]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.9-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 6 Sep 2022 11:41:36 +0000 (13:41 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 6 Sep 2022 11:41:36 +0000 (13:41 +0200)
added patches:
s390-fix-nospec-table-alignments.patch
s390-hugetlb-fix-prepare_hugepage_range-check-for-2-gb-hugepages.patch
usb-cdc-acm-add-icom-pmr-f3400-support-0c26-0020.patch
usb-core-prevent-nested-device-reset-calls.patch
usb-gadget-mass_storage-fix-cdrom-data-transfers-on-mac-os.patch
usb-serial-cp210x-add-decagon-uca-device-id.patch
usb-serial-option-add-support-for-cinterion-mv32-wa-wb-rmnet-mode.patch
usb-serial-option-add-support-for-oppo-r11-diag-port.patch
usb-storage-add-ignore-residue-quirk-for-nxp-pn7462au.patch

queue-4.9/s390-fix-nospec-table-alignments.patch [new file with mode: 0644]
queue-4.9/s390-hugetlb-fix-prepare_hugepage_range-check-for-2-gb-hugepages.patch [new file with mode: 0644]
queue-4.9/series
queue-4.9/usb-cdc-acm-add-icom-pmr-f3400-support-0c26-0020.patch [new file with mode: 0644]
queue-4.9/usb-core-prevent-nested-device-reset-calls.patch [new file with mode: 0644]
queue-4.9/usb-gadget-mass_storage-fix-cdrom-data-transfers-on-mac-os.patch [new file with mode: 0644]
queue-4.9/usb-serial-cp210x-add-decagon-uca-device-id.patch [new file with mode: 0644]
queue-4.9/usb-serial-option-add-support-for-cinterion-mv32-wa-wb-rmnet-mode.patch [new file with mode: 0644]
queue-4.9/usb-serial-option-add-support-for-oppo-r11-diag-port.patch [new file with mode: 0644]
queue-4.9/usb-storage-add-ignore-residue-quirk-for-nxp-pn7462au.patch [new file with mode: 0644]

diff --git a/queue-4.9/s390-fix-nospec-table-alignments.patch b/queue-4.9/s390-fix-nospec-table-alignments.patch
new file mode 100644 (file)
index 0000000..41c4ad8
--- /dev/null
@@ -0,0 +1,53 @@
+From c9305b6c1f52060377c72aebe3a701389e9f3172 Mon Sep 17 00:00:00 2001
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+Date: Fri, 26 Aug 2022 16:55:44 -0700
+Subject: s390: fix nospec table alignments
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+commit c9305b6c1f52060377c72aebe3a701389e9f3172 upstream.
+
+Add proper alignment for .nospec_call_table and .nospec_return_table in
+vmlinux.
+
+[hca@linux.ibm.com]: The problem with the missing alignment of the nospec
+tables exist since a long time, however only since commit e6ed91fd0768
+("s390/alternatives: remove padding generation code") and with
+CONFIG_RELOCATABLE=n the kernel may also crash at boot time.
+
+The above named commit reduced the size of struct alt_instr by one byte,
+so its new size is 11 bytes. Therefore depending on the number of cpu
+alternatives the size of the __alt_instructions array maybe odd, which
+again also causes that the addresses of the nospec tables will be odd.
+
+If the address of __nospec_call_start is odd and the kernel is compiled
+With CONFIG_RELOCATABLE=n the compiler may generate code that loads the
+address of __nospec_call_start with a 'larl' instruction.
+
+This will generate incorrect code since the 'larl' instruction only works
+with even addresses. In result the members of the nospec tables will be
+accessed with an off-by-one offset, which subsequently may lead to
+addressing exceptions within __nospec_revert().
