From: Greg Kroah-Hartman Date: Tue, 18 Feb 2025 11:53:59 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v6.1.129~70 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4f3cd079b36a36f461db1a5e57cf6630dc05fbec;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: alpha-make-stack-16-byte-aligned-most-cases.patch batman-adv-fix-panic-during-interface-removal.patch can-c_can-fix-unbalanced-runtime-pm-disable-in-error-path.patch can-j1939-j1939_sk_send_loop-fix-unable-to-send-messages-with-data-length-zero.patch usb-add-usb_quirk_no_lpm-quirk-for-sony-xperia-xz1-smartphone.patch usb-cdc-acm-check-control-transfer-buffer-size-before-access.patch usb-cdc-acm-fill-in-renesas-r-car-d3-usb-download-mode-quirk.patch usb-cdc-acm-fix-handling-of-oversized-fragments.patch usb-dwc2-gadget-remove-of_node-reference-upon-udc_stop.patch usb-gadget-f_midi-fix-midi-streaming-descriptor-lengths.patch usb-gadget-udc-renesas_usb3-fix-compiler-warning.patch usb-hub-ignore-non-compliant-devices-with-too-many-configs-or-interfaces.patch usb-pci-quirks-fix-hccparams-register-error-for-ls7a-ehci.patch usb-quirks-add-usb_quirk_no_lpm-quirk-for-teclast-dist.patch usb-roles-set-switch-registered-flag-early-on.patch usb-serial-option-add-meig-smart-slm828.patch usb-serial-option-add-telit-cinterion-fn990b-compositions.patch usb-serial-option-drop-meig-smart-defines.patch usb-serial-option-fix-telit-cinterion-fn990a-name.patch --- diff --git a/queue-5.4/alpha-make-stack-16-byte-aligned-most-cases.patch b/queue-5.4/alpha-make-stack-16-byte-aligned-most-cases.patch new file mode 100644 index 0000000000..5142f0ba70 --- /dev/null +++ b/queue-5.4/alpha-make-stack-16-byte-aligned-most-cases.patch @@ -0,0 +1,69 @@ +From 0a0f7362b0367634a2d5cb7c96226afc116f19c9 Mon Sep 17 00:00:00 2001 +From: Ivan Kokshaysky +Date: Tue, 4 Feb 2025 23:35:23 +0100 +Subject: alpha: make stack 16-byte aligned (most cases) + +From: Ivan Kokshaysky + +commit 0a0f7362b0367634a2d5cb7c96226afc116f19c9 upstream. + +The problem is that GCC expects 16-byte alignment of the incoming stack +since early 2004, as Maciej found out [1]: + Having actually dug speculatively I can see that the psABI was changed in + GCC 3.5 with commit e5e10fb4a350 ("re PR target/14539 (128-bit long double + improperly aligned)") back in Mar 2004, when the stack pointer alignment + was increased from 8 bytes to 16 bytes, and arch/alpha/kernel/entry.S has + various suspicious stack pointer adjustments, starting with SP_OFF which + is not a whole multiple of 16. + +Also, as Magnus noted, "ALPHA Calling Standard" [2] required the same: + D.3.1 Stack Alignment + This standard requires that stacks be octaword aligned at the time a + new procedure is invoked. + +However: +- the "normal" kernel stack is always misaligned by 8 bytes, thanks to + the odd number of 64-bit words in 'struct pt_regs', which is the very + first thing pushed onto the kernel thread stack; +- syscall, fault, interrupt etc. handlers may, or may not, receive aligned + stack depending on numerous factors. + +Somehow we got away with it until recently, when we ended up with +a stack corruption in kernel/smp.c:smp_call_function_single() due to +its use of 32-byte aligned local data and the compiler doing clever +things allocating it on the stack. + +This adds padding between the PAL-saved and kernel-saved registers +so that 'struct pt_regs' have an even number of 64-bit words. +This makes the stack properly aligned for most of the kernel +code, except two handlers which need special threatment. + +Note: struct pt_regs doesn't belong in uapi/asm; this should be fixed, +but let's put this off until later. + +Link: https://lore.kernel.org/rcu/alpine.DEB.2.21.2501130248010.18889@angie.orcam.me.uk/ [1] +Link: https://bitsavers.org/pdf/dec/alpha/Alpha_Calling_Standard_Rev_2.0_19900427.pdf [2] + +Cc: stable@vger.kernel.org +Tested-by: Maciej W. Rozycki +Tested-by: Magnus Lindholm +Tested-by: Matt Turner +Reviewed-by: Maciej W. Rozycki +Signed-off-by: Ivan Kokshaysky +Signed-off-by: Matt Turner +Signed-off-by: Greg Kroah-Hartman +--- + arch/alpha/include/uapi/asm/ptrace.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/alpha/include/uapi/asm/ptrace.h ++++ b/arch/alpha/include/uapi/asm/ptrace.h +@@ -42,6 +42,8 @@ struct pt_regs { + unsigned long trap_a0; + unsigned long trap_a1; + unsigned long trap_a2; ++/* This makes the stack 16-byte aligned as GCC expects */ ++ unsigned long __pad0; + /* These are saved by PAL-code: */ + unsigned long ps; + unsigned long pc; diff --git a/queue-5.4/batman-adv-fix-panic-during-interface-removal.patch b/queue-5.4/batman-adv-fix-panic-during-interface-removal.patch new file mode 100644 index 0000000000..43c14f9d41 --- /dev/null +++ b/queue-5.4/batman-adv-fix-panic-during-interface-removal.patch @@ -0,0 +1,81 @@ +From ccb7276a6d26d6f8416e315b43b45e15ee7f29e2 Mon Sep 17 00:00:00 2001 +From: Andy Strohman +Date: Thu, 9 Jan 2025 02:27:56 +0000 +Subject: batman-adv: fix panic during interface removal + +From: Andy Strohman + +commit ccb7276a6d26d6f8416e315b43b45e15ee7f29e2 upstream. + +Reference counting is used to ensure that +batadv_hardif_neigh_node and batadv_hard_iface +are not freed before/during +batadv_v_elp_throughput_metric_update work is +finished. + +But there isn't a guarantee that the hard if will +remain associated with a soft interface up until +the work is finished. + +This fixes a crash triggered by reboot that looks +like this: + +Call trace: + batadv_v_mesh_free+0xd0/0x4dc [batman_adv] + batadv_v_elp_throughput_metric_update+0x1c/0xa4 + process_one_work+0x178/0x398 + worker_thread+0x2e8/0x4d0 + kthread+0xd8/0xdc + ret_from_fork+0x10/0x20 + +(the batadv_v_mesh_free call is misleading, +and does not actually happen) + +I was able to make the issue happen more reliably +by changing hardif_neigh->bat_v.metric_work work +to be delayed work. This allowed me to track down +and confirm the fix. + +Cc: stable@vger.kernel.org +Fixes: c833484e5f38 ("batman-adv: ELP - compute the metric based on the estimated throughput") +Signed-off-by: Andy Strohman +[sven@narfation.org: prevent entering batadv_v_elp_get_throughput without + soft_iface] +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/bat_v_elp.