From: Greg Kroah-Hartman Date: Sun, 22 Jan 2023 12:35:33 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v4.14.304~40 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ae7c6b4d0f173a0241e70a44752877f0c3ba64e2;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: acpi-prm-check-whether-efi-runtime-is-available.patch comedi-adv_pci1760-fix-pwm-instruction-handling.patch misc-fastrpc-don-t-remove-map-on-creater_process-and-device_release.patch misc-fastrpc-fix-use-after-free-and-race-in-fastrpc_map_find.patch misc-fastrpc-fix-use-after-free-race-condition-for-maps.patch prlimit-do_prlimit-needs-to-have-a-speculation-check.patch revert-serial-stm32-merge-hard-irq-and-threaded-irq-handling-into-single-irq-handler.patch serial-stm32-merge-hard-irq-and-threaded-irq-handling-into-single-irq-handler.patch staging-vchiq_arm-fix-enum-vchiq_status-return-types.patch usb-acpi-add-helper-to-check-port-lpm-capability-using-acpi-_dsm.patch usb-core-hub-disable-autosuspend-for-ti-tusb8041.patch usb-misc-iowarrior-fix-up-header-size-for-usb_device_id_codemercs_iow100.patch usb-misc-onboard_hub-invert-driver-registration-order.patch usb-misc-onboard_hub-move-attach-work-to-the-driver.patch usb-serial-option-add-quectel-ec200u-modem.patch usb-serial-option-add-quectel-em05-g-cs-modem.patch usb-serial-option-add-quectel-em05-g-gr-modem.patch usb-serial-option-add-quectel-em05-g-rs-modem.patch usb-serial-option-add-quectel-em05cn-modem.patch usb-serial-option-add-quectel-em05cn-sg-modem.patch usb-xhci-check-endpoint-is-valid-before-dereferencing-it.patch xhci-add-a-flag-to-disable-usb3-lpm-on-a-xhci-root-port-level.patch xhci-add-update_hub_device-override-for-pci-xhci-hosts.patch xhci-detect-lpm-incapable-xhc-usb3-roothub-ports-from-acpi-tables.patch xhci-fix-null-pointer-dereference-when-host-dies.patch xhci-pci-set-the-dma-max_seg_size.patch --- diff --git a/queue-6.1/acpi-prm-check-whether-efi-runtime-is-available.patch b/queue-6.1/acpi-prm-check-whether-efi-runtime-is-available.patch new file mode 100644 index 00000000000..b19ade493b7 --- /dev/null +++ b/queue-6.1/acpi-prm-check-whether-efi-runtime-is-available.patch @@ -0,0 +1,55 @@ +From 182da6f2b81a78709c58021542fb694f8ed80774 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Thu, 12 Jan 2023 14:33:19 +0100 +Subject: ACPI: PRM: Check whether EFI runtime is available + +From: Ard Biesheuvel + +commit 182da6f2b81a78709c58021542fb694f8ed80774 upstream. + +The ACPI PRM address space handler calls efi_call_virt_pointer() to +execute PRM firmware code, but doing so is only permitted when the EFI +runtime environment is available. Otherwise, such calls are guaranteed +to result in a crash, and must therefore be avoided. + +Given that the EFI runtime services may become unavailable after a crash +occurring in the firmware, we need to check this each time the PRM +address space handler is invoked. If the EFI runtime services were not +available at registration time to being with, don't install the address +space handler at all. + +Fixes: cefc7ca46235 ("ACPI: PRM: implement OperationRegion handler for the PlatformRtMechanism subtype") +Signed-off-by: Ard Biesheuvel +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/prmt.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/acpi/prmt.c ++++ b/drivers/acpi/prmt.c +@@ -236,6 +236,11 @@ static acpi_status acpi_platformrt_space + efi_status_t status; + struct prm_context_buffer context; + ++ if (!efi_enabled(EFI_RUNTIME_SERVICES)) { ++ pr_err_ratelimited("PRM: EFI runtime services no longer available\n"); ++ return AE_NO_HANDLER; ++ } ++ + /* + * The returned acpi_status will always be AE_OK. Error values will be + * saved in the first byte of the PRM message buffer to be used by ASL. +@@ -325,6 +330,11 @@ void __init init_prmt(void) + + pr_info("PRM: found %u modules\n", mc); + ++ if (!efi_enabled(EFI_RUNTIME_SERVICES)) { ++ pr_err("PRM: EFI runtime services unavailable\n"); ++ return; ++ } ++ + status = acpi_install_address_space_handler(ACPI_ROOT_OBJECT, + ACPI_ADR_SPACE_PLATFORM_RT, + &acpi_platformrt_space_handler, diff --git a/queue-6.1/comedi-adv_pci1760-fix-pwm-instruction-handling.patch b/queue-6.1/comedi-adv_pci1760-fix-pwm-instruction-handling.patch new file mode 100644 index 00000000000..b8eb580efde --- /dev/null +++ b/queue-6.1/comedi-adv_pci1760-fix-pwm-instruction-handling.patch @@ -0,0 +1,48 @@ +From 2efb6edd52dc50273f5e68ad863dd1b1fb2f2d1c Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Tue, 3 Jan 2023 14:37:54 +0000 +Subject: comedi: adv_pci1760: Fix PWM instruction handling + +From: Ian Abbott + +commit 2efb6edd52dc50273f5e68ad863dd1b1fb2f2d1c upstream. + +(Actually, this is fixing the "Read the Current Status" command sent to +the device's outgoing mailbox, but it is only currently used for the PWM +instructions.) + +The PCI-1760 is operated mostly by sending commands to a set of Outgoing +Mailbox registers, waiting for the command to complete, and reading the +result from the Incoming Mailbox registers. One of these commands is +the "Read the Current Status" command. The number of this command is +0x07 (see the User's Manual for the PCI-1760 at +. +The `PCI1760_CMD_GET_STATUS` macro defined in the driver should expand +to this command number 0x07, but unfortunately it currently expands to +0x03. (Command number 0x03 is not defined in the User's Manual.) +Correct the definition of the `PCI1760_CMD_GET_STATUS` macro to fix it. + +This is used by all the PWM subdevice related instructions handled by +`pci1760_pwm_insn_config()` which are probably all broken. The effect +of sending the undefined command number 0x03 is not known. + +Fixes: 14b93bb6bbf0 ("staging: comedi: adv_pci_dio: separate out PCI-1760 support") +Cc: # v4.5+ +Signed-off-by: Ian Abbott +Link: https://lore.kernel.org/r/20230103143754.17564-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/comedi/drivers/adv_pci1760.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/comedi/drivers/adv_pci1760.c ++++ b/drivers/comedi/drivers/adv_pci1760.c +@@ -58,7 +58,7 @@ + #define PCI1760_CMD_CLR_IMB2 0x00 /* Clears IMB2 */ + #define PCI1760_CMD_SET_DO 0x01 /* Set output state */ + #define PCI1760_CMD_GET_DO 0x02 /* Read output status */ +-#define PCI1760_CMD_GET_STATUS 0x03 /* Read current status */ ++#define PCI1760_CMD_GET_STATUS 0x07 /* Read current status */ + #define PCI1760_CMD_GET_FW_VER 0x0e /* Read firmware version */ + #define PCI1760_CMD_GET_HW_VER 0x0f /* Read hardware version */ + #define PCI1760_CMD_SET_PWM_HI(x) (0x10 + (x) * 2) /* Set "hi" period */ diff --git a/queue-6.1/misc-fastrpc-don-t-remove-map-on-creater_process-and-device_release.patch b/queue-6.1/misc-fastrpc-don-t-remove-map-on-creater_process-and-device_release.patch new file mode 100644 index 00000000000..f2673e208c4 --- /dev/null +++ b/queue-6.1/misc-fastrpc-don-t-remove-map-on-creater_process-and-device_release.patch @@ -0,0 +1,71 @@ +From 5bb96c8f9268e2fdb0e5321cbc358ee5941efc15 Mon Sep 17 00:00:00 2001 +From: Abel Vesa +Date: Thu, 24 Nov 2022 17:49:40 +0000 +Subject: misc: fastrpc: Don't remove map on creater_process and device_release + +From: Abel Vesa + +commit 5bb96c8f9268e2fdb0e5321cbc358ee5941efc15 upstream. + +Do not remove the map from the list on error path in +fastrpc_init_create_process, instead call fastrpc_map_put, to avoid +use-after-free. Do not remove it on fastrpc_device_release either, +call fastrpc_map_put instead. + +The fastrpc_free_map is the only proper place to remove the map. +This is called only after the reference count is 0. + +Fixes: b49f6d83e290 ("misc: fastrpc: Fix a possible double free") +Cc: stable +Co-developed-by: Ola Jeppsson +Signed-off-by: Ola Jeppsson +Signed-off-by: Abel Vesa +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20221124174941.418450-3-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -316,6 +316,13 @@ static void fastrpc_free_map(struct kref + dma_buf_put(map->buf); + } + ++ if (map->fl) { ++ spin_lock(&map->fl->lock); ++ list_del(&map->node); ++ spin_unlock(&map->fl->lock); ++ map->fl = NULL; ++ } ++ + kfree(map); + } + +@@ -1266,12 +1273,7 @@ err_invoke: + fl->init_mem = NULL; + fastrpc_buf_free(imem); + err_alloc: +- if (map) { +- spin_lock(&fl->lock); +- list_del(&map->node); +- spin_unlock(&fl->lock); +- fastrpc_map_put(map); +- } ++ fastrpc_map_put(map); + err: + kfree(args); + +@@ -1347,10 +1349,8 @@ static int fastrpc_device_release(struct + fastrpc_context_put(ctx); + } + +- list_for_each_entry_safe(map, m, &fl->maps, node) { +- list_del(&map->node); ++ list_for_each_entry_safe(map, m, &fl->maps, node) + fastrpc_map_put(map); +- } + + list_for_each_entry_safe(buf, b, &fl->mmaps, node) { + list_del(&buf->node); diff --git a/queue-6.1/misc-fastrpc-fix-use-after-free-and-race-in-fastrpc_map_find.patch b/queue-6.1/misc-fastrpc-fix-use-after-free-and-race-in-fastrpc_map_find.patch new file mode 100644 index 00000000000..9179f8b6825 --- /dev/null +++ b/queue-6.1/misc-fastrpc-fix-use-after-free-and-race-in-fastrpc_map_find.patch @@ -0,0 +1,101 @@ +From 9446fa1683a7e3937d9970248ced427c1983a1c5 Mon Sep 17 00:00:00 2001 +From: Abel Vesa +Date: Thu, 24 Nov 2022 17:49:39 +0000 +Subject: misc: fastrpc: Fix use-after-free and race in fastrpc_map_find + +From: Abel Vesa + +commit 9446fa1683a7e3937d9970248ced427c1983a1c5 upstream. + +Currently, there is a race window between the point when the mutex is +unlocked in fastrpc_map_lookup and the reference count increasing +(fastrpc_map_get) in fastrpc_map_find, which can also lead to +use-after-free. + +So lets merge fastrpc_map_find into fastrpc_map_lookup which allows us +to both protect the maps list by also taking the &fl->lock spinlock and +the reference count, since the spinlock will be released only after. +Add take_ref argument to make this suitable for all callers. + +Fixes: 8f6c1d8c4f0c ("misc: fastrpc: Add fdlist implementation") +Cc: stable +Co-developed-by: Ola Jeppsson +Signed-off-by: Ola Jeppsson +Signed-off-by: Abel Vesa +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20221124174941.418450-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 41 +++++++++++++++++++++-------------------- + 1 file changed, 21 insertions(+), 20 deletions(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -333,30 +333,31 @@ static void fastrpc_map_get(struct fastr + + + static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd, +- struct fastrpc_map **ppmap) ++ struct fastrpc_map **ppmap, bool take_ref) + { ++ struct fastrpc_session_ctx *sess = fl->sctx; + struct fastrpc_map *map = NULL; ++ int ret = -ENOENT; + +- mutex_lock(&fl->mutex); ++ spin_lock(&fl->lock); + list_for_each_entry(map, &fl->maps, node) { +- if (map->fd == fd) { +- *ppmap = map; +- mutex_unlock(&fl->mutex); +- return 0; +- } +- } +- mutex_unlock(&fl->mutex); +- +- return -ENOENT; +-} ++ if (map->fd != fd) ++ continue; + +-static int fastrpc_map_find(struct fastrpc_user *fl, int fd, +- struct fastrpc_map **ppmap) +-{ +- int ret = fastrpc_map_lookup(fl, fd, ppmap); ++ if (take_ref) { ++ ret = fastrpc_map_get(map); ++ if (ret) { ++ dev_dbg(sess->dev, "%s: Failed to get map fd=%d ret=%d\n", ++ __func__, fd, ret); ++ break; ++ } ++ } + +- if (!ret) +- fastrpc_map_get(*ppmap); ++ *ppmap = map; ++ ret = 0; ++ break; ++ } ++ spin_unlock(&fl->lock); + + return ret; + } +@@ -703,7 +704,7 @@ static int fastrpc_map_create(struct fas + struct fastrpc_map *map = NULL; + int err = 0; + +- if (!fastrpc_map_find(fl, fd, ppmap)) ++ if (!fastrpc_map_lookup(fl, fd, ppmap, true)) + return 0; + + map = kzalloc(sizeof(*map), GFP_KERNEL); +@@ -1026,7 +1027,7 @@ static int fastrpc_put_args(struct fastr + for (i = 0; i < FASTRPC_MAX_FDLIST; i++) { + if (!fdlist[i]) + break; +- if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap)) ++ if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap, false)) + fastrpc_map_put(mmap); + } + diff --git a/queue-6.1/misc-fastrpc-fix-use-after-free-race-condition-for-maps.patch b/queue-6.1/misc-fastrpc-fix-use-after-free-race-condition-for-maps.patch new file mode 100644 index 00000000000..a8b1b039522 --- /dev/null +++ b/queue-6.1/misc-fastrpc-fix-use-after-free-race-condition-for-maps.patch @@ -0,0 +1,61 @@ +From 96b328d119eca7563c1edcc4e1039a62e6370ecb Mon Sep 17 00:00:00 2001 +From: Ola Jeppsson +Date: Thu, 24 Nov 2022 17:49:41 +0000 +Subject: misc: fastrpc: Fix use-after-free race condition for maps + +From: Ola Jeppsson + +commit 96b328d119eca7563c1edcc4e1039a62e6370ecb upstream. + +It is possible that in between calling fastrpc_map_get() until +map->fl->lock is taken in fastrpc_free_map(), another thread can call +fastrpc_map_lookup() and get a reference to a map that is about to be +deleted. + +Rewrite fastrpc_map_get() to only increase the reference count of a map +if it's non-zero. Propagate this to callers so they can know if a map is +about to be deleted. + +Fixes this warning: +refcount_t: addition on 0; use-after-free. +WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate +... +Call trace: + refcount_warn_saturate + [fastrpc_map_get inlined] + [fastrpc_map_lookup inlined] + fastrpc_map_create + fastrpc_internal_invoke + fastrpc_device_ioctl + __arm64_sys_ioctl + invoke_syscall + +Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") +Cc: stable +Signed-off-by: Ola Jeppsson +Signed-off-by: Abel Vesa +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20221124174941.418450-4-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -332,10 +332,12 @@ static void fastrpc_map_put(struct fastr + kref_put(&map->refcount, fastrpc_free_map); + } + +-static void fastrpc_map_get(struct fastrpc_map *map) ++static int fastrpc_map_get(struct fastrpc_map *map) + { +- if (map) +- kref_get(&map->refcount); ++ if (!map) ++ return -ENOENT; ++ ++ return kref_get_unless_zero(&map->refcount) ? 0 : -ENOENT; + } + + diff --git a/queue-6.1/prlimit-do_prlimit-needs-to-have-a-speculation-check.patch b/queue-6.1/prlimit-do_prlimit-needs-to-have-a-speculation-check.patch new file mode 100644 index 00000000000..f72e31746af --- /dev/null +++ b/queue-6.1/prlimit-do_prlimit-needs-to-have-a-speculation-check.patch @@ -0,0 +1,33 @@ +From 739790605705ddcf18f21782b9c99ad7d53a8c11 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Fri, 20 Jan 2023 11:03:20 +0100 +Subject: prlimit: do_prlimit needs to have a speculation check + +From: Greg Kroah-Hartman + +commit 739790605705ddcf18f21782b9c99ad7d53a8c11 upstream. + +do_prlimit() adds the user-controlled resource value to a pointer that +will subsequently be dereferenced. In order to help prevent this +codepath from being used as a spectre "gadget" a barrier needs to be +added after checking the range. + +Reported-by: Jordy Zomer +Tested-by: Jordy Zomer +Suggested-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sys.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/kernel/sys.c ++++ b/kernel/sys.c +@@ -1442,6 +1442,8 @@ static int do_prlimit(struct task_struct + + if (resource >= RLIM_NLIMITS) + return -EINVAL; ++ resource = array_index_nospec(resource, RLIM_NLIMITS); ++ + if (new_rlim) { + if (new_rlim->rlim_cur > new_rlim->rlim_max) + return -EINVAL; diff --git a/queue-6.1/revert-serial-stm32-merge-hard-irq-and-threaded-irq-handling-into-single-irq-handler.patch b/queue-6.1/revert-serial-stm32-merge-hard-irq-and-threaded-irq-handling-into-single-irq-handler.patch new file mode 100644 index 00000000000..bd8029aacda --- /dev/null +++ b/queue-6.1/revert-serial-stm32-merge-hard-irq-and-threaded-irq-handling-into-single-irq-handler.patch @@ -0,0 +1,80 @@ +From 2cbafffbf69addd7509072f4be5917f81d238cf6 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Fri, 20 Jan 2023 11:16:59 +0100 +Subject: Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler" + +From: Greg Kroah-Hartman + +commit 2cbafffbf69addd7509072f4be5917f81d238cf6 upstream. + +This reverts commit f24771b62a83239f0dce816bddf0f6807f436235 as it is +reported to break the build. + +Reported-by: kernel test robot +Link: https://lore.kernel.org/r/202301200130.ttBiTzfO-lkp@intel.com +Fixes: f24771b62a83 ("serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler") +Cc: Sebastian Andrzej Siewior +Cc: Valentin Caron # V3 +Cc: Marek Vasut +Cc: Johan Hovold +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/stm32-usart.c | 31 +++++++++++++++++++++++++++---- + 1 file changed, 27 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -798,9 +798,23 @@ static irqreturn_t stm32_usart_interrupt + spin_unlock(&port->lock); + } + ++ if (stm32_usart_rx_dma_enabled(port)) ++ return IRQ_WAKE_THREAD; ++ else ++ return IRQ_HANDLED; ++} ++ ++static irqreturn_t stm32_usart_threaded_interrupt(int irq, void *ptr) ++{ ++ struct uart_port *port = ptr; ++ struct tty_port *tport = &port->state->port; ++ struct stm32_port *stm32_port = to_stm32_port(port); ++ unsigned int size; ++ unsigned long flags; ++ + /* Receiver timeout irq for DMA RX */ +- if (stm32_usart_rx_dma_enabled(port) && !stm32_port->throttled) { +- spin_lock(&port->lock); ++ if (!stm32_port->throttled) { ++ spin_lock_irqsave(&port->lock, flags); + size = stm32_usart_receive_chars(port, false); + uart_unlock_and_check_sysrq_irqrestore(port, flags); + if (size) +@@ -1002,8 +1016,10 @@ static int stm32_usart_startup(struct ua + u32 val; + int ret; + +- ret = request_irq(port->irq, stm32_usart_interrupt, +- IRQF_NO_SUSPEND, name, port); ++ ret = request_threaded_irq(port->irq, stm32_usart_interrupt, ++ stm32_usart_threaded_interrupt, ++ IRQF_ONESHOT | IRQF_NO_SUSPEND, ++ name, port); + if (ret) + return ret; + +@@ -1586,6 +1602,13 @@ static int stm32_usart_of_dma_rx_probe(s + struct dma_slave_config config; + int ret; + ++ /* ++ * Using DMA and threaded handler for the console could lead to ++ * deadlocks. ++ */ ++ if (uart_console(port)) ++ return -ENODEV; ++ + stm32port->rx_buf = dma_alloc_coherent(dev, RX_BUF_L, + &stm32port->rx_dma_buf, + GFP_KERNEL); diff --git a/queue-6.1/serial-stm32-merge-hard-irq-and-threaded-irq-handling-into-single-irq-handler.patch b/queue-6.1/serial-stm32-merge-hard-irq-and-threaded-irq-handling-into-single-irq-handler.patch new file mode 100644 index 00000000000..12367d181de --- /dev/null +++ b/queue-6.1/serial-stm32-merge-hard-irq-and-threaded-irq-handling-into-single-irq-handler.patch @@ -0,0 +1,84 @@ +From f24771b62a83239f0dce816bddf0f6807f436235 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Thu, 12 Jan 2023 19:04:17 +0100 +Subject: serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler + +From: Marek Vasut + +commit f24771b62a83239f0dce816bddf0f6807f436235 upstream. + +Requesting an interrupt with IRQF_ONESHOT will run the primary handler +in the hard-IRQ context even in the force-threaded mode. The +force-threaded mode is used by PREEMPT_RT in order to avoid acquiring +sleeping locks (spinlock_t) in hard-IRQ context. This combination +makes it impossible and leads to "sleeping while atomic" warnings. + +Use one interrupt handler for both handlers (primary and secondary) +and drop the IRQF_ONESHOT flag which is not needed. + +Fixes: e359b4411c283 ("serial: stm32: fix threaded interrupt handling") +Reviewed-by: Sebastian Andrzej Siewior +Tested-by: Valentin Caron # V3 +Signed-off-by: Marek Vasut +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230112180417.25595-1-marex@denx.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/stm32-usart.c | 31 ++++--------------------------- + 1 file changed, 4 insertions(+), 27 deletions(-) + +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -798,23 +798,9 @@ static irqreturn_t stm32_usart_interrupt + spin_unlock(&port->lock); + } + +- if (stm32_usart_rx_dma_enabled(port)) +- return IRQ_WAKE_THREAD; +- else +- return IRQ_HANDLED; +-} +- +-static irqreturn_t stm32_usart_threaded_interrupt(int irq, void *ptr) +-{ +- struct uart_port *port = ptr; +- struct tty_port *tport = &port->state->port; +- struct stm32_port *stm32_port = to_stm32_port(port); +- unsigned int size; +- unsigned long flags; +- + /* Receiver timeout irq for DMA RX */ +- if (!stm32_port->throttled) { +- spin_lock_irqsave(&port->lock, flags); ++ if (stm32_usart_rx_dma_enabled(port) && !stm32_port->throttled) { ++ spin_lock(&port->lock); + size = stm32_usart_receive_chars(port, false); + uart_unlock_and_check_sysrq_irqrestore(port, flags); + if (size) +@@ -1016,10 +1002,8 @@ static int stm32_usart_startup(struct ua + u32 val; + int ret; + +- ret = request_threaded_irq(port->irq, stm32_usart_interrupt, +- stm32_usart_threaded_interrupt, +- IRQF_ONESHOT | IRQF_NO_SUSPEND, +- name, port); ++ ret = request_irq(port->irq, stm32_usart_interrupt, ++ IRQF_NO_SUSPEND, name, port); + if (ret) + return ret; + +@@ -1602,13 +1586,6 @@ static int stm32_usart_of_dma_rx_probe(s + struct dma_slave_config config; + int ret; + +- /* +- * Using DMA and threaded handler for the console could lead to +- * deadlocks. +- */ +- if (uart_console(port)) +- return -ENODEV; +- + stm32port->rx_buf = dma_alloc_coherent(dev, RX_BUF_L, + &stm32port->rx_dma_buf, + GFP_KERNEL); diff --git a/queue-6.1/series b/queue-6.1/series index 500325e366b..3963c792c12 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -45,3 +45,29 @@ nilfs2-fix-general-protection-fault-in-nilfs_btree_insert.patch mm-shmem-restore-shmem_huge_deny-precedence-over-madv_collapse.patch hugetlb-unshare-some-pmds-when-splitting-vmas.patch mm-khugepaged-fix-collapse_pte_mapped_thp-to-allow-anon_vma.patch +serial-stm32-merge-hard-irq-and-threaded-irq-handling-into-single-irq-handler.patch +revert-serial-stm32-merge-hard-irq-and-threaded-irq-handling-into-single-irq-handler.patch +xhci-pci-set-the-dma-max_seg_size.patch +usb-xhci-check-endpoint-is-valid-before-dereferencing-it.patch +xhci-fix-null-pointer-dereference-when-host-dies.patch +xhci-add-update_hub_device-override-for-pci-xhci-hosts.patch +xhci-add-a-flag-to-disable-usb3-lpm-on-a-xhci-root-port-level.patch +usb-acpi-add-helper-to-check-port-lpm-capability-using-acpi-_dsm.patch +xhci-detect-lpm-incapable-xhc-usb3-roothub-ports-from-acpi-tables.patch +prlimit-do_prlimit-needs-to-have-a-speculation-check.patch +usb-serial-option-add-quectel-em05-g-gr-modem.patch +usb-serial-option-add-quectel-em05-g-cs-modem.patch +usb-serial-option-add-quectel-em05-g-rs-modem.patch +usb-serial-option-add-quectel-ec200u-modem.patch +usb-serial-option-add-quectel-em05cn-sg-modem.patch +usb-serial-option-add-quectel-em05cn-modem.patch +staging-vchiq_arm-fix-enum-vchiq_status-return-types.patch +usb-misc-iowarrior-fix-up-header-size-for-usb_device_id_codemercs_iow100.patch +usb-misc-onboard_hub-invert-driver-registration-order.patch +usb-misc-onboard_hub-move-attach-work-to-the-driver.patch +misc-fastrpc-fix-use-after-free-and-race-in-fastrpc_map_find.patch +misc-fastrpc-don-t-remove-map-on-creater_process-and-device_release.patch +misc-fastrpc-fix-use-after-free-race-condition-for-maps.patch +usb-core-hub-disable-autosuspend-for-ti-tusb8041.patch +comedi-adv_pci1760-fix-pwm-instruction-handling.patch +acpi-prm-check-whether-efi-runtime-is-available.patch diff --git a/queue-6.1/staging-vchiq_arm-fix-enum-vchiq_status-return-types.patch b/queue-6.1/staging-vchiq_arm-fix-enum-vchiq_status-return-types.patch new file mode 100644 index 00000000000..b90da1a52fc --- /dev/null +++ b/queue-6.1/staging-vchiq_arm-fix-enum-vchiq_status-return-types.patch @@ -0,0 +1,56 @@ +From 7d83299351fe7c812c529f5e39fe63b5312e4233 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Tue, 17 Jan 2023 17:39:32 +0100 +Subject: staging: vchiq_arm: fix enum vchiq_status return types + +From: Arnd Bergmann + +commit 7d83299351fe7c812c529f5e39fe63b5312e4233 upstream. + +gcc-13 notices a type mismatch between function declaration +and definition for a few functions that have been converted +from returning vchiq specific status values to regular error +codes: + +drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:662:5: error: conflicting types for 'vchiq_initialise' due to enum/integer mismatch; have 'int(struct vchiq_instance **)' [-Werror=enum-int-mismatch] +drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1411:1: error: conflicting types for 'vchiq_use_internal' due to enum/integer mismatch; have 'int(struct vchiq_state *, struct vchiq_service *, enum USE_TYPE_E)' [-Werror=enum-int-mismatch] +drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1468:1: error: conflicting types for 'vchiq_release_internal' due to enum/integer mismatch; have 'int(struct vchiq_state *, struct vchiq_service *)' [-Werror=enum-int-mismatch] + +Change the declarations to match the actual function definition. + +Fixes: a9fbd828be7f ("staging: vchiq_arm: drop enum vchiq_status from vchiq_*_internal") +Cc: stable +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20230117163957.1109872-1-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/vc04_services/include/linux/raspberrypi/vchiq.h | 2 +- + drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/staging/vc04_services/include/linux/raspberrypi/vchiq.h ++++ b/drivers/staging/vc04_services/include/linux/raspberrypi/vchiq.h +@@ -86,7 +86,7 @@ struct vchiq_service_params_kernel { + + struct vchiq_instance; + +-extern enum vchiq_status vchiq_initialise(struct vchiq_instance **pinstance); ++extern int vchiq_initialise(struct vchiq_instance **pinstance); + extern enum vchiq_status vchiq_shutdown(struct vchiq_instance *instance); + extern enum vchiq_status vchiq_connect(struct vchiq_instance *instance); + extern enum vchiq_status vchiq_open_service(struct vchiq_instance *instance, +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h +@@ -100,10 +100,10 @@ vchiq_dump_platform_use_state(struct vch + extern void + vchiq_dump_service_use_state(struct