From: Greg Kroah-Hartman Date: Sun, 18 Aug 2019 19:10:53 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v4.19.68~44 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9013e338a7ff9f7744c12bef197e4bbf27194ef9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: staging-comedi-dt3000-fix-rounding-up-of-timer-divisor.patch staging-comedi-dt3000-fix-signed-integer-overflow-divider-base.patch usb-cdc-acm-make-sure-a-refcount-is-taken-early-enough.patch usb-cdc-fix-sanity-checks-in-cdc-union-parser.patch usb-core-fix-races-in-character-device-registration-and-deregistraion.patch usb-serial-option-add-d-link-dwm-222-device-id.patch usb-serial-option-add-motorola-modem-uarts.patch usb-serial-option-add-support-for-zte-mf871a.patch usb-serial-option-add-the-broadmobi-bm818-card.patch x86-boot-save-fields-explicitly-zero-out-everything-else.patch --- diff --git a/queue-4.9/series b/queue-4.9/series index 95ef756cafe..415d2e1e656 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -80,4 +80,14 @@ arm64-mm-fix-variable-pud-set-but-not-used.patch ib-core-add-mitigation-for-spectre-v1.patch ib-mad-fix-use-after-free-in-ib-mad-completion-handl.patch ocfs2-remove-set-but-not-used-variable-last_hash.patch +staging-comedi-dt3000-fix-signed-integer-overflow-divider-base.patch +staging-comedi-dt3000-fix-rounding-up-of-timer-divisor.patch +x86-boot-save-fields-explicitly-zero-out-everything-else.patch +usb-core-fix-races-in-character-device-registration-and-deregistraion.patch +usb-cdc-acm-make-sure-a-refcount-is-taken-early-enough.patch +usb-cdc-fix-sanity-checks-in-cdc-union-parser.patch +usb-serial-option-add-d-link-dwm-222-device-id.patch +usb-serial-option-add-support-for-zte-mf871a.patch +usb-serial-option-add-the-broadmobi-bm818-card.patch +usb-serial-option-add-motorola-modem-uarts.patch asm-generic-fix-wtype-limits-compiler-warnings.patch diff --git a/queue-4.9/staging-comedi-dt3000-fix-rounding-up-of-timer-divisor.patch b/queue-4.9/staging-comedi-dt3000-fix-rounding-up-of-timer-divisor.patch new file mode 100644 index 00000000000..e99df64770d --- /dev/null +++ b/queue-4.9/staging-comedi-dt3000-fix-rounding-up-of-timer-divisor.patch @@ -0,0 +1,54 @@ +From 8e2a589a3fc36ce858d42e767c3bcd8fc62a512b Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Mon, 12 Aug 2019 13:08:14 +0100 +Subject: staging: comedi: dt3000: Fix rounding up of timer divisor + +From: Ian Abbott + +commit 8e2a589a3fc36ce858d42e767c3bcd8fc62a512b upstream. + +`dt3k_ns_to_timer()` determines the prescaler and divisor to use to +produce a desired timing period. It is influenced by a rounding mode +and can round the divisor up, down, or to the nearest value. However, +the code for rounding up currently does the same as rounding down! Fix +ir by using the `DIV_ROUND_UP()` macro to calculate the divisor when +rounding up. + +Also, change the types of the `divider`, `base` and `prescale` variables +from `int` to `unsigned int` to avoid mixing signed and unsigned types +in the calculations. + +Also fix a typo in a nearby comment: "improvment" => "improvement". + +Signed-off-by: Ian Abbott +Cc: stable +Link: https://lore.kernel.org/r/20190812120814.21188-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/dt3000.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/staging/comedi/drivers/dt3000.c ++++ b/drivers/staging/comedi/drivers/dt3000.c +@@ -351,9 +351,9 @@ static irqreturn_t dt3k_interrupt(int ir + static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec, + unsigned int flags) + { +- int divider, base, prescale; ++ unsigned int divider, base, prescale; + +- /* This function needs improvment */ ++ /* This function needs improvement */ + /* Don't know if divider==0 works. */ + + for (prescale = 0; prescale < 16; prescale++) { +@@ -367,7 +367,7 @@ static int dt3k_ns_to_timer(unsigned int + divider = (*nanosec) / base; + break; + case CMDF_ROUND_UP: +- divider = (*nanosec) / base; ++ divider = DIV_ROUND_UP(*nanosec, base); + break; + } + if (divider < 65536) { diff --git a/queue-4.9/staging-comedi-dt3000-fix-signed-integer-overflow-divider-base.patch b/queue-4.9/staging-comedi-dt3000-fix-signed-integer-overflow-divider-base.patch new file mode 100644 index 00000000000..230134da3af --- /dev/null +++ b/queue-4.9/staging-comedi-dt3000-fix-signed-integer-overflow-divider-base.patch @@ -0,0 +1,50 @@ +From b4d98bc3fc93ec3a58459948a2c0e0c9b501cd88 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Mon, 12 Aug 2019 12:15:17 +0100 +Subject: staging: comedi: dt3000: Fix signed integer overflow 'divider * base' + +From: Ian Abbott + +commit b4d98bc3fc93ec3a58459948a2c0e0c9b501cd88 upstream. + +In `dt3k_ns_to_timer()` the following lines near the end of the function +result in a signed integer overflow: + + prescale = 15; + base = timer_base * (1 << prescale); + divider = 65535; + *nanosec = divider * base; + +(`divider`, `base` and `prescale` are type `int`, `timer_base` and +`*nanosec` are type `unsigned int`. The value of `timer_base` will be +either 50 or 100.) + +The main reason for the overflow is that the calculation for `base` is +completely wrong. It should be: + + base = timer_base * (prescale + 1); + +which matches an earlier instance of this calculation in the same +function. + +Reported-by: David Binderman +Cc: +Signed-off-by: Ian Abbott +Link: https://lore.kernel.org/r/20190812111517.26803-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/dt3000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/comedi/drivers/dt3000.c ++++ b/drivers/staging/comedi/drivers/dt3000.c +@@ -377,7 +377,7 @@ static int dt3k_ns_to_timer(unsigned int + } + + prescale = 15; +- base = timer_base * (1 << prescale); ++ base = timer_base * (prescale + 1); + divider = 65535; + *nanosec = divider * base; + return (prescale << 16) | (divider); diff --git a/queue-4.9/usb-cdc-acm-make-sure-a-refcount-is-taken-early-enough.patch b/queue-4.9/usb-cdc-acm-make-sure-a-refcount-is-taken-early-enough.patch new file mode 100644 index 00000000000..f31774bcf43 --- /dev/null +++ b/queue-4.9/usb-cdc-acm-make-sure-a-refcount-is-taken-early-enough.patch @@ -0,0 +1,58 @@ +From c52873e5a1ef72f845526d9f6a50704433f9c625 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 8 Aug 2019 16:21:19 +0200 +Subject: usb: cdc-acm: make sure a refcount is taken early enough + +From: Oliver Neukum + +commit c52873e5a1ef72f845526d9f6a50704433f9c625 upstream. + +destroy() will decrement the refcount on the interface, so that +it needs to be taken so early that it never undercounts. + +Fixes: 7fb57a019f94e ("USB: cdc-acm: Fix potential deadlock (lockdep warning)") +Cc: stable +Reported-and-tested-by: syzbot+1b2449b7b5dc240d107a@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20190808142119.7998-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1264,10 +1264,6 @@ made_compressed_probe: + if (acm == NULL) + goto alloc_fail; + +- minor = acm_alloc_minor(acm); +- if (minor < 0) +- goto alloc_fail1; +- + ctrlsize = usb_endpoint_maxp(epctrl); + readsize = usb_endpoint_maxp(epread) * + (quirks == SINGLE_RX_URB ? 1 : 2); +@@ -1275,6 +1271,13 @@ made_compressed_probe: + acm->writesize = usb_endpoint_maxp(epwrite) * 20; + acm->control = control_interface; + acm->data = data_interface; ++ ++ usb_get_intf(acm->control); /* undone in destruct() */ ++ ++ minor = acm_alloc_minor(acm); ++ if (minor < 0) ++ goto alloc_fail1; ++ + acm->minor = minor; + acm->dev = usb_dev; + if (h.usb_cdc_acm_descriptor) +@@ -1420,7 +1423,6 @@ skip_countries: + usb_driver_claim_interface(&acm_driver, data_interface, acm); + usb_set_intfdata(data_interface, acm); + +- usb_get_intf(control_interface); + tty_dev = tty_port_register_device(&acm->port, acm_tty_driver, minor, + &control_interface->dev); + if (IS_ERR(tty_dev)) { diff --git a/queue-4.9/usb-cdc-fix-sanity-checks-in-cdc-union-parser.patch b/queue-4.9/usb-cdc-fix-sanity-checks-in-cdc-union-parser.patch new file mode 100644 index 00000000000..47266502b5f --- /dev/null +++ b/queue-4.9/usb-cdc-fix-sanity-checks-in-cdc-union-parser.patch @@ -0,0 +1,42 @@ +From 54364278fb3cabdea51d6398b07c87415065b3fc Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 13 Aug 2019 11:35:41 +0200 +Subject: USB: CDC: fix sanity checks in CDC union parser + +From: Oliver Neukum + +commit 54364278fb3cabdea51d6398b07c87415065b3fc upstream. + +A few checks checked for the size of the pointer to a structure +instead of the structure itself. Copy & paste issue presumably. + +Fixes: e4c6fb7794982 ("usbnet: move the CDC parser into USB core") +Cc: stable +Reported-by: syzbot+45a53506b65321c1fe91@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20190813093541.18889-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/message.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -2142,14 +2142,14 @@ int cdc_parse_cdc_header(struct usb_cdc_ + (struct usb_cdc_dmm_desc *)buffer; + break; + case USB_CDC_MDLM_TYPE: +- if (elength < sizeof(struct usb_cdc_mdlm_desc *)) ++ if (elength < sizeof(struct usb_cdc_mdlm_desc)) + goto next_desc; + if (desc) + return -EINVAL; + desc = (struct usb_cdc_mdlm_desc *)buffer; + break; + case USB_CDC_MDLM_DETAIL_TYPE: +- if (elength < sizeof(struct usb_cdc_mdlm_detail_desc *)) ++ if (elength < sizeof(struct usb_cdc_mdlm_detail_desc)) + goto next_desc; + if (detail) + return -EINVAL; diff --git a/queue-4.9/usb-core-fix-races-in-character-device-registration-and-deregistraion.patch b/queue-4.9/usb-core-fix-races-in-character-device-registration-and-deregistraion.patch new file mode 100644 index 00000000000..55267864998 --- /dev/null +++ b/queue-4.9/usb-core-fix-races-in-character-device-registration-and-deregistraion.patch @@ -0,0 +1,89 @@ +From 303911cfc5b95d33687d9046133ff184cf5043ff Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 12 Aug 2019 16:11:07 -0400 +Subject: USB: core: Fix races in character device registration and deregistraion + +From: Alan Stern + +commit 303911cfc5b95d33687d9046133ff184cf5043ff upstream. + +The syzbot fuzzer has found two (!) races in the USB character device +registration and deregistration routines. This patch fixes the races. + +The first race results from the fact that usb_deregister_dev() sets +usb_minors[intf->minor] to NULL before calling device_destroy() on the +class device. This leaves a window during which another thread can +allocate the same minor number but will encounter a duplicate name +error when it tries to register its own class device. A typical error +message in the system log would look like: + + sysfs: cannot create duplicate filename '/class/usbmisc/ldusb0' + +The patch fixes this race by destroying the class device first. + +The second race is in usb_register_dev(). When that routine runs, it +first allocates a minor number, then drops minor_rwsem, and then +creates the class device. If the device creation fails, the minor +number is deallocated and the whole routine returns an error. But +during the time while minor_rwsem was dropped, there is a window in +which the minor number is allocated and so another thread can +successfully open the device file. Typically this results in +use-after-free errors or invalid accesses when the other thread closes +its open file reference, because the kernel then tries to release +resources that were already deallocated when usb_register_dev() +failed. The patch fixes this race by keeping minor_rwsem locked +throughout the entire routine. + +Reported-and-tested-by: syzbot+30cf45ebfe0b0c4847a1@syzkaller.appspotmail.com +Signed-off-by: Alan Stern +CC: +Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1908121607590.1659-100000@iolanthe.rowland.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/file.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/usb/core/file.c ++++ b/drivers/usb/core/file.c +@@ -191,9 +191,10 @@ int usb_register_dev(struct usb_interfac + intf->minor = minor; + break; + } +- up_write(&minor_rwsem); +- if (intf->minor < 0) ++ if (intf->minor < 0) { ++ up_write(&minor_rwsem); + return -EXFULL; ++ } + + /* create a usb class device for this usb interface */ + snprintf(name, sizeof(name), class_driver->name, minor - minor_base); +@@ -201,12 +202,11 @@ int usb_register_dev(struct usb_interfac + MKDEV(USB_MAJOR, minor), class_driver, + "%s", kbasename(name)); + if (IS_ERR(intf->usb_dev)) { +- down_write(&minor_rwsem); + usb_minors[minor] = NULL; + intf->minor = -1; +- up_write(&minor_rwsem); + retval = PTR_ERR(intf->usb_dev); + } ++ up_write(&minor_rwsem); + return retval; + } + EXPORT_SYMBOL_GPL(usb_register_dev); +@@ -232,12 +232,12 @@ void usb_deregister_dev(struct usb_inter + return; + + dev_dbg(&intf->dev, "removing %d minor\n", intf->minor); ++ device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor)); + + down_write(&minor_rwsem); + usb_minors[intf->minor] = NULL; + up_write(&minor_rwsem); + +- device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor)); + intf->usb_dev = NULL; + intf->minor = -1; + destroy_usb_class(); diff --git a/queue-4.9/usb-serial-option-add-d-link-dwm-222-device-id.patch b/queue-4.9/usb-serial-option-add-d-link-dwm-222-device-id.patch new file mode 100644 index 00000000000..72272361a44 --- /dev/null +++ b/queue-4.9/usb-serial-option-add-d-link-dwm-222-device-id.patch @@ -0,0 +1,38 @@ +From 552573e42aab5f75aff9bab855a9677979d9a7d5 Mon Sep 17 00:00:00 2001 +From: Rogan Dawes +Date: Wed, 17 Jul 2019 11:11:34 +0200 +Subject: USB: serial: option: add D-Link DWM-222 device ID + +From: Rogan Dawes + +commit 552573e42aab5f75aff9bab855a9677979d9a7d5 upstream. + +Add device id for D-Link DWM-222 A2. + +MI_00 D-Link HS-USB Diagnostics +MI_01 D-Link HS-USB Modem +MI_02 D-Link HS-USB AT Port +MI_03 D-Link HS-USB NMEA +MI_04 D-Link HS-USB WWAN Adapter (qmi_wwan) +MI_05 USB Mass Storage Device + +Cc: stable@vger.kernel.org +Signed-off-by: Rogan Dawes +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1949,6 +1949,8 @@ static const struct usb_device_id option + .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ + .driver_info = RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e3d, 0xff), /* D-Link DWM-222 A2 */ ++ .driver_info = RSVD(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ diff --git a/queue-4.9/usb-serial-option-add-motorola-modem-uarts.patch b/queue-4.9/usb-serial-option-add-motorola-modem-uarts.patch new file mode 100644 index 00000000000..4452f9830ae --- /dev/null +++ b/queue-4.9/usb-serial-option-add-motorola-modem-uarts.patch @@ -0,0 +1,175 @@ +From 6caf0be40a707689e8ff8824fdb96ef77685b1ba Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Thu, 15 Aug 2019 01:26:02 -0700 +Subject: USB: serial: option: Add Motorola modem UARTs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tony Lindgren + +commit 6caf0be40a707689e8ff8824fdb96ef77685b1ba upstream. + +On Motorola Mapphone devices such as Droid 4 there are five USB ports +that do not use the same layout as Gobi 1K/2K/etc devices listed in +qcserial.c. So we should use qcaux.c or option.c as noted by +Dan Williams . + +As the Motorola USB serial ports have an interrupt endpoint as shown +with lsusb -v, we should use option.c instead of qcaux.c as pointed out +by Johan Hovold . + +The ff/ff/ff interfaces seem to always be UARTs on Motorola devices. +For the other interfaces, class 0x0a (CDC Data) should not in general +be added as they are typically part of a multi-interface function as +noted earlier by Bjørn Mork . + +However, looking at the Motorola mapphone kernel code, the mdm6600 0x0a +class is only used for flashing the modem firmware, and there are no +other interfaces. So I've added that too with more details below as it +works just fine. + +The ttyUSB ports on Droid 4 are: + +ttyUSB0 DIAG, CQDM-capable +ttyUSB1 MUX or NMEA, no response +ttyUSB2 MUX or NMEA, no response +ttyUSB3 TCMD +ttyUSB4 AT-capable + +The ttyUSB0 is detected as QCDM capable by ModemManager. I think +it's only used for debugging with ModemManager --debug for sending +custom AT commands though. ModemManager already can manage data +connection using the USB QMI ports that are already handled by the +qmi_wwan.c driver. + +To enable the MUX or NMEA ports, it seems that something needs to be +done additionally to enable them, maybe via the DIAG or TCMD port. +It might be just a NVRAM setting somewhere, but I have no idea what +NVRAM settings may need changing for that. + +The TCMD port seems to be a Motorola custom protocol for testing +the modem and to configure it's NVRAM and seems to work just fine +based on a quick test with a minimal tcmdrw tool I wrote. + +The voice modem AT-capable port seems to provide only partial +support, and no PM support compared to the TS 27.010 based UART +wired directly to the modem. + +The UARTs added with this change are the same product IDs as the +Motorola Mapphone Android Linux kernel mdm6600_id_table. I don't +have any mdm9600 based devices, so I have only tested these on +mdm6600 based droid 4. + +Then for the class 0x0a (CDC Data) mode, the Motorola Mapphone Android +Linux kernel driver moto_flashqsc.c just seems to change the +port->bulk_out_size to 8K from the default. And is only used for +flashing the modem firmware it seems. + +I've verified that flashing the modem with signed firmware works just +fine with the option driver after manually toggling the GPIO pins, so +I've added droid 4 modem flashing mode to the option driver. I've not +added the other devices listed in moto_flashqsc.c in case they really +need different port->bulk_out_size. Those can be added as they get +tested to work for flashing the modem. + +After this patch the output of /sys/kernel/debug/usb/devices has +the following for normal 22b8:2a70 mode including the related qmi_wwan +interfaces: + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=22b8 ProdID=2a70 Rev= 0.00 +S: Manufacturer=Motorola, Incorporated +S: Product=Flash MZ600 +C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=5ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan +E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=5ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan +E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=5ms +E: Ad=8a(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan +E: Ad=8b(I) Atr=03(Int.) MxPS= 64 Ivl=5ms +E: Ad=8c(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=08(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan +E: Ad=8d(I) Atr=03(Int.) MxPS= 64 Ivl=5ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=09(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms + +In 22b8:900e "qc_dload" mode the device shows up as: + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=22b8 ProdID=900e Rev= 0.00 +S: Manufacturer=Motorola, Incorporated +S: Product=Flash MZ600 +C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms + +And in 22b8:4281 "ram_downloader" mode the device shows up as: + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=22b8 ProdID=4281 Rev= 0.00 +S: Manufacturer=Motorola, Incorporated +S: Product=Flash MZ600 +C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=fc Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms + +Cc: Bjørn Mork +Cc: Dan Williams +Cc: Lars Melin +Cc: Marcel Partap +Cc: Merlijn Wajer +Cc: Michael Scott +Cc: NeKit +Cc: Pavel Machek +Cc: Sebastian Reichel +Tested-by: Pavel Machek +Signed-off-by: Tony Lindgren +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -967,6 +967,11 @@ static const struct usb_device_id option + { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7B) }, + { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7C) }, + ++ /* Motorola devices */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x2a70, 0xff, 0xff, 0xff) }, /* mdm6600 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x2e0a, 0xff, 0xff, 0xff) }, /* mdm9600 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x4281, 0x0a, 0x00, 0xfc) }, /* mdm ram dl */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x900e, 0xff, 0xff, 0xff) }, /* mdm qc dl */ + + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, diff --git a/queue-4.9/usb-serial-option-add-support-for-zte-mf871a.patch b/queue-4.9/usb-serial-option-add-support-for-zte-mf871a.patch new file mode 100644 index 00000000000..a37c0afd613 --- /dev/null +++ b/queue-4.9/usb-serial-option-add-support-for-zte-mf871a.patch @@ -0,0 +1,49 @@ +From 7e7ae38bf928c5cfa6dd6e9a2cf8b42c84a27c92 Mon Sep 17 00:00:00 2001 +From: Yoshiaki Okamoto +Date: Sat, 20 Jul 2019 22:23:18 +0900 +Subject: USB: serial: option: Add support for ZTE MF871A + +From: Yoshiaki Okamoto + +commit 7e7ae38bf928c5cfa6dd6e9a2cf8b42c84a27c92 upstream. + +This patch adds support for MF871A USB modem (aka Speed USB STICK U03) +to option driver. This modem is manufactured by ZTE corporation, and +sold by KDDI. + +Interface layout: +0: AT +1: MODEM + +usb-devices output: +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=19d2 ProdID=1481 Rev=52.87 +S: Manufacturer=ZTE,Incorporated +S: Product=ZTE Technologies MSM +S: SerialNumber=1234567890ABCDEF +C: #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option + +Co-developed-by: Hiroyuki Yamamoto +Signed-off-by: Hiroyuki Yamamoto +Signed-off-by: Yoshiaki Okamoto +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1544,6 +1544,7 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */ + .driver_info = RSVD(2) }, + { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */ ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0x00, 0x00) }, /* ZTE MF871A */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) }, diff --git a/queue-4.9/usb-serial-option-add-the-broadmobi-bm818-card.patch b/queue-4.9/usb-serial-option-add-the-broadmobi-bm818-card.patch new file mode 100644 index 00000000000..89cc3e550f2 --- /dev/null +++ b/queue-4.9/usb-serial-option-add-the-broadmobi-bm818-card.patch @@ -0,0 +1,45 @@ +From e5d8badf37e6b547842f2fcde10361b29e08bd36 Mon Sep 17 00:00:00 2001 +From: Bob Ham +Date: Wed, 24 Jul 2019 07:52:26 -0700 +Subject: USB: serial: option: add the BroadMobi BM818 card + +From: Bob Ham + +commit e5d8badf37e6b547842f2fcde10361b29e08bd36 upstream. + +Add a VID:PID for the BroadMobi BM818 M.2 card + +T: Bus=01 Lev=03 Prnt=40 Port=03 Cnt=01 Dev#= 44 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2020 ProdID=2060 Rev=00.00 +S: Manufacturer=Qualcomm, Incorporated +S: Product=Qualcomm CDMA Technologies MSM +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=(none) +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) + +Signed-off-by: Bob Ham +Signed-off-by: Angus Ainslie (Purism) +Cc: stable +[ johan: use USB_DEVICE_INTERFACE_CLASS() ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1957,6 +1957,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ + .driver_info = RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */ ++ .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, diff --git a/queue-4.9/x86-boot-save-fields-explicitly-zero-out-everything-else.patch b/queue-4.9/x86-boot-save-fields-explicitly-zero-out-everything-else.patch new file mode 100644 index 00000000000..d262251d9a6 --- /dev/null +++ b/queue-4.9/x86-boot-save-fields-explicitly-zero-out-everything-else.patch @@ -0,0 +1,105 @@ +From a90118c445cc7f07781de26a9684d4ec58bfcfd1 Mon Sep 17 00:00:00 2001 +From: John Hubbard +Date: Tue, 30 Jul 2019 22:46:27 -0700 +Subject: x86/boot: Save fields explicitly, zero out everything else + +From: John Hubbard + +commit a90118c445cc7f07781de26a9684d4ec58bfcfd1 upstream. + +Recent gcc compilers (gcc 9.1) generate warnings about an out of bounds +memset, if the memset goes accross several fields of a struct. This +generated a couple of warnings on x86_64 builds in sanitize_boot_params(). + +Fix this by explicitly saving the fields in struct boot_params +that are intended to be preserved, and zeroing all the rest. + +[ tglx: Tagged for stable as it breaks the warning free build there as well ] + +Suggested-by: Thomas Gleixner +Suggested-by: H. Peter Anvin +Signed-off-by: John Hubbard +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/20190731054627.5627-2-jhubbard@nvidia.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/bootparam_utils.h | 59 +++++++++++++++++++++++++-------- + 1 file changed, 46 insertions(+), 13 deletions(-) + +--- a/arch/x86/include/asm/bootparam_utils.h ++++ b/arch/x86/include/asm/bootparam_utils.h +@@ -17,6 +17,20 @@ + * Note: efi_info is commonly left uninitialized, but that field has a + * private magic, so it is better to leave it unchanged. + */ ++ ++#define sizeof_mbr(type, member) ({ sizeof(((type *)0)->member); }) ++ ++#define BOOT_PARAM_PRESERVE(struct_member) \ ++ { \ ++ .start = offsetof(struct boot_params, struct_member), \ ++ .len = sizeof_mbr(struct boot_params, struct_member), \ ++ } ++ ++struct boot_params_to_save { ++ unsigned int start; ++ unsigned int len; ++}; ++ + static void sanitize_boot_params(struct boot_params *boot_params) + { + /* +@@ -35,19 +49,38 @@ static void sanitize_boot_params(struct + */ + if (boot_params->sentinel) { + /* fields in boot_params are left uninitialized, clear them */ +- memset(&boot_params->ext_ramdisk_image, 0, +- (char *)&boot_params->efi_info - +- (char *)&boot_params->ext_ramdisk_image); +- memset(&boot_params->kbd_status, 0, +- (char *)&boot_params->hdr - +- (char *)&boot_params->kbd_status); +- memset(&boot_params->_pad7[0], 0, +- (char *)&boot_params->edd_mbr_sig_buffer[0] - +- (char *)&boot_params->_pad7[0]); +- memset(&boot_params->_pad8[0], 0, +- (char *)&boot_params->eddbuf[0] - +- (char *)&boot_params->_pad8[0]); +- memset(&boot_params->_pad9[0], 0, sizeof(boot_params->_pad9)); ++ static struct boot_params scratch; ++ char *bp_base = (char *)boot_params; ++ char *save_base = (char *)&scratch; ++ int i; ++ ++ const struct boot_params_to_save to_save[] = { ++ BOOT_PARAM_PRESERVE(screen_info), ++ BOOT_PARAM_PRESERVE(apm_bios_info), ++ BOOT_PARAM_PRESERVE(tboot_addr), ++ BOOT_PARAM_PRESERVE(ist_info), ++ BOOT_PARAM_PRESERVE(hd0_info), ++ BOOT_PARAM_PRESERVE(hd1_info), ++ BOOT_PARAM_PRESERVE(sys_desc_table), ++ BOOT_PARAM_PRESERVE(olpc_ofw_header), ++ BOOT_PARAM_PRESERVE(efi_info), ++ BOOT_PARAM_PRESERVE(alt_mem_k), ++ BOOT_PARAM_PRESERVE(scratch), ++ BOOT_PARAM_PRESERVE(e820_entries), ++ BOOT_PARAM_PRESERVE(eddbuf_entries), ++ BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries), ++ BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer), ++ BOOT_PARAM_PRESERVE(eddbuf), ++ }; ++ ++ memset(&scratch, 0, sizeof(scratch)); ++ ++ for (i = 0; i < ARRAY_SIZE(to_save); i++) { ++ memcpy(save_base + to_save[i].start, ++ bp_base + to_save[i].start, to_save[i].len); ++ } ++ ++ memcpy(boot_params, save_base, sizeof(*boot_params)); + } + } +