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/net/batman-adv/bat_v_elp.c ++++ b/net/batman-adv/bat_v_elp.c +@@ -65,12 +65,19 @@ static void batadv_v_elp_start_timer(str + static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh) + { + struct batadv_hard_iface *hard_iface = neigh->if_incoming; ++ struct net_device *soft_iface = hard_iface->soft_iface; + struct ethtool_link_ksettings link_settings; + struct net_device *real_netdev; + struct station_info sinfo; + u32 throughput; + int ret; + ++ /* don't query throughput when no longer associated with any ++ * batman-adv interface ++ */ ++ if (!soft_iface) ++ return BATADV_THROUGHPUT_DEFAULT_VALUE; ++ + /* if the user specified a customised value for this interface, then + * return it directly + */ +@@ -134,7 +141,7 @@ static u32 batadv_v_elp_get_throughput(s + + default_throughput: + if (!(hard_iface->bat_v.flags & BATADV_WARNING_DEFAULT)) { +- batadv_info(hard_iface->soft_iface, ++ batadv_info(soft_iface, + "WiFi driver or ethtool info does not provide information about link speeds on interface %s, therefore defaulting to hardcoded throughput values of %u.%1u Mbps. Consider overriding the throughput manually or checking your driver.\n", + hard_iface->net_dev->name, + BATADV_THROUGHPUT_DEFAULT_VALUE / 10, diff --git a/queue-5.4/can-c_can-fix-unbalanced-runtime-pm-disable-in-error-path.patch b/queue-5.4/can-c_can-fix-unbalanced-runtime-pm-disable-in-error-path.patch new file mode 100644 index 0000000000..7c80d1923f --- /dev/null +++ b/queue-5.4/can-c_can-fix-unbalanced-runtime-pm-disable-in-error-path.patch @@ -0,0 +1,45 @@ +From 257a2cd3eb578ee63d6bf90475dc4f4b16984139 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Sun, 12 Jan 2025 13:41:52 +0100 +Subject: can: c_can: fix unbalanced runtime PM disable in error path + +From: Krzysztof Kozlowski + +commit 257a2cd3eb578ee63d6bf90475dc4f4b16984139 upstream. + +Runtime PM is enabled as one of the last steps of probe(), so all +earlier gotos to "exit_free_device" label were not correct and were +leading to unbalanced runtime PM disable depth. + +Fixes: 6e2fe01dd6f9 ("can: c_can: move runtime PM enable/disable to c_can_platform") +Cc: stable@vger.kernel.org +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Vincent Mailhol +Link: https://patch.msgid.link/20250112-syscon-phandle-args-can-v1-1-314d9549906f@linaro.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/c_can/c_can_platform.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/c_can/c_can_platform.c ++++ b/drivers/net/can/c_can/c_can_platform.c +@@ -391,15 +391,16 @@ static int c_can_plat_probe(struct platf + if (ret) { + dev_err(&pdev->dev, "registering %s failed (err=%d)\n", + KBUILD_MODNAME, ret); +- goto exit_free_device; ++ goto exit_pm_runtime; + } + + dev_info(&pdev->dev, "%s device registered (regs=%p, irq=%d)\n", + KBUILD_MODNAME, priv->base, dev->irq); + return 0; + +-exit_free_device: ++exit_pm_runtime: + pm_runtime_disable(priv->device); ++exit_free_device: + free_c_can_dev(dev); + exit: + dev_err(&pdev->dev, "probe failed\n"); diff --git a/queue-5.4/can-j1939-j1939_sk_send_loop-fix-unable-to-send-messages-with-data-length-zero.patch b/queue-5.4/can-j1939-j1939_sk_send_loop-fix-unable-to-send-messages-with-data-length-zero.patch new file mode 100644 index 0000000000..b20b66e80c --- /dev/null +++ b/queue-5.4/can-j1939-j1939_sk_send_loop-fix-unable-to-send-messages-with-data-length-zero.patch @@ -0,0 +1,78 @@ +From 44de577e61ed239db09f0da9d436866bef9b77dd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Alexander=20H=C3=B6lzl?= +Date: Wed, 5 Feb 2025 18:46:51 +0100 +Subject: can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Hölzl + +commit 44de577e61ed239db09f0da9d436866bef9b77dd upstream. + +The J1939 standard requires the transmission of messages of length 0. + +For example proprietary messages are specified with a data length of 0 +to 1785. The transmission of such messages is not possible. Sending +results in no error being returned but no corresponding can frame +being generated. + +Enable the transmission of zero length J1939 messages. In order to +facilitate this two changes are necessary: + +1) If the transmission of a new message is requested from user space +the message is segmented in j1939_sk_send_loop(). Let the segmentation +take into account zero length messages, do not terminate immediately, +queue the corresponding skb. + +2) j1939_session_skb_get_by_offset() selects the next skb to transmit +for a session. Take into account that there might be zero length skbs +in the queue. + +Signed-off-by: Alexander Hölzl +Acked-by: Oleksij Rempel +Link: https://patch.msgid.link/20250205174651.103238-1-alexander.hoelzl@gmx.net +Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") +Cc: stable@vger.kernel.org +[mkl: commit message rephrased] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + net/can/j1939/socket.c | 4 ++-- + net/can/j1939/transport.c | 5 +++-- + 2 files changed, 5 insertions(+), 4 deletions(-) + +--- a/net/can/j1939/socket.c ++++ b/net/can/j1939/socket.c +@@ -1055,7 +1055,7 @@ static int j1939_sk_send_loop(struct j19 + + todo_size = size; + +- while (todo_size) { ++ do { + struct j1939_sk_buff_cb *skcb; + + segment_size = min_t(size_t, J1939_MAX_TP_PACKET_SIZE, +@@ -1100,7 +1100,7 @@ static int j1939_sk_send_loop(struct j19 + + todo_size -= segment_size; + session->total_queued_size += segment_size; +- } ++ } while (todo_size); + + switch (ret) { + case 0: /* OK */ +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -378,8 +378,9 @@ sk_buff *j1939_session_skb_get_by_offset + skb_queue_walk(&session->skb_queue, do_skb) { + do_skcb = j1939_skb_to_cb(do_skb); + +- if (offset_start >= do_skcb->offset && +- offset_start < (do_skcb->offset + do_skb->len)) { ++ if ((offset_start >= do_skcb->offset && ++ offset_start < (do_skcb->offset + do_skb->len)) || ++ (offset_start == 0 && do_skcb->offset == 0 && do_skb->len == 0)) { + skb = do_skb; + } + } diff --git a/queue-5.4/series b/queue-5.4/series index 0c248418cd..d3c3ef0e15 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -166,3 +166,22 @@ vfio-pci-enable-iowrite64-and-ioread64-for-vfio-pci.patch grab-mm-lock-before-grabbing-pt-lock.patch orangefs-fix-a-oob-in-orangefs_debug_write.patch asoc-intel-bytcr_rt5640-add-dmi-quirk-for-vexia-edu-.patch +batman-adv-fix-panic-during-interface-removal.patch +usb-roles-set-switch-registered-flag-early-on.patch +usb-gadget-udc-renesas_usb3-fix-compiler-warning.patch +usb-dwc2-gadget-remove-of_node-reference-upon-udc_stop.patch +usb-pci-quirks-fix-hccparams-register-error-for-ls7a-ehci.patch +usb-quirks-add-usb_quirk_no_lpm-quirk-for-teclast-dist.patch +usb-add-usb_quirk_no_lpm-quirk-for-sony-xperia-xz1-smartphone.patch +usb-gadget-f_midi-fix-midi-streaming-descriptor-lengths.patch +usb-hub-ignore-non-compliant-devices-with-too-many-configs-or-interfaces.patch +usb-cdc-acm-fill-in-renesas-r-car-d3-usb-download-mode-quirk.patch +usb-cdc-acm-check-control-transfer-buffer-size-before-access.patch +usb-cdc-acm-fix-handling-of-oversized-fragments.patch +usb-serial-option-add-meig-smart-slm828.patch +usb-serial-option-add-telit-cinterion-fn990b-compositions.patch +usb-serial-option-fix-telit-cinterion-fn990a-name.patch +usb-serial-option-drop-meig-smart-defines.patch +can-c_can-fix-unbalanced-runtime-pm-disable-in-error-path.patch +can-j1939-j1939_sk_send_loop-fix-unable-to-send-messages-with-data-length-zero.patch +alpha-make-stack-16-byte-aligned-most-cases.patch diff --git a/queue-5.4/usb-add-usb_quirk_no_lpm-quirk-for-sony-xperia-xz1-smartphone.patch b/queue-5.4/usb-add-usb_quirk_no_lpm-quirk-for-sony-xperia-xz1-smartphone.patch new file mode 100644 index 0000000000..9592dd6e89 --- /dev/null +++ b/queue-5.4/usb-add-usb_quirk_no_lpm-quirk-for-sony-xperia-xz1-smartphone.patch @@ -0,0 +1,55 @@ +From 159daf1258227f44b26b5d38f4aa8f37b8cca663 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Thu, 6 Feb 2025 17:18:36 +0200 +Subject: USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone + +From: Mathias Nyman + +commit 159daf1258227f44b26b5d38f4aa8f37b8cca663 upstream. + +The fastboot tool for communicating with Android bootloaders does not +work reliably with this device if USB 2 Link Power Management (LPM) +is enabled. + +Various fastboot commands are affected, including the +following, which usually reproduces the problem within two tries: + + fastboot getvar kernel + getvar:kernel FAILED (remote: 'GetVar Variable Not found') + +This issue was hidden on many systems up until commit 63a1f8454962 +("xhci: stored cached port capability values in one place") as the xhci +driver failed to detect USB 2 LPM support if USB 3 ports were listed +before USB 2 ports in the "supported protocol capabilities". + +Adding the quirk resolves the issue. No drawbacks are expected since +the device uses different USB product IDs outside of fastboot mode, and +since fastboot commands worked before, until LPM was enabled on the +tested system by the aforementioned commit. + +Based on a patch from Forest from which most of the +code and commit message is taken. + +Cc: stable +Reported-by: Forest +Closes: https://lore.kernel.org/hk8umj9lv4l4qguftdq1luqtdrpa1gks5l@sonic.net +Tested-by: Forest +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20250206151836.51742-1-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -430,6 +430,9 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x0c45, 0x7056), .driver_info = + USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + ++ /* Sony Xperia XZ1 Compact (lilac) smartphone in fastboot mode */ ++ { USB_DEVICE(0x0fce, 0x0dde), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* Action Semiconductor flash disk */ + { USB_DEVICE(0x10d6, 0x2200), .driver_info = + USB_QUIRK_STRING_FETCH_255 }, diff --git a/queue-5.4/usb-cdc-acm-check-control-transfer-buffer-size-before-access.patch b/queue-5.4/usb-cdc-acm-check-control-transfer-buffer-size-before-access.patch new file mode 100644 index 0000000000..8e01acb432 --- /dev/null +++ b/queue-5.4/usb-cdc-acm-check-control-transfer-buffer-size-before-access.patch @@ -0,0 +1,66 @@ +From e563b01208f4d1f609bcab13333b6c0e24ce6a01 Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Wed, 12 Feb 2025 19:15:15 +0100 +Subject: usb: cdc-acm: Check control transfer buffer size before access + +From: Jann Horn + +commit e563b01208f4d1f609bcab13333b6c0e24ce6a01 upstream. + +If the first fragment is shorter than struct usb_cdc_notification, we can't +calculate an expected_size. Log an error and discard the notification +instead of reading lengths from memory outside the received data, which can +lead to memory corruption when the expected_size decreases between +fragments, causing `expected_size - acm->nb_index` to wrap. + +This issue has been present since the beginning of git history; however, +it only leads to memory corruption since commit ea2583529cd1 +("cdc-acm: reassemble fragmented notifications"). + +A mitigating factor is that acm_ctrl_irq() can only execute after userspace +has opened /dev/ttyACM*; but if ModemManager is running, ModemManager will +do that automatically depending on the USB device's vendor/product IDs and +its other interfaces. + +Cc: stable +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jann Horn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-acm.