vchiq_state *state); + +-extern enum vchiq_status ++extern int + vchiq_use_internal(struct vchiq_state *state, struct vchiq_service *service, + enum USE_TYPE_E use_type); +-extern enum vchiq_status ++extern int + vchiq_release_internal(struct vchiq_state *state, + struct vchiq_service *service); + diff --git a/queue-6.1/usb-acpi-add-helper-to-check-port-lpm-capability-using-acpi-_dsm.patch b/queue-6.1/usb-acpi-add-helper-to-check-port-lpm-capability-using-acpi-_dsm.patch new file mode 100644 index 00000000000..5662aa88eb4 --- /dev/null +++ b/queue-6.1/usb-acpi-add-helper-to-check-port-lpm-capability-using-acpi-_dsm.patch @@ -0,0 +1,122 @@ +From cd702d18c882d5a4ea44bbdb38edd5d5577ef640 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Mon, 16 Jan 2023 16:22:15 +0200 +Subject: usb: acpi: add helper to check port lpm capability using acpi _DSM + +From: Mathias Nyman + +commit cd702d18c882d5a4ea44bbdb38edd5d5577ef640 upstream. + +Add a helper to evaluate ACPI usb device specific method (_DSM) provided +in case the USB3 port shouldn't enter U1 and U2 link states. + +This _DSM was added as port specific retimer configuration may lead to +exit latencies growing beyond U1/U2 exit limits, and OS needs a way to +find which ports can't support U1/U2 link power management states. + +This _DSM is also used by windows: +Link: https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/usb-device-specific-method---dsm- + +Some patch issues found in testing resolved by Ron Lee + +Cc: stable@vger.kernel.org +Tested-by: Ron Lee +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20230116142216.1141605-7-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/usb-acpi.c | 65 ++++++++++++++++++++++++++++++++++++++++++++ + include/linux/usb.h | 3 ++ + 2 files changed, 68 insertions(+) + +--- a/drivers/usb/core/usb-acpi.c ++++ b/drivers/usb/core/usb-acpi.c +@@ -37,6 +37,71 @@ bool usb_acpi_power_manageable(struct us + } + EXPORT_SYMBOL_GPL(usb_acpi_power_manageable); + ++#define UUID_USB_CONTROLLER_DSM "ce2ee385-00e6-48cb-9f05-2edb927c4899" ++#define USB_DSM_DISABLE_U1_U2_FOR_PORT 5 ++ ++/** ++ * usb_acpi_port_lpm_incapable - check if lpm should be disabled for a port. ++ * @hdev: USB device belonging to the usb hub ++ * @index: zero based port index ++ * ++ * Some USB3 ports may not support USB3 link power management U1/U2 states ++ * due to different retimer setup. ACPI provides _DSM method which returns 0x01 ++ * if U1 and U2 states should be disabled. Evaluate _DSM with: ++ * Arg0: UUID = ce2ee385-00e6-48cb-9f05-2edb927c4899 ++ * Arg1: Revision ID = 0 ++ * Arg2: Function Index = 5 ++ * Arg3: (empty) ++ * ++ * Return 1 if USB3 port is LPM incapable, negative on error, otherwise 0 ++ */ ++ ++int usb_acpi_port_lpm_incapable(struct usb_device *hdev, int index) ++{ ++ union acpi_object *obj; ++ acpi_handle port_handle; ++ int port1 = index + 1; ++ guid_t guid; ++ int ret; ++ ++ ret = guid_parse(UUID_USB_CONTROLLER_DSM, &guid); ++ if (ret) ++ return ret; ++ ++ port_handle = usb_get_hub_port_acpi_handle(hdev, port1); ++ if (!port_handle) { ++ dev_dbg(&hdev->dev, "port-%d no acpi handle\n", port1); ++ return -ENODEV; ++ } ++ ++ if (!acpi_check_dsm(port_handle, &guid, 0, ++ BIT(USB_DSM_DISABLE_U1_U2_FOR_PORT))) { ++ dev_dbg(&hdev->dev, "port-%d no _DSM function %d\n", ++ port1, USB_DSM_DISABLE_U1_U2_FOR_PORT); ++ return -ENODEV; ++ } ++ ++ obj = acpi_evaluate_dsm(port_handle, &guid, 0, ++ USB_DSM_DISABLE_U1_U2_FOR_PORT, NULL); ++ ++ if (!obj) ++ return -ENODEV; ++ ++ if (obj->type != ACPI_TYPE_INTEGER) { ++ dev_dbg(&hdev->dev, "evaluate port-%d _DSM failed\n", port1); ++ ACPI_FREE(obj); ++ return -EINVAL; ++ } ++ ++ if (obj->integer.value == 0x01) ++ ret = 1; ++ ++ ACPI_FREE(obj); ++ ++ return ret; ++} ++EXPORT_SYMBOL_GPL(usb_acpi_port_lpm_incapable); ++ + /** + * usb_acpi_set_power_state - control usb port's power via acpi power + * resource +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -751,11 +751,14 @@ extern struct device *usb_intf_get_dma_d + extern int usb_acpi_set_power_state(struct usb_device *hdev, int index, + bool enable); + extern bool usb_acpi_power_manageable(struct usb_device *hdev, int index); ++extern int usb_acpi_port_lpm_incapable(struct usb_device *hdev, int index); + #else + static inline int usb_acpi_set_power_state(struct usb_device *hdev, int index, + bool enable) { return 0; } + static inline bool usb_acpi_power_manageable(struct usb_device *hdev, int index) + { return true; } ++static inline int usb_acpi_port_lpm_incapable(struct usb_device *hdev, int index) ++ { return 0; } + #endif + + /* USB autosuspend and autoresume */ diff --git a/queue-6.1/usb-core-hub-disable-autosuspend-for-ti-tusb8041.patch b/queue-6.1/usb-core-hub-disable-autosuspend-for-ti-tusb8041.patch new file mode 100644 index 00000000000..5676dbd6cd9 --- /dev/null +++ b/queue-6.1/usb-core-hub-disable-autosuspend-for-ti-tusb8041.patch @@ -0,0 +1,61 @@ +From 7171b0e261b17de96490adf053b8bb4b00061bcf Mon Sep 17 00:00:00 2001 +From: Flavio Suligoi +Date: Mon, 19 Dec 2022 13:47:59 +0100 +Subject: usb: core: hub: disable autosuspend for TI TUSB8041 + +From: Flavio Suligoi + +commit 7171b0e261b17de96490adf053b8bb4b00061bcf upstream. + +The Texas Instruments TUSB8041 has an autosuspend problem at high +temperature. + +If there is not USB traffic, after a couple of ms, the device enters in +autosuspend mode. In this condition the external clock stops working, to +save energy. When the USB activity turns on, ther hub exits the +autosuspend state, the clock starts running again and all works fine. + +At ambient temperature all works correctly, but at high temperature, +when the USB activity turns on, the external clock doesn't restart and +the hub disappears from the USB bus. + +Disabling the autosuspend mode for this hub solves the issue. + +Signed-off-by: Flavio Suligoi +Cc: stable +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20221219124759.3207032-1-f.suligoi@asem.it +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/hub.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -44,6 +44,9 @@ + #define USB_PRODUCT_USB5534B 0x5534 + #define USB_VENDOR_CYPRESS 0x04b4 + #define USB_PRODUCT_CY7C65632 0x6570 ++#define USB_VENDOR_TEXAS_INSTRUMENTS 0x0451 ++#define USB_PRODUCT_TUSB8041_USB3 0x8140 ++#define USB_PRODUCT_TUSB8041_USB2 0x8142 + #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01 + #define HUB_QUIRK_DISABLE_AUTOSUSPEND 0x02 + +@@ -5798,6 +5801,16 @@ static const struct usb_device_id hub_id + .idVendor = USB_VENDOR_GENESYS_LOGIC, + .bInterfaceClass = USB_CLASS_HUB, + .driver_info = HUB_QUIRK_CHECK_PORT_AUTOSUSPEND}, ++ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR ++ | USB_DEVICE_ID_MATCH_PRODUCT, ++ .idVendor = USB_VENDOR_TEXAS_INSTRUMENTS, ++ .idProduct = USB_PRODUCT_TUSB8041_USB2, ++ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND}, ++ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR ++ | USB_DEVICE_ID_MATCH_PRODUCT, ++ .idVendor = USB_VENDOR_TEXAS_INSTRUMENTS, ++ .idProduct = USB_PRODUCT_TUSB8041_USB3, ++ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND}, + { .match_flags = USB_DEVICE_ID_MATCH_DEV_CLASS, + .bDeviceClass = USB_CLASS_HUB}, + { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS, diff --git a/queue-6.1/usb-misc-iowarrior-fix-up-header-size-for-usb_device_id_codemercs_iow100.patch b/queue-6.1/usb-misc-iowarrior-fix-up-header-size-for-usb_device_id_codemercs_iow100.patch new file mode 100644 index 00000000000..d6e954b4862 --- /dev/null +++ b/queue-6.1/usb-misc-iowarrior-fix-up-header-size-for-usb_device_id_codemercs_iow100.patch @@ -0,0 +1,32 @@ +From 14ff7460bb58662d86aa50298943cc7d25532e28 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Fri, 20 Jan 2023 14:53:30 +0100 +Subject: USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100 + +From: Greg Kroah-Hartman + +commit 14ff7460bb58662d86aa50298943cc7d25532e28 upstream. + +The USB_DEVICE_ID_CODEMERCS_IOW100 header size was incorrect, it should +be 12, not 13. + +Cc: stable +Fixes: 17a82716587e ("USB: iowarrior: fix up report size handling for some devices") +Reported-by: Christoph Jung +Link: https://lore.kernel.org/r/20230120135330.3842518-1-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/misc/iowarrior.