+
+Fixes: f19fbd5ed642 ("s390: introduce execute-trampolines for branches")
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Link: https://lore.kernel.org/r/8719bf1ce4a72ebdeb575200290094e9ce047bcc.1661557333.git.jpoimboe@kernel.org
+Cc: <stable@vger.kernel.org> # 4.16
+Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/kernel/vmlinux.lds.S |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -125,6 +125,7 @@ SECTIONS
+       /*
+        * Table with the patch locations to undo expolines
+       */
++      . = ALIGN(4);
+       .nospec_call_table : {
+               __nospec_call_start = . ;
+               *(.s390_indirect*)
diff --git a/queue-4.9/s390-hugetlb-fix-prepare_hugepage_range-check-for-2-gb-hugepages.patch b/queue-4.9/s390-hugetlb-fix-prepare_hugepage_range-check-for-2-gb-hugepages.patch
new file mode 100644 (file)
index 0000000..1926d32
--- /dev/null
@@ -0,0 +1,45 @@
+From 7c8d42fdf1a84b1a0dd60d6528309c8ec127e87c Mon Sep 17 00:00:00 2001
+From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Date: Fri, 19 Aug 2022 18:53:43 +0200
+Subject: s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages
+
+From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+
+commit 7c8d42fdf1a84b1a0dd60d6528309c8ec127e87c upstream.
+
+The alignment check in prepare_hugepage_range() is wrong for 2 GB
+hugepages, it only checks for 1 MB hugepage alignment.
+
+This can result in kernel crash in __unmap_hugepage_range() at the
+BUG_ON(start & ~huge_page_mask(h)) alignment check, for mappings
+created with MAP_FIXED at unaligned address.
+
+Fix this by correctly handling multiple hugepage sizes, similar to the
+generic version of prepare_hugepage_range().
+
+Fixes: d08de8e2d867 ("s390/mm: add support for 2GB hugepages")
+Cc: <stable@vger.kernel.org> # 4.8+
+Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/include/asm/hugetlb.h |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/s390/include/asm/hugetlb.h
++++ b/arch/s390/include/asm/hugetlb.h
+@@ -29,9 +29,11 @@ pte_t huge_ptep_get_and_clear(struct mm_
+ static inline int prepare_hugepage_range(struct file *file,
+                       unsigned long addr, unsigned long len)
+ {
+-      if (len & ~HPAGE_MASK)
++      struct hstate *h = hstate_file(file);
++
++      if (len & ~huge_page_mask(h))
+               return -EINVAL;
+-      if (addr & ~HPAGE_MASK)
++      if (addr & ~huge_page_mask(h))
+               return -EINVAL;
+       return 0;
+ }
index 3d915fd6ef744b3f1e5acd16843e80e4814ee628..74389163f780fd22fc48ca5035e9fe093732f21a 100644 (file)
@@ -7,3 +7,12 @@ vt-clear-selection-before-changing-the-font.patch
 usb-serial-ftdi_sio-add-omron-cs1w-cif31-device-id.patch
 hwmon-gpio-fan-fix-array-out-of-bounds-access.patch
 xhci-add-grace-period-after-xhc-start-to-prevent-premature-runtime-suspend.patch
+usb-serial-cp210x-add-decagon-uca-device-id.patch
+usb-serial-option-add-support-for-oppo-r11-diag-port.patch
+usb-serial-option-add-support-for-cinterion-mv32-wa-wb-rmnet-mode.patch
+usb-cdc-acm-add-icom-pmr-f3400-support-0c26-0020.patch
+usb-storage-add-ignore-residue-quirk-for-nxp-pn7462au.patch
+s390-hugetlb-fix-prepare_hugepage_range-check-for-2-gb-hugepages.patch
+s390-fix-nospec-table-alignments.patch
+usb-core-prevent-nested-device-reset-calls.patch
+usb-gadget-mass_storage-fix-cdrom-data-transfers-on-mac-os.patch
diff --git a/queue-4.9/usb-cdc-acm-add-icom-pmr-f3400-support-0c26-0020.patch b/queue-4.9/usb-cdc-acm-add-icom-pmr-f3400-support-0c26-0020.patch
new file mode 100644 (file)
index 0000000..961cc0d
--- /dev/null
@@ -0,0 +1,113 @@
+From a10bc71729b236fe36de0d8e4d35c959fd8dec3a Mon Sep 17 00:00:00 2001
+From: Thierry GUIBERT <thierry.guibert@croix-rouge.fr>
+Date: Fri, 19 Aug 2022 10:17:02 +0200
+Subject: USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020)
+
+From: Thierry GUIBERT <thierry.guibert@croix-rouge.fr>
+
+commit a10bc71729b236fe36de0d8e4d35c959fd8dec3a upstream.
