--- /dev/null
+From 4fe1ec995483737f3d2a14c3fe1d8fe634972979 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Tue, 1 Nov 2022 16:53:35 -0400
+Subject: dm ioctl: fix misbehavior if list_versions races with module loading
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 4fe1ec995483737f3d2a14c3fe1d8fe634972979 upstream.
+
+__list_versions will first estimate the required space using the
+"dm_target_iterate(list_version_get_needed, &needed)" call and then will
+fill the space using the "dm_target_iterate(list_version_get_info,
+&iter_info)" call. Each of these calls locks the targets using the
+"down_read(&_lock)" and "up_read(&_lock)" calls, however between the first
+and second "dm_target_iterate" there is no lock held and the target
+modules can be loaded at this point, so the second "dm_target_iterate"
+call may need more space than what was the first "dm_target_iterate"
+returned.
+
+The code tries to handle this overflow (see the beginning of
+list_version_get_info), however this handling is incorrect.
+
+The code sets "param->data_size = param->data_start + needed" and
+"iter_info.end = (char *)vers+len" - "needed" is the size returned by the
+first dm_target_iterate call; "len" is the size of the buffer allocated by
+userspace.
+
+"len" may be greater than "needed"; in this case, the code will write up
+to "len" bytes into the buffer, however param->data_size is set to
+"needed", so it may write data past the param->data_size value. The ioctl
+interface copies only up to param->data_size into userspace, thus part of
+the result will be truncated.
+
+Fix this bug by setting "iter_info.end = (char *)vers + needed;" - this
+guarantees that the second "dm_target_iterate" call will write only up to
+the "needed" buffer and it will exit with "DM_BUFFER_FULL_FLAG" if it
+overflows the "needed" space - in this case, userspace will allocate a
+larger buffer and retry.
+
+Note that there is also a bug in list_version_get_needed - we need to add
+"strlen(tt->name) + 1" to the needed size, not "strlen(tt->name)".
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-ioctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -561,7 +561,7 @@ static void list_version_get_needed(stru
+ size_t *needed = needed_param;
+
+ *needed += sizeof(struct dm_target_versions);
+- *needed += strlen(tt->name);
++ *needed += strlen(tt->name) + 1;
+ *needed += ALIGN_MASK;
+ }
+
+@@ -616,7 +616,7 @@ static int list_versions(struct dm_ioctl
+ iter_info.old_vers = NULL;
+ iter_info.vers = vers;
+ iter_info.flags = 0;
+- iter_info.end = (char *)vers+len;
++ iter_info.end = (char *)vers + needed;
+
+ /*
+ * Now loop through filling out the names & versions.
--- /dev/null
+From 65f20301607d07ee279b0804d11a05a62a6c1a1c Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Mon, 24 Oct 2022 16:45:11 +0800
+Subject: iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+commit 65f20301607d07ee279b0804d11a05a62a6c1a1c upstream.
+
+If iio_trigger_register() returns error, it should call iio_trigger_free()
+to give up the reference that hold in iio_trigger_alloc(), so that it can
+call iio_trig_release() to free memory when the refcount hit to 0.
+
+Fixes: 0e589d5fb317 ("ARM: AT91: IIO: Add AT91 ADC driver.")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20221024084511.815096-1-yangyingliang@huawei.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/at91_adc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -617,8 +617,10 @@ static struct iio_trigger *at91_adc_allo
+ trig->ops = &at91_adc_trigger_ops;
+
+ ret = iio_trigger_register(trig);
+- if (ret)
++ if (ret) {
++ iio_trigger_free(trig);
+ return NULL;
++ }
+
+ return trig;
+ }
--- /dev/null
+From 741cec30cc52058d1c10d415f3b98319887e4f73 Mon Sep 17 00:00:00 2001
+From: Mitja Spes <mitja@lxnav.com>
+Date: Fri, 21 Oct 2022 15:58:21 +0200
+Subject: iio: pressure: ms5611: changed hardcoded SPI speed to value limited
+
+From: Mitja Spes <mitja@lxnav.com>
+
+commit 741cec30cc52058d1c10d415f3b98319887e4f73 upstream.
+
+Don't hardcode the ms5611 SPI speed, limit it instead.
+
+Signed-off-by: Mitja Spes <mitja@lxnav.com>
+Fixes: c0644160a8b5 ("iio: pressure: add support for MS5611 pressure and temperature sensor")
+Link: https://lore.kernel.org/r/20221021135827.1444793-3-mitja@lxnav.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/pressure/ms5611_spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/pressure/ms5611_spi.c
++++ b/drivers/iio/pressure/ms5611_spi.c
+@@ -95,7 +95,7 @@ static int ms5611_spi_probe(struct spi_d
+ spi_set_drvdata(spi, indio_dev);
+
+ spi->mode = SPI_MODE_0;
+- spi->max_speed_hz = 20000000;
++ spi->max_speed_hz = min(spi->max_speed_hz, 20000000U);
+ spi->bits_per_word = 8;
+ ret = spi_setup(spi);
+ if (ret < 0)
--- /dev/null
+From efa17e90e1711bdb084e3954fa44afb6647331c0 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Sat, 22 Oct 2022 15:42:12 +0800
+Subject: iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+commit efa17e90e1711bdb084e3954fa44afb6647331c0 upstream.
+
+dev_set_name() allocates memory for name, it need be freed
+when device_add() fails, call put_device() to give up the
+reference that hold in device_initialize(), so that it can
+be freed in kobject_cleanup() when the refcount hit to 0.
+
+Fault injection test can trigger this:
+
+unreferenced object 0xffff8e8340a7b4c0 (size 32):
+ comm "modprobe", pid 243, jiffies 4294678145 (age 48.845s)
+ hex dump (first 32 bytes):
+ 69 69 6f 5f 73 79 73 66 73 5f 74 72 69 67 67 65 iio_sysfs_trigge
+ 72 00 a7 40 83 8e ff ff 00 86 13 c4 f6 ee ff ff r..@............
+ backtrace:
+ [<0000000074999de8>] __kmem_cache_alloc_node+0x1e9/0x360
+ [<00000000497fd30b>] __kmalloc_node_track_caller+0x44/0x1a0
+ [<000000003636c520>] kstrdup+0x2d/0x60
+ [<0000000032f84da2>] kobject_set_name_vargs+0x1e/0x90
+ [<0000000092efe493>] dev_set_name+0x4e/0x70
+
+Fixes: 1f785681a870 ("staging:iio:trigger sysfs userspace trigger rework.")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20221022074212.1386424-1-yangyingliang@huawei.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/trigger/iio-trig-sysfs.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/trigger/iio-trig-sysfs.c
++++ b/drivers/iio/trigger/iio-trig-sysfs.c
+@@ -212,9 +212,13 @@ static int iio_sysfs_trigger_remove(int
+
+ static int __init iio_sysfs_trig_init(void)
+ {
++ int ret;
+ device_initialize(&iio_sysfs_trig_dev);
+ dev_set_name(&iio_sysfs_trig_dev, "iio_sysfs_trigger");
+- return device_add(&iio_sysfs_trig_dev);
++ ret = device_add(&iio_sysfs_trig_dev);
++ if (ret)
++ put_device(&iio_sysfs_trig_dev);
++ return ret;
+ }
+ module_init(iio_sysfs_trig_init);
+
--- /dev/null
+From a931237cbea256aff13bb403da13a97b2d1605d9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
+Date: Tue, 8 Nov 2022 14:19:49 +0200
+Subject: serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+commit a931237cbea256aff13bb403da13a97b2d1605d9 upstream.
+
+DW UART sometimes triggers IIR_RDI during DMA Rx when IIR_RX_TIMEOUT
+should have been triggered instead. Since IIR_RDI has higher priority
+than IIR_RX_TIMEOUT, this causes the Rx to hang into interrupt loop.
+The problem seems to occur at least with some combinations of
+small-sized transfers (I've reproduced the problem on Elkhart Lake PSE
+UARTs).
+
+If there's already an on-going Rx DMA and IIR_RDI triggers, fall
+graciously back to non-DMA Rx. That is, behave as if IIR_RX_TIMEOUT had
+occurred.
+
+8250_omap already considers IIR_RDI similar to this change so its
+nothing unheard of.
+
+Fixes: 75df022b5f89 ("serial: 8250_dma: Fix RX handling")
+Cc: <stable@vger.kernel.org>
+Co-developed-by: Srikanth Thokala <srikanth.thokala@intel.com>
+Signed-off-by: Srikanth Thokala <srikanth.thokala@intel.com>
+Co-developed-by: Aman Kumar <aman.kumar@intel.com>
+Signed-off-by: Aman Kumar <aman.kumar@intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20221108121952.5497-2-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_port.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1798,6 +1798,10 @@ EXPORT_SYMBOL_GPL(serial8250_modem_statu
+ static bool handle_rx_dma(struct uart_8250_port *up, unsigned int iir)
+ {
+ switch (iir & 0x3f) {
++ case UART_IIR_RDI:
++ if (!up->dma->rx_running)
++ break;
++ /* fall-through */
+ case UART_IIR_RX_TIMEOUT:
+ serial8250_rx_dma_flush(up);
+ /* fall-through */
--- /dev/null
+From 1bfcbe5805d0cfc83c3544dcd01e0a282c1f6790 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
+Date: Tue, 8 Nov 2022 14:19:50 +0200
+Subject: serial: 8250_lpss: Configure DMA also w/o DMA filter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+commit 1bfcbe5805d0cfc83c3544dcd01e0a282c1f6790 upstream.
+
+If the platform doesn't use DMA device filter (as is the case with
+Elkhart Lake), whole lpss8250_dma_setup() setup is skipped. This
+results in skipping also *_maxburst setup which is undesirable.
+Refactor lpss8250_dma_setup() to configure DMA even if filter is not
+setup.
+
+Cc: stable <stable@kernel.org>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20221108121952.5497-3-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_lpss.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/tty/serial/8250/8250_lpss.c
++++ b/drivers/tty/serial/8250/8250_lpss.c
+@@ -245,8 +245,13 @@ static int lpss8250_dma_setup(struct lps
+ struct dw_dma_slave *rx_param, *tx_param;
+ struct device *dev = port->port.dev;
+
+- if (!lpss->dma_param.dma_dev)
++ if (!lpss->dma_param.dma_dev) {
++ dma = port->dma;
++ if (dma)
++ goto out_configuration_only;
++
+ return 0;
++ }
+
+ rx_param = devm_kzalloc(dev, sizeof(*rx_param), GFP_KERNEL);
+ if (!rx_param)
+@@ -257,16 +262,18 @@ static int lpss8250_dma_setup(struct lps
+ return -ENOMEM;
+
+ *rx_param = lpss->dma_param;
+- dma->rxconf.src_maxburst = lpss->dma_maxburst;
+-
+ *tx_param = lpss->dma_param;
+- dma->txconf.dst_maxburst = lpss->dma_maxburst;
+
+ dma->fn = lpss8250_dma_filter;
+ dma->rx_param = rx_param;
+ dma->tx_param = tx_param;
+
+ port->dma = dma;
++
++out_configuration_only:
++ dma->rxconf.src_maxburst = lpss->dma_maxburst;
++ dma->txconf.dst_maxburst = lpss->dma_maxburst;
++
+ return 0;
+ }
+
ftrace-optimize-the-allocation-for-mcount-entries.patch
ring_buffer-do-not-deactivate-non-existant-pages.patch
alsa-usb-audio-drop-snd_bug_on-from-snd_usbmidi_output_open.patch
+usb-serial-option-add-sierra-wireless-em9191.patch
+usb-serial-option-remove-old-lara-r6-pid.patch
+usb-serial-option-add-u-blox-lara-r6-00b-modem.patch
+usb-serial-option-add-u-blox-lara-l6-modem.patch
+usb-serial-option-add-fibocom-fm160-0x0111-composition.patch
+usb-add-no_lpm-quirk-for-realforce-87u-keyboard.patch
+usb-chipidea-fix-deadlock-in-ci_otg_del_timer.patch
+iio-adc-at91_adc-fix-possible-memory-leak-in-at91_adc_allocate_trigger.patch
+iio-trigger-sysfs-fix-possible-memory-leak-in-iio_sysfs_trig_init.patch
+iio-pressure-ms5611-changed-hardcoded-spi-speed-to-value-limited.patch
+dm-ioctl-fix-misbehavior-if-list_versions-races-with-module-loading.patch
+serial-8250-fall-back-to-non-dma-rx-if-iir_rdi-occurs.patch
+serial-8250_lpss-configure-dma-also-w-o-dma-filter.patch
--- /dev/null
+From 181135bb20dcb184edd89817831b888eb8132741 Mon Sep 17 00:00:00 2001
+From: Nicolas Dumazet <ndumazet@google.com>
+Date: Wed, 9 Nov 2022 13:29:46 +0100
+Subject: usb: add NO_LPM quirk for Realforce 87U Keyboard
+
+From: Nicolas Dumazet <ndumazet@google.com>
+
+commit 181135bb20dcb184edd89817831b888eb8132741 upstream.
+
+Before adding this quirk, this (mechanical keyboard) device would not be
+recognized, logging:
+
+ new full-speed USB device number 56 using xhci_hcd
+ unable to read config index 0 descriptor/start: -32
+ chopping to 0 config(s)
+
+It would take dozens of plugging/unpuggling cycles for the keyboard to
+be recognized. Keyboard seems to simply work after applying this quirk.
+
+This issue had been reported by users in two places already ([1], [2])
+but nobody tried upstreaming a patch yet. After testing I believe their
+suggested fix (DELAY_INIT + NO_LPM + DEVICE_QUALIFIER) was probably a
+little overkill. I assume this particular combination was tested because
+it had been previously suggested in [3], but only NO_LPM seems
+sufficient for this device.
+
+[1]: https://qiita.com/float168/items/fed43d540c8e2201b543
+[2]: https://blog.kostic.dev/posts/making-the-realforce-87ub-work-with-usb30-on-Ubuntu/
+[3]: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1678477
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Nicolas Dumazet <ndumazet@google.com>
+Link: https://lore.kernel.org/r/20221109122946.706036-1-ndumazet@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -209,6 +209,9 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM },
+ { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM },
+
++ /* Realforce 87U Keyboard */
++ { USB_DEVICE(0x0853, 0x011b), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* M-Systems Flash Disk Pioneers */
+ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+
--- /dev/null
+From 7a58b8d6021426b796eebfae80983374d9a80a75 Mon Sep 17 00:00:00 2001
+From: Duoming Zhou <duoming@zju.edu.cn>
+Date: Sun, 18 Sep 2022 11:33:12 +0800
+Subject: usb: chipidea: fix deadlock in ci_otg_del_timer
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+commit 7a58b8d6021426b796eebfae80983374d9a80a75 upstream.
+
+There is a deadlock in ci_otg_del_timer(), the process is
+shown below:
+
+ (thread 1) | (thread 2)
+ci_otg_del_timer() | ci_otg_hrtimer_func()
+ ... |
+ spin_lock_irqsave() //(1) | ...
+ ... |
+ hrtimer_cancel() | spin_lock_irqsave() //(2)
+ (block forever)
+
+We hold ci->lock in position (1) and use hrtimer_cancel() to
+wait ci_otg_hrtimer_func() to stop, but ci_otg_hrtimer_func()
+also need ci->lock in position (2). As a result, the
+hrtimer_cancel() in ci_otg_del_timer() will be blocked forever.
+
+This patch extracts hrtimer_cancel() from the protection of
+spin_lock_irqsave() in order that the ci_otg_hrtimer_func()
+could obtain the ci->lock.
+
+What`s more, there will be no race happen. Because the
+"next_timer" is always under the protection of
+spin_lock_irqsave() and we only check whether "next_timer"
+equals to NUM_OTG_FSM_TIMERS in the following code.
+
+Fixes: 3a316ec4c91c ("usb: chipidea: use hrtimer for otg fsm timers")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Link: https://lore.kernel.org/r/20220918033312.94348-1-duoming@zju.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/chipidea/otg_fsm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/chipidea/otg_fsm.c
++++ b/drivers/usb/chipidea/otg_fsm.c
+@@ -260,8 +260,10 @@ static void ci_otg_del_timer(struct ci_h
+ ci->enabled_otg_timer_bits &= ~(1 << t);
+ if (ci->next_otg_timer == t) {
+ if (ci->enabled_otg_timer_bits == 0) {
++ spin_unlock_irqrestore(&ci->lock, flags);
+ /* No enabled timers after delete it */
+ hrtimer_cancel(&ci->otg_fsm_hrtimer);
++ spin_lock_irqsave(&ci->lock, flags);
+ ci->next_otg_timer = NUM_OTG_FSM_TIMERS;
+ } else {
+ /* Find the next timer */
--- /dev/null
+From 148f4b32b4504d8a32cf82049b7b9499a4b299ab Mon Sep 17 00:00:00 2001
+From: Reinhard Speyerer <rspmn@arcor.de>
+Date: Wed, 9 Nov 2022 22:24:15 +0100
+Subject: USB: serial: option: add Fibocom FM160 0x0111 composition
+
+From: Reinhard Speyerer <rspmn@arcor.de>
+
+commit 148f4b32b4504d8a32cf82049b7b9499a4b299ab upstream.
+
+Add support for the following Fibocom FM160 composition:
+
+0x0111: MBIM + MODEM + DIAG + AT
+
+T: Bus=01 Lev=02 Prnt=125 Port=01 Cnt=02 Dev#= 93 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=2cb7 ProdID=0111 Rev= 5.04
+S: Manufacturer=Fibocom
+S: Product=Fibocom FM160 Modem_SN:12345678
+S: SerialNumber=12345678
+C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
+I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
+E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Signed-off-by: Reinhard Speyerer <rspmn@arcor.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2140,6 +2140,7 @@ static const struct usb_device_id option
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x010a, 0xff) }, /* Fibocom MA510 (ECM mode) */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */
++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) }, /* Fibocom FM160 (MBIM mode) */
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */
--- /dev/null
+From df3414b0a245f43476061fddd78cee7d6cff797f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Beno=C3=AEt=20Monin?= <benoit.monin@gmx.fr>
+Date: Thu, 13 Oct 2022 16:26:48 +0200
+Subject: USB: serial: option: add Sierra Wireless EM9191
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Benoît Monin <benoit.monin@gmx.fr>
+
+commit df3414b0a245f43476061fddd78cee7d6cff797f upstream.
+
+Add support for the AT and diag ports, similar to other qualcomm SDX55
+modems. In QDL mode, the modem uses a different device ID and support
+is provided by qcserial in commit 11c52d250b34 ("USB: serial: qcserial:
+add EM9191 QDL support").
+
+T: Bus=08 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0
+D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=1199 ProdID=90d3 Rev=00.06
+S: Manufacturer=Sierra Wireless, Incorporated
+S: Product=Sierra Wireless EM9191
+S: SerialNumber=xxxxxxxxxxxxxxxx
+C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=896mA
+I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none)
+
+Signed-off-by: Benoît Monin <benoit.monin@gmx.fr>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -575,6 +575,9 @@ static void option_instat_callback(struc
+ #define OPPO_VENDOR_ID 0x22d9
+ #define OPPO_PRODUCT_R11 0x276c
+
++/* Sierra Wireless products */
++#define SIERRA_VENDOR_ID 0x1199
++#define SIERRA_PRODUCT_EM9191 0x90d3
+
+ /* Device flags */
+
+@@ -2137,6 +2140,8 @@ static const struct usb_device_id option
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
+ { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
--- /dev/null
+From c1547f12df8b8e9ca2686accee43213ecd117efe Mon Sep 17 00:00:00 2001
+From: Davide Tronchin <davide.tronchin.94@gmail.com>
+Date: Wed, 16 Nov 2022 16:59:50 +0100
+Subject: USB: serial: option: add u-blox LARA-L6 modem
+
+From: Davide Tronchin <davide.tronchin.94@gmail.com>
+
+commit c1547f12df8b8e9ca2686accee43213ecd117efe upstream.
+
+Add LARA-L6 PIDs for three different USB compositions.
+
+LARA-L6 module can be configured (by AT interface) in three different
+USB modes:
+* Default mode (Vendor ID: 0x1546 Product ID: 0x1341) with 4 serial
+interfaces
+* RmNet mode (Vendor ID: 0x1546 Product ID: 0x1342) with 4 serial
+interfaces and 1 RmNet virtual network interface
+* CDC-ECM mode (Vendor ID: 0x1546 Product ID: 0x1343) with 4 serial
+interface and 1 CDC-ECM virtual network interface
+
+In default mode LARA-L6 exposes the following interfaces:
+If 0: Diagnostic
+If 1: AT parser
+If 2: AT parser
+If 3: AT parser/alternative functions
+
+In RmNet mode LARA-L6 exposes the following interfaces:
+If 0: Diagnostic
+If 1: AT parser
+If 2: AT parser
+If 3: AT parset/alternative functions
+If 4: RMNET interface
+
+In CDC-ECM mode LARA-L6 exposes the following interfaces:
+If 0: Diagnostic
+If 1: AT parser
+If 2: AT parser
+If 3: AT parset/alternative functions
+If 4: CDC-ECM interface
+
+Signed-off-by: Davide Tronchin <davide.tronchin.94@gmail.com>
+[ johan: drop PID defines in favour of comments ]
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -165,6 +165,8 @@ static void option_instat_callback(struc
+ #define NOVATELWIRELESS_PRODUCT_G2 0xA010
+ #define NOVATELWIRELESS_PRODUCT_MC551 0xB001
+
++#define UBLOX_VENDOR_ID 0x1546
++
+ /* AMOI PRODUCTS */
+ #define AMOI_VENDOR_ID 0x1614
+ #define AMOI_PRODUCT_H01 0x0800
+@@ -1121,6 +1123,12 @@ static const struct usb_device_id option
+ .driver_info = RSVD(4) },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa),
+ .driver_info = RSVD(3) },
++ /* u-blox products */
++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1341) }, /* u-blox LARA-L6 */
++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1342), /* u-blox LARA-L6 (RMNET) */
++ .driver_info = RSVD(4) },
++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1343), /* u-blox LARA-L6 (ECM) */
++ .driver_info = RSVD(4) },
+ /* Quectel products using Quectel vendor ID */
+ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
+ .driver_info = RSVD(4) },
--- /dev/null
+From d9e37a5c4d80ea25a7171ab8557a449115554e76 Mon Sep 17 00:00:00 2001
+From: Davide Tronchin <davide.tronchin.94@gmail.com>
+Date: Wed, 16 Nov 2022 16:59:49 +0100
+Subject: USB: serial: option: add u-blox LARA-R6 00B modem
+
+From: Davide Tronchin <davide.tronchin.94@gmail.com>
+
+commit d9e37a5c4d80ea25a7171ab8557a449115554e76 upstream.
+
+The official LARA-R6 (00B) modem uses 0x908b PID. LARA-R6 00B does not
+implement a QMI interface on port 4, the reservation (RSVD(4)) has been
+added to meet other companies that implement QMI on that interface.
+
+LARA-R6 00B USB composition exposes the following interfaces:
+If 0: Diagnostic
+If 1: AT parser
+If 2: AT parser
+If 3: AT parser/alternative functions
+
+Signed-off-by: Davide Tronchin <davide.tronchin.94@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1117,6 +1117,8 @@ static const struct usb_device_id option
+ /* u-blox products using Qualcomm vendor ID */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M),
+ .driver_info = RSVD(1) | RSVD(3) },
++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x908b), /* u-blox LARA-R6 00B */
++ .driver_info = RSVD(4) },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa),
+ .driver_info = RSVD(3) },
+ /* Quectel products using Quectel vendor ID */
--- /dev/null
+From 2ec106b96afc19698ff934323b633c0729d4c7f8 Mon Sep 17 00:00:00 2001
+From: Davide Tronchin <davide.tronchin.94@gmail.com>
+Date: Wed, 16 Nov 2022 16:59:48 +0100
+Subject: USB: serial: option: remove old LARA-R6 PID
+
+From: Davide Tronchin <davide.tronchin.94@gmail.com>
+
+commit 2ec106b96afc19698ff934323b633c0729d4c7f8 upstream.
+
+Remove the UBLOX_PRODUCT_R6XX 0x90fa association since LARA-R6 00B final
+product uses a new USB composition with different PID. 0x90fa PID used
+only by LARA-R6 internal prototypes.
+
+Move 0x90fa PID directly in the option_ids array since used by other
+Qualcomm based modem vendors as pointed out in:
+
+ https://lore.kernel.org/all/6572c4e6-d8bc-b8d3-4396-d879e4e76338@gmail.com
+
+Signed-off-by: Davide Tronchin <davide.tronchin.94@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -243,7 +243,6 @@ static void option_instat_callback(struc
+ #define QUECTEL_PRODUCT_UC15 0x9090
+ /* These u-blox products use Qualcomm's vendor ID */
+ #define UBLOX_PRODUCT_R410M 0x90b2
+-#define UBLOX_PRODUCT_R6XX 0x90fa
+ /* These Yuga products use Qualcomm's vendor ID */
+ #define YUGA_PRODUCT_CLM920_NC5 0x9625
+
+@@ -1118,7 +1117,7 @@ static const struct usb_device_id option
+ /* u-blox products using Qualcomm vendor ID */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M),
+ .driver_info = RSVD(1) | RSVD(3) },
+- { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R6XX),
++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa),
+ .driver_info = RSVD(3) },
+ /* Quectel products using Quectel vendor ID */
+ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
projects / thirdparty / kernel / stable-queue.git / commitdiff
