs_auart_irq_handle(int irq, void *context) + { +- u32 istat; ++ u32 istat, stat; + struct mxs_auart_port *s = context; + u32 mctrl_temp = s->mctrl_prev; +- u32 stat = mxs_read(s, REG_STAT); + ++ uart_port_lock(&s->port); ++ ++ stat = mxs_read(s, REG_STAT); + istat = mxs_read(s, REG_INTR); + + /* ack irq */ +@@ -1134,6 +1136,8 @@ static irqreturn_t mxs_auart_irq_handle( + istat &= ~AUART_INTR_TXIS; + } + ++ uart_port_unlock(&s->port); ++ + return IRQ_HANDLED; + } + diff --git a/queue-6.1/serial-pmac_zilog-remove-flawed-mitigation-for-rx-irq-flood.patch b/queue-6.1/serial-pmac_zilog-remove-flawed-mitigation-for-rx-irq-flood.patch new file mode 100644 index 00000000000..df149697517 --- /dev/null +++ b/queue-6.1/serial-pmac_zilog-remove-flawed-mitigation-for-rx-irq-flood.patch @@ -0,0 +1,86 @@ +From 1be3226445362bfbf461c92a5bcdb1723f2e4907 Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Mon, 8 Apr 2024 19:23:43 +1000 +Subject: serial/pmac_zilog: Remove flawed mitigation for rx irq flood + +From: Finn Thain + +commit 1be3226445362bfbf461c92a5bcdb1723f2e4907 upstream. + +The mitigation was intended to stop the irq completely. That may be +better than a hard lock-up but it turns out that you get a crash anyway +if you're using pmac_zilog as a serial console: + +ttyPZ0: pmz: rx irq flood ! +BUG: spinlock recursion on CPU#0, swapper/0 + +That's because the pr_err() call in pmz_receive_chars() results in +pmz_console_write() attempting to lock a spinlock already locked in +pmz_interrupt(). With CONFIG_DEBUG_SPINLOCK=y, this produces a fatal +BUG splat. The spinlock in question is the one in struct uart_port. + +Even when it's not fatal, the serial port rx function ceases to work. +Also, the iteration limit doesn't play nicely with QEMU, as can be +seen in the bug report linked below. + +A web search for other reports of the error message "pmz: rx irq flood" +didn't produce anything. So I don't think this code is needed any more. +Remove it. + +Cc: Benjamin Herrenschmidt +Cc: Michael Ellerman +Cc: Nicholas Piggin +Cc: Christophe Leroy +Cc: Aneesh Kumar K.V +Cc: Naveen N. Rao +Cc: Andy Shevchenko +Cc: stable@kernel.org +Cc: linux-m68k@lists.linux-m68k.org +Link: https://github.com/vivier/qemu-m68k/issues/44 +Link: https://lore.kernel.org/all/1078874617.9746.36.camel@gaston/ +Acked-by: Michael Ellerman +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable +Signed-off-by: Finn Thain +Link: https://lore.kernel.org/r/e853cf2c762f23101cd2ddec0cc0c2be0e72685f.1712568223.git.fthain@linux-m68k.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/pmac_zilog.c | 14 -------------- + 1 file changed, 14 deletions(-) + +--- a/drivers/tty/serial/pmac_zilog.c ++++ b/drivers/tty/serial/pmac_zilog.c +@@ -210,7 +210,6 @@ static bool pmz_receive_chars(struct uar + { + struct tty_port *port; + unsigned char ch, r1, drop, flag; +- int loops = 0; + + /* Sanity check, make sure the old bug is no longer happening */ + if (uap->port.state == NULL) { +@@ -291,25 +290,12 @@ static bool pmz_receive_chars(struct uar + if (r1 & Rx_OVR) + tty_insert_flip_char(port, 0, TTY_OVERRUN); + next_char: +- /* We can get stuck in an infinite loop getting char 0 when the +- * line is in a wrong HW state, we break that here. +- * When that happens, I disable the receive side of the driver. +- * Note that what I've been experiencing is a real irq loop where +- * I'm getting flooded regardless of the actual port speed. +- * Something strange is going on with the HW +- */ +- if ((++loops) > 1000) +- goto flood; + ch = read_zsreg(uap, R0); + if (!(ch & Rx_CH_AV)) + break; + } + + return true; +- flood: +- pmz_interrupt_control(uap, 0); +- pmz_error("pmz: rx irq flood !