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -359,7 +359,7 @@ static void acm_process_notification(str + static void acm_ctrl_irq(struct urb *urb) + { + struct acm *acm = urb->context; +- struct usb_cdc_notification *dr = urb->transfer_buffer; ++ struct usb_cdc_notification *dr; + unsigned int current_size = urb->actual_length; + unsigned int expected_size, copy_size, alloc_size; + int retval; +@@ -386,9 +386,20 @@ static void acm_ctrl_irq(struct urb *urb + + usb_mark_last_busy(acm->dev); + +- if (acm->nb_index) ++ if (acm->nb_index == 0) { ++ /* ++ * The first chunk of a message must contain at least the ++ * notification header with the length field, otherwise we ++ * can't get an expected_size. ++ */ ++ if (current_size < sizeof(struct usb_cdc_notification)) { ++ dev_dbg(&acm->control->dev, "urb too short\n"); ++ goto exit; ++ } ++ dr = urb->transfer_buffer; ++ } else { + dr = (struct usb_cdc_notification *)acm->notification_buffer; +- ++ } + /* size = notification-header + (optional) data */ + expected_size = sizeof(struct usb_cdc_notification) + + le16_to_cpu(dr->wLength); diff --git a/queue-5.4/usb-cdc-acm-fill-in-renesas-r-car-d3-usb-download-mode-quirk.patch b/queue-5.4/usb-cdc-acm-fill-in-renesas-r-car-d3-usb-download-mode-quirk.patch new file mode 100644 index 0000000000..6d2e115973 --- /dev/null +++ b/queue-5.4/usb-cdc-acm-fill-in-renesas-r-car-d3-usb-download-mode-quirk.patch @@ -0,0 +1,46 @@ +From 7284922f3e4fa285dff1b8bb593aa9a0b8458f30 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Sun, 9 Feb 2025 15:56:11 +0100 +Subject: USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk + +From: Marek Vasut + +commit 7284922f3e4fa285dff1b8bb593aa9a0b8458f30 upstream. + +Add Renesas R-Car D3 USB Download mode quirk and update comments +on all the other Renesas R-Car USB Download mode quirks to discern +them from each other. This follows R-Car Series, 3rd Generation +reference manual Rev.2.00 chapter 19.2.8 USB download mode . + +Fixes: 6d853c9e4104 ("usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode") +Cc: stable +Signed-off-by: Marek Vasut +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20250209145708.106914-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-acm.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1733,13 +1733,16 @@ static const struct usb_device_id acm_id + { USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */ + .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ + }, +- { USB_DEVICE(0x045b, 0x023c), /* Renesas USB Download mode */ ++ { USB_DEVICE(0x045b, 0x023c), /* Renesas R-Car H3 USB Download mode */ + .driver_info = DISABLE_ECHO, /* Don't echo banner */ + }, +- { USB_DEVICE(0x045b, 0x0248), /* Renesas USB Download mode */ ++ { USB_DEVICE(0x045b, 0x0247), /* Renesas R-Car D3 USB Download mode */ + .driver_info = DISABLE_ECHO, /* Don't echo banner */ + }, +- { USB_DEVICE(0x045b, 0x024D), /* Renesas USB Download mode */ ++ { USB_DEVICE(0x045b, 0x0248), /* Renesas R-Car M3-N USB Download mode */ ++ .driver_info = DISABLE_ECHO, /* Don't echo banner */ ++ }, ++ { USB_DEVICE(0x045b, 0x024D), /* Renesas R-Car E3 USB Download mode */ + .driver_info = DISABLE_ECHO, /* Don't echo banner */ + }, + { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */ diff --git a/queue-5.4/usb-cdc-acm-fix-handling-of-oversized-fragments.patch b/queue-5.4/usb-cdc-acm-fix-handling-of-oversized-fragments.patch new file mode 100644 index 0000000000..5904c8b736 --- /dev/null +++ b/queue-5.4/usb-cdc-acm-fix-handling-of-oversized-fragments.patch @@ -0,0 +1,42 @@ +From 12e712964f41d05ae034989892de445781c46730 Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Wed, 12 Feb 2025 19:15:16 +0100 +Subject: usb: cdc-acm: Fix handling of oversized fragments + +From: Jann Horn + +commit 12e712964f41d05ae034989892de445781c46730 upstream. + +If we receive an initial fragment of size 8 bytes which specifies a wLength +of 1 byte (so the reassembled message is supposed to be 9 bytes long), and +we then receive a second fragment of size 9 bytes (which is not supposed to +happen), we currently wrongly bypass the fragment reassembly code but still +pass the pointer to the acm->notification_buffer to +acm_process_notification(). + +Make this less wrong by always going through fragment reassembly when we +expect more fragments. + +Before this patch, receiving an overlong fragment could lead to `newctrl` +in acm_process_notification() being uninitialized data (instead of data +coming from the device). + +Cc: stable +Fixes: ea2583529cd1 ("cdc-acm: reassemble fragmented notifications") +Signed-off-by: Jann Horn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-acm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -404,7 +404,7 @@ static void acm_ctrl_irq(struct urb *urb + expected_size = sizeof(struct usb_cdc_notification) + + le16_to_cpu(dr->wLength); + +- if (current_size < expected_size) { ++ if (acm->nb_index != 0 || current_size < expected_size) { + /* notification is transmitted fragmented, reassemble */ + if (acm->nb_size < expected_size) { + u8 *new_buffer; diff --git a/queue-5.4/usb-dwc2-gadget-remove-of_node-reference-upon-udc_stop.patch b/queue-5.4/usb-dwc2-gadget-remove-of_node-reference-upon-udc_stop.patch new file mode 100644 index 0000000000..90cf7a0ca3 --- /dev/null +++ b/queue-5.4/usb-dwc2-gadget-remove-of_node-reference-upon-udc_stop.patch @@ -0,0 +1,51 @@ +From 58cd423820d5b5610977e55e4acdd06628829ede Mon Sep 17 00:00:00 2001 +From: Fabrice Gasnier +Date: Fri, 24 Jan 2025 18:33:25 +0100 +Subject: usb: dwc2: gadget: remove of_node reference upon udc_stop + +From: Fabrice Gasnier + +commit 58cd423820d5b5610977e55e4acdd06628829ede upstream. + +In dwc2_hsotg_udc_start(), e.g. when binding composite driver, "of_node" +is set to hsotg->dev->of_node. + +It causes errors when binding the gadget driver several times, on +stm32mp157c-ev1 board. Below error is seen: +"pin PA10 already requested by 49000000.usb-otg; cannot claim for gadget.0" + +The first time, no issue is seen as when registering the driver, of_node +isn't NULL: +-> gadget_dev_desc_UDC_store + -> usb_gadget_register_driver_owner + -> driver_register + ... + -> really_probe -> pinctrl_bind_pins (no effect) + +Then dwc2_hsotg_udc_start() sets of_node. + +The second time (stop the gadget, reconfigure it, then start it again), +of_node has been set, so the probing code tries to acquire pins for the +gadget. These pins are hold by the controller, hence the error. + +So clear gadget.dev.of_node in udc_stop() routine to avoid the issue. + +Fixes: 7d7b22928b90 ("usb: gadget: s3c-hsotg: Propagate devicetree to gadget drivers") +Cc: stable +Signed-off-by: Fabrice Gasnier +Link: https://lore.kernel.org/r/20250124173325.2747710-1-fabrice.gasnier@foss.st.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/gadget.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -4548,6 +4548,7 @@ static int dwc2_hsotg_udc_stop(struct us + spin_lock_irqsave(&hsotg->lock, flags); + + hsotg->driver = NULL; ++ hsotg->gadget.dev.of_node = NULL; + hsotg->gadget.speed = USB_SPEED_UNKNOWN; + hsotg->enabled = 0; + diff --git a/queue-5.4/usb-gadget-f_midi-fix-midi-streaming-descriptor-lengths.patch b/queue-5.4/usb-gadget-f_midi-fix-midi-streaming-descriptor-lengths.patch new file mode 100644 index 0000000000..b4bd5e61f5 --- /dev/null +++ b/queue-5.4/usb-gadget-f_midi-fix-midi-streaming-descriptor-lengths.patch @@ -0,0 +1,52 @@ +From da1668997052ed1cb00322e1f3b63702615c9429 Mon Sep 17 00:00:00 2001 +From: John Keeping +Date: Thu, 30 Jan 2025 19:50:34 +0000 +Subject: usb: gadget: f_midi: fix MIDI Streaming descriptor lengths + +From: John Keeping + +commit da1668997052ed1cb00322e1f3b63702615c9429 upstream. + +While the MIDI jacks are configured correctly, and the MIDIStreaming +endpoint descriptors are filled with the correct information, +bNumEmbMIDIJack and bLength are set incorrectly in these descriptors. + +This does not matter when the numbers of in and out ports are equal, but +when they differ the host will receive broken descriptors with +uninitialized stack memory leaking into the descriptor for whichever +value is smaller. + +The precise meaning of "in" and "out" in the port counts is not clearly +defined and can be confusing. But elsewhere the driver consistently +uses this to match the USB meaning of IN and OUT viewed from the host, +so that "in" ports send data to the host and "out" ports receive data +from it. + +Cc: stable +Fixes: c8933c3f79568 ("USB: gadget: f_midi: allow a dynamic number of input and output ports") +Signed-off-by: John Keeping +Reviewed-by: Takashi Iwai +Link: https://lore.kernel.org/r/20250130195035.3883857-1-jkeeping@inmusicbrands.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_midi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/function/f_midi.c ++++ b/drivers/usb/gadget/function/f_midi.c +@@ -997,11 +997,11 @@ static int f_midi_bind(struct usb_config + } + + /* configure the endpoint descriptors ... */ +- ms_out_desc.bLength = USB_DT_MS_ENDPOINT_SIZE(midi->in_ports); +- ms_out_desc.bNumEmbMIDIJack = midi->in_ports; ++ ms_out_desc.bLength = USB_DT_MS_ENDPOINT_SIZE(midi->out_ports); ++ ms_out_desc.bNumEmbMIDIJack = midi->out_ports; + +- ms_in_desc.bLength = USB_DT_MS_ENDPOINT_SIZE(midi->out_ports); +- ms_in_desc.bNumEmbMIDIJack = midi->out_ports; ++ ms_in_desc.bLength = USB_DT_MS_ENDPOINT_SIZE(midi->in_ports); ++ ms_in_desc.bNumEmbMIDIJack = midi->in_ports; + + /* ... and add them to the list */ + endpoint_descriptor_index = i; diff --git a/queue-5.4/usb-gadget-udc-renesas_usb3-fix-compiler-warning.patch b/queue-5.4/usb-gadget-udc-renesas_usb3-fix-compiler-warning.patch new file mode 100644 index 0000000000..92f62054f2 --- /dev/null +++ b/queue-5.4/usb-gadget-udc-renesas_usb3-fix-compiler-warning.patch @@ -0,0 +1,38 @@ +From 335a1fc1193481f8027f176649c72868172f6f8b Mon Sep 17 00:00:00 2001 +From: Guo Ren +Date: Wed, 22 Jan 2025 03:12:31 -0500 +Subject: usb: gadget: udc: renesas_usb3: Fix compiler warning + +From: Guo Ren + +commit 335a1fc1193481f8027f176649c72868172f6f8b upstream. + +drivers/usb/gadget/udc/renesas_usb3.c: In function 'renesas_usb3_probe': +drivers/usb/gadget/udc/renesas_usb3.c:2638:73: warning: '%d' +directive output may be truncated writing between 1 and 11 bytes into a +region of size 6 [-Wformat-truncation=] +2638 | snprintf(usb3_ep->ep_name, sizeof(usb3_ep->ep_name), "ep%d", i); + ^~~~~~~~~~~~~~~~~~~~~~~~ ^~ ^ + +Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") +Cc: stable@vger.kernel.org +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202501201409.BIQPtkeB-lkp@intel.com/ +Signed-off-by: Guo Ren +Link: https://lore.kernel.org/r/20250122081231.47594-1-guoren@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/renesas_usb3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -306,7 +306,7 @@ struct renesas_usb3_request { + struct list_head queue; + }; + +-#define USB3_EP_NAME_SIZE 8 ++#define USB3_EP_NAME_SIZE 16 + struct renesas_usb3_ep { + struct usb_ep ep; + struct renesas_usb3 *usb3; diff --git a/queue-5.4/usb-hub-ignore-non-compliant-devices-with-too-many-configs-or-interfaces.patch b/queue-5.4/usb-hub-ignore-non-compliant-devices-with-too-many-configs-or-interfaces.patch new file mode 100644 index 0000000000..533a6efc47 --- /dev/null +++ b/queue-5.4/usb-hub-ignore-non-compliant-devices-with-too-many-configs-or-interfaces.patch @@ -0,0 +1,79 @@ +From 2240fed37afbcdb5e8b627bc7ad986891100e05d Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 22 Jan 2025 14:26:17 -0500 +Subject: USB: hub: Ignore non-compliant devices with too many configs or interfaces + +From: Alan Stern + +commit 2240fed37afbcdb5e8b627bc7ad986891100e05d upstream. + +Robert Morris created a test program which can cause +usb_hub_to_struct_hub() to dereference a NULL or inappropriate +pointer: + +Oops: general protection fault, probably for non-canonical address +0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI +CPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14 +Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021 +Workqueue: usb_hub_wq hub_event +RIP: 0010:usb_hub_adjust_deviceremovable+0x78/0x110 +... +Call Trace: + + ? die_addr+0x31/0x80 + ? exc_general_protection+0x1b4/0x3c0 + ? asm_exc_general_protection+0x26/0x30 + ? usb_hub_adjust_deviceremovable+0x78/0x110 + hub_probe+0x7c7/0xab0 + usb_probe_interface+0x14b/0x350 + really_probe+0xd0/0x2d0 + ? __pfx___device_attach_driver+0x10/0x10 + __driver_probe_device+0x6e/0x110 + driver_probe_device+0x1a/0x90 + __device_attach_driver+0x7e/0xc0 + bus_for_each_drv+0x7f/0xd0 + __device_attach+0xaa/0x1a0 + bus_probe_device+0x8b/0xa0 + device_add+0x62e/0x810 + usb_set_configuration+0x65d/0x990 + usb_generic_driver_probe+0x4b/0x70 + usb_probe_device+0x36/0xd0 + +The cause of this error is that the device has two interfaces, and the +hub driver binds to interface 1 instead of interface 0, which is where +usb_hub_to_struct_hub() looks. + +We can prevent the problem from occurring by refusing to accept hub +devices that violate the USB spec by having more than one +configuration or interface. + +Reported-and-tested-by: Robert Morris +Cc: stable +Closes: https://lore.kernel.org/linux-usb/95564.1737394039@localhost/ +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/r/c27f3bf4-63d8-4fb5-ac82-09e3cd19f61c@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/hub.