From: Greg Kroah-Hartman Date: Mon, 21 Nov 2022 12:00:48 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v4.19.266~31 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5822ea89b6e7cb3a716b2a71aba5d307c70f8d55;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: dm-ioctl-fix-misbehavior-if-list_versions-races-with-module-loading.patch iio-adc-at91_adc-fix-possible-memory-leak-in-at91_adc_allocate_trigger.patch iio-pressure-ms5611-changed-hardcoded-spi-speed-to-value-limited.patch iio-trigger-sysfs-fix-possible-memory-leak-in-iio_sysfs_trig_init.patch serial-8250-fall-back-to-non-dma-rx-if-iir_rdi-occurs.patch serial-8250_lpss-configure-dma-also-w-o-dma-filter.patch usb-add-no_lpm-quirk-for-realforce-87u-keyboard.patch usb-chipidea-fix-deadlock-in-ci_otg_del_timer.patch usb-serial-option-add-fibocom-fm160-0x0111-composition.patch usb-serial-option-add-sierra-wireless-em9191.patch usb-serial-option-add-u-blox-lara-l6-modem.patch usb-serial-option-add-u-blox-lara-r6-00b-modem.patch usb-serial-option-remove-old-lara-r6-pid.patch --- diff --git a/queue-4.14/dm-ioctl-fix-misbehavior-if-list_versions-races-with-module-loading.patch b/queue-4.14/dm-ioctl-fix-misbehavior-if-list_versions-races-with-module-loading.patch new file mode 100644 index 00000000000..01d1d115e6c --- /dev/null +++ b/queue-4.14/dm-ioctl-fix-misbehavior-if-list_versions-races-with-module-loading.patch @@ -0,0 +1,70 @@ +From 4fe1ec995483737f3d2a14c3fe1d8fe634972979 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Tue, 1 Nov 2022 16:53:35 -0400 +Subject: dm ioctl: fix misbehavior if list_versions races with module loading + +From: Mikulas Patocka + +commit 4fe1ec995483737f3d2a14c3fe1d8fe634972979 upstream. + +__list_versions will first estimate the required space using the +"dm_target_iterate(list_version_get_needed, &needed)" call and then will +fill the space using the "dm_target_iterate(list_version_get_info, +&iter_info)" call. Each of these calls locks the targets using the +"down_read(&_lock)" and "up_read(&_lock)" calls, however between the first +and second "dm_target_iterate" there is no lock held and the target +modules can be loaded at this point, so the second "dm_target_iterate" +call may need more space than what was the first "dm_target_iterate" +returned. + +The code tries to handle this overflow (see the beginning of +list_version_get_info), however this handling is incorrect. + +The code sets "param->data_size = param->data_start + needed" and +"iter_info.end = (char *)vers+len" - "needed" is the size returned by the +first dm_target_iterate call; "len" is the size of the buffer allocated by +userspace. + +"len" may be greater than "needed"; in this case, the code will write up +to "len" bytes into the buffer, however param->data_size is set to +"needed", so it may write data past the param->data_size value. The ioctl +interface copies only up to param->data_size into userspace, thus part of +the result will be truncated. + +Fix this bug by setting "iter_info.end = (char *)vers + needed;" - this +guarantees that the second "dm_target_iterate" call will write only up to +the "needed" buffer and it will exit with "DM_BUFFER_FULL_FLAG" if it +overflows the "needed" space - in this case, userspace will allocate a +larger buffer and retry. + +Note that there is also a bug in list_version_get_needed - we need to add +"strlen(tt->name) + 1" to the needed size, not "strlen(tt->name)". + +Cc: stable@vger.kernel.org +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-ioctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -573,7 +573,7 @@ static void list_version_get_needed(stru + size_t *needed = needed_param; + + *needed += sizeof(struct dm_target_versions); +- *needed += strlen(tt->name); ++ *needed += strlen(tt->name) + 1; + *needed += ALIGN_MASK; + } + +@@ -628,7 +628,7 @@ static int list_versions(struct file *fi + iter_info.old_vers = NULL; + iter_info.vers = vers; + iter_info.flags = 0; +- iter_info.end = (char *)vers+len; ++ iter_info.end = (char *)vers + needed; + + /* + * Now loop through filling out the names & versions. diff --git a/queue-4.14/iio-adc-at91_adc-fix-possible-memory-leak-in-at91_adc_allocate_trigger.patch b/queue-4.14/iio-adc-at91_adc-fix-possible-memory-leak-in-at91_adc_allocate_trigger.patch new file mode 100644 index 00000000000..fe70a25342f --- /dev/null +++ b/queue-4.14/iio-adc-at91_adc-fix-possible-memory-leak-in-at91_adc_allocate_trigger.patch @@ -0,0 +1,37 @@ +From 65f20301607d07ee279b0804d11a05a62a6c1a1c Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Mon, 24 Oct 2022 16:45:11 +0800 +Subject: iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() + +From: Yang Yingliang + +commit 65f20301607d07ee279b0804d11a05a62a6c1a1c upstream. + +If iio_trigger_register() returns error, it should call iio_trigger_free() +to give up the reference that hold in iio_trigger_alloc(), so that it can +call iio_trig_release() to free memory when the refcount hit to 0. + +Fixes: 0e589d5fb317 ("ARM: AT91: IIO: Add AT91 ADC driver.") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221024084511.815096-1-yangyingliang@huawei.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/at91_adc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/iio/adc/at91_adc.c ++++ b/drivers/iio/adc/at91_adc.c +@@ -618,8 +618,10 @@ static struct iio_trigger *at91_adc_allo + trig->ops = &at91_adc_trigger_ops; + + ret = iio_trigger_register(trig); +- if (ret) ++ if (ret) { ++ iio_trigger_free(trig); + return NULL; ++ } + + return trig; + } diff --git a/queue-4.14/iio-pressure-ms5611-changed-hardcoded-spi-speed-to-value-limited.patch b/queue-4.14/iio-pressure-ms5611-changed-hardcoded-spi-speed-to-value-limited.patch new file mode 100644 index 00000000000..b22cea146ee --- /dev/null +++ b/queue-4.14/iio-pressure-ms5611-changed-hardcoded-spi-speed-to-value-limited.patch @@ -0,0 +1,32 @@ +From 741cec30cc52058d1c10d415f3b98319887e4f73 Mon Sep 17 00:00:00 2001 +From: Mitja Spes +Date: Fri, 21 Oct 2022 15:58:21 +0200 +Subject: iio: pressure: ms5611: changed hardcoded SPI speed to value limited + +From: Mitja Spes + +commit 741cec30cc52058d1c10d415f3b98319887e4f73 upstream. + +Don't hardcode the ms5611 SPI speed, limit it instead. + +Signed-off-by: Mitja Spes +Fixes: c0644160a8b5 ("iio: pressure: add support for MS5611 pressure and temperature sensor") +Link: https://lore.kernel.org/r/20221021135827.1444793-3-mitja@lxnav.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/pressure/ms5611_spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/pressure/ms5611_spi.c ++++ b/drivers/iio/pressure/ms5611_spi.c +@@ -95,7 +95,7 @@ static int ms5611_spi_probe(struct spi_d + spi_set_drvdata(spi, indio_dev); + + spi->mode = SPI_MODE_0; +- spi->max_speed_hz = 20000000; ++ spi->max_speed_hz = min(spi->max_speed_hz, 20000000U); + spi->bits_per_word = 8; + ret = spi_setup(spi); + if (ret < 0) diff --git a/queue-4.14/iio-trigger-sysfs-fix-possible-memory-leak-in-iio_sysfs_trig_init.patch b/queue-4.14/iio-trigger-sysfs-fix-possible-memory-leak-in-iio_sysfs_trig_init.patch new file mode 100644 index 00000000000..5ab0da10fbf --- /dev/null +++ b/queue-4.14/iio-trigger-sysfs-fix-possible-memory-leak-in-iio_sysfs_trig_init.patch @@ -0,0 +1,55 @@ +From efa17e90e1711bdb084e3954fa44afb6647331c0 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Sat, 22 Oct 2022 15:42:12 +0800 +Subject: iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() + +From: Yang Yingliang + +commit efa17e90e1711bdb084e3954fa44afb6647331c0 upstream. + +dev_set_name() allocates memory for name, it need be freed +when device_add() fails, call put_device() to give up the +reference that hold in device_initialize(), so that it can +be freed in kobject_cleanup() when the refcount hit to 0. + +Fault injection test can trigger this: + +unreferenced object 0xffff8e8340a7b4c0 (size 32): + comm "modprobe", pid 243, jiffies 4294678145 (age 48.845s) + hex dump (first 32 bytes): + 69 69 6f 5f 73 79 73 66 73 5f 74 72 69 67 67 65 iio_sysfs_trigge + 72 00 a7 40 83 8e ff ff 00 86 13 c4 f6 ee ff ff r..@............ + backtrace: + [<0000000074999de8>] __kmem_cache_alloc_node+0x1e9/0x360 + [<00000000497fd30b>] __kmalloc_node_track_caller+0x44/0x1a0 + [<000000003636c520>] kstrdup+0x2d/0x60 + [<0000000032f84da2>] kobject_set_name_vargs+0x1e/0x90 + [<0000000092efe493>] dev_set_name+0x4e/0x70 + +Fixes: 1f785681a870 ("staging:iio:trigger sysfs userspace trigger rework.") +Signed-off-by: Yang Yingliang +Cc: +Link: https://lore.kernel.org/r/20221022074212.1386424-1-yangyingliang@huawei.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/trigger/iio-trig-sysfs.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/iio/trigger/iio-trig-sysfs.c ++++ b/drivers/iio/trigger/iio-trig-sysfs.c +@@ -212,9 +212,13 @@ static int iio_sysfs_trigger_remove(int + + static int __init iio_sysfs_trig_init(void) + { ++ int ret; + device_initialize(&iio_sysfs_trig_dev); + dev_set_name(&iio_sysfs_trig_dev, "iio_sysfs_trigger"); +- return device_add(&iio_sysfs_trig_dev); ++ ret = device_add(&iio_sysfs_trig_dev); ++ if (ret) ++ put_device(&iio_sysfs_trig_dev); ++ return ret; + } + module_init(iio_sysfs_trig_init); + diff --git a/queue-4.14/serial-8250-fall-back-to-non-dma-rx-if-iir_rdi-occurs.patch b/queue-4.14/serial-8250-fall-back-to-non-dma-rx-if-iir_rdi-occurs.patch new file mode 100644 index 00000000000..451e2b629ec --- /dev/null +++ b/queue-4.14/serial-8250-fall-back-to-non-dma-rx-if-iir_rdi-occurs.patch @@ -0,0 +1,53 @@ +From a931237cbea256aff13bb403da13a97b2d1605d9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Tue, 8 Nov 2022 14:19:49 +0200 +Subject: serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit a931237cbea256aff13bb403da13a97b2d1605d9 upstream. + +DW UART sometimes triggers IIR_RDI during DMA Rx when IIR_RX_TIMEOUT +should have been triggered instead. Since IIR_RDI has higher priority +than IIR_RX_TIMEOUT, this causes the Rx to hang into interrupt loop. +The problem seems to occur at least with some combinations of +small-sized transfers (I've reproduced the problem on Elkhart Lake PSE +UARTs). + +If there's already an on-going Rx DMA and IIR_RDI triggers, fall +graciously back to non-DMA Rx. That is, behave as if IIR_RX_TIMEOUT had +occurred. + +8250_omap already considers IIR_RDI similar to this change so its +nothing unheard of. + +Fixes: 75df022b5f89 ("serial: 8250_dma: Fix RX handling") +Cc: +Co-developed-by: Srikanth Thokala +Signed-off-by: Srikanth Thokala +Co-developed-by: Aman Kumar +Signed-off-by: Aman Kumar +Signed-off-by: Ilpo Järvinen +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20221108121952.5497-2-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_port.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -1866,6 +1866,10 @@ EXPORT_SYMBOL_GPL(serial8250_modem_statu + static bool handle_rx_dma(struct uart_8250_port *up, unsigned int iir) + { + switch (iir & 0x3f) { ++ case UART_IIR_RDI: ++ if (!up->dma->rx_running) ++ break; ++ /* fall-through */ + case UART_IIR_RX_TIMEOUT: + serial8250_rx_dma_flush(up); + /* fall-through */ diff --git a/queue-4.14/serial-8250_lpss-configure-dma-also-w-o-dma-filter.patch b/queue-4.14/serial-8250_lpss-configure-dma-also-w-o-dma-filter.patch new file mode 100644 index 00000000000..0e4ccb1ba2c --- /dev/null +++ b/queue-4.14/serial-8250_lpss-configure-dma-also-w-o-dma-filter.patch @@ -0,0 +1,66 @@ +From 1bfcbe5805d0cfc83c3544dcd01e0a282c1f6790 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Tue, 8 Nov 2022 14:19:50 +0200 +Subject: serial: 8250_lpss: Configure DMA also w/o DMA filter +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit 1bfcbe5805d0cfc83c3544dcd01e0a282c1f6790 upstream. + +If the platform doesn't use DMA device filter (as is the case with +Elkhart Lake), whole lpss8250_dma_setup() setup is skipped. This +results in skipping also *_maxburst setup which is undesirable. +Refactor lpss8250_dma_setup() to configure DMA even if filter is not +setup. + +Cc: stable +Signed-off-by: Ilpo Järvinen +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20221108121952.5497-3-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_lpss.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/8250/8250_lpss.c ++++ b/drivers/tty/serial/8250/8250_lpss.c +@@ -249,8 +249,13 @@ static int lpss8250_dma_setup(struct lps + struct dw_dma_slave *rx_param, *tx_param; + struct device *dev = port->port.dev; + +- if (!lpss->dma_param.dma_dev) ++ if (!lpss->dma_param.dma_dev) { ++ dma = port->dma; ++ if (dma) ++ goto out_configuration_only; ++ + return 0; ++ } + + rx_param = devm_kzalloc(dev, sizeof(*rx_param), GFP_KERNEL); + if (!rx_param) +@@ -261,16 +266,18 @@ static int lpss8250_dma_setup(struct lps + return -ENOMEM; + + *rx_param = lpss->dma_param; +- dma->rxconf.src_maxburst = lpss->dma_maxburst; +- + *tx_param = lpss->dma_param; +- dma->txconf.dst_maxburst = lpss->dma_maxburst; + + dma->fn = lpss8250_dma_filter; + dma->rx_param = rx_param; + dma->tx_param = tx_param; + + port->dma = dma; ++ ++out_configuration_only: ++ dma->rxconf.src_maxburst = lpss->dma_maxburst; ++ dma->txconf.dst_maxburst = lpss->dma_maxburst; ++ + return 0; + } + diff --git a/queue-4.14/series b/queue-4.14/series index ee5a9900047..2d30bf63580 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -55,3 +55,16 @@ ftrace-optimize-the-allocation-for-mcount-entries.patch ftrace-fix-null-pointer-dereference-in-ftrace_add_mod.patch ring_buffer-do-not-deactivate-non-existant-pages.patch alsa-usb-audio-drop-snd_bug_on-from-snd_usbmidi_output_open.patch +usb-serial-option-add-sierra-wireless-em9191.patch +usb-serial-option-remove-old-lara-r6-pid.patch +usb-serial-option-add-u-blox-lara-r6-00b-modem.patch +usb-serial-option-add-u-blox-lara-l6-modem.patch +usb-serial-option-add-fibocom-fm160-0x0111-composition.patch +usb-add-no_lpm-quirk-for-realforce-87u-keyboard.patch +usb-chipidea-fix-deadlock-in-ci_otg_del_timer.patch +iio-adc-at91_adc-fix-possible-memory-leak-in-at91_adc_allocate_trigger.patch +iio-trigger-sysfs-fix-possible-memory-leak-in-iio_sysfs_trig_init.patch +iio-pressure-ms5611-changed-hardcoded-spi-speed-to-value-limited.patch +dm-ioctl-fix-misbehavior-if-list_versions-races-with-module-loading.patch +serial-8250-fall-back-to-non-dma-rx-if-iir_rdi-occurs.patch +serial-8250_lpss-configure-dma-also-w-o-dma-filter.patch diff --git a/queue-4.14/usb-add-no_lpm-quirk-for-realforce-87u-keyboard.patch b/queue-4.14/usb-add-no_lpm-quirk-for-realforce-87u-keyboard.patch new file mode 100644 index 00000000000..6bb232b0127 --- /dev/null +++ b/queue-4.14/usb-add-no_lpm-quirk-for-realforce-87u-keyboard.patch @@ -0,0 +1,50 @@ +From 181135bb20dcb184edd89817831b888eb8132741 Mon Sep 17 00:00:00 2001 +From: Nicolas Dumazet +Date: Wed, 9 Nov 2022 13:29:46 +0100 +Subject: usb: add NO_LPM quirk for Realforce 87U Keyboard + +From: Nicolas Dumazet + +commit 181135bb20dcb184edd89817831b888eb8132741 upstream. + +Before adding this quirk, this (mechanical keyboard) device would not be +recognized, logging: + + new full-speed USB device number 56 using xhci_hcd + unable to read config index 0 descriptor/start: -32 + chopping to 0 config(s) + +It would take dozens of plugging/unpuggling cycles for the keyboard to +be recognized. Keyboard seems to simply work after applying this quirk. + +This issue had been reported by users in two places already ([1], [2]) +but nobody tried upstreaming a patch yet. After testing I believe their +suggested fix (DELAY_INIT + NO_LPM + DEVICE_QUALIFIER) was probably a +little overkill. I assume this particular combination was tested because +it had been previously suggested in [3], but only NO_LPM seems +sufficient for this device. + +[1]: https://qiita.com/float168/items/fed43d540c8e2201b543 +[2]: https://blog.kostic.dev/posts/making-the-realforce-87ub-work-with-usb30-on-Ubuntu/ +[3]: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1678477 + +Cc: stable@vger.kernel.org +Signed-off-by: Nicolas Dumazet +Link: https://lore.kernel.org/r/20221109122946.706036-1-ndumazet@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -209,6 +209,9 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM }, + { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* Realforce 87U Keyboard */ ++ { USB_DEVICE(0x0853, 0x011b), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* M-Systems Flash Disk Pioneers */ + { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME }, + diff --git a/queue-4.14/usb-chipidea-fix-deadlock-in-ci_otg_del_timer.patch b/queue-4.14/usb-chipidea-fix-deadlock-in-ci_otg_del_timer.patch new file mode 100644 index 00000000000..52624babb23 --- /dev/null +++ b/queue-4.14/usb-chipidea-fix-deadlock-in-ci_otg_del_timer.patch @@ -0,0 +1,56 @@ +From 7a58b8d6021426b796eebfae80983374d9a80a75 Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Sun, 18 Sep 2022 11:33:12 +0800 +Subject: usb: chipidea: fix deadlock in ci_otg_del_timer + +From: Duoming Zhou + +commit 7a58b8d6021426b796eebfae80983374d9a80a75 upstream. + +There is a deadlock in ci_otg_del_timer(), the process is +shown below: + + (thread 1) | (thread 2) +ci_otg_del_timer() | ci_otg_hrtimer_func() + ... | + spin_lock_irqsave() //(1) | ... + ... | + hrtimer_cancel() | spin_lock_irqsave() //(2) + (block forever) + +We hold ci->lock in position (1) and use hrtimer_cancel() to +wait ci_otg_hrtimer_func() to stop, but ci_otg_hrtimer_func() +also need ci->lock in position (2). As a result, the +hrtimer_cancel() in ci_otg_del_timer() will be blocked forever. + +This patch extracts hrtimer_cancel() from the protection of +spin_lock_irqsave() in order that the ci_otg_hrtimer_func() +could obtain the ci->lock. + +What`s more, there will be no race happen. Because the +"next_timer" is always under the protection of +spin_lock_irqsave() and we only check whether "next_timer" +equals to NUM_OTG_FSM_TIMERS in the following code. + +Fixes: 3a316ec4c91c ("usb: chipidea: use hrtimer for otg fsm timers") +Cc: stable +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20220918033312.94348-1-duoming@zju.edu.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/chipidea/otg_fsm.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/chipidea/otg_fsm.c ++++ b/drivers/usb/chipidea/otg_fsm.c +@@ -260,8 +260,10 @@ static void ci_otg_del_timer(struct ci_h + ci->enabled_otg_timer_bits &= ~(1 << t); + if (ci->next_otg_timer == t) { + if (ci->enabled_otg_timer_bits == 0) { ++ spin_unlock_irqrestore(&ci->lock, flags); + /* No enabled timers after delete it */ + hrtimer_cancel(&ci->otg_fsm_hrtimer); ++ spin_lock_irqsave(&ci->lock, flags); + ci->next_otg_timer = NUM_OTG_FSM_TIMERS; + } else { + /* Find the next timer */ diff --git a/queue-4.14/usb-serial-option-add-fibocom-fm160-0x0111-composition.patch b/queue-4.14/usb-serial-option-add-fibocom-fm160-0x0111-composition.patch new file mode 100644 index 00000000000..36477507b74 --- /dev/null +++ b/queue-4.14/usb-serial-option-add-fibocom-fm160-0x0111-composition.patch @@ -0,0 +1,57 @@ +From 148f4b32b4504d8a32cf82049b7b9499a4b299ab Mon Sep 17 00:00:00 2001 +From: Reinhard Speyerer +Date: Wed, 9 Nov 2022 22:24:15 +0100 +Subject: USB: serial: option: add Fibocom FM160 0x0111 composition + +From: Reinhard Speyerer + +commit 148f4b32b4504d8a32cf82049b7b9499a4b299ab upstream. + +Add support for the following Fibocom FM160 composition: + +0x0111: MBIM + MODEM + DIAG + AT + +T: Bus=01 Lev=02 Prnt=125 Port=01 Cnt=02 Dev#= 93 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0111 Rev= 5.04 +S: Manufacturer=Fibocom +S: Product=Fibocom FM160 Modem_SN:12345678 +S: SerialNumber=12345678 +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Reinhard Speyerer +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2181,6 +2181,7 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x010a, 0xff) }, /* Fibocom MA510 (ECM mode) */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) }, /* Fibocom FM160 (MBIM mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */ diff --git a/queue-4.14/usb-serial-option-add-sierra-wireless-em9191.patch b/queue-4.14/usb-serial-option-add-sierra-wireless-em9191.patch new file mode 100644 index 00000000000..a22934983be --- /dev/null +++ b/queue-4.14/usb-serial-option-add-sierra-wireless-em9191.patch @@ -0,0 +1,58 @@ +From df3414b0a245f43476061fddd78cee7d6cff797f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Beno=C3=AEt=20Monin?= +Date: Thu, 13 Oct 2022 16:26:48 +0200 +Subject: USB: serial: option: add Sierra Wireless EM9191 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Benoît Monin + +commit df3414b0a245f43476061fddd78cee7d6cff797f upstream. + +Add support for the AT and diag ports, similar to other qualcomm SDX55 +modems. In QDL mode, the modem uses a different device ID and support +is provided by qcserial in commit 11c52d250b34 ("USB: serial: qcserial: +add EM9191 QDL support"). + +T: Bus=08 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=1199 ProdID=90d3 Rev=00.06 +S: Manufacturer=Sierra Wireless, Incorporated +S: Product=Sierra Wireless EM9191 +S: SerialNumber=xxxxxxxxxxxxxxxx +C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) + +Signed-off-by: Benoît Monin +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -584,6 +584,9 @@ static void option_instat_callback(struc + #define OPPO_VENDOR_ID 0x22d9 + #define OPPO_PRODUCT_R11 0x276c + ++/* Sierra Wireless products */ ++#define SIERRA_VENDOR_ID 0x1199 ++#define SIERRA_PRODUCT_EM9191 0x90d3 + + /* Device flags */ + +@@ -2178,6 +2181,8 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ + { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); diff --git a/queue-4.14/usb-serial-option-add-u-blox-lara-l6-modem.patch b/queue-4.14/usb-serial-option-add-u-blox-lara-l6-modem.patch new file mode 100644 index 00000000000..d84c15fe4d4 --- /dev/null +++ b/queue-4.14/usb-serial-option-add-u-blox-lara-l6-modem.patch @@ -0,0 +1,73 @@ +From c1547f12df8b8e9ca2686accee43213ecd117efe Mon Sep 17 00:00:00 2001 +From: Davide Tronchin +Date: Wed, 16 Nov 2022 16:59:50 +0100 +Subject: USB: serial: option: add u-blox LARA-L6 modem + +From: Davide Tronchin + +commit c1547f12df8b8e9ca2686accee43213ecd117efe upstream. + +Add LARA-L6 PIDs for three different USB compositions. + +LARA-L6 module can be configured (by AT interface) in three different +USB modes: +* Default mode (Vendor ID: 0x1546 Product ID: 0x1341) with 4 serial +interfaces +* RmNet mode (Vendor ID: 0x1546 Product ID: 0x1342) with 4 serial +interfaces and 1 RmNet virtual network interface +* CDC-ECM mode (Vendor ID: 0x1546 Product ID: 0x1343) with 4 serial +interface and 1 CDC-ECM virtual network interface + +In default mode LARA-L6 exposes the following interfaces: +If 0: Diagnostic +If 1: AT parser +If 2: AT parser +If 3: AT parser/alternative functions + +In RmNet mode LARA-L6 exposes the following interfaces: +If 0: Diagnostic +If 1: AT parser +If 2: AT parser +If 3: AT parset/alternative functions +If 4: RMNET interface + +In CDC-ECM mode LARA-L6 exposes the following interfaces: +If 0: Diagnostic +If 1: AT parser +If 2: AT parser +If 3: AT parset/alternative functions +If 4: CDC-ECM interface + +Signed-off-by: Davide Tronchin +[ johan: drop PID defines in favour of comments ] +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -165,6 +165,8 @@ static void option_instat_callback(struc + #define NOVATELWIRELESS_PRODUCT_G2 0xA010 + #define NOVATELWIRELESS_PRODUCT_MC551 0xB001 + ++#define UBLOX_VENDOR_ID 0x1546 ++ + /* AMOI PRODUCTS */ + #define AMOI_VENDOR_ID 0x1614 + #define AMOI_PRODUCT_H01 0x0800 +@@ -1133,6 +1135,12 @@ static const struct usb_device_id option + .driver_info = RSVD(4) }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa), + .driver_info = RSVD(3) }, ++ /* u-blox products */ ++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1341) }, /* u-blox LARA-L6 */ ++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1342), /* u-blox LARA-L6 (RMNET) */ ++ .driver_info = RSVD(4) }, ++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1343), /* u-