\n"); +- return true; + } + + static void pmz_status_handle(struct uart_pmac_port *uap) diff --git a/queue-6.1/serial-stm32-reset-.throttled-state-in-.startup.patch b/queue-6.1/serial-stm32-reset-.throttled-state-in-.startup.patch new file mode 100644 index 00000000000..e339fdc2a6e --- /dev/null +++ b/queue-6.1/serial-stm32-reset-.throttled-state-in-.startup.patch @@ -0,0 +1,39 @@ +From ea2624b5b829b8f93c0dce25721d835969b34faf Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Wed, 17 Apr 2024 11:03:28 +0200 +Subject: serial: stm32: Reset .throttled state in .startup() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit ea2624b5b829b8f93c0dce25721d835969b34faf upstream. + +When an UART is opened that still has .throttled set from a previous +open, the RX interrupt is enabled but the irq handler doesn't consider +it. This easily results in a stuck irq with the effect to occupy the CPU +in a tight loop. + +So reset the throttle state in .startup() to ensure that RX irqs are +handled. + +Fixes: d1ec8a2eabe9 ("serial: stm32: update throttle and unthrottle ops for dma mode") +Cc: stable@vger.kernel.org +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/a784f80d3414f7db723b2ec66efc56e1ad666cbf.1713344161.git.u.kleine-koenig@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/stm32-usart.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -1021,6 +1021,7 @@ static int stm32_usart_startup(struct ua + val |= USART_CR2_SWAP; + writel_relaxed(val, port->membase + ofs->cr2); + } ++ stm32_port->throttled = false; + + /* RX FIFO Flush */ + if (ofs->rqr != UNDEF_REG) diff --git a/queue-6.1/serial-stm32-return-irq_none-in-the-isr-if-no-handling-happend.patch b/queue-6.1/serial-stm32-return-irq_none-in-the-isr-if-no-handling-happend.patch new file mode 100644 index 00000000000..9834082e609 --- /dev/null +++ b/queue-6.1/serial-stm32-return-irq_none-in-the-isr-if-no-handling-happend.patch @@ -0,0 +1,92 @@ +From 13c785323b36b845300b256d0e5963c3727667d7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Wed, 17 Apr 2024 11:03:27 +0200 +Subject: serial: stm32: Return IRQ_NONE in the ISR if no handling happend +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit 13c785323b36b845300b256d0e5963c3727667d7 upstream. + +If there is a stuck irq that the handler doesn't address, returning +IRQ_HANDLED unconditionally makes it impossible for the irq core to +detect the problem and disable the irq. So only return IRQ_HANDLED if +an event was handled. + +A stuck irq is still problematic, but with this change at least it only +makes the UART nonfunctional instead of occupying the (usually only) CPU +by 100% and so stall the whole machine. + +Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver") +Cc: stable@vger.kernel.org +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/5f92603d0dfd8a5b8014b2b10a902d91e0bb881f.1713344161.git.u.kleine-koenig@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/stm32-usart.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -755,6 +755,7 @@ static irqreturn_t stm32_usart_interrupt + const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + u32 sr; + unsigned int size; ++ irqreturn_t ret = IRQ_NONE; + + sr = readl_relaxed(port->membase + ofs->isr); + +@@ -763,11 +764,14 @@ static irqreturn_t stm32_usart_interrupt + (sr & USART_SR_TC)) { + stm32_usart_tc_interrupt_disable(port); + stm32_usart_rs485_rts_disable(port); ++ ret = IRQ_HANDLED; + } + +- if ((sr & USART_SR_RTOF) && ofs->icr != UNDEF_REG) ++ if ((sr & USART_SR_RTOF) && ofs->icr != UNDEF_REG) { + writel_relaxed(USART_ICR_RTOCF, + port->membase + ofs->icr); ++ ret = IRQ_HANDLED; ++ } + + if ((sr & USART_SR_WUF) && ofs->icr != UNDEF_REG) { + /* Clear wake up flag and disable wake up interrupt */ +@@ -776,6 +780,7 @@ static irqreturn_t stm32_usart_interrupt + stm32_usart_clr_bits(port, ofs->cr3, USART_CR3_WUFIE); + if (irqd_is_wakeup_set(irq_get_irq_data(port->irq))) + pm_wakeup_event(tport->tty->dev, 0); ++ ret = IRQ_HANDLED; + } + + /* +@@ -790,6 +795,7 @@ static irqreturn_t stm32_usart_interrupt + uart_unlock_and_check_sysrq(port); + if (size) + tty_flip_buffer_push(tport); ++ ret = IRQ_HANDLED; + } + } + +@@ -797,6 +803,7 @@ static irqreturn_t stm32_usart_interrupt + spin_lock(&port->lock); + stm32_usart_transmit_chars(port); + spin_unlock(&port->lock); ++ ret = IRQ_HANDLED; + } + + /* Receiver timeout irq for DMA RX */ +@@ -806,9 +813,10 @@ static irqreturn_t stm32_usart_interrupt + uart_unlock_and_check_sysrq(port); + if (size) + tty_flip_buffer_push(tport); ++ ret = IRQ_HANDLED; + } + +- return IRQ_HANDLED; ++ return ret; + } + + static void stm32_usart_set_mctrl(struct uart_port *port, unsigned int mctrl) diff --git a/queue-6.1/series b/queue-6.1/series index 943cd38de62..da1ec93b6a5 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -103,3 +103,26 @@ binder-check-offset-alignment-in-binder_get_object.patch thunderbolt-avoid-notify-pm-core-about-runtime-pm-resume.patch thunderbolt-fix-wake-configurations-after-device-unplug.patch comedi-vmk80xx-fix-incomplete-endpoint-checking.patch +serial-mxs-auart-add-spinlock-around-changing-cts-state.patch +serial-pmac_zilog-remove-flawed-mitigation-for-rx-irq-flood.patch +serial-stm32-return-irq_none-in-the-isr-if-no-handling-happend.patch +serial-stm32-reset-.throttled-state-in-.startup.patch +usb-serial-option-add-fibocom-fm135-gl-variants.patch +usb-serial-option-add-support-for-fibocom-fm650-fg650.patch +usb-serial-option-add-lonsung-u8300-u9300-product.patch +usb-serial-option-support-quectel-em060k-sub-models.patch +usb-serial-option-add-rolling-rw101-gl-and-rw135-gl-support.patch +usb-serial-option-add-telit-fn920c04-rmnet-compositions.patch +revert-usb-cdc-wdm-close-race-between-read-and-workqueue.patch +usb-dwc2-host-fix-dereference-issue-in-ddma-completion-flow.patch +usb-disable-usb3-lpm-at-shutdown.patch +usb-gadget-f_ncm-fix-uaf-ncm-object-at-re-bind-after-usb-ep-transport-error.patch +mei-me-disable-rpl-s-on-sps-and-ign-firmwares.patch +speakup-avoid-crash-on-very-long-word.patch +fs-sysfs-fix-reference-leak-in-sysfs_break_active_protection.patch +kvm-x86-snapshot-if-a-vcpu-s-vendor-model-is-amd-vs.-intel-compatible.patch +kvm-x86-pmu-disable-support-for-adaptive-pebs.patch +kvm-x86-pmu-do-not-mask-lvtpc-when-handling-a-pmi-on-amd-platforms.patch +arm64-hibernate-fix-level3-translation-fault-in-swsusp_save.patch +init-main.c-fix-potential-static_command_line-memory-overflow.patch +mm-memory-failure-fix-deadlock-when-hugetlb_optimize_vmemmap-is-enabled.patch diff --git a/queue-6.1/speakup-avoid-crash-on-very-long-word.patch b/queue-6.1/speakup-avoid-crash-on-very-long-word.patch new file mode 100644 index 00000000000..156143d7038 --- /dev/null +++ b/queue-6.1/speakup-avoid-crash-on-very-long-word.patch @@ -0,0 +1,32 @@ +From c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 Mon Sep 17 00:00:00 2001 +From: Samuel Thibault +Date: Sat, 23 Mar 2024 17:48:43 +0100 +Subject: speakup: Avoid crash on very long word + +From: Samuel Thibault + +commit c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 upstream. + +In case a console is set up really large and contains a really long word +(> 256 characters), we have to stop before the length of the word buffer. + +Signed-off-by: Samuel Thibault +Fixes: c6e3fd22cd538 ("Staging: add speakup to the staging directory") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240323164843.1426997-1-samuel.thibault@ens-lyon.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/accessibility/speakup/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/accessibility/speakup/main.c ++++ b/drivers/accessibility/speakup/main.c +@@ -573,7 +573,7 @@ static u_long get_word(struct vc_data *v + } + attr_ch = get_char(vc, (u_short *)tmp_pos, &spk_attr); + buf[cnt++] = attr_ch; +- while (tmpx < vc->vc_cols - 1) { ++ while (tmpx < vc->vc_cols - 1 && cnt < sizeof(buf) - 1) { + tmp_pos += 2; + tmpx++; + ch = get_char(vc, (u_short *)tmp_pos, &temp); diff --git a/queue-6.1/usb-disable-usb3-lpm-at-shutdown.patch b/queue-6.1/usb-disable-usb3-lpm-at-shutdown.patch new file mode 100644 index 00000000000..740e56c0f18 --- /dev/null +++ b/queue-6.1/usb-disable-usb3-lpm-at-shutdown.patch @@ -0,0 +1,87 @@ +From d920a2ed8620be04a3301e1a9c2b7cc1de65f19d Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Tue, 5 Mar 2024 14:51:38 +0800 +Subject: usb: Disable USB3 LPM at shutdown + +From: Kai-Heng Feng + +commit d920a2ed8620be04a3301e1a9c2b7cc1de65f19d upstream. + +SanDisks USB3 storage may disapper after system reboot: + +usb usb2-port3: link state change +xhci_hcd 0000:00:14.0: clear port3 link state change, portsc: 0x2c0 +usb usb2-port3: do warm reset, port only +xhci_hcd 0000:00:14.0: xhci_hub_status_data: stopping usb2 port polling +xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x2b0, return 0x2b0 +usb usb2-port3: not warm reset yet, waiting 50ms +xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x2f0, return 0x2f0 +usb usb2-port3: not warm reset yet, waiting 200ms +... +xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x6802c0, return 0x7002c0 +usb usb2-port3: not warm reset yet, waiting 200ms +xhci_hcd 0000:00:14.0: clear port3 reset change, portsc: 0x4802c0 +xhci_hcd 0000:00:14.0: clear port3 warm(BH) reset change, portsc: 0x4002c0 +xhci_hcd 0000:00:14.0: clear port3 link state change, portsc: 0x2c0 +xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x2c0, return 0x2c0 +usb usb2-port3: not enabled, trying warm reset again... + +This is due to the USB device still cause port change event after xHCI is +shuted down: + +xhci_hcd 0000:38:00.0: // Setting command ring address to 0xffffe001 +xhci_hcd 0000:38:00.0: xhci_resume: starting usb3 port polling. +xhci_hcd 0000:38:00.0: xhci_hub_status_data: stopping usb4 port polling +xhci_hcd 0000:38:00.0: xhci_hub_status_data: stopping usb3 port polling +xhci_hcd 0000:38:00.0: hcd_pci_runtime_resume: 0 +xhci_hcd 0000:38:00.0: xhci_shutdown: stopping usb3 port polling. +xhci_hcd 0000:38:00.0: // Halt the HC +xhci_hcd 0000:38:00.0: xhci_shutdown completed - status = 1 +xhci_hcd 0000:00:14.0: xhci_shutdown: stopping usb1 port polling. +xhci_hcd 0000:00:14.0: // Halt the HC +xhci_hcd 0000:00:14.0: xhci_shutdown completed - status = 1 +xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x1203, return 0x203 +xhci_hcd 0000:00:14.0: set port reset, actual port 2-3 status = 0x1311 +xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x201203, return 0x100203 +xhci_hcd 0000:00:14.0: clear port3 reset change, portsc: 0x1203 +xhci_hcd 0000:00:14.0: clear port3 warm(BH) reset change, portsc: 0x1203 +xhci_hcd 0000:00:14.0: clear port3 link state change, portsc: 0x1203 +xhci_hcd 0000:00:14.0: clear port3 connect change, portsc: 0x1203 +xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x1203, return 0x203 +usb 2-3: device not accepting address 2, error -108 +xhci_hcd 0000:00:14.0: xHCI dying or halted, can't queue_command +xhci_hcd 0000:00:14.0: Set port 2-3 link state, portsc: 0x1203, write 0x11261 +xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x1263, return 0x263 +xhci_hcd 0000:00:14.0: set port reset, actual port 2-3 status = 0x1271 +xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x12b1, return 0x2b1 +usb usb2-port3: not reset yet, waiting 60ms +ACPI: PM: Preparing to enter system sleep state S5 +xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x12f1, return 0x2f1 +usb usb2-port3: not reset yet, waiting 200ms +reboot: Restarting system + +The port change event is caused by LPM transition, so disabling LPM at shutdown +to make sure the device is in U0 for warmboot. + +Signed-off-by: Kai-Heng Feng +Cc: stable +Link: https://lore.kernel.org/r/20240305065140.66801-1-kai.heng.feng@canonical.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/port.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/port.c ++++ b/drivers/usb/core/port.c +@@ -409,8 +409,10 @@ static void usb_port_shutdown(struct dev + { + struct usb_port *port_dev = to_usb_port(dev); + +- if (port_dev->child) ++ if (port_dev->child) { + usb_disable_usb2_hardware_lpm(port_dev->child); ++ usb_unlocked_disable_lpm(port_dev->child); ++ } + } + + static const struct dev_pm_ops usb_port_pm_ops = { diff --git a/queue-6.1/usb-dwc2-host-fix-dereference-issue-in-ddma-completion-flow.patch b/queue-6.1/usb-dwc2-host-fix-dereference-issue-in-ddma-completion-flow.patch new file mode 100644 index 00000000000..879bb6f0266 --- /dev/null +++ b/queue-6.1/usb-dwc2-host-fix-dereference-issue-in-ddma-completion-flow.patch @@ -0,0 +1,41 @@ +From eed04fa96c48790c1cce73c8a248e9d460b088f8 Mon Sep 17 00:00:00 2001 +From: Minas Harutyunyan +Date: Tue, 9 Apr 2024 12:27:54 +0000 +Subject: usb: dwc2: host: Fix dereference issue in DDMA completion flow. + +From: Minas Harutyunyan + +commit eed04fa96c48790c1cce73c8a248e9d460b088f8 upstream. + +Fixed variable dereference issue in DDMA completion flow. + +Fixes: b258e4268850 ("usb: dwc2: host: Fix ISOC flow in DDMA mode") +CC: stable@vger.kernel.org +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/linux-usb/2024040834-ethically-rumble-701f@gregkh/T/#m4c4b83bef0ebb4b67fe2e0a7d6466cbb6f416e39 +Signed-off-by: Minas Harutyunyan +Link: https://lore.kernel.org/r/cc826d3ef53c934d8e6d98870f17f3cdc3d2755d.1712665387.git.Minas.Harutyunyan@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/hcd_ddma.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc2/hcd_ddma.c ++++ b/drivers/usb/dwc2/hcd_ddma.c +@@ -867,13 +867,15 @@ static int dwc2_cmpl_host_isoc_dma_desc( + struct dwc2_dma_desc *dma_desc; + struct dwc2_hcd_iso_packet_desc *frame_desc; + u16 frame_desc_idx; +- struct urb *usb_urb = qtd->urb->priv; ++ struct urb *usb_urb; + u16 remain = 0; + int rc = 0; + + if (!qtd->urb) + return -EINVAL; + ++ usb_urb = qtd->urb->priv; ++ + dma_sync_single_for_cpu(hsotg->dev, qh->desc_list_dma + (idx * + sizeof(struct dwc2_dma_desc)), + sizeof(struct dwc2_dma_desc), diff --git a/queue-6.1/usb-gadget-f_ncm-fix-uaf-ncm-object-at-re-bind-after-usb-ep-transport-error.patch b/queue-6.1/usb-gadget-f_ncm-fix-uaf-ncm-object-at-re-bind-after-usb-ep-transport-error.patch new file mode 100644 index 00000000000..4e555591821 --- /dev/null +++ b/queue-6.1/usb-gadget-f_ncm-fix-uaf-ncm-object-at-re-bind-after-usb-ep-transport-error.patch @@ -0,0 +1,77 @@ +From 6334b8e4553cc69f51e383c9de545082213d785e Mon Sep 17 00:00:00 2001 +From: Norihiko Hama +Date: Wed, 27 Mar 2024 11:35:50 +0900 +Subject: usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error + +From: Norihiko Hama + +commit 6334b8e4553cc69f51e383c9de545082213d785e upstream. + +When ncm function is working and then stop usb0 interface for link down, +eth_stop() is called. At this piont, accidentally if usb transport error +should happen in usb_ep_enable(), 'in_ep' and/or 'out_ep' may not be enabled. + +After that, ncm_disable() is called to disable for ncm unbind +but gether_disconnect() is never called since 'in_ep' is not enabled. + +As the result, ncm object is released in ncm unbind +but 'dev->port_usb' associated to 'ncm->port' is not NULL. + +And when ncm bind again to recover netdev, ncm object is reallocated +but usb0 interface is already associated to previous released ncm object. + +Therefore, once usb0 interface is up and eth_start_xmit() is called, +released ncm object is dereferrenced and it might cause use-after-free memory. + +[function unlink via configfs] + usb0: eth_stop dev->port_usb=ffffff9b179c3200 + --> error happens in usb_ep_enable(). + NCM: ncm_disable: ncm=ffffff9b179c3200 + --> no gether_disconnect() since ncm->port.in_ep->enabled is false. + NCM: ncm_unbind: ncm unbind ncm=ffffff9b179c3200 + NCM: ncm_free: ncm free ncm=ffffff9b179c3200 <-- released ncm + +[function link via configfs] + NCM: ncm_alloc: ncm alloc ncm=ffffff9ac4f8a000 + NCM: ncm_bind: ncm bind ncm=ffffff9ac4f8a000 + NCM: ncm_set_alt: ncm=ffffff9ac4f8a000 alt=0 + usb0: eth_open dev->port_usb=ffffff9b179c3200 <-- previous released ncm + usb0: eth_start dev->port_usb=ffffff9b179c3200 <-- + eth_start_xmit() + --> dev->wrap() + Unable to handle kernel paging request at virtual address dead00000000014f + +This patch addresses the issue by checking if 'ncm->netdev' is not NULL at +ncm_disable() to call gether_disconnect() to deassociate 'dev->port_usb'. +It's more reasonable to check 'ncm->netdev' to call gether_connect/disconnect +rather than check 'ncm->port.in_ep->enabled' since it might not be enabled +but the gether connection might be established. + +Signed-off-by: Norihiko Hama +Cc: stable +Link: https://lore.kernel.org/r/20240327023550.51214-1-Norihiko.Hama@alpsalpine.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_ncm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/function/f_ncm.c ++++ b/drivers/usb/gadget/function/f_ncm.c +@@ -884,7 +884,7 @@ static int ncm_set_alt(struct usb_functi + if (alt > 1) + goto fail; + +- if (ncm->port.in_ep->enabled) { ++ if (ncm->netdev) { + DBG(cdev, "reset ncm\n"); + ncm->netdev = NULL; + gether_disconnect(&ncm->port); +@@ -1369,7 +1369,7 @@ static void ncm_disable(struct usb_funct + + DBG(cdev, "ncm deactivated\n"); + +- if (ncm->port.in_ep->enabled) { ++ if (ncm->netdev) { + ncm->netdev = NULL; + gether_disconnect(&ncm->port); + } diff --git a/queue-6.1/usb-serial-option-add-fibocom-fm135-gl-variants.patch b/queue-6.1/usb-serial-option-add-fibocom-fm135-gl-variants.patch new file mode 100644 index 00000000000..2408433f145 --- /dev/null +++ b/queue-6.1/usb-serial-option-add-fibocom-fm135-gl-variants.patch @@ -0,0 +1,62 @@ +From 356952b13af5b2c338df1e06889fd1b5e12cbbf4 Mon Sep 17 00:00:00 2001 +From: bolan wang +Date: Wed, 6 Mar 2024 19:03:39 +0800 +Subject: USB: serial: option: add Fibocom FM135-GL variants + +From: bolan wang + +commit 356952b13af5b2c338df1e06889fd1b5e12cbbf4 upstream. + +Update the USB serial option driver support for the Fibocom +FM135-GL LTE modules. +- VID:PID 2cb7:0115, FM135-GL for laptop debug M.2 cards(with MBIM +interface for /Linux/Chrome OS) + +0x0115: mbim, diag, at, pipe + +Here are the outputs of usb-devices: +T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0115 Rev=05.15 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=Fibocom Module +S: SerialNumber=12345678 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: bolan wang +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2272,6 +2272,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) }, /* Fibocom FM160 (MBIM mode) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0115, 0xff), /* Fibocom FM135 (laptop MBIM) */ ++ .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ diff --git a/queue-6.1/usb-serial-option-add-lonsung-u8300-u9300-product.patch b/queue-6.1/usb-serial-option-add-lonsung-u8300-u9300-product.patch new file mode 100644 index 00000000000..40585175973 --- /dev/null +++ b/queue-6.1/usb-serial-option-add-lonsung-u8300-u9300-product.patch @@ -0,0 +1,114 @@ +From cf16ffa17c398434a77b8a373e69287c95b60de2 Mon Sep 17 00:00:00 2001 +From: Coia Prant +Date: Mon, 15 Apr 2024 07:26:25 -0700 +Subject: USB: serial: option: add Lonsung U8300/U9300 product + +From: Coia Prant + +commit cf16ffa17c398434a77b8a373e69287c95b60de2 upstream. + +Update the USB serial option driver to support Longsung U8300/U9300. + +For U8300 + +Interface 4 is used by for QMI interface in stock firmware of U8300, the +router which uses U8300 modem. +Interface 5 is used by for ADB interface in stock firmware of U8300, the +router which uses U8300 modem. + +Interface mapping is: +0: unknown (Debug), 1: AT (Modem), 2: AT, 3: PPP (NDIS / Pipe), 4: QMI, 5: ADB + +T: Bus=05 Lev=01 Prnt=03 Port=02 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1c9e ProdID=9b05 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +C: #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +For U9300 + +Interface 1 is used by for ADB interface in stock firmware of U9300, the +router which uses U9300 modem. +Interface 4 is used by for QMI interface in stock firmware of U9300, the +router which uses U9300 modem. + +Interface mapping is: +0: ADB, 1: AT (Modem), 2: AT, 3: PPP (NDIS / Pipe), 4: QMI + +Note: Interface 3 of some models of the U9300 series can send AT commands. + +T: Bus=05 Lev=01 Prnt=05 Port=04 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1c9e ProdID=9b3c Rev=03.18 +S: Manufacturer=Android +S: Product=Android +C: #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms + +Tested successfully using Modem Manager on U9300. +Tested successfully AT commands using If=1, If=2 and If=3 on U9300. + +Signed-off-by: Coia Prant +Reviewed-by: Lars Melin +[ johan: drop product defines, trim commit message ] +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2052,6 +2052,10 @@ static const struct usb_device_id option + .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9803, 0xff), + .driver_info = RSVD(4) }, ++ { USB_DEVICE(LONGCHEER_VENDOR_ID, 0x9b05), /* Longsung U8300 */ ++ .driver_info = RSVD(4) | RSVD(5) }, ++ { USB_DEVICE(LONGCHEER_VENDOR_ID, 0x9b3c), /* Longsung U9300 */ ++ .driver_info = RSVD(0) | RSVD(4) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, + { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, diff --git a/queue-6.1/usb-serial-option-add-rolling-rw101-gl-and-rw135-gl-support.patch b/queue-6.1/usb-serial-option-add-rolling-rw101-gl-and-rw135-gl-support.patch new file mode 100644 index 00000000000..75fbfe7ef32 --- /dev/null +++ b/queue-6.1/usb-serial-option-add-rolling-rw101-gl-and-rw135-gl-support.patch @@ -0,0 +1,175 @@ +From 311f97a4c7c22a01f8897bddf00428dfd0668e79 Mon Sep 17 00:00:00 2001 +From: Vanillan Wang +Date: Tue, 16 Apr 2024 18:02:55 +0800 +Subject: USB: serial: option: add Rolling RW101-GL and RW135-GL support + +From: Vanillan Wang + +commit 311f97a4c7c22a01f8897bddf00428dfd0668e79 upstream. + +Update the USB serial option driver support for the Rolling +LTE modules. + +- VID:PID 33f8:01a2, RW101-GL for laptop debug M.2 cards(with MBIM +interface for /Linux/Chrome OS) +0x01a2: mbim, diag, at, pipe +- VID:PID 33f8:01a3, RW101-GL for laptop debug M.2 cards(with MBIM +interface for /Linux/Chrome OS) +0x01a3: mbim, pipe +- VID:PID 33f8:01a4, RW101-GL for laptop debug M.2 cards(with MBIM +interface for /Linux/Chrome OS) +0x01a4: mbim, diag, at, pipe +- VID:PID 33f8:0104, RW101-GL for laptop debug M.2 cards(with RMNET +interface for /Linux/Chrome OS) +0x0104: RMNET, diag, at, pipe +- VID:PID 33f8:0115, RW135-GL for laptop debug M.2 cards(with MBIM +interface for /Linux/Chrome OS) +0x0115: MBIM, diag, at, pipe + +Here are the outputs of usb-devices: +T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=33f8 ProdID=01a2 Rev=05.15 +S: Manufacturer=Rolling Wireless S.a.r.l. +S: Product=Rolling Module +S: SerialNumber=12345678 +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=33f8 ProdID=01a3 Rev=05.15 +S: Manufacturer=Rolling Wireless S.a.r.l. +S: Product=Rolling Module +S: SerialNumber=12345678 +C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 17 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=33f8 ProdID=01a4 Rev=05.15 +S: Manufacturer=Rolling Wireless S.a.r.l. +S: Product=Rolling Module +S: SerialNumber=12345678 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=33f8 ProdID=0104 Rev=05.04 +S: Manufacturer=Rolling Wireless S.a.r.l. +S: Product=Rolling Module +S: SerialNumber=ba2eb033 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=33f8 ProdID=0115 Rev=05.15 +S: Manufacturer=Rolling Wireless S.a.r.l. +S: Product=Rolling Module +S: SerialNumber=12345678 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Vanillan Wang +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2307,6 +2307,14 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ ++ { USB_DEVICE(0x33f8, 0x0104), /* Rolling RW101-GL (laptop RMNET) */ ++ .driver_info = RSVD(4) | RSVD(5) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a2, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a3, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a4, 0xff), /* Rolling RW101-GL (laptop MBIM) */ ++ .driver_info = RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ ++ .driver_info = RSVD(5) }, + { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) }, diff --git a/queue-6.1/usb-serial-option-add-support-for-fibocom-fm650-fg650.patch b/queue-6.1/usb-serial-option-add-support-for-fibocom-fm650-fg650.patch new file mode 100644 index 00000000000..a395d0969df --- /dev/null +++ b/queue-6.1/usb-serial-option-add-support-for-fibocom-fm650-fg650.patch @@ -0,0 +1,139 @@ +From fb1f4584b1215e8c209f6b3a4028ed8351a0e961 Mon Sep 17 00:00:00 2001 +From: Chuanhong Guo +Date: Tue, 12 Mar 2024 14:29:12 +0800 +Subject: USB: serial: option: add support for Fibocom FM650/FG650 + +From: Chuanhong Guo + +commit fb1f4584b1215e8c209f6b3a4028ed8351a0e961 upstream. + +Fibocom FM650/FG650 are 5G modems with ECM/NCM/RNDIS/MBIM modes. +This patch adds support to all 4 modes. + +In all 4 modes, the first serial port is the AT console while the other +3 appear to be diagnostic interfaces for dumping modem logs. + +usb-devices output for all modes: + +ECM: +T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=5000 MxCh= 0 +D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0a04 Rev=04.04 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=FG650 Module +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=504mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +NCM: +T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=5000 MxCh= 0 +D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0a05 Rev=04.04 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=FG650 Module +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=504mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0d Prot=00 Driver=cdc_ncm +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +RNDIS: +T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 +D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0a06 Rev=04.04 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=FG650 Module +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=504mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +MBIM: +T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 7 Spd=5000 MxCh= 0 +D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0a07 Rev=04.04 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=FG650 Module +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=504mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +Signed-off-by: Chuanhong Guo +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2279,6 +2279,10 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */ + .driver_info = RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a04, 0xff) }, /* Fibocom FM650-CN (ECM mode) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a05, 0xff) }, /* Fibocom FM650-CN (NCM mode) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a06, 0xff) }, /* Fibocom FM650-CN (RNDIS mode) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a07, 0xff) }, /* Fibocom FM650-CN (MBIM mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ diff --git a/queue-6.1/usb-serial-option-add-telit-fn920c04-rmnet-compositions.patch b/queue-6.1/usb-serial-option-add-telit-fn920c04-rmnet-compositions.patch new file mode 100644 index 00000000000..2172320864f --- /dev/null +++ b/queue-6.1/usb-serial-option-add-telit-fn920c04-rmnet-compositions.patch @@ -0,0 +1,107 @@ +From 582ee2f9d268d302595db3e36b985e5cbb93284d Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Thu, 18 Apr 2024 13:34:30 +0200 +Subject: USB: serial: option: add Telit FN920C04 rmnet compositions + +From: Daniele Palmas + +commit 582ee2f9d268d302595db3e36b985e5cbb93284d upstream. + +Add the following Telit FN920C04 compositions: + +0x10a0: rmnet + tty (AT/NMEA) + tty (AT) + tty (diag) +T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10a0 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN920 +S: SerialNumber=92c4c4d8 +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10a4: rmnet + tty (AT) + tty (AT) + tty (diag) +T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10a4 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN920 +S: SerialNumber=92c4c4d8 +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10a9: rmnet + tty (AT) + tty (diag) + DPL (data packet logging) + adb +T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10a9 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN920 +S: SerialNumber=92c4c4d8 +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Daniele Palmas +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1376,6 +1376,12 @@ static const struct usb_device_id option + .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990 (ECM) */ + .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */ ++ .driver_info = RSVD(0) | NCTRL(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff), /* Telit FN20C04 (rmnet) */ ++ .driver_info = RSVD(0) | NCTRL(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a9, 0xff), /* Telit FN20C04 (rmnet) */ ++ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), diff --git a/queue-6.1/usb-serial-option-support-quectel-em060k-sub-models.patch b/queue-6.1/usb-serial-option-support-quectel-em060k-sub-models.patch new file mode 100644 index 00000000000..85c4823c5a2 --- /dev/null +++ b/queue-6.1/usb-serial-option-support-quectel-em060k-sub-models.patch @@ -0,0 +1,86 @@ +From c840244aba7ad2b83ed904378b36bd6aef25511c Mon Sep 17 00:00:00 2001 +From: Jerry Meng +Date: Mon, 15 Apr 2024 15:04:29 +0800 +Subject: USB: serial: option: support Quectel EM060K sub-models + +From: Jerry Meng + +commit c840244aba7ad2b83ed904378b36bd6aef25511c upstream. + +EM060K_129, EM060K_12a, EM060K_12b and EM0060K_12c are EM060K's sub-models, +having the same name "Quectel EM060K-GL" and the same interface layout. + +MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL + +T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0129 Rev= 5.04 +S: Manufacturer=Quectel +S: Product=Quectel EM060K-GL +S: SerialNumber=f6fa08b6 +C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Jerry Meng +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -255,6 +255,10 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_EM061K_LMS 0x0124 + #define QUECTEL_PRODUCT_EC25 0x0125 + #define QUECTEL_PRODUCT_EM060K_128 0x0128 ++#define QUECTEL_PRODUCT_EM060K_129 0x0129 ++#define QUECTEL_PRODUCT_EM060K_12a 0x012a ++#define QUECTEL_PRODUCT_EM060K_12b 0x012b ++#define QUECTEL_PRODUCT_EM060K_12c 0x012c + #define QUECTEL_PRODUCT_EG91 0x0191 + #define QUECTEL_PRODUCT_EG95 0x0195 + #define QUECTEL_PRODUCT_BG96 0x0296 +@@ -1218,6 +1222,18 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x40) },