+
+Supports for ICOM F3400 and ICOM F4400 PMR radios in CDC-ACM driver
+enabling the AT serial port.
+The Vendor Id is 0x0C26
+The Product ID is 0x0020
+
+Output of lsusb :
+Bus 001 Device 009: ID 0c26:0020 Prolific Technology Inc. ICOM Radio
+Couldn't open device, some information will be missing
+Device Descriptor:
+  bLength                18
+  bDescriptorType         1
+  bcdUSB               2.00
+  bDeviceClass            2 Communications
+  bDeviceSubClass         0
+  bDeviceProtocol         0
+  bMaxPacketSize0        64
+  idVendor           0x0c26 Prolific Technology Inc.
+  idProduct          0x0020
+  bcdDevice            0.00
+  iManufacturer           1 ICOM Inc.
+  iProduct                2 ICOM Radio
+  iSerial                 3 *obfuscated*
+  bNumConfigurations      1
+  Configuration Descriptor:
+    bLength                 9
+    bDescriptorType         2
+    wTotalLength       0x0030
+    bNumInterfaces          2
+    bConfigurationValue     1
+    iConfiguration          0
+    bmAttributes         0xc0
+      Self Powered
+    MaxPower                0mA
+    Interface Descriptor:
+      bLength                 9
+      bDescriptorType         4
+      bInterfaceNumber        0
+      bAlternateSetting       0
+      bNumEndpoints           1
+      bInterfaceClass         2 Communications
+      bInterfaceSubClass      2 Abstract (modem)
+      bInterfaceProtocol      1 AT-commands (v.25ter)
+      iInterface              0
+      Endpoint Descriptor:
+        bLength                 7
+        bDescriptorType         5
+        bEndpointAddress     0x83  EP 3 IN
+        bmAttributes            3
+          Transfer Type            Interrupt
+          Synch Type               None
+          Usage Type               Data
+        wMaxPacketSize     0x0040  1x 64 bytes
+        bInterval              12
+    Interface Descriptor:
+      bLength                 9
+      bDescriptorType         4
+      bInterfaceNumber        1
+      bAlternateSetting       0
+      bNumEndpoints           2
+      bInterfaceClass        10 CDC Data
+      bInterfaceSubClass      0
+      bInterfaceProtocol      0
+      iInterface              0
+      Endpoint Descriptor:
+        bLength                 7
+        bDescriptorType         5
+        bEndpointAddress     0x82  EP 2 IN
+        bmAttributes            2
+          Transfer Type            Bulk
+          Synch Type               None
+          Usage Type               Data
+        wMaxPacketSize     0x0200  1x 512 bytes
+        bInterval               0
+      Endpoint Descriptor:
+        bLength                 7
+        bDescriptorType         5
+        bEndpointAddress     0x02  EP 2 OUT
+        bmAttributes            2
+          Transfer Type            Bulk
+          Synch Type               None
+          Usage Type               Data
+        wMaxPacketSize     0x0200  1x 512 bytes
+        bInterval               0
+
+Signed-off-by: Thierry GUIBERT <thierry.guibert@croix-rouge.fr>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20220819081702.84118-1-thierry.guibert@croix-rouge.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-acm.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1774,6 +1774,9 @@ static const struct usb_device_id acm_id
+       { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */
+       .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */
+       },
++      { USB_DEVICE(0x0c26, 0x0020), /* Icom ICF3400 Serie */
++      .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
++      },
+       { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */
+       .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+       },
diff --git a/queue-4.9/usb-core-prevent-nested-device-reset-calls.patch b/queue-4.9/usb-core-prevent-nested-device-reset-calls.patch
new file mode 100644 (file)
index 0000000..79c7cc1
--- /dev/null
@@ -0,0 +1,130 @@
+From 9c6d778800b921bde3bff3cff5003d1650f942d1 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 26 Aug 2022 15:31:32 -0400
+Subject: USB: core: Prevent nested device-reset calls
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 9c6d778800b921bde3bff3cff5003d1650f942d1 upstream.
+
+Automatic kernel fuzzing revealed a recursive locking violation in
+usb-storage:
+
+============================================
+WARNING: possible recursive locking detected
+5.18.0 #3 Not tainted
+--------------------------------------------
+kworker/1:3/1205 is trying to acquire lock:
+ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at:
+usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230
+
+but task is already holding lock:
+ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at:
+usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230
+
+...
+
+stack backtrace:
+CPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+1.13.0-1ubuntu1.1 04/01/2014
+Workqueue: usb_hub_wq hub_event
+Call Trace:
+<TASK>
+__dump_stack lib/dump_stack.c:88 [inline]
+dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
+print_deadlock_bug kernel/locking/lockdep.c:2988 [inline]
+check_deadlock kernel/locking/lockdep.c:3031 [inline]
+validate_chain kernel/locking/lockdep.c:3816 [inline]
+__lock_acquire.cold+0x152/0x3ca kernel/locking/lockdep.c:5053
+lock_acquire kernel/locking/lockdep.c:5665 [inline]
+lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5630
+__mutex_lock_common kernel/locking/mutex.c:603 [inline]
+__mutex_lock+0x14f/0x1610 kernel/locking/mutex.c:747
+usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230
+usb_reset_device+0x37d/0x9a0 drivers/usb/core/hub.c:6109
+r871xu_dev_remove+0x21a/0x270 drivers/staging/rtl8712/usb_intf.c:622
+usb_unbind_interface+0x1bd/0x890 drivers/usb/core/driver.c:458
+device_remove drivers/base/dd.c:545 [inline]
+device_remove+0x11f/0x170 drivers/base/dd.c:537
+__device_release_driver drivers/base/dd.c:1222 [inline]
+device_release_driver_internal+0x1a7/0x2f0 drivers/base/dd.c:1248
+usb_driver_release_interface+0x102/0x180 drivers/usb/core/driver.c:627
+usb_forced_unbind_intf+0x4d/0xa0 drivers/usb/core/driver.c:1118
+usb_reset_device+0x39b/0x9a0 drivers/usb/core/hub.c:6114
+
+This turned out not to be an error in usb-storage but rather a nested
+device reset attempt.  That is, as the rtl8712 driver was being
+unbound from a composite device in preparation for an unrelated USB
+reset (that driver does not have pre_reset or post_reset callbacks),
+its ->remove routine called usb_reset_device() -- thus nesting one
+reset call within another.
+
+Performing a reset as part of disconnect processing is a questionable
+practice at best.  However, the bug report points out that the USB
+core does not have any protection against nested resets.  Adding a
+reset_in_progress flag and testing it will prevent such errors in the
+future.
+
+Link: https://lore.kernel.org/all/CAB7eexKUpvX-JNiLzhXBDWgfg2T9e9_0Tw4HQ6keN==voRbP0g@mail.gmail.com/
+Cc: stable@vger.kernel.org
+Reported-and-tested-by: Rondreis <linhaoguo86@gmail.com>
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/YwkflDxvg0KWqyZK@rowland.harvard.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/hub.c |   10 ++++++++++
+ include/linux/usb.h    |    2 ++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5701,6 +5701,11 @@ re_enumerate_no_bos:
+  * the reset is over (using their post_reset method).
+  *
+  * Return: The same as for usb_reset_and_verify_device().
++ * However, if a reset is already in progress (for instance, if a
++ * driver doesn't have pre_ or post_reset() callbacks, and while
++ * being unbound or re-bound during the ongoing reset its disconnect()
++ * or probe() routine tries to perform a second, nested reset), the
++ * routine returns -EINPROGRESS.
+  *
+  * Note:
+  * The caller must own the device lock.  For example, it's safe to use
+@@ -5734,6 +5739,10 @@ int usb_reset_device(struct usb_device *
+               return -EISDIR;
+       }
++      if (udev->reset_in_progress)
++              return -EINPROGRESS;
++      udev->reset_in_progress = 1;
++
+       port_dev = hub->ports[udev->portnum - 1];
+       /*
+@@ -5798,6 +5807,7 @@ int usb_reset_device(struct usb_device *
+       usb_autosuspend_device(udev);
+       memalloc_noio_restore(noio_flag);
++      udev->reset_in_progress = 0;
+       return ret;
+ }
+ EXPORT_SYMBOL_GPL(usb_reset_device);
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -531,6 +531,7 @@ struct usb3_lpm_parameters {
+  * @level: number of USB hub ancestors
+  * @can_submit: URBs may be submitted
+  * @persist_enabled:  USB_PERSIST enabled for this device
++ * @reset_in_progress: the device is being reset
+  * @have_langid: whether string_langid is valid
+  * @authorized: policy has said we can use it;
+  *    (user space) policy determines if we authorize this device to be
+@@ -609,6 +610,7 @@ struct usb_device {
+       unsigned can_submit:1;
+       unsigned persist_enabled:1;
++      unsigned reset_in_progress:1;
+       unsigned have_langid:1;
+       unsigned authorized:1;
+       unsigned authenticated:1;
diff --git a/queue-4.9/usb-gadget-mass_storage-fix-cdrom-data-transfers-on-mac-os.patch b/queue-4.9/usb-gadget-mass_storage-fix-cdrom-data-transfers-on-mac-os.patch
new file mode 100644 (file)
index 0000000..077bc15
--- /dev/null
@@ -0,0 +1,48 @@
+From 9d4dc16ec71bd6368548e9743223e449b4377fc7 Mon Sep 17 00:00:00 2001
+From: Krishna Kurapati <quic_kriskura@quicinc.com>
+Date: Sat, 27 Aug 2022 08:45:10 +0530
+Subject: usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
+
+From: Krishna Kurapati <quic_kriskura@quicinc.com>
+
+commit 9d4dc16ec71bd6368548e9743223e449b4377fc7 upstream.
+
+During cdrom emulation, the response to read_toc command must contain
+the cdrom address as the number of sectors (2048 byte sized blocks)
+represented either as an absolute value (when MSF bit is '0') or in
+terms of PMin/PSec/PFrame (when MSF bit is set to '1'). Incase of
+cdrom, the fsg_lun_open call sets the sector size to 2048 bytes.
+
+When MAC OS sends a read_toc request with MSF set to '1', the
+store_cdrom_address assumes that the address being provided is the
+LUN size represented in 512 byte sized blocks instead of 2048. It
+tries to modify the address further to convert it to 2048 byte sized
+blocks and store it in MSF format. This results in data transfer
+failures as the cdrom address being provided in the read_toc response
+is incorrect.
+
+Fixes: 3f565a363cee ("usb: gadget: storage: adapt logic block size to bound block devices")
+Cc: stable@vger.kernel.org
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
+Link: https://lore.kernel.org/r/1661570110-19127-1-git-send-email-quic_kriskura@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/storage_common.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/function/storage_common.c
++++ b/drivers/usb/gadget/function/storage_common.c
+@@ -298,8 +298,10 @@ EXPORT_SYMBOL_GPL(fsg_lun_fsync_sub);
+ void store_cdrom_address(u8 *dest, int msf, u32 addr)
+ {
+       if (msf) {
+-              /* Convert to Minutes-Seconds-Frames */
+-              addr >>= 2;             /* Convert to 2048-byte frames */
++              /*
++               * Convert to Minutes-Seconds-Frames.
++               * Sector size is already set to 2048 bytes.
++               */
+               addr += 2*75;           /* Lead-in occupies 2 seconds */
+               dest[3] = addr % 75;    /* Frames */
+               addr /= 75;
diff --git a/queue-4.9/usb-serial-cp210x-add-decagon-uca-device-id.patch b/queue-4.9/usb-serial-cp210x-add-decagon-uca-device-id.patch
new file mode 100644 (file)
index 0000000..0f85ff8
--- /dev/null
@@ -0,0 +1,29 @@
+From ceb4038472a4803e7046ed488b03d11551991514 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 29 Aug 2022 16:25:50 +0200
+Subject: USB: serial: cp210x: add Decagon UCA device id
+
+From: Johan Hovold <johan@kernel.org>
+
+commit ceb4038472a4803e7046ed488b03d11551991514 upstream.
+
+Add the device id for Decagon Devices USB Cable Adapter.
+
+Link: https://lore.kernel.org/r/trinity-819f9db2-d3e1-40e9-a669-9c245817c046-1661523546680@msvc-mesg-web108
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -128,6 +128,7 @@ static const struct usb_device_id id_tab
+       { USB_DEVICE(0x10C4, 0x83AA) }, /* Mark-10 Digital Force Gauge */
+       { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */
+       { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
++      { USB_DEVICE(0x10C4, 0x8414) }, /* Decagon USB Cable Adapter */
+       { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
+       { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
+       { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */
diff --git a/queue-4.9/usb-serial-option-add-support-for-cinterion-mv32-wa-wb-rmnet-mode.patch b/queue-4.9/usb-serial-option-add-support-for-cinterion-mv32-wa-wb-rmnet-mode.patch
new file mode 100644 (file)
index 0000000..0ba7adf
--- /dev/null
@@ -0,0 +1,70 @@
+From 8ffe20d08f2c95d702c453020d03a4c568a988f0 Mon Sep 17 00:00:00 2001
+From: Slark Xiao <slark_xiao@163.com>
+Date: Wed, 10 Aug 2022 11:30:50 +0800
+Subject: USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode
+
+From: Slark Xiao <slark_xiao@163.com>
+
+commit 8ffe20d08f2c95d702c453020d03a4c568a988f0 upstream.
+
+We added PIDs for MV32-WA/WB MBIM mode before, now we need to add
+support for RmNet mode.
+
+Test evidence as below:
+T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#=  3 Spd=480 MxCh= 0
+D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=1e2d ProdID=00f3 Rev=05.04
+S:  Manufacturer=Cinterion
+S:  Product=Cinterion PID 0x00F3 USB Mobile Broadband
+S:  SerialNumber=d7b4be8d
+C:  #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA
+I:  If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
+I:  If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+I:  If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+
+T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 10 Spd=480 MxCh= 0
+D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=1e2d ProdID=00f4 Rev=05.04
+S:  Manufacturer=Cinterion
+S:  Product=Cinterion PID 0x00F4 USB Mobile Broadband
+S:  SerialNumber=d095087d
+C:  #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA
+I:  If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
+I:  If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+I:  If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+
+Signed-off-by: Slark Xiao <slark_xiao@163.com>
+[ johan: sort entries ]
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -434,6 +434,8 @@ static void option_instat_callback(struc
+ #define CINTERION_PRODUCT_MV31_2_RMNET                0x00b9
+ #define CINTERION_PRODUCT_MV32_WA             0x00f1
+ #define CINTERION_PRODUCT_MV32_WB             0x00f2
++#define CINTERION_PRODUCT_MV32_WA_RMNET               0x00f3
++#define CINTERION_PRODUCT_MV32_WB_RMNET               0x00f4
+ /* Olivetti products */
+ #define OLIVETTI_VENDOR_ID                    0x0b3c
+@@ -1966,8 +1968,12 @@ static const struct usb_device_id option
+         .driver_info = RSVD(0)},
+       { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff),
+         .driver_info = RSVD(3)},
++      { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA_RMNET, 0xff),
++        .driver_info = RSVD(0) },
+       { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff),
+         .driver_info = RSVD(3)},
++      { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB_RMNET, 0xff),
++        .driver_info = RSVD(0) },
+       { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
+         .driver_info = RSVD(4) },
+       { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
diff --git a/queue-4.9/usb-serial-option-add-support-for-oppo-r11-diag-port.patch b/queue-4.9/usb-serial-option-add-support-for-oppo-r11-diag-port.patch
new file mode 100644 (file)
index 0000000..8873a31
--- /dev/null
@@ -0,0 +1,54 @@
+From 8d5fc280392735e4441b35de14f2f4860fa8d83c Mon Sep 17 00:00:00 2001
+From: Yan Xinyu <sdlyyxy@bupt.edu.cn>
+Date: Thu, 14 Jul 2022 18:20:37 +0800
+Subject: USB: serial: option: add support for OPPO R11 diag port
+
+From: Yan Xinyu <sdlyyxy@bupt.edu.cn>
+
+commit 8d5fc280392735e4441b35de14f2f4860fa8d83c upstream.
+
+Add support for OPPO R11 USB diag serial port to option driver. This
+phone uses Qualcomm Snapdragon 660 SoC.
+
+usb-devices output:
+T:  Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 10 Spd=480 MxCh= 0
+D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
+P:  Vendor=22d9 ProdID=276c Rev=04.04
+S:  Manufacturer=OPPO
+S:  Product=SDM660-MTP _SN:09C6BCA7
+S:  SerialNumber=beb2c403
+C:  #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mA
+I:  If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+I:  If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs
+
+Signed-off-by: Yan Xinyu <sdlyyxy@bupt.edu.cn>
+Link: https://lore.kernel.org/r/20220714102037.4113889-1-sdlyyxy@bupt.edu.cn
+Link: https://lore.kernel.org/r/Yt1WfSZk03Plpnan@hovoldconsulting.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -569,6 +569,10 @@ static void option_instat_callback(struc
+ #define WETELECOM_PRODUCT_6802                        0x6802
+ #define WETELECOM_PRODUCT_WMD300              0x6803
++/* OPPO products */
++#define OPPO_VENDOR_ID                                0x22d9
++#define OPPO_PRODUCT_R11                      0x276c
++
+ /* Device flags */
+@@ -2126,6 +2130,7 @@ static const struct usb_device_id option
+       { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },                   /* GosunCn GM500 RNDIS */
+       { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },                   /* GosunCn GM500 MBIM */
+       { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },                   /* GosunCn GM500 ECM/NCM */
++      { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
+       { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/queue-4.9/usb-storage-add-ignore-residue-quirk-for-nxp-pn7462au.patch b/queue-4.9/usb-storage-add-ignore-residue-quirk-for-nxp-pn7462au.patch
new file mode 100644 (file)
index 0000000..cff961f
--- /dev/null
@@ -0,0 +1,40 @@
+From 2aa48857ad52236a9564c71183d6cc8893becd41 Mon Sep 17 00:00:00 2001
+From: Witold Lipieta <witold.lipieta@thaumatec.com>
+Date: Tue, 9 Aug 2022 13:29:11 +0200
+Subject: usb-storage: Add ignore-residue quirk for NXP PN7462AU
+
+From: Witold Lipieta <witold.lipieta@thaumatec.com>
+
+commit 2aa48857ad52236a9564c71183d6cc8893becd41 upstream.
+
+This is USB mass storage primary boot loader for code download on
+NXP PN7462AU.
+
+Without the quirk it is impossible to write whole memory at once as
+device restarts during the write due to bogus residue values reported.
+
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Cc: stable <stable@kernel.org>
+Signed-off-by: Witold Lipieta <witold.lipieta@thaumatec.com>
+Link: https://lore.kernel.org/r/20220809112911.462776-1-witold.lipieta@thaumatec.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/storage/unusual_devs.h |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2301,6 +2301,13 @@ UNUSUAL_DEV( 0x1e74, 0x4621, 0x0000, 0x0
+               USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+               US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
++/* Reported by Witold Lipieta <witold.lipieta@thaumatec.com> */
++UNUSUAL_DEV( 0x1fc9, 0x0117, 0x0100, 0x0100,
++              "NXP Semiconductors",
++              "PN7462AU",
++              USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++              US_FL_IGNORE_RESIDUE ),
++
+ /* Supplied with some Castlewood ORB removable drives */
+ UNUSUAL_DEV(  0x2027, 0xa001, 0x0000, 0x9999,
+               "Double-H Technology",