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1793,6 +1793,17 @@ static int hub_probe(struct usb_interfac + hdev = interface_to_usbdev(intf); + + /* ++ * The USB 2.0 spec prohibits hubs from having more than one ++ * configuration or interface, and we rely on this prohibition. ++ * Refuse to accept a device that violates it. ++ */ ++ if (hdev->descriptor.bNumConfigurations > 1 || ++ hdev->actconfig->desc.bNumInterfaces > 1) { ++ dev_err(&intf->dev, "Invalid hub with more than one config or interface\n"); ++ return -EINVAL; ++ } ++ ++ /* + * Set default autosuspend delay as 0 to speedup bus suspend, + * based on the below considerations: + * diff --git a/queue-5.4/usb-pci-quirks-fix-hccparams-register-error-for-ls7a-ehci.patch b/queue-5.4/usb-pci-quirks-fix-hccparams-register-error-for-ls7a-ehci.patch new file mode 100644 index 0000000000..11807b7e49 --- /dev/null +++ b/queue-5.4/usb-pci-quirks-fix-hccparams-register-error-for-ls7a-ehci.patch @@ -0,0 +1,54 @@ +From e71f7f42e3c874ac3314b8f250e8416a706165af Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Sun, 2 Feb 2025 20:49:35 +0800 +Subject: USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI + +From: Huacai Chen + +commit e71f7f42e3c874ac3314b8f250e8416a706165af upstream. + +LS7A EHCI controller doesn't have extended capabilities, so the EECP +(EHCI Extended Capabilities Pointer) field of HCCPARAMS register should +be 0x0, but it reads as 0xa0 now. This is a hardware flaw and will be +fixed in future, now just clear the EECP field to avoid error messages +on boot: + +...... +[ 0.581675] pci 0000:00:04.1: EHCI: unrecognized capability ff +[ 0.581699] pci 0000:00:04.1: EHCI: unrecognized capability ff +[ 0.581716] pci 0000:00:04.1: EHCI: unrecognized capability ff +[ 0.581851] pci 0000:00:04.1: EHCI: unrecognized capability ff +...... +[ 0.581916] pci 0000:00:05.1: EHCI: unrecognized capability ff +[ 0.581951] pci 0000:00:05.1: EHCI: unrecognized capability ff +[ 0.582704] pci 0000:00:05.1: EHCI: unrecognized capability ff +[ 0.582799] pci 0000:00:05.1: EHCI: unrecognized capability ff +...... + +Cc: stable +Signed-off-by: Baoqi Zhang +Signed-off-by: Huacai Chen +Link: https://lore.kernel.org/r/20250202124935.480500-1-chenhuacai@loongson.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/pci-quirks.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -945,6 +945,15 @@ static void quirk_usb_disable_ehci(struc + * booting from USB disk or using a usb keyboard + */ + hcc_params = readl(base + EHCI_HCC_PARAMS); ++ ++ /* LS7A EHCI controller doesn't have extended capabilities, the ++ * EECP (EHCI Extended Capabilities Pointer) field of HCCPARAMS ++ * register should be 0x0 but it reads as 0xa0. So clear it to ++ * avoid error messages on boot. ++ */ ++ if (pdev->vendor == PCI_VENDOR_ID_LOONGSON && pdev->device == 0x7a14) ++ hcc_params &= ~(0xffL << 8); ++ + offset = (hcc_params >> 8) & 0xff; + while (offset && --count) { + pci_read_config_dword(pdev, offset, &cap); diff --git a/queue-5.4/usb-quirks-add-usb_quirk_no_lpm-quirk-for-teclast-dist.patch b/queue-5.4/usb-quirks-add-usb_quirk_no_lpm-quirk-for-teclast-dist.patch new file mode 100644 index 0000000000..4cd0c60017 --- /dev/null +++ b/queue-5.4/usb-quirks-add-usb_quirk_no_lpm-quirk-for-teclast-dist.patch @@ -0,0 +1,33 @@ +From e169d96eecd447ff7fd7542ca5fa0911f5622054 Mon Sep 17 00:00:00 2001 +From: Lei Huang +Date: Wed, 12 Feb 2025 17:38:29 +0800 +Subject: USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist + +From: Lei Huang + +commit e169d96eecd447ff7fd7542ca5fa0911f5622054 upstream. + +Teclast disk used on Huawei hisi platforms doesn't work well, +losing connectivity intermittently if LPM is enabled. +Add quirk disable LPM to resolve the issue. + +Signed-off-by: Lei Huang +Cc: stable +Link: https://lore.kernel.org/r/20250212093829.7379-1-huanglei814@163.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -520,6 +520,9 @@ static const struct usb_device_id usb_qu + /* Blackmagic Design UltraStudio SDI */ + { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* Teclast disk */ ++ { USB_DEVICE(0x1f75, 0x0917), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* Hauppauge HVR-950q */ + { USB_DEVICE(0x2040, 0x7200), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, diff --git a/queue-5.4/usb-roles-set-switch-registered-flag-early-on.patch b/queue-5.4/usb-roles-set-switch-registered-flag-early-on.patch new file mode 100644 index 0000000000..f7920496d3 --- /dev/null +++ b/queue-5.4/usb-roles-set-switch-registered-flag-early-on.patch @@ -0,0 +1,63 @@ +From 634775a752a86784511018a108f3b530cc3399a7 Mon Sep 17 00:00:00 2001 +From: Elson Roy Serrao +Date: Thu, 6 Feb 2025 11:39:50 -0800 +Subject: usb: roles: set switch registered flag early on + +From: Elson Roy Serrao + +commit 634775a752a86784511018a108f3b530cc3399a7 upstream. + +The role switch registration and set_role() can happen in parallel as they +are invoked independent of each other. There is a possibility that a driver +might spend significant amount of time in usb_role_switch_register() API +due to the presence of time intensive operations like component_add() +which operate under common mutex. This leads to a time window after +allocating the switch and before setting the registered flag where the set +role notifications are dropped. Below timeline summarizes this behavior + +Thread1 | Thread2 +usb_role_switch_register() | + | | + ---> allocate switch | + | | + ---> component_add() | usb_role_switch_set_role() + | | | + | | --> Drop role notifications + | | since sw->registered + | | flag is not set. + | | + --->Set registered flag.| + +To avoid this, set the registered flag early on in the switch register +API. + +Fixes: b787a3e78175 ("usb: roles: don't get/set_role() when usb_role_switch is unregistered") +Cc: stable +Signed-off-by: Elson Roy Serrao +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250206193950.22421-1-quic_eserrao@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/roles/class.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/roles/class.c ++++ b/drivers/usb/roles/class.c +@@ -317,14 +317,15 @@ usb_role_switch_register(struct device * + sw->dev.type = &usb_role_dev_type; + dev_set_name(&sw->dev, "%s-role-switch", dev_name(parent)); + ++ sw->registered = true; ++ + ret = device_register(&sw->dev); + if (ret) { ++ sw->registered = false; + put_device(&sw->dev); + return ERR_PTR(ret); + } + +- sw->registered = true; +- + /* TODO: Symlinks for the host port and the device controller. */ + + return sw; diff --git a/queue-5.4/usb-serial-option-add-meig-smart-slm828.patch b/queue-5.4/usb-serial-option-add-meig-smart-slm828.patch new file mode 100644 index 0000000000..c8667a82f6 --- /dev/null +++ b/queue-5.4/usb-serial-option-add-meig-smart-slm828.patch @@ -0,0 +1,85 @@ +From db79e75460fc59b19f9c89d4b068e61cee59f37d Mon Sep 17 00:00:00 2001 +From: "Chester A. Unal" +Date: Fri, 24 Jan 2025 10:28:00 +0000 +Subject: USB: serial: option: add MeiG Smart SLM828 + +From: Chester A. Unal + +commit db79e75460fc59b19f9c89d4b068e61cee59f37d upstream. + +MeiG Smart SLM828 is an LTE-A CAT6 modem with the mPCIe form factor. The +"Cls=ff(vend.) Sub=10 Prot=02" and "Cls=ff(vend.) Sub=10 Prot=03" +interfaces respond to AT commands. Add these interfaces. + +The product ID the modem uses is shared across multiple modems. Therefore, +add comments to describe which interface is used for which modem. + +T: Bus=01 Lev=01 Prnt=05 Port=01 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2dee ProdID=4d22 Rev=05.04 +S: Manufacturer=MEIG +S: Product=LTE-A Module +S: SerialNumber=4da7ec42 +C: #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=10 Prot=01 Driver=(none) +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=10 Prot=02 Driver=(none) +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=10 Prot=03 Driver=(none) +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=10 Prot=04 Driver=(none) +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=10 Prot=05 Driver=qmi_wwan +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Chester A. Unal +Link: https://lore.kernel.org/20250124-for-johan-meig-slm828-v2-1-6b4cd3f6344f@arinc9.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -621,7 +621,10 @@ static void option_instat_callback(struc + + /* MeiG Smart Technology products */ + #define MEIGSMART_VENDOR_ID 0x2dee +-/* MeiG Smart SRM815/SRM825L based on Qualcomm 315 */ ++/* ++ * MeiG Smart SLM828, SRM815, and SRM825L use the same product ID. SLM828 is ++ * based on Qualcomm SDX12. SRM815 and SRM825L are based on Qualcomm 315. ++ */ + #define MEIGSMART_PRODUCT_SRM825L 0x4d22 + /* MeiG Smart SLM320 based on UNISOC UIS8910 */ + #define MEIGSMART_PRODUCT_SLM320 0x4d41 +@@ -2405,10 +2408,12 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) }, +- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) }, +- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, +- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, +- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) }, /* MeiG Smart SRM815 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0x10, 0x02) }, /* MeiG Smart SLM828 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0x10, 0x03) }, /* MeiG Smart SLM828 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, /* MeiG Smart SRM815 and SRM825L */ ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, /* MeiG Smart SRM825L */ ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, /* MeiG Smart SRM825L */ + { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */ + .driver_info = NCTRL(1) }, + { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff), /* TCL IK512 ECM */ diff --git a/queue-5.4/usb-serial-option-add-telit-cinterion-fn990b-compositions.patch b/queue-5.4/usb-serial-option-add-telit-cinterion-fn990b-compositions.patch new file mode 100644 index 0000000000..e8593441c4 --- /dev/null +++ b/queue-5.4/usb-serial-option-add-telit-cinterion-fn990b-compositions.patch @@ -0,0 +1,208 @@ +From c979fb5ece2dc11cc9cc3d5c66f750e210bfdee2 Mon Sep 17 00:00:00 2001 +From: Fabio Porcedda +Date: Wed, 5 Feb 2025 18:16:45 +0100 +Subject: USB: serial: option: add Telit Cinterion FN990B compositions + +From: Fabio Porcedda + +commit c979fb5ece2dc11cc9cc3d5c66f750e210bfdee2 upstream. + +Add the following Telit Cinterion FN990B40 compositions: + +0x10d0: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 17 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10d0 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN990 +S: SerialNumber=43b38f19 +C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10d1: MBIM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10d1 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN990 +S: SerialNumber=43b38f19 +C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10d2: RNDIS + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 18 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10d2 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN990 +S: SerialNumber=43b38f19 +C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10d3: ECM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 20 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10d3 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN990 +S: SerialNumber=43b38f19 +C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: stable@vger.kernel.org +Signed-off-by: Fabio Porcedda +Reviewed-by: Daniele Palmas +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1406,6 +1406,22 @@ static const struct usb_device_id option + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, ++ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x60) }, /* Telit FN990B (rmnet) */ ++ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x40) }, ++ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x30), ++ .driver_info = NCTRL(5) }, ++ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x60) }, /* Telit FN990B (MBIM) */ ++ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x40) }, ++ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x30), ++ .driver_info = NCTRL(6) }, ++ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x60) }, /* Telit FN990B (RNDIS) */ ++ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x40) }, ++ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x30), ++ .driver_info = NCTRL(6) }, ++ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x60) }, /* Telit FN990B (ECM) */ ++ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x40) }, ++ { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x30), ++ .driver_info = NCTRL(6) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), diff --git a/queue-5.4/usb-serial-option-drop-meig-smart-defines.patch b/queue-5.4/usb-serial-option-drop-meig-smart-defines.patch new file mode 100644 index 0000000000..8dfa9b3bee --- /dev/null +++ b/queue-5.4/usb-serial-option-drop-meig-smart-defines.patch @@ -0,0 +1,74 @@ +From 6aa8a63c471eb6756aabd03f880feffe6a7af6c9 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 11 Feb 2025 15:45:16 +0100 +Subject: USB: serial: option: drop MeiG Smart defines + +From: Johan Hovold + +commit 6aa8a63c471eb6756aabd03f880feffe6a7af6c9 upstream. + +Several MeiG Smart modems apparently use the same product id, making the +defines even less useful. + +Drop them in favour of using comments consistently to make the id table +slightly less unwieldy. + +Cc: stable@vger.kernel.org +Acked-by: Chester A. Unal +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 28 ++++++++-------------------- + 1 file changed, 8 insertions(+), 20 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -619,18 +619,6 @@ static void option_instat_callback(struc + /* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */ + #define LUAT_PRODUCT_AIR720U 0x4e00 + +-/* MeiG Smart Technology products */ +-#define MEIGSMART_VENDOR_ID 0x2dee +-/* +- * MeiG Smart SLM828, SRM815, and SRM825L use the same product ID. SLM828 is +- * based on Qualcomm SDX12. SRM815 and SRM825L are based on Qualcomm 315. +- */ +-#define MEIGSMART_PRODUCT_SRM825L 0x4d22 +-/* MeiG Smart SLM320 based on UNISOC UIS8910 */ +-#define MEIGSMART_PRODUCT_SLM320 0x4d41 +-/* MeiG Smart SLM770A based on ASR1803 */ +-#define MEIGSMART_PRODUCT_SLM770A 0x4d57 +- + /* Device flags */ + + /* Highest interface number which can be used with NCTRL() and RSVD() */ +@@ -2366,6 +2354,14 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a05, 0xff) }, /* Fibocom FM650-CN (NCM mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a06, 0xff) }, /* Fibocom FM650-CN (RNDIS mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a07, 0xff) }, /* Fibocom FM650-CN (MBIM mode) */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d41, 0xff, 0, 0) }, /* MeiG Smart SLM320 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d57, 0xff, 0, 0) }, /* MeiG Smart SLM770A */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0, 0) }, /* MeiG Smart SRM815 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0x10, 0x02) }, /* MeiG Smart SLM828 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0x10, 0x03) }, /* MeiG Smart SLM828 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x30) }, /* MeiG Smart SRM815 and SRM825L */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x40) }, /* MeiG Smart SRM825L */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x60) }, /* MeiG Smart SRM825L */ + { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ +@@ -2422,14 +2418,6 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, +- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, +- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) }, +- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) }, /* MeiG Smart SRM815 */ +- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0x10, 0x02) }, /* MeiG Smart SLM828 */ +- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0x10, 0x03) }, /* MeiG Smart SLM828 */ +- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, /* MeiG Smart SRM815 and SRM825L */ +- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, /* MeiG Smart SRM825L */ +- { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, /* MeiG Smart SRM825L */ + { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */ + .driver_info = NCTRL(1) }, + { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff), /* TCL IK512 ECM */ diff --git a/queue-5.4/usb-serial-option-fix-telit-cinterion-fn990a-name.patch b/queue-5.4/usb-serial-option-fix-telit-cinterion-fn990a-name.patch new file mode 100644 index 0000000000..3ee474d0b8 --- /dev/null +++ b/queue-5.4/usb-serial-option-fix-telit-cinterion-fn990a-name.patch @@ -0,0 +1,43 @@ +From 12606fe73f33647c5e79bf666833bf0b225e649d Mon Sep 17 00:00:00 2001 +From: Fabio Porcedda +Date: Wed, 5 Feb 2025 18:16:47 +0100 +Subject: USB: serial: option: fix Telit Cinterion FN990A name + +From: Fabio Porcedda + +commit 12606fe73f33647c5e79bf666833bf0b225e649d upstream. + +The correct name for FN990 is FN990A so use it in order to avoid +confusion with FN990B. + +Signed-off-by: Fabio Porcedda +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1370,15 +1370,15 @@ static const struct usb_device_id option + .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff), /* Telit LN920 (ECM) */ + .driver_info = NCTRL(0) | RSVD(1) }, +- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1070, 0xff), /* Telit FN990 (rmnet) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1070, 0xff), /* Telit FN990A (rmnet) */ + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, +- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1071, 0xff), /* Telit FN990 (MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1071, 0xff), /* Telit FN990A (MBIM) */ + .driver_info = NCTRL(0) | RSVD(1) }, +- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1072, 0xff), /* Telit FN990 (RNDIS) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1072, 0xff), /* Telit FN990A (RNDIS) */ + .driver_info = NCTRL(2) | RSVD(3) }, +- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990 (ECM) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990A (ECM) */ + .driver_info = NCTRL(0) | RSVD(1) }, +- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990 (PCIe) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990A (PCIe) */ + .driver_info = RSVD(0) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990 (rmnet) */ + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },