From: Greg Kroah-Hartman Date: Mon, 24 Dec 2018 09:57:30 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.19.13~22 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d6afcdcfc77c893d44179b01bc22842989856bb8;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: ubifs-handle-re-linking-of-inodes-correctly-while-recovery.patch usb-hso-fix-oob-memory-access-in-hso_probe-hso_get_config_data.patch usb-serial-option-add-fibocom-nl668-series.patch usb-serial-option-add-gosuncn-zte-welink-me3630.patch usb-serial-option-add-hp-lt4132.patch usb-serial-option-add-simcom-sim7500-sim7600-mbim-mode.patch usb-serial-option-add-telit-ln940-series.patch xhci-don-t-prevent-usb2-bus-suspend-in-state-check-intended-for-usb3-only.patch --- diff --git a/queue-4.9/series b/queue-4.9/series index d0601b40be7..79d7afbbe4b 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -1,3 +1,11 @@ block-break-discard-submissions-into-the-user-define.patch block-fix-infinite-loop-if-the-device-loses-discard-.patch ib_srpt-fix-a-use-after-free-in-__srpt_close_all_ch.patch +usb-hso-fix-oob-memory-access-in-hso_probe-hso_get_config_data.patch +xhci-don-t-prevent-usb2-bus-suspend-in-state-check-intended-for-usb3-only.patch +usb-serial-option-add-gosuncn-zte-welink-me3630.patch +usb-serial-option-add-hp-lt4132.patch +usb-serial-option-add-simcom-sim7500-sim7600-mbim-mode.patch +usb-serial-option-add-fibocom-nl668-series.patch +usb-serial-option-add-telit-ln940-series.patch +ubifs-handle-re-linking-of-inodes-correctly-while-recovery.patch diff --git a/queue-4.9/ubifs-handle-re-linking-of-inodes-correctly-while-recovery.patch b/queue-4.9/ubifs-handle-re-linking-of-inodes-correctly-while-recovery.patch new file mode 100644 index 00000000000..40e5f0b9fec --- /dev/null +++ b/queue-4.9/ubifs-handle-re-linking-of-inodes-correctly-while-recovery.patch @@ -0,0 +1,97 @@ +From e58725d51fa8da9133f3f1c54170aa2e43056b91 Mon Sep 17 00:00:00 2001 +From: Richard Weinberger +Date: Wed, 7 Nov 2018 23:04:43 +0100 +Subject: ubifs: Handle re-linking of inodes correctly while recovery +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Richard Weinberger + +commit e58725d51fa8da9133f3f1c54170aa2e43056b91 upstream. + +UBIFS's recovery code strictly assumes that a deleted inode will never +come back, therefore it removes all data which belongs to that inode +as soon it faces an inode with link count 0 in the replay list. +Before O_TMPFILE this assumption was perfectly fine. With O_TMPFILE +it can lead to data loss upon a power-cut. + +Consider a journal with entries like: +0: inode X (nlink = 0) /* O_TMPFILE was created */ +1: data for inode X /* Someone writes to the temp file */ +2: inode X (nlink = 0) /* inode was changed, xattr, chmod, … */ +3: inode X (nlink = 1) /* inode was re-linked via linkat() */ + +Upon replay of entry #2 UBIFS will drop all data that belongs to inode X, +this will lead to an empty file after mounting. + +As solution for this problem, scan the replay list for a re-link entry +before dropping data. + +Fixes: 474b93704f32 ("ubifs: Implement O_TMPFILE") +Cc: stable@vger.kernel.org +Cc: Russell Senior +Cc: Rafał Miłecki +Reported-by: Russell Senior +Reported-by: Rafał Miłecki +Tested-by: Rafał Miłecki +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ubifs/replay.c | 37 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 37 insertions(+) + +--- a/fs/ubifs/replay.c ++++ b/fs/ubifs/replay.c +@@ -210,6 +210,38 @@ static int trun_remove_range(struct ubif + } + + /** ++ * inode_still_linked - check whether inode in question will be re-linked. ++ * @c: UBIFS file-system description object ++ * @rino: replay entry to test ++ * ++ * O_TMPFILE files can be re-linked, this means link count goes from 0 to 1. ++ * This case needs special care, otherwise all references to the inode will ++ * be removed upon the first replay entry of an inode with link count 0 ++ * is found. ++ */ ++static bool inode_still_linked(struct ubifs_info *c, struct replay_entry *rino) ++{ ++ struct replay_entry *r; ++ ++ ubifs_assert(c, rino->deletion); ++ ubifs_assert(c, key_type(c, &rino->key) == UBIFS_INO_KEY); ++ ++ /* ++ * Find the most recent entry for the inode behind @rino and check ++ * whether it is a deletion. ++ */ ++ list_for_each_entry_reverse(r, &c->replay_list, list) { ++ ubifs_assert(c, r->sqnum >= rino->sqnum); ++ if (key_inum(c, &r->key) == key_inum(c, &rino->key)) ++ return r->deletion == 0; ++ ++ } ++ ++ ubifs_assert(c, 0); ++ return false; ++} ++ ++/** + * apply_replay_entry - apply a replay entry to the TNC. + * @c: UBIFS file-system description object + * @r: replay entry to apply +@@ -239,6 +271,11 @@ static int apply_replay_entry(struct ubi + { + ino_t inum = key_inum(c, &r->key); + ++ if (inode_still_linked(c, r)) { ++ err = 0; ++ break; ++ } ++ + err = ubifs_tnc_remove_ino(c, inum); + break; + } diff --git a/queue-4.9/usb-hso-fix-oob-memory-access-in-hso_probe-hso_get_config_data.patch b/queue-4.9/usb-hso-fix-oob-memory-access-in-hso_probe-hso_get_config_data.patch new file mode 100644 index 00000000000..e02ed5138a2 --- /dev/null +++ b/queue-4.9/usb-hso-fix-oob-memory-access-in-hso_probe-hso_get_config_data.patch @@ -0,0 +1,67 @@ +From 5146f95df782b0ac61abde36567e718692725c89 Mon Sep 17 00:00:00 2001 +From: Hui Peng +Date: Wed, 12 Dec 2018 12:42:24 +0100 +Subject: USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data + +From: Hui Peng + +commit 5146f95df782b0ac61abde36567e718692725c89 upstream. + +The function hso_probe reads if_num from the USB device (as an u8) and uses +it without a length check to index an array, resulting in an OOB memory read +in hso_probe or hso_get_config_data. + +Add a length check for both locations and updated hso_probe to bail on +error. + +This issue has been assigned CVE-2018-19985. + +Reported-by: Hui Peng +Reported-by: Mathias Payer +Signed-off-by: Hui Peng +Signed-off-by: Mathias Payer +Reviewed-by: Sebastian Andrzej Siewior +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/hso.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2808,6 +2808,12 @@ static int hso_get_config_data(struct us + return -EIO; + } + ++ /* check if we have a valid interface */ ++ if (if_num > 16) { ++ kfree(config_data); ++ return -EINVAL; ++ } ++ + switch (config_data[if_num]) { + case 0x0: + result = 0; +@@ -2878,10 +2884,18 @@ static int hso_probe(struct usb_interfac + + /* Get the interface/port specification from either driver_info or from + * the device itself */ +- if (id->driver_info) ++ if (id->driver_info) { ++ /* if_num is controlled by the device, driver_info is a 0 terminated ++ * array. Make sure, the access is in bounds! */ ++ for (i = 0; i <= if_num; ++i) ++ if (((u32 *)(id->driver_info))[i] == 0) ++ goto exit; + port_spec = ((u32 *)(id->driver_info))[if_num]; +- else ++ } else { + port_spec = hso_get_config_data(interface); ++ if (port_spec < 0) ++ goto exit; ++ } + + /* Check if we need to switch to alt interfaces prior to port + * configuration */ diff --git a/queue-4.9/usb-serial-option-add-fibocom-nl668-series.patch b/queue-4.9/usb-serial-option-add-fibocom-nl668-series.patch new file mode 100644 index 00000000000..494fa98b262 --- /dev/null +++ b/queue-4.9/usb-serial-option-add-fibocom-nl668-series.patch @@ -0,0 +1,66 @@ +From 30360224441ce89a98ed627861e735beb4010775 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= +Date: Wed, 12 Dec 2018 21:47:36 +0100 +Subject: USB: serial: option: add Fibocom NL668 series +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jörgen Storvist + +commit 30360224441ce89a98ed627861e735beb4010775 upstream. + +Added USB serial option driver support for Fibocom NL668 series cellular +modules. Reserved USB endpoints 4, 5 and 6 for network + ADB interfaces. + +usb-devices output (QMI mode) +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1508 ProdID=1001 Rev=03.18 +S: Manufacturer=Nodecom NL668 Modem +S: Product=Nodecom NL668-CN Modem +S: SerialNumber= +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) + +usb-devices output (ECM mode) +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 17 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1508 ProdID=1001 Rev=03.18 +S: Manufacturer=Nodecom NL668 Modem +S: Product=Nodecom NL668-CN Modem +S: SerialNumber= +C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) + +Signed-off-by: Jörgen Storvist +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1950,6 +1950,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) }, ++ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */ ++ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); diff --git a/queue-4.9/usb-serial-option-add-gosuncn-zte-welink-me3630.patch b/queue-4.9/usb-serial-option-add-gosuncn-zte-welink-me3630.patch new file mode 100644 index 00000000000..ec4aecaec36 --- /dev/null +++ b/queue-4.9/usb-serial-option-add-gosuncn-zte-welink-me3630.patch @@ -0,0 +1,70 @@ +From 70a7444c550a75584ffcfae95267058817eff6a7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= +Date: Tue, 11 Dec 2018 18:28:28 +0100 +Subject: USB: serial: option: add GosunCn ZTE WeLink ME3630 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jörgen Storvist + +commit 70a7444c550a75584ffcfae95267058817eff6a7 upstream. + +Added USB serial option driver support for GosunCn ZTE WeLink ME3630 +series cellular modules for USB modes ECM/NCM and MBIM. + +usb-devices output MBIM mode: +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=19d2 ProdID=0602 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +S: SerialNumber= +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim + +usb-devices output ECM/NCM mode: +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=19d2 ProdID=1476 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +S: SerialNumber= +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +I: If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether + +Signed-off-by: Jörgen Storvist +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1327,6 +1327,7 @@ static const struct usb_device_id option + .driver_info = RSVD(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x0602, 0xff) }, /* GosunCn ZTE WeLink ME3630 (MBIM mode) */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff), + .driver_info = RSVD(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff), +@@ -1530,6 +1531,7 @@ static const struct usb_device_id option + .driver_info = RSVD(2) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */ + .driver_info = RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) }, diff --git a/queue-4.9/usb-serial-option-add-hp-lt4132.patch b/queue-4.9/usb-serial-option-add-hp-lt4132.patch new file mode 100644 index 00000000000..ba9e6bfe3e4 --- /dev/null +++ b/queue-4.9/usb-serial-option-add-hp-lt4132.patch @@ -0,0 +1,83 @@ +From d57ec3c83b5153217a70b561d4fb6ed96f2f7a25 Mon Sep 17 00:00:00 2001 +From: Tore Anderson +Date: Sat, 8 Dec 2018 19:05:12 +0100 +Subject: USB: serial: option: add HP lt4132 + +From: Tore Anderson + +commit d57ec3c83b5153217a70b561d4fb6ed96f2f7a25 upstream. + +The HP lt4132 is a rebranded Huawei ME906s-158 LTE modem. + +The interface with protocol 0x16 is "CDC ECM & NCM" according to the *.inf +files included with the Windows driver. Attaching the option driver to it +doesn't result in a /dev/ttyUSB* device being created, so I've excluded it. +Note that it is also excluded for corresponding Huawei-branded devices, cf. +commit d544db293a44 ("USB: support new huawei devices in option.c"). + +T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=ff MxPS=64 #Cfgs= 3 +P: Vendor=03f0 ProdID=a31d Rev=01.02 +S: Manufacturer=HP Inc. +S: Product=HP lt4132 LTE/HSPA+ 4G Module +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=2mA +I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=10 Driver=option +I: If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=13 Driver=option +I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=12 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=06 Prot=16 Driver=(none) +I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=1b Driver=option + +T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=ff MxPS=64 #Cfgs= 3 +P: Vendor=03f0 ProdID=a31d Rev=01.02 +S: Manufacturer=HP Inc. +S: Product=HP lt4132 LTE/HSPA+ 4G Module +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 7 Cfg#= 2 Atr=a0 MxPwr=2mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=06 Prot=00 Driver=cdc_ether +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=10 Driver=option +I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=13 Driver=option +I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=12 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option +I: If#=0x6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=1b Driver=option + +T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=ff MxPS=64 #Cfgs= 3 +P: Vendor=03f0 ProdID=a31d Rev=01.02 +S: Manufacturer=HP Inc. +S: Product=HP lt4132 LTE/HSPA+ 4G Module +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 3 Cfg#= 3 Atr=a0 MxPwr=2mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option + +Signed-off-by: Tore Anderson +Cc: stable@vger.kernel.org +[ johan: drop id defines ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1943,7 +1943,12 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x10) }, /* HP lt4132 (Huawei ME906s-158) */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x12) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); diff --git a/queue-4.9/usb-serial-option-add-simcom-sim7500-sim7600-mbim-mode.patch b/queue-4.9/usb-serial-option-add-simcom-sim7500-sim7600-mbim-mode.patch new file mode 100644 index 00000000000..9f6d828aedd --- /dev/null +++ b/queue-4.9/usb-serial-option-add-simcom-sim7500-sim7600-mbim-mode.patch @@ -0,0 +1,49 @@ +From cc6730df08a291e51e145bc65e24ffb5e2f17ab6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= +Date: Wed, 12 Dec 2018 08:39:39 +0100 +Subject: USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jörgen Storvist + +commit cc6730df08a291e51e145bc65e24ffb5e2f17ab6 upstream. + +Added USB serial option driver support for Simcom SIM7500/SIM7600 series +cellular modules exposing MBIM interface (VID 0x1e0e,PID 0x9003) + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 14 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1e0e ProdID=9003 Rev=03.18 +S: Manufacturer=SimTech, Incorporated +S: Product=SimTech, Incorporated +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 5 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#= 6 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim + +Signed-off-by: Jörgen Storvist +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1759,6 +1759,7 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, + { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E), + .driver_info = RSVD(5) | RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */ + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), + .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D), diff --git a/queue-4.9/usb-serial-option-add-telit-ln940-series.patch b/queue-4.9/usb-serial-option-add-telit-ln940-series.patch new file mode 100644 index 00000000000..d5f0f617218 --- /dev/null +++ b/queue-4.9/usb-serial-option-add-telit-ln940-series.patch @@ -0,0 +1,66 @@ +From 28a86092b1753b802ef7e3de8a4c4a69a9c1bb03 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= +Date: Thu, 13 Dec 2018 17:32:08 +0100 +Subject: USB: serial: option: add Telit LN940 series +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jörgen Storvist + +commit 28a86092b1753b802ef7e3de8a4c4a69a9c1bb03 upstream. + +Added USB serial option driver support for Telit LN940 series cellular +modules. Covering both QMI and MBIM modes. + +usb-devices output (0x1900): +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=1900 Rev=03.10 +S: Manufacturer=Telit +S: Product=Telit LN940 Mobile Broadband +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option + +usb-devices output (0x1901): +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 20 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=1901 Rev=03.10 +S: Manufacturer=Telit +S: Product=Telit LN940 Mobile Broadband +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim + +Signed-off-by: Jörgen Storvist +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1163,6 +1163,10 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, 0x1900), /* Telit LN940 (QMI) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ ++ .driver_info = NCTRL(0) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, diff --git a/queue-4.9/xhci-don-t-prevent-usb2-bus-suspend-in-state-check-intended-for-usb3-only.patch b/queue-4.9/xhci-don-t-prevent-usb2-bus-suspend-in-state-check-intended-for-usb3-only.patch new file mode 100644 index 00000000000..e193bf4013a --- /dev/null +++ b/queue-4.9/xhci-don-t-prevent-usb2-bus-suspend-in-state-check-intended-for-usb3-only.patch @@ -0,0 +1,39 @@ +From 45f750c16cae3625014c14c77bd9005eda975d35 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Fri, 14 Dec 2018 10:54:43 +0200 +Subject: xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only + +From: Mathias Nyman + +commit 45f750c16cae3625014c14c77bd9005eda975d35 upstream. + +The code to prevent a bus suspend if a USB3 port was still in link training +also reacted to USB2 port polling state. +This caused bus suspend to busyloop in some cases. +USB2 polling state is different from USB3, and should not prevent bus +suspend. + +Limit the USB3 link training state check to USB3 root hub ports only. +The origial commit went to stable so this need to be applied there as well + +Fixes: 2f31a67f01a8 ("usb: xhci: Prevent bus suspend if a port connect change or polling state is detected") +Cc: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1353,7 +1353,8 @@ int xhci_bus_suspend(struct usb_hcd *hcd + portsc_buf[port_index] = 0; + + /* Bail out if a USB3 port has a new device in link training */ +- if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) { ++ if ((hcd->speed >= HCD_USB3) && ++ (t1 & PORT_PLS_MASK) == XDEV_POLLING) { + bus_state->bus_suspended = 0; + spin_unlock_irqrestore(&xhci->lock, flags); + xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");