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -814,7 +814,7 @@ static int iowarrior_probe(struct usb_in + break; + + case USB_DEVICE_ID_CODEMERCS_IOW100: +- dev->report_size = 13; ++ dev->report_size = 12; + break; + } + } diff --git a/queue-6.1/usb-misc-onboard_hub-invert-driver-registration-order.patch b/queue-6.1/usb-misc-onboard_hub-invert-driver-registration-order.patch new file mode 100644 index 00000000000..432986c520a --- /dev/null +++ b/queue-6.1/usb-misc-onboard_hub-invert-driver-registration-order.patch @@ -0,0 +1,56 @@ +From e5854355d76b8d768cea8e4fc3ce6dfdba25518a Mon Sep 17 00:00:00 2001 +From: Matthias Kaehlcke +Date: Tue, 10 Jan 2023 17:32:52 +0000 +Subject: usb: misc: onboard_hub: Invert driver registration order + +From: Matthias Kaehlcke + +commit e5854355d76b8d768cea8e4fc3ce6dfdba25518a upstream. + +The onboard_hub 'driver' consists of two drivers, a platform +driver and a USB driver. Currently when the onboard hub driver +is initialized it first registers the platform driver, then the +USB driver. This results in a race condition when the 'attach' +work is executed, which is scheduled when the platform device +is probed. The purpose of fhe 'attach' work is to bind elegible +USB hub devices to the onboard_hub USB driver. This fails if +the work runs before the USB driver has been registered. + +Register the USB driver first, then the platform driver. This +increases the chances that the onboard_hub USB devices are probed +before their corresponding platform device, which the USB driver +tries to locate in _probe(). The driver already handles this +situation and defers probing if the onboard hub platform device +doesn't exist yet. + +Cc: stable@vger.kernel.org +Fixes: 8bc063641ceb ("usb: misc: Add onboard_usb_hub driver") +Link: https://lore.kernel.org/lkml/Y6W00vQm3jfLflUJ@hovoldconsulting.com/T/#m0d64295f017942fd988f7c53425db302d61952b4 +Reported-by: Alexander Stein +Signed-off-by: Matthias Kaehlcke +Tested-by: Stefan Wahren +Link: https://lore.kernel.org/r/20230110172954.v2.1.I75494ebee7027a50235ce4b1e930fa73a578fbe2@changeid +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/misc/onboard_usb_hub.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/misc/onboard_usb_hub.c ++++ b/drivers/usb/misc/onboard_usb_hub.c +@@ -431,13 +431,13 @@ static int __init onboard_hub_init(void) + { + int ret; + +- ret = platform_driver_register(&onboard_hub_driver); ++ ret = usb_register_device_driver(&onboard_hub_usbdev_driver, THIS_MODULE); + if (ret) + return ret; + +- ret = usb_register_device_driver(&onboard_hub_usbdev_driver, THIS_MODULE); ++ ret = platform_driver_register(&onboard_hub_driver); + if (ret) +- platform_driver_unregister(&onboard_hub_driver); ++ usb_deregister_device_driver(&onboard_hub_usbdev_driver); + + return ret; + } diff --git a/queue-6.1/usb-misc-onboard_hub-move-attach-work-to-the-driver.patch b/queue-6.1/usb-misc-onboard_hub-move-attach-work-to-the-driver.patch new file mode 100644 index 00000000000..c18d00bc399 --- /dev/null +++ b/queue-6.1/usb-misc-onboard_hub-move-attach-work-to-the-driver.patch @@ -0,0 +1,113 @@ +From cde37881e2e14590675d0acdfbad408300d9ca95 Mon Sep 17 00:00:00 2001 +From: Matthias Kaehlcke +Date: Tue, 10 Jan 2023 17:32:53 +0000 +Subject: usb: misc: onboard_hub: Move 'attach' work to the driver + +From: Matthias Kaehlcke + +commit cde37881e2e14590675d0acdfbad408300d9ca95 upstream. + +Currently each onboard_hub platform device owns an 'attach' work, +which is scheduled when the device probes. With this deadlocks +have been reported on a Raspberry Pi 3 B+ [1], which has nested +onboard hubs. + +The flow of the deadlock is something like this (with the onboard_hub +driver built as a module) [2]: + +- USB root hub is instantiated +- core hub driver calls onboard_hub_create_pdevs(), which creates the + 'raw' platform device for the 1st level hub +- 1st level hub is probed by the core hub driver +- core hub driver calls onboard_hub_create_pdevs(), which creates + the 'raw' platform device for the 2nd level hub + +- onboard_hub platform driver is registered +- platform device for 1st level hub is probed + - schedules 'attach' work +- platform device for 2nd level hub is probed + - schedules 'attach' work + +- onboard_hub USB driver is registered +- device (and parent) lock of hub is held while the device is + re-probed with the onboard_hub driver + +- 'attach' work (running in another thread) calls driver_attach(), which + blocks on one of the hub device locks + +- onboard_hub_destroy_pdevs() is called by the core hub driver when one + of the hubs is detached +- destroying the pdevs invokes onboard_hub_remove(), which waits for the + 'attach' work to complete + - waits forever, since the 'attach' work can't acquire the device lock + +Use a single work struct for the driver instead of having a work struct +per onboard hub platform driver instance. With that it isn't necessary +to cancel the work in onboard_hub_remove(), which fixes the deadlock. +The work is only cancelled when the driver is unloaded. + +[1] https://lore.kernel.org/r/d04bcc45-3471-4417-b30b-5cf9880d785d@i2se.com/ +[2] https://lore.kernel.org/all/Y6OrGbqaMy2iVDWB@google.com/ + +Cc: stable@vger.kernel.org +Fixes: 8bc063641ceb ("usb: misc: Add onboard_usb_hub driver") +Link: https://lore.kernel.org/r/d04bcc45-3471-4417-b30b-5cf9880d785d@i2se.com/ +Link: https://lore.kernel.org/all/Y6OrGbqaMy2iVDWB@google.com/ +Reported-by: Stefan Wahren +Signed-off-by: Matthias Kaehlcke +Link: https://lore.kernel.org/r/20230110172954.v2.2.I16b51f32db0c32f8a8532900bfe1c70c8572881a@changeid +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/misc/onboard_usb_hub.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/usb/misc/onboard_usb_hub.c ++++ b/drivers/usb/misc/onboard_usb_hub.c +@@ -27,7 +27,10 @@ + + #include "onboard_usb_hub.h" + ++static void onboard_hub_attach_usb_driver(struct work_struct *work); ++ + static struct usb_device_driver onboard_hub_usbdev_driver; ++static DECLARE_WORK(attach_usb_driver_work, onboard_hub_attach_usb_driver); + + /************************** Platform driver **************************/ + +@@ -45,7 +48,6 @@ struct onboard_hub { + bool is_powered_on; + bool going_away; + struct list_head udev_list; +- struct work_struct attach_usb_driver_work; + struct mutex lock; + }; + +@@ -271,8 +273,7 @@ static int onboard_hub_probe(struct plat + * This needs to be done deferred to avoid self-deadlocks on systems + * with nested onboard hubs. + */ +- INIT_WORK(&hub->attach_usb_driver_work, onboard_hub_attach_usb_driver); +- schedule_work(&hub->attach_usb_driver_work); ++ schedule_work(&attach_usb_driver_work); + + return 0; + } +@@ -285,9 +286,6 @@ static int onboard_hub_remove(struct pla + + hub->going_away = true; + +- if (&hub->attach_usb_driver_work != current_work()) +- cancel_work_sync(&hub->attach_usb_driver_work); +- + mutex_lock(&hub->lock); + + /* unbind the USB devices to avoid dangling references to this device */ +@@ -447,6 +445,8 @@ static void __exit onboard_hub_exit(void + { + usb_deregister_device_driver(&onboard_hub_usbdev_driver); + platform_driver_unregister(&onboard_hub_driver); ++ ++ cancel_work_sync(&attach_usb_driver_work); + } + module_exit(onboard_hub_exit); + diff --git a/queue-6.1/usb-serial-option-add-quectel-ec200u-modem.patch b/queue-6.1/usb-serial-option-add-quectel-ec200u-modem.patch new file mode 100644 index 00000000000..5df026f5fe9 --- /dev/null +++ b/queue-6.1/usb-serial-option-add-quectel-ec200u-modem.patch @@ -0,0 +1,77 @@ +From d9bbb15881046bd76f8710c76e26a740eee997ef Mon Sep 17 00:00:00 2001 +From: Ali Mirghasemi +Date: Wed, 28 Dec 2022 15:08:47 +0330 +Subject: USB: serial: option: add Quectel EC200U modem + +From: Ali Mirghasemi + +commit d9bbb15881046bd76f8710c76e26a740eee997ef upstream. + +Add support for EC200U modem + +0x0901: EC200U - AT + AP + CP + NMEA + DIAG + MOS + +usb-device output: +T: Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0901 Rev= 3.18 +S: Manufacturer=Android +S: Product=Android +C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=400mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=03(Int.) MxPS= 512 Ivl=4096ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=03(Int.) MxPS= 512 Ivl=4096ms +I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Ali Mirghasemi +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -262,6 +262,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_EM12 0x0512 + #define QUECTEL_PRODUCT_RM500Q 0x0800 + #define QUECTEL_PRODUCT_RM520N 0x0801 ++#define QUECTEL_PRODUCT_EC200U 0x0901 + #define QUECTEL_PRODUCT_EC200S_CN 0x6002 + #define QUECTEL_PRODUCT_EC200T 0x6026 + #define QUECTEL_PRODUCT_RM500K 0x7001 +@@ -1189,6 +1190,7 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) }, diff --git a/queue-6.1/usb-serial-option-add-quectel-em05-g-cs-modem.patch b/queue-6.1/usb-serial-option-add-quectel-em05-g-cs-modem.patch new file mode 100644 index 00000000000..14625202295 --- /dev/null +++ b/queue-6.1/usb-serial-option-add-quectel-em05-g-cs-modem.patch @@ -0,0 +1,108 @@ +From bb78654b0b46316dac687fd4b7dc7cce636f46cd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Duke=20Xin=28=E8=BE=9B=E5=AE=89=E6=96=87=29?= + +Date: Tue, 27 Dec 2022 01:28:25 -0800 +Subject: USB: serial: option: add Quectel EM05-G (CS) modem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Duke Xin(辛安文) + +commit bb78654b0b46316dac687fd4b7dc7cce636f46cd upstream. + +The EM05-G (CS) modem has 2 USB configurations that are configurable via +the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate +with the following interfaces, respectively: + +"RMNET" : AT + DIAG + NMEA + Modem + QMI +"MBIM" : MBIM + AT + DIAG + NMEA + Modem + +The detailed description of the USB configuration for each mode as follows: + +RMNET Mode +-------------- +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=030C Rev= 3.18 +S: Manufacturer=Quectel +S: Product=Quectel EM05-G +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +MBIM Mode +-------------- +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=030C Rev= 3.18 +S: Manufacturer=Quectel +S: Product=Quectel EM05-G +C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Duke Xin(辛安文) +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -255,6 +255,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_EP06 0x0306 + #define QUECTEL_PRODUCT_EM05G 0x030a + #define QUECTEL_PRODUCT_EM060K 0x030b ++#define QUECTEL_PRODUCT_EM05G_CS 0x030c + #define QUECTEL_PRODUCT_EM05G_SG 0x0311 + #define QUECTEL_PRODUCT_EM05G_GR 0x0313 + #define QUECTEL_PRODUCT_EM12 0x0512 +@@ -1164,6 +1165,8 @@ static const struct usb_device_id option + .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff), + .driver_info = RSVD(6) | ZLP }, ++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_CS, 0xff), ++ .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_SG, 0xff), + .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) }, diff --git a/queue-6.1/usb-serial-option-add-quectel-em05-g-gr-modem.patch b/queue-6.1/usb-serial-option-add-quectel-em05-g-gr-modem.patch new file mode 100644 index 00000000000..faa082b5f5b --- /dev/null +++ b/queue-6.1/usb-serial-option-add-quectel-em05-g-gr-modem.patch @@ -0,0 +1,108 @@ +From 6c331f32e32ac71eb3e8b93fceda2802d7ecb889 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Duke=20Xin=28=E8=BE=9B=E5=AE=89=E6=96=87=29?= + +Date: Tue, 27 Dec 2022 01:44:30 -0800 +Subject: USB: serial: option: add Quectel EM05-G (GR) modem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Duke Xin(辛安文) + +commit 6c331f32e32ac71eb3e8b93fceda2802d7ecb889 upstream. + +The EM05-G (GR) modem has 2 USB configurations that are configurable via +the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate +with the following interfaces, respectively: + +"RMNET" : AT + DIAG + NMEA + Modem + QMI +"MBIM" : MBIM + AT + DIAG + NMEA + Modem + +The detailed description of the USB configuration for each mode as follows: + +RMNET Mode +-------------- +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0313 Rev= 3.18 +S: Manufacturer=Quectel +S: Product=Quectel EM05-G +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +MBIM Mode +-------------- +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0313 Rev= 3.18 +S: Manufacturer=Quectel +S: Product=Quectel EM05-G +C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Duke Xin(辛安文) +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -256,6 +256,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_EM05G 0x030a + #define QUECTEL_PRODUCT_EM060K 0x030b + #define QUECTEL_PRODUCT_EM05G_SG 0x0311 ++#define QUECTEL_PRODUCT_EM05G_GR 0x0313 + #define QUECTEL_PRODUCT_EM12 0x0512 + #define QUECTEL_PRODUCT_RM500Q 0x0800 + #define QUECTEL_PRODUCT_RM520N 0x0801 +@@ -1161,6 +1162,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff), + .driver_info = RSVD(6) | ZLP }, ++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff), ++ .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_SG, 0xff), + .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) }, diff --git a/queue-6.1/usb-serial-option-add-quectel-em05-g-rs-modem.patch b/queue-6.1/usb-serial-option-add-quectel-em05-g-rs-modem.patch new file mode 100644 index 00000000000..23697c717f5 --- /dev/null +++ b/queue-6.1/usb-serial-option-add-quectel-em05-g-rs-modem.patch @@ -0,0 +1,108 @@ +From b72d13977689f0c717444010e108c4f20658dfee Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Duke=20Xin=28=E8=BE=9B=E5=AE=89=E6=96=87=29?= + +Date: Tue, 27 Dec 2022 01:51:27 -0800 +Subject: USB: serial: option: add Quectel EM05-G (RS) modem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Duke Xin(辛安文) + +commit b72d13977689f0c717444010e108c4f20658dfee upstream. + +The EM05-G (RS) modem has 2 USB configurations that are configurable via +the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate +with the following interfaces, respectively: + +"RMNET" : AT + DIAG + NMEA + Modem + QMI +"MBIM" : MBIM + AT + DIAG + NMEA + Modem + +The detailed description of the USB configuration for each mode as follows: + +RMNET Mode +-------------- +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0314 Rev= 3.18 +S: Manufacturer=Quectel +S: Product=Quectel EM05-G +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +MBIM Mode +-------------- +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0314 Rev= 3.18 +S: Manufacturer=Quectel +S: Product=Quectel EM05-G +C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Duke Xin(辛安文) +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -258,6 +258,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_EM05G_CS 0x030c + #define QUECTEL_PRODUCT_EM05G_SG 0x0311 + #define QUECTEL_PRODUCT_EM05G_GR 0x0313 ++#define QUECTEL_PRODUCT_EM05G_RS 0x0314 + #define QUECTEL_PRODUCT_EM12 0x0512 + #define QUECTEL_PRODUCT_RM500Q 0x0800 + #define QUECTEL_PRODUCT_RM520N 0x0801 +@@ -1167,6 +1168,8 @@ static const struct usb_device_id option + .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_CS, 0xff), + .driver_info = RSVD(6) | ZLP }, ++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_RS, 0xff), ++ .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_SG, 0xff), + .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) }, diff --git a/queue-6.1/usb-serial-option-add-quectel-em05cn-modem.patch b/queue-6.1/usb-serial-option-add-quectel-em05cn-modem.patch new file mode 100644 index 00000000000..f9ff8766491 --- /dev/null +++ b/queue-6.1/usb-serial-option-add-quectel-em05cn-modem.patch @@ -0,0 +1,108 @@ +From 71dfd381a7c051f16a61f82fbd38a4cca563bdca Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Duke=20Xin=28=E8=BE=9B=E5=AE=89=E6=96=87=29?= + +Date: Sun, 15 Jan 2023 18:33:28 -0800 +Subject: USB: serial: option: add Quectel EM05CN modem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Duke Xin(辛安文) + +commit 71dfd381a7c051f16a61f82fbd38a4cca563bdca upstream. + +The EM05CN modem has 2 USB configurations that are configurable via the AT +command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with +the following interfaces, respectively: + +"MBIM" : AT + MBIM + DIAG + NMEA + MODEM +"RMNET" : AT + DIAG + NMEA + Modem + QMI + +The detailed description of the USB configuration for each mode as follows: + +MBIM Mode +-------------- +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0312 Rev= 3.18 +S: Manufacturer=Quectel +S: Product=Quectel EM05-CN +C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 1 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 2 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +RMNET Mode +-------------- +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0312 Rev= 3.18 +S: Manufacturer=Quectel +S: Product=Quectel EM05-CN +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Duke Xin(辛安文) +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -258,6 +258,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_EM05G_CS 0x030c + #define QUECTEL_PRODUCT_EM05CN_SG 0x0310 + #define QUECTEL_PRODUCT_EM05G_SG 0x0311 ++#define QUECTEL_PRODUCT_EM05CN 0x0312 + #define QUECTEL_PRODUCT_EM05G_GR 0x0313 + #define QUECTEL_PRODUCT_EM05G_RS 0x0314 + #define QUECTEL_PRODUCT_EM12 0x0512 +@@ -1164,6 +1165,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) }, ++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05CN, 0xff), ++ .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05CN_SG, 0xff), + .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff), diff --git a/queue-6.1/usb-serial-option-add-quectel-em05cn-sg-modem.patch b/queue-6.1/usb-serial-option-add-quectel-em05cn-sg-modem.patch new file mode 100644 index 00000000000..1afc9f0e2ef --- /dev/null +++ b/queue-6.1/usb-serial-option-add-quectel-em05cn-sg-modem.patch @@ -0,0 +1,108 @@ +From 1541dd0097c0f8f470e76eddf5120fc55a7e3101 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Duke=20Xin=28=E8=BE=9B=E5=AE=89=E6=96=87=29?= + +Date: Sun, 15 Jan 2023 18:07:27 -0800 +Subject: USB: serial: option: add Quectel EM05CN (SG) modem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Duke Xin(辛安文) + +commit 1541dd0097c0f8f470e76eddf5120fc55a7e3101 upstream. + +The EM05CN (SG) modem has 2 USB configurations that are configurable via the AT +command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with +the following interfaces, respectively: + +"MBIM" : AT + MBIM + DIAG + NMEA + MODEM +"RMNET" : AT + DIAG + NMEA + Modem + QMI + +The detailed description of the USB configuration for each mode as follows: + +MBIM Mode +-------------- +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0310 Rev= 3.18 +S: Manufacturer=Quectel +S: Product=Quectel EM05-CN +C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 1 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 2 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +RMNET Mode +-------------- +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0310 Rev= 3.18 +S: Manufacturer=Quectel +S: Product=Quectel EM05-CN +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Duke Xin(辛安文) +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -256,6 +256,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_EM05G 0x030a + #define QUECTEL_PRODUCT_EM060K 0x030b + #define QUECTEL_PRODUCT_EM05G_CS 0x030c ++#define QUECTEL_PRODUCT_EM05CN_SG 0x0310 + #define QUECTEL_PRODUCT_EM05G_SG 0x0311 + #define QUECTEL_PRODUCT_EM05G_GR 0x0313 + #define QUECTEL_PRODUCT_EM05G_RS 0x0314 +@@ -1163,6 +1164,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) }, ++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05CN_SG, 0xff), ++ .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff), + .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff), diff --git a/queue-6.1/usb-xhci-check-endpoint-is-valid-before-dereferencing-it.patch b/queue-6.1/usb-xhci-check-endpoint-is-valid-before-dereferencing-it.patch new file mode 100644 index 00000000000..99286a3e22e --- /dev/null +++ b/queue-6.1/usb-xhci-check-endpoint-is-valid-before-dereferencing-it.patch @@ -0,0 +1,64 @@ +From e8fb5bc76eb86437ab87002d4a36d6da02165654 Mon Sep 17 00:00:00 2001 +From: Jimmy Hu +Date: Mon, 16 Jan 2023 16:22:11 +0200 +Subject: usb: xhci: Check endpoint is valid before dereferencing it + +From: Jimmy Hu + +commit e8fb5bc76eb86437ab87002d4a36d6da02165654 upstream. + +When the host controller is not responding, all URBs queued to all +endpoints need to be killed. This can cause a kernel panic if we +dereference an invalid endpoint. + +Fix this by using xhci_get_virt_ep() helper to find the endpoint and +checking if the endpoint is valid before dereferencing it. + +[233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead +[233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8 + +[233311.853964] pc : xhci_hc_died+0x10c/0x270 +[233311.853971] lr : xhci_hc_died+0x1ac/0x270 + +[233311.854077] Call trace: +[233311.854085] xhci_hc_died+0x10c/0x270 +[233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4 +[233311.854105] call_timer_fn+0x50/0x2d4 +[233311.854112] expire_timers+0xac/0x2e4 +[233311.854118] run_timer_softirq+0x300/0xabc +[233311.854127] __do_softirq+0x148/0x528 +[233311.854135] irq_exit+0x194/0x1a8 +[233311.854143] __handle_domain_irq+0x164/0x1d0 +[233311.854149] gic_handle_irq.22273+0x10c/0x188 +[233311.854156] el1_irq+0xfc/0x1a8 +[233311.854175] lpm_cpuidle_enter+0x25c/0x418 [msm_pm] +[233311.854185] cpuidle_enter_state+0x1f0/0x764 +[233311.854194] do_idle+0x594/0x6ac +[233311.854201] cpu_startup_entry+0x7c/0x80 +[233311.854209] secondary_start_kernel+0x170/0x198 + +Fixes: 50e8725e7c42 ("xhci: Refactor command watchdog and fix split string.") +Cc: stable@vger.kernel.org +Signed-off-by: Jimmy Hu +Signed-off-by: Mathias Nyman +Message-ID: <0fe978ed-8269-9774-1c40-f8a98c17e838@linux.intel.com> +Link: https://lore.kernel.org/r/20230116142216.1141605-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-ring.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1170,7 +1170,10 @@ static void xhci_kill_endpoint_urbs(stru + struct xhci_virt_ep *ep; + struct xhci_ring *ring; + +- ep = &xhci->devs[slot_id]->eps[ep_index]; ++ ep = xhci_get_virt_ep(xhci, slot_id, ep_index); ++ if (!ep) ++ return; ++ + if ((ep->ep_state & EP_HAS_STREAMS) || + (ep->ep_state & EP_GETTING_NO_STREAMS)) { + int stream_id; diff --git a/queue-6.1/xhci-add-a-flag-to-disable-usb3-lpm-on-a-xhci-root-port-level.patch b/queue-6.1/xhci-add-a-flag-to-disable-usb3-lpm-on-a-xhci-root-port-level.patch new file mode 100644 index 00000000000..404a58627fa --- /dev/null +++ b/queue-6.1/xhci-add-a-flag-to-disable-usb3-lpm-on-a-xhci-root-port-level.patch @@ -0,0 +1,63 @@ +From 0522b9a1653048440da5f21747f21e498b9220d1 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Mon, 16 Jan 2023 16:22:14 +0200 +Subject: xhci: Add a flag to disable USB3 lpm on a xhci root port level. + +From: Mathias Nyman + +commit 0522b9a1653048440da5f21747f21e498b9220d1 upstream. + +One USB3 roothub port may support link power management, while another +root port on the same xHC can't due to different retimers used for +the ports. + +This is the case with Intel Alder Lake, and possible future platforms +where retimers used for USB4 ports cause too long exit latecy to +enable native USB3 lpm U1 and U2 states. + +Add a flag in the xhci port structure to indicate if the port is +lpm_incapable, and check it while calculating exit latency. + +Cc: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20230116142216.1141605-6-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci.c | 8 ++++++++ + drivers/usb/host/xhci.h | 1 + + 2 files changed, 9 insertions(+) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -5049,6 +5049,7 @@ static int xhci_enable_usb3_lpm_timeout( + struct usb_device *udev, enum usb3_link_state state) + { + struct xhci_hcd *xhci; ++ struct xhci_port *port; + u16 hub_encoded_timeout; + int mel; + int ret; +@@ -5065,6 +5066,13 @@ static int xhci_enable_usb3_lpm_timeout( + if (xhci_check_tier_policy(xhci, udev, state) < 0) + return USB3_LPM_DISABLED; + ++ /* If connected to root port then check port can handle lpm */ ++ if (udev->parent && !udev->parent->parent) { ++ port = xhci->usb3_rhub.ports[udev->portnum - 1]; ++ if (port->lpm_incapable) ++ return USB3_LPM_DISABLED; ++ } ++ + hub_encoded_timeout = xhci_calculate_lpm_timeout(hcd, udev, state); + mel = calculate_max_exit_latency(udev, state, hub_encoded_timeout); + if (mel < 0) { +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1735,6 +1735,7 @@ struct xhci_port { + int hcd_portnum; + struct xhci_hub *rhub; + struct xhci_port_cap *port_cap; ++ unsigned int lpm_incapable:1; + }; + + struct xhci_hub { diff --git a/queue-6.1/xhci-add-update_hub_device-override-for-pci-xhci-hosts.patch b/queue-6.1/xhci-add-update_hub_device-override-for-pci-xhci-hosts.patch new file mode 100644 index 00000000000..8c780695611 --- /dev/null +++ b/queue-6.1/xhci-add-update_hub_device-override-for-pci-xhci-hosts.patch @@ -0,0 +1,107 @@ +From 23a3b8d5a2365653fd9bc5a9454d1e7f4facbf85 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Mon, 16 Jan 2023 16:22:13 +0200 +Subject: xhci: Add update_hub_device override for PCI xHCI hosts + +From: Mathias Nyman + +commit 23a3b8d5a2365653fd9bc5a9454d1e7f4facbf85 upstream. + +Allow PCI hosts to check and tune roothub and port settings +before the hub is up and running. + +This override is needed to turn off U1 and U2 LPM for some ports +based on per port ACPI _DSM, _UPC, or possibly vendor specific mmio +values for Intel xHC hosts. + +Usb core calls the host update_hub_device once it creates a hub. + +Entering U1 or U2 link power save state on ports with this limitation +will cause link to fail, turning the usb device unusable in that setup. + +Cc: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20230116142216.1141605-5-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-pci.c | 9 +++++++++ + drivers/usb/host/xhci.c | 5 ++++- + drivers/usb/host/xhci.h | 4 ++++ + 3 files changed, 17 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -78,9 +78,12 @@ static const char hcd_name[] = "xhci_hcd + static struct hc_driver __read_mostly xhci_pci_hc_driver; + + static int xhci_pci_setup(struct usb_hcd *hcd); ++static int xhci_pci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev, ++ struct usb_tt *tt, gfp_t mem_flags); + + static const struct xhci_driver_overrides xhci_pci_overrides __initconst = { + .reset = xhci_pci_setup, ++ .update_hub_device = xhci_pci_update_hub_device, + }; + + /* called after powerup, by probe or system-pm "wakeup" */ +@@ -386,6 +389,12 @@ static int xhci_pci_setup(struct usb_hcd + return xhci_pci_reinit(xhci, pdev); + } + ++static int xhci_pci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev, ++ struct usb_tt *tt, gfp_t mem_flags) ++{ ++ return xhci_update_hub_device(hcd, hdev, tt, mem_flags); ++} ++ + /* + * We need to register our own PCI probe function (instead of the USB core's + * function) in order to create a second roothub under xHCI. +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -5124,7 +5124,7 @@ static int xhci_disable_usb3_lpm_timeout + /* Once a hub descriptor is fetched for a device, we need to update the xHC's + * internal data structures for the device. + */ +-static int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev, ++int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev, + struct usb_tt *tt, gfp_t mem_flags) + { + struct xhci_hcd *xhci = hcd_to_xhci(hcd); +@@ -5224,6 +5224,7 @@ static int xhci_update_hub_device(struct + xhci_free_command(xhci, config_cmd); + return ret; + } ++EXPORT_SYMBOL_GPL(xhci_update_hub_device); + + static int xhci_get_frame(struct usb_hcd *hcd) + { +@@ -5507,6 +5508,8 @@ void xhci_init_driver(struct hc_driver * + drv->check_bandwidth = over->check_bandwidth; + if (over->reset_bandwidth) + drv->reset_bandwidth = over->reset_bandwidth; ++ if (over->update_hub_device) ++ drv->update_hub_device = over->update_hub_device; + } + } + EXPORT_SYMBOL_GPL(xhci_init_driver); +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1943,6 +1943,8 @@ struct xhci_driver_overrides { + struct usb_host_endpoint *ep); + int (*check_bandwidth)(struct usb_hcd *, struct usb_device *); + void (*reset_bandwidth)(struct usb_hcd *, struct usb_device *); ++ int (*update_hub_device)(struct usb_hcd *hcd, struct usb_device *hdev, ++ struct usb_tt *tt, gfp_t mem_flags); + }; + + #define XHCI_CFC_DELAY 10 +@@ -2122,6 +2124,8 @@ int xhci_drop_endpoint(struct usb_hcd *h + struct usb_host_endpoint *ep); + int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev); + void xhci_reset_bandwidth(struct usb_hcd *hcd, struct usb_device *udev); ++int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev, ++ struct usb_tt *tt, gfp_t mem_flags); + int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id); + int xhci_ext_cap_init(struct xhci_hcd *xhci); + diff --git a/queue-6.1/xhci-detect-lpm-incapable-xhc-usb3-roothub-ports-from-acpi-tables.patch b/queue-6.1/xhci-detect-lpm-incapable-xhc-usb3-roothub-ports-from-acpi-tables.patch new file mode 100644 index 00000000000..4a738ebb372 --- /dev/null +++ b/queue-6.1/xhci-detect-lpm-incapable-xhc-usb3-roothub-ports-from-acpi-tables.patch @@ -0,0 +1,81 @@ +From 74622f0a81d0c2bcfc39f9192b788124e8c7f0af Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Mon, 16 Jan 2023 16:22:16 +0200 +Subject: xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables + +From: Mathias Nyman + +commit 74622f0a81d0c2bcfc39f9192b788124e8c7f0af upstream. + +USB3 ports on xHC hosts may have retimers that cause too long +exit latency to work with native USB3 U1/U2 link power management states. + +For now only use usb_acpi_port_lpm_incapable() to evaluate if port lpm +should be disabled while setting up the USB3 roothub. + +Other ways to identify lpm incapable ports can be added here later if +ACPI _DSM does not exist. + +Limit this to Intel hosts for now, this is to my knowledge only +an Intel issue. + +Cc: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20230116142216.1141605-8-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-pci.c | 34 ++++++++++++++++++++++++++++++++++ + 1 file changed, 34 insertions(+) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -355,8 +355,38 @@ static void xhci_pme_acpi_rtd3_enable(st + NULL); + ACPI_FREE(obj); + } ++ ++static void xhci_find_lpm_incapable_ports(struct usb_hcd *hcd, struct usb_device *hdev) ++{ ++ struct xhci_hcd *xhci = hcd_to_xhci(hcd); ++ struct xhci_hub *rhub = &xhci->usb3_rhub; ++ int ret; ++ int i; ++ ++ /* This is not the usb3 roothub we are looking for */ ++ if (hcd != rhub->hcd) ++ return; ++ ++ if (hdev->maxchild > rhub->num_ports) { ++ dev_err(&hdev->dev, "USB3 roothub port number mismatch\n"); ++ return; ++ } ++ ++ for (i = 0; i < hdev->maxchild; i++) { ++ ret = usb_acpi_port_lpm_incapable(hdev, i); ++ ++ dev_dbg(&hdev->dev, "port-%d disable U1/U2 _DSM: %d\n", i + 1, ret); ++ ++ if (ret >= 0) { ++ rhub->ports[i]->lpm_incapable = ret; ++ continue; ++ } ++ } ++} ++ + #else + static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev) { } ++static void xhci_find_lpm_incapable_ports(struct usb_hcd *hcd, struct usb_device *hdev) { } + #endif /* CONFIG_ACPI */ + + /* called during probe() after chip reset completes */ +@@ -392,6 +422,10 @@ static int xhci_pci_setup(struct usb_hcd + static int xhci_pci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev, + struct usb_tt *tt, gfp_t mem_flags) + { ++ /* Check if acpi claims some USB3 roothub ports are lpm incapable */ ++ if (!hdev->parent) ++ xhci_find_lpm_incapable_ports(hcd, hdev); ++ + return xhci_update_hub_device(hcd, hdev, tt, mem_flags); + } + diff --git a/queue-6.1/xhci-fix-null-pointer-dereference-when-host-dies.patch b/queue-6.1/xhci-fix-null-pointer-dereference-when-host-dies.patch new file mode 100644 index 00000000000..fd136d2df84 --- /dev/null +++ b/queue-6.1/xhci-fix-null-pointer-dereference-when-host-dies.patch @@ -0,0 +1,49 @@ +From a2bc47c43e70cf904b1af49f76d572326c08bca7 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Mon, 16 Jan 2023 16:22:12 +0200 +Subject: xhci: Fix null pointer dereference when host dies + +From: Mathias Nyman + +commit a2bc47c43e70cf904b1af49f76d572326c08bca7 upstream. + +Make sure xhci_free_dev() and xhci_kill_endpoint_urbs() do not race +and cause null pointer dereference when host suddenly dies. + +Usb core may call xhci_free_dev() which frees the xhci->devs[slot_id] +virt device at the same time that xhci_kill_endpoint_urbs() tries to +loop through all the device's endpoints, checking if there are any +cancelled urbs left to give back. + +hold the xhci spinlock while freeing the virt device + +Cc: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20230116142216.1141605-4-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3974,6 +3974,7 @@ static void xhci_free_dev(struct usb_hcd + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + struct xhci_virt_device *virt_dev; + struct xhci_slot_ctx *slot_ctx; ++ unsigned long flags; + int i, ret; + + /* +@@ -4000,7 +4001,11 @@ static void xhci_free_dev(struct usb_hcd + virt_dev->eps[i].ep_state &= ~EP_STOP_CMD_PENDING; + virt_dev->udev = NULL; + xhci_disable_slot(xhci, udev->slot_id); ++ ++ spin_lock_irqsave(&xhci->lock, flags); + xhci_free_virt_device(xhci, udev->slot_id); ++ spin_unlock_irqrestore(&xhci->lock, flags); ++ + } + + int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) diff --git a/queue-6.1/xhci-pci-set-the-dma-max_seg_size.patch b/queue-6.1/xhci-pci-set-the-dma-max_seg_size.patch new file mode 100644 index 00000000000..b10582f4325 --- /dev/null +++ b/queue-6.1/xhci-pci-set-the-dma-max_seg_size.patch @@ -0,0 +1,35 @@ +From 93915a4170e9defd56a767a18e6c4076f3d18609 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 16 Jan 2023 16:22:10 +0200 +Subject: xhci-pci: set the dma max_seg_size + +From: Ricardo Ribalda + +commit 93915a4170e9defd56a767a18e6c4076f3d18609 upstream. + +Allow devices to have dma operations beyond 64K, and avoid warnings such +as: + +xhci_hcd 0000:00:14.0: mapping sg segment longer than device claims to support [len=98304] [max=65536] + +Cc: stable@vger.kernel.org +Cc: Takashi Iwai +Signed-off-by: Ricardo Ribalda +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20230116142216.1141605-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -455,6 +455,8 @@ static int xhci_pci_probe(struct pci_dev + if (xhci->quirks & XHCI_DEFAULT_PM_RUNTIME_ALLOW) + pm_runtime_allow(&dev->dev); + ++ dma_set_max_seg_size(&dev->dev, UINT_MAX); ++ + return 0; + + put_usb3_hcd: