From: Greg Kroah-Hartman Date: Mon, 28 Feb 2022 06:48:58 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v4.9.304~34 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c2b15a6e05e04098c888f39aa513bc0a7d34ece9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: ata-pata_hpt37x-disable-primary-channel-on-hpt371.patch iio-adc-men_z188_adc-fix-a-resource-leak-in-an-error-handling-path.patch revert-usb-serial-ch341-add-new-product-id-for-ch341a.patch tracefs-set-the-group-ownership-in-apply_options-not-parse_options.patch tracing-dump-stacktrace-trigger-to-the-corresponding-instance.patch usb-dwc3-gadget-let-the-interrupt-handler-disable-bottom-halves.patch usb-gadget-rndis-add-spinlock-for-rndis-response-list.patch usb-gadget-validate-endpoint-index-for-xilinx-udc.patch usb-serial-option-add-support-for-dw5829e.patch usb-serial-option-add-telit-le910r1-compositions.patch xhci-prevent-futile-urb-re-submissions-due-to-incorrect-return-value.patch xhci-re-initialize-the-hc-during-resume-if-hce-was-set.patch --- diff --git a/queue-4.14/ata-pata_hpt37x-disable-primary-channel-on-hpt371.patch b/queue-4.14/ata-pata_hpt37x-disable-primary-channel-on-hpt371.patch new file mode 100644 index 00000000000..109471856f7 --- /dev/null +++ b/queue-4.14/ata-pata_hpt37x-disable-primary-channel-on-hpt371.patch @@ -0,0 +1,47 @@ +From 8d093e02e898b24c58788b0289e3202317a96d2a Mon Sep 17 00:00:00 2001 +From: Sergey Shtylyov +Date: Sat, 19 Feb 2022 20:44:43 +0300 +Subject: ata: pata_hpt37x: disable primary channel on HPT371 + +From: Sergey Shtylyov + +commit 8d093e02e898b24c58788b0289e3202317a96d2a upstream. + +The HPT371 chip physically has only one channel, the secondary one, +however the primary channel registers do exist! Thus we have to +manually disable the non-existing channel if the BIOS hasn't done this +already. Similarly to the pata_hpt3x2n driver, always disable the +primary channel. + +Fixes: 669a5db411d8 ("[libata] Add a bunch of PATA drivers.") +Cc: stable@vger.kernel.org +Signed-off-by: Sergey Shtylyov +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/pata_hpt37x.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/ata/pata_hpt37x.c ++++ b/drivers/ata/pata_hpt37x.c +@@ -920,6 +920,20 @@ static int hpt37x_init_one(struct pci_de + pci_write_config_byte(dev, 0x5a, irqmask); + + /* ++ * HPT371 chips physically have only one channel, the secondary one, ++ * but the primary channel registers do exist! Go figure... ++ * So, we manually disable the non-existing channel here ++ * (if the BIOS hasn't done this already). ++ */ ++ if (dev->device == PCI_DEVICE_ID_TTI_HPT371) { ++ u8 mcr1; ++ ++ pci_read_config_byte(dev, 0x50, &mcr1); ++ mcr1 &= ~0x04; ++ pci_write_config_byte(dev, 0x50, mcr1); ++ } ++ ++ /* + * default to pci clock. make sure MA15/16 are set to output + * to prevent drives having problems with 40-pin cables. Needed + * for some drives such as IBM-DTLA which will not enter ready diff --git a/queue-4.14/iio-adc-men_z188_adc-fix-a-resource-leak-in-an-error-handling-path.patch b/queue-4.14/iio-adc-men_z188_adc-fix-a-resource-leak-in-an-error-handling-path.patch new file mode 100644 index 00000000000..511ba1930db --- /dev/null +++ b/queue-4.14/iio-adc-men_z188_adc-fix-a-resource-leak-in-an-error-handling-path.patch @@ -0,0 +1,50 @@ +From e0a2e37f303828d030a83f33ffe14b36cb88d563 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sat, 29 Jan 2022 09:32:47 +0100 +Subject: iio: adc: men_z188_adc: Fix a resource leak in an error handling path + +From: Christophe JAILLET + +commit e0a2e37f303828d030a83f33ffe14b36cb88d563 upstream. + +If iio_device_register() fails, a previous ioremap() is left unbalanced. + +Update the error handling path and add the missing iounmap() call, as +already done in the remove function. + +Fixes: 74aeac4da66f ("iio: adc: Add MEN 16z188 ADC driver") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/320fc777863880247c2aff4a9d1a54ba69abf080.1643445149.git.christophe.jaillet@wanadoo.fr +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/men_z188_adc.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/iio/adc/men_z188_adc.c ++++ b/drivers/iio/adc/men_z188_adc.c +@@ -107,6 +107,7 @@ static int men_z188_probe(struct mcb_dev + struct z188_adc *adc; + struct iio_dev *indio_dev; + struct resource *mem; ++ int ret; + + indio_dev = devm_iio_device_alloc(&dev->dev, sizeof(struct z188_adc)); + if (!indio_dev) +@@ -133,8 +134,14 @@ static int men_z188_probe(struct mcb_dev + adc->mem = mem; + mcb_set_drvdata(dev, indio_dev); + +- return iio_device_register(indio_dev); ++ ret = iio_device_register(indio_dev); ++ if (ret) ++ goto err_unmap; + ++ return 0; ++ ++err_unmap: ++ iounmap(adc->base); + err: + mcb_release_mem(mem); + return -ENXIO; diff --git a/queue-4.14/revert-usb-serial-ch341-add-new-product-id-for-ch341a.patch b/queue-4.14/revert-usb-serial-ch341-add-new-product-id-for-ch341a.patch new file mode 100644 index 00000000000..737957697a7 --- /dev/null +++ b/queue-4.14/revert-usb-serial-ch341-add-new-product-id-for-ch341a.patch @@ -0,0 +1,37 @@ +From 198a7ebd5fa17b4d0be8cb70240ee1be885175c0 Mon Sep 17 00:00:00 2001 +From: Dmytro Bagrii +Date: Thu, 10 Feb 2022 18:41:37 +0200 +Subject: Revert "USB: serial: ch341: add new Product ID for CH341A" + +From: Dmytro Bagrii + +commit 198a7ebd5fa17b4d0be8cb70240ee1be885175c0 upstream. + +This reverts commit 46ee4abb10a07bd8f8ce910ee6b4ae6a947d7f63. + +CH341 has Product ID 0x5512 in EPP/MEM mode which is used for +I2C/SPI/GPIO interfaces. In asynchronous serial interface mode +CH341 has PID 0x5523 which is already in the table. + +Mode is selected by corresponding jumper setting. + +Signed-off-by: Dmytro Bagrii +Link: https://lore.kernel.org/r/20220210164137.4376-1-dimich.dmb@gmail.com +Link: https://lore.kernel.org/r/YJ0OCS/sh+1ifD/q@hovoldconsulting.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/ch341.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -83,7 +83,6 @@ + #define CH341_LCR_CS5 0x00 + + static const struct usb_device_id id_table[] = { +- { USB_DEVICE(0x1a86, 0x5512) }, + { USB_DEVICE(0x1a86, 0x5523) }, + { USB_DEVICE(0x1a86, 0x7522) }, + { USB_DEVICE(0x1a86, 0x7523) }, diff --git a/queue-4.14/series b/queue-4.14/series index c06f8f20250..ec75b3e3b35 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -13,3 +13,15 @@ drm-edid-always-set-rgb444.patch net-mlx5e-fix-wrong-return-value-on-ioctl-eeprom-query-failure.patch configfs-fix-a-race-in-configfs_-un-register_subsyst.patch rdma-ib_srp-fix-a-deadlock.patch +tracing-dump-stacktrace-trigger-to-the-corresponding-instance.patch +iio-adc-men_z188_adc-fix-a-resource-leak-in-an-error-handling-path.patch +ata-pata_hpt37x-disable-primary-channel-on-hpt371.patch +revert-usb-serial-ch341-add-new-product-id-for-ch341a.patch +usb-gadget-rndis-add-spinlock-for-rndis-response-list.patch +usb-gadget-validate-endpoint-index-for-xilinx-udc.patch +tracefs-set-the-group-ownership-in-apply_options-not-parse_options.patch +usb-serial-option-add-support-for-dw5829e.patch +usb-serial-option-add-telit-le910r1-compositions.patch +usb-dwc3-gadget-let-the-interrupt-handler-disable-bottom-halves.patch +xhci-re-initialize-the-hc-during-resume-if-hce-was-set.patch +xhci-prevent-futile-urb-re-submissions-due-to-incorrect-return-value.patch diff --git a/queue-4.14/tracefs-set-the-group-ownership-in-apply_options-not-parse_options.patch b/queue-4.14/tracefs-set-the-group-ownership-in-apply_options-not-parse_options.patch new file mode 100644 index 00000000000..713eeae3eb0 --- /dev/null +++ b/queue-4.14/tracefs-set-the-group-ownership-in-apply_options-not-parse_options.patch @@ -0,0 +1,50 @@ +From 851e99ebeec3f4a672bb5010cf1ece095acee447 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Fri, 25 Feb 2022 15:34:26 -0500 +Subject: tracefs: Set the group ownership in apply_options() not parse_options() + +From: Steven Rostedt (Google) + +commit 851e99ebeec3f4a672bb5010cf1ece095acee447 upstream. + +Al Viro brought it to my attention that the dentries may not be filled +when the parse_options() is called, causing the call to set_gid() to +possibly crash. It should only be called if parse_options() succeeds +totally anyway. + +He suggested the logical place to do the update is in apply_options(). + +Link: https://lore.kernel.org/all/20220225165219.737025658@goodmis.org/ +Link: https://lkml.kernel.org/r/20220225153426.1c4cab6b@gandalf.local.home + +Cc: stable@vger.kernel.org +Acked-by: Al Viro +Reported-by: Al Viro +Fixes: 48b27b6b5191 ("tracefs: Set all files to the same group ownership as the mount option") +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + fs/tracefs/inode.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/tracefs/inode.c ++++ b/fs/tracefs/inode.c +@@ -265,7 +265,6 @@ static int tracefs_parse_options(char *d + if (!gid_valid(gid)) + return -EINVAL; + opts->gid = gid; +- set_gid(tracefs_mount->mnt_root, gid); + break; + case Opt_mode: + if (match_octal(&args[0], &option)) +@@ -292,7 +291,9 @@ static int tracefs_apply_options(struct + inode->i_mode |= opts->mode; + + inode->i_uid = opts->uid; +- inode->i_gid = opts->gid; ++ ++ /* Set all the group ids to the mount option */ ++ set_gid(sb->s_root, opts->gid); + + return 0; + } diff --git a/queue-4.14/tracing-dump-stacktrace-trigger-to-the-corresponding-instance.patch b/queue-4.14/tracing-dump-stacktrace-trigger-to-the-corresponding-instance.patch new file mode 100644 index 00000000000..f5e1ddfbe60 --- /dev/null +++ b/queue-4.14/tracing-dump-stacktrace-trigger-to-the-corresponding-instance.patch @@ -0,0 +1,45 @@ +From ce33c845b030c9cf768370c951bc699470b09fa7 Mon Sep 17 00:00:00 2001 +From: Daniel Bristot de Oliveira +Date: Sun, 20 Feb 2022 23:49:57 +0100 +Subject: tracing: Dump stacktrace trigger to the corresponding instance + +From: Daniel Bristot de Oliveira + +commit ce33c845b030c9cf768370c951bc699470b09fa7 upstream. + +The stacktrace event trigger is not dumping the stacktrace to the instance +where it was enabled, but to the global "instance." + +Use the private_data, pointing to the trigger file, to figure out the +corresponding trace instance, and use it in the trigger action, like +snapshot_trigger does. + +Link: https://lkml.kernel.org/r/afbb0b4f18ba92c276865bc97204d438473f4ebc.1645396236.git.bristot@kernel.org + +Cc: stable@vger.kernel.org +Fixes: ae63b31e4d0e2 ("tracing: Separate out trace events from global variables") +Reviewed-by: Tom Zanussi +Tested-by: Tom Zanussi +Signed-off-by: Daniel Bristot de Oliveira +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events_trigger.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/kernel/trace/trace_events_trigger.c ++++ b/kernel/trace/trace_events_trigger.c +@@ -1156,7 +1156,12 @@ static __init int register_trigger_snaps + static void + stacktrace_trigger(struct event_trigger_data *data, void *rec) + { +- trace_dump_stack(STACK_SKIP); ++ struct trace_event_file *file = data->private_data; ++ ++ if (file) ++ __trace_stack(file->tr, tracing_gen_ctx(), STACK_SKIP); ++ else ++ trace_dump_stack(STACK_SKIP); + } + + static void diff --git a/queue-4.14/usb-dwc3-gadget-let-the-interrupt-handler-disable-bottom-halves.patch b/queue-4.14/usb-dwc3-gadget-let-the-interrupt-handler-disable-bottom-halves.patch new file mode 100644 index 00000000000..f0816e6fa87 --- /dev/null +++ b/queue-4.14/usb-dwc3-gadget-let-the-interrupt-handler-disable-bottom-halves.patch @@ -0,0 +1,57 @@ +From 84918a89d6efaff075de570b55642b6f4ceeac6d Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior +Date: Fri, 18 Feb 2022 18:32:45 +0100 +Subject: usb: dwc3: gadget: Let the interrupt handler disable bottom halves. + +From: Sebastian Andrzej Siewior + +commit 84918a89d6efaff075de570b55642b6f4ceeac6d upstream. + +The interrupt service routine registered for the gadget is a primary +handler which mask the interrupt source and a threaded handler which +handles the source of the interrupt. Since the threaded handler is +voluntary threaded, the IRQ-core does not disable bottom halves before +invoke the handler like it does for the forced-threaded handler. + +Due to changes in networking it became visible that a network gadget's +completions handler may schedule a softirq which remains unprocessed. +The gadget's completion handler is usually invoked either in hard-IRQ or +soft-IRQ context. In this context it is enough to just raise the softirq +because the softirq itself will be handled once that context is left. +In the case of the voluntary threaded handler, there is nothing that +will process pending softirqs. Which means it remain queued until +another random interrupt (on this CPU) fires and handles it on its exit +path or another thread locks and unlocks a lock with the bh suffix. +Worst case is that the CPU goes idle and the NOHZ complains about +unhandled softirqs. + +Disable bottom halves before acquiring the lock (and disabling +interrupts) and enable them after dropping the lock. This ensures that +any pending softirqs will handled right away. + +Link: https://lkml.kernel.org/r/c2a64979-73d1-2c22-e048-c275c9f81558@samsung.com +Fixes: e5f68b4a3e7b0 ("Revert "usb: dwc3: gadget: remove unnecessary _irqsave()"") +Cc: stable +Reported-by: Marek Szyprowski +Tested-by: Marek Szyprowski +Signed-off-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/Yg/YPejVQH3KkRVd@linutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3153,9 +3153,11 @@ static irqreturn_t dwc3_thread_interrupt + unsigned long flags; + irqreturn_t ret = IRQ_NONE; + ++ local_bh_disable(); + spin_lock_irqsave(&dwc->lock, flags); + ret = dwc3_process_event_buf(evt); + spin_unlock_irqrestore(&dwc->lock, flags); ++ local_bh_enable(); + + return ret; + } diff --git a/queue-4.14/usb-gadget-rndis-add-spinlock-for-rndis-response-list.patch b/queue-4.14/usb-gadget-rndis-add-spinlock-for-rndis-response-list.patch new file mode 100644 index 00000000000..c00bb2a8e6c --- /dev/null +++ b/queue-4.14/usb-gadget-rndis-add-spinlock-for-rndis-response-list.patch @@ -0,0 +1,103 @@ +From aaaba1c86d04dac8e49bf508b492f81506257da3 Mon Sep 17 00:00:00 2001 +From: Daehwan Jung +Date: Tue, 22 Feb 2022 14:29:28 +0900 +Subject: usb: gadget: rndis: add spinlock for rndis response list + +From: Daehwan Jung + +commit aaaba1c86d04dac8e49bf508b492f81506257da3 upstream. + +There's no lock for rndis response list. It could cause list corruption +if there're two different list_add at the same time like below. +It's better to add in rndis_add_response / rndis_free_response +/ rndis_get_next_response to prevent any race condition on response list. + +[ 361.894299] [1: irq/191-dwc3:16979] list_add corruption. +next->prev should be prev (ffffff80651764d0), +but was ffffff883dc36f80. (next=ffffff80651764d0). + +[ 361.904380] [1: irq/191-dwc3:16979] Call trace: +[ 361.904391] [1: irq/191-dwc3:16979] __list_add_valid+0x74/0x90 +[ 361.904401] [1: irq/191-dwc3:16979] rndis_msg_parser+0x168/0x8c0 +[ 361.904409] [1: irq/191-dwc3:16979] rndis_command_complete+0x24/0x84 +[ 361.904417] [1: irq/191-dwc3:16979] usb_gadget_giveback_request+0x20/0xe4 +[ 361.904426] [1: irq/191-dwc3:16979] dwc3_gadget_giveback+0x44/0x60 +[ 361.904434] [1: irq/191-dwc3:16979] dwc3_ep0_complete_data+0x1e8/0x3a0 +[ 361.904442] [1: irq/191-dwc3:16979] dwc3_ep0_interrupt+0x29c/0x3dc +[ 361.904450] [1: irq/191-dwc3:16979] dwc3_process_event_entry+0x78/0x6cc +[ 361.904457] [1: irq/191-dwc3:16979] dwc3_process_event_buf+0xa0/0x1ec +[ 361.904465] [1: irq/191-dwc3:16979] dwc3_thread_interrupt+0x34/0x5c + +Fixes: f6281af9d62e ("usb: gadget: rndis: use list_for_each_entry_safe") +Cc: stable +Signed-off-by: Daehwan Jung +Link: https://lore.kernel.org/r/1645507768-77687-1-git-send-email-dh10.jung@samsung.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/rndis.c | 8 ++++++++ + drivers/usb/gadget/function/rndis.h | 1 + + 2 files changed, 9 insertions(+) + +--- a/drivers/usb/gadget/function/rndis.c ++++ b/drivers/usb/gadget/function/rndis.c +@@ -922,6 +922,7 @@ struct rndis_params *rndis_register(void + params->resp_avail = resp_avail; + params->v = v; + INIT_LIST_HEAD(¶ms->resp_queue); ++ spin_lock_init(¶ms->resp_lock); + pr_debug("%s: configNr = %d\n", __func__, i); + + return params; +@@ -1015,12 +1016,14 @@ void rndis_free_response(struct rndis_pa + { + rndis_resp_t *r, *n; + ++ spin_lock(¶ms->resp_lock); + list_for_each_entry_safe(r, n, ¶ms->resp_queue, list) { + if (r->buf == buf) { + list_del(&r->list); + kfree(r); + } + } ++ spin_unlock(¶ms->resp_lock); + } + EXPORT_SYMBOL_GPL(rndis_free_response); + +@@ -1030,14 +1033,17 @@ u8 *rndis_get_next_response(struct rndis + + if (!length) return NULL; + ++ spin_lock(¶ms->resp_lock); + list_for_each_entry_safe(r, n, ¶ms->resp_queue, list) { + if (!r->send) { + r->send = 1; + *length = r->length; ++ spin_unlock(¶ms->resp_lock); + return r->buf; + } + } + ++ spin_unlock(¶ms->resp_lock); + return NULL; + } + EXPORT_SYMBOL_GPL(rndis_get_next_response); +@@ -1054,7 +1060,9 @@ static rndis_resp_t *rndis_add_response( + r->length = length; + r->send = 0; + ++ spin_lock(¶ms->resp_lock); + list_add_tail(&r->list, ¶ms->resp_queue); ++ spin_unlock(¶ms->resp_lock); + return r; + } + +--- a/drivers/usb/gadget/function/rndis.h ++++ b/drivers/usb/gadget/function/rndis.h +@@ -177,6 +177,7 @@ typedef struct rndis_params { + void (*resp_avail)(void *v); + void *v; + struct list_head resp_queue; ++ spinlock_t resp_lock; + } rndis_params; + + /* RNDIS Message parser and other useless functions */ diff --git a/queue-4.14/usb-gadget-validate-endpoint-index-for-xilinx-udc.patch b/queue-4.14/usb-gadget-validate-endpoint-index-for-xilinx-udc.patch new file mode 100644 index 00000000000..6e4aa490ce8 --- /dev/null +++ b/queue-4.14/usb-gadget-validate-endpoint-index-for-xilinx-udc.patch @@ -0,0 +1,41 @@ +From 7f14c7227f342d9932f9b918893c8814f86d2a0d Mon Sep 17 00:00:00 2001 +From: Szymon Heidrich +Date: Mon, 21 Feb 2022 13:24:56 +0100 +Subject: USB: gadget: validate endpoint index for xilinx udc + +From: Szymon Heidrich + +commit 7f14c7227f342d9932f9b918893c8814f86d2a0d upstream. + +Assure that host may not manipulate the index to point +past endpoint array. + +Signed-off-by: Szymon Heidrich +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/udc-xilinx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/gadget/udc/udc-xilinx.c ++++ b/drivers/usb/gadget/udc/udc-xilinx.c +@@ -1620,6 +1620,8 @@ static void xudc_getstatus(struct xusb_u + break; + case USB_RECIP_ENDPOINT: + epnum = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK; ++ if (epnum >= XUSB_MAX_ENDPOINTS) ++ goto stall; + target_ep = &udc->ep[epnum]; + epcfgreg = udc->read_fn(udc->addr + target_ep->offset); + halt = epcfgreg & XUSB_EP_CFG_STALL_MASK; +@@ -1687,6 +1689,10 @@ static void xudc_set_clear_feature(struc + case USB_RECIP_ENDPOINT: + if (!udc->setup.wValue) { + endpoint = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK; ++ if (endpoint >= XUSB_MAX_ENDPOINTS) { ++ xudc_ep0_stall(udc); ++ return; ++ } + target_ep = &udc->ep[endpoint]; + outinbit = udc->setup.wIndex & USB_ENDPOINT_DIR_MASK; + outinbit = outinbit >> 7; diff --git a/queue-4.14/usb-serial-option-add-support-for-dw5829e.patch b/queue-4.14/usb-serial-option-add-support-for-dw5829e.patch new file mode 100644 index 00000000000..79654b11c19 --- /dev/null +++ b/queue-4.14/usb-serial-option-add-support-for-dw5829e.patch @@ -0,0 +1,114 @@ +From 6ecb3f0b18b320320460a42e40d6fb603f6ded96 Mon Sep 17 00:00:00 2001 +From: Slark Xiao +Date: Mon, 14 Feb 2022 10:14:01 +0800 +Subject: USB: serial: option: add support for DW5829e + +From: Slark Xiao + +commit 6ecb3f0b18b320320460a42e40d6fb603f6ded96 upstream. + +Dell DW5829e same as DW5821e except CAT level. +DW5821e supports CAT16 but DW5829e supports CAT9. +There are 2 types product of DW5829e: normal and eSIM. +So we will add 2 PID for DW5829e. +And for each PID, it support MBIM or RMNET. +Let's see test evidence as below: + +DW5829e MBIM mode: +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 +D: Ver= 3.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 2 +P: Vendor=413c ProdID=81e6 Rev=03.18 +S: Manufacturer=Dell Inc. +S: Product=DW5829e Snapdragon X20 LTE +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 7 Cfg#= 2 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#=0x6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) + +DW5829e RMNET mode: +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 5 Spd=5000 MxCh= 0 +D: Ver= 3.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=413c ProdID=81e6 Rev=03.18 +S: Manufacturer=Dell Inc. +S: Product=DW5829e Snapdragon X20 LTE +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +I: If#=0x1 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=00 Prot=00 Driver=usbhid +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option + +DW5829e-eSIM MBIM mode: +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 6 Spd=5000 MxCh= 0 +D: Ver= 3.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 2 +P: Vendor=413c ProdID=81e4 Rev=03.18 +S: Manufacturer=Dell Inc. +S: Product=DW5829e-eSIM Snapdragon X20 LTE +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 7 Cfg#= 2 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#=0x6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) + +DW5829e-eSIM RMNET mode: +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 7 Spd=5000 MxCh= 0 +D: Ver= 3.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=413c ProdID=81e4 Rev=03.18 +S: Manufacturer=Dell Inc. +S: Product=DW5829e-eSIM Snapdragon X20 LTE +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +I: If#=0x1 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=00 Prot=00 Driver=usbhid +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option + +BTW, the interface 0x6 of MBIM mode is GNSS port, which not same as NMEA +port. So it's banned from serial option driver. +The remaining interfaces 0x2-0x5 are: MODEM, MODEM, NMEA, DIAG. + +Signed-off-by: Slark Xiao +Link: https://lore.kernel.org/r/20220214021401.6264-1-slark_xiao@163.com +[ johan: drop unnecessary reservation of interface 1 ] +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -201,6 +201,8 @@ static void option_instat_callback(struc + + #define DELL_PRODUCT_5821E 0x81d7 + #define DELL_PRODUCT_5821E_ESIM 0x81e0 ++#define DELL_PRODUCT_5829E_ESIM 0x81e4 ++#define DELL_PRODUCT_5829E 0x81e6 + + #define KYOCERA_VENDOR_ID 0x0c88 + #define KYOCERA_PRODUCT_KPC650 0x17da +@@ -1066,6 +1068,10 @@ static const struct usb_device_id option + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, + { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5821E_ESIM), + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, ++ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5829E), ++ .driver_info = RSVD(0) | RSVD(6) }, ++ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5829E_ESIM), ++ .driver_info = RSVD(0) | RSVD(6) }, + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */ + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) }, + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) }, diff --git a/queue-4.14/usb-serial-option-add-telit-le910r1-compositions.patch b/queue-4.14/usb-serial-option-add-telit-le910r1-compositions.patch new file mode 100644 index 00000000000..74b4c9129a6 --- /dev/null +++ b/queue-4.14/usb-serial-option-add-telit-le910r1-compositions.patch @@ -0,0 +1,43 @@ +From cfc4442c642d568014474b6718ccf65dc7ca6099 Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Fri, 18 Feb 2022 14:45:52 +0100 +Subject: USB: serial: option: add Telit LE910R1 compositions + +From: Daniele Palmas + +commit cfc4442c642d568014474b6718ccf65dc7ca6099 upstream. + +Add support for the following Telit LE910R1 compositions: + +0x701a: rndis, tty, tty, tty +0x701b: ecm, tty, tty, tty +0x9201: tty + +Signed-off-by: Daniele Palmas +Link: https://lore.kernel.org/r/20220218134552.4051-1-dnlplm@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1282,10 +1282,16 @@ static const struct usb_device_id option + .driver_info = NCTRL(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff), /* Telit LE910-S1 (ECM) */ + .driver_info = NCTRL(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701a, 0xff), /* Telit LE910R1 (RNDIS) */ ++ .driver_info = NCTRL(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701b, 0xff), /* Telit LE910R1 (ECM) */ ++ .driver_info = NCTRL(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ + .driver_info = NCTRL(0) | ZLP }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */ + .driver_info = NCTRL(0) | ZLP }, ++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9201), /* Telit LE910R1 flashing device */ ++ .driver_info = NCTRL(0) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, diff --git a/queue-4.14/xhci-prevent-futile-urb-re-submissions-due-to-incorrect-return-value.patch b/queue-4.14/xhci-prevent-futile-urb-re-submissions-due-to-incorrect-return-value.patch new file mode 100644 index 00000000000..74efa53a266 --- /dev/null +++ b/queue-4.14/xhci-prevent-futile-urb-re-submissions-due-to-incorrect-return-value.patch @@ -0,0 +1,58 @@ +From 243a1dd7ba48c120986dd9e66fee74bcb7751034 Mon Sep 17 00:00:00 2001 +From: Hongyu Xie +Date: Tue, 15 Feb 2022 14:33:20 +0200 +Subject: xhci: Prevent futile URB re-submissions due to incorrect return value. + +From: Hongyu Xie + +commit 243a1dd7ba48c120986dd9e66fee74bcb7751034 upstream. + +The -ENODEV return value from xhci_check_args() is incorrectly changed +to -EINVAL in a couple places before propagated further. + +xhci_check_args() returns 4 types of value, -ENODEV, -EINVAL, 1 and 0. +xhci_urb_enqueue and xhci_check_streams_endpoint return -EINVAL if +the return value of xhci_check_args <= 0. +This causes problems for example r8152_submit_rx, calling usb_submit_urb +in drivers/net/usb/r8152.c. +r8152_submit_rx will never get -ENODEV after submiting an urb when xHC +is halted because xhci_urb_enqueue returns -EINVAL in the very beginning. + +[commit message and header edit -Mathias] + +Fixes: 203a86613fb3 ("xhci: Avoid NULL pointer deref when host dies.") +Cc: stable@vger.kernel.org +Signed-off-by: Hongyu Xie +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220215123320.1253947-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1397,9 +1397,12 @@ static int xhci_urb_enqueue(struct usb_h + struct urb_priv *urb_priv; + int num_tds; + +- if (!urb || xhci_check_args(hcd, urb->dev, urb->ep, +- true, true, __func__) <= 0) ++ if (!urb) + return -EINVAL; ++ ret = xhci_check_args(hcd, urb->dev, urb->ep, ++ true, true, __func__); ++ if (ret <= 0) ++ return ret ? ret : -EINVAL; + + slot_id = urb->dev->slot_id; + ep_index = xhci_get_endpoint_index(&urb->ep->desc); +@@ -3026,7 +3029,7 @@ static int xhci_check_streams_endpoint(s + return -EINVAL; + ret = xhci_check_args(xhci_to_hcd(xhci), udev, ep, 1, true, __func__); + if (ret <= 0) +- return -EINVAL; ++ return ret ? ret : -EINVAL; + if (usb_ss_max_streams(&ep->ss_ep_comp) == 0) { + xhci_warn(xhci, "WARN: SuperSpeed Endpoint Companion" + " descriptor for ep 0x%x does not support streams\n", diff --git a/queue-4.14/xhci-re-initialize-the-hc-during-resume-if-hce-was-set.patch b/queue-4.14/xhci-re-initialize-the-hc-during-resume-if-hce-was-set.patch new file mode 100644 index 00000000000..47c1d5b4a4d --- /dev/null +++ b/queue-4.14/xhci-re-initialize-the-hc-during-resume-if-hce-was-set.patch @@ -0,0 +1,68 @@ +From 8b328f8002bcf29ef517ee4bf234e09aabec4d2e Mon Sep 17 00:00:00 2001 +From: Puma Hsu +Date: Tue, 15 Feb 2022 14:33:19 +0200 +Subject: xhci: re-initialize the HC during resume if HCE was set + +From: Puma Hsu + +commit 8b328f8002bcf29ef517ee4bf234e09aabec4d2e upstream. + +When HCE(Host Controller Error) is set, it means an internal +error condition has been detected. Software needs to re-initialize +the HC, so add this check in xhci resume. + +Cc: stable@vger.kernel.org +Signed-off-by: Puma Hsu +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220215123320.1253947-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1022,6 +1022,7 @@ int xhci_resume(struct xhci_hcd *xhci, b + int retval = 0; + bool comp_timer_running = false; + bool pending_portevent = false; ++ bool reinit_xhc = false; + + if (!hcd->state) + return 0; +@@ -1038,10 +1039,11 @@ int xhci_resume(struct xhci_hcd *xhci, b + set_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags); + + spin_lock_irq(&xhci->lock); +- if ((xhci->quirks & XHCI_RESET_ON_RESUME) || xhci->broken_suspend) +- hibernated = true; + +- if (!hibernated) { ++ if (hibernated || xhci->quirks & XHCI_RESET_ON_RESUME || xhci->broken_suspend) ++ reinit_xhc = true; ++ ++ if (!reinit_xhc) { + /* + * Some controllers might lose power during suspend, so wait + * for controller not ready bit to clear, just as in xHC init. +@@ -1074,12 +1076,17 @@ int xhci_resume(struct xhci_hcd *xhci, b + spin_unlock_irq(&xhci->lock); + return -ETIMEDOUT; + } +- temp = readl(&xhci->op_regs->status); + } + +- /* If restore operation fails, re-initialize the HC during resume */ +- if ((temp & STS_SRE) || hibernated) { ++ temp = readl(&xhci->op_regs->status); ++ ++ /* re-initialize the HC on Restore Error, or Host Controller Error */ ++ if (temp & (STS_SRE | STS_HCE)) { ++ reinit_xhc = true; ++ xhci_warn(xhci, "xHC error in resume, USBSTS 0x%x, Reinit\n", temp); ++ } + ++ if (reinit_xhc) { + if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) && + !(xhci_all_ports_seen_u0(xhci))) { + del_timer_sync(&xhci->comp_mode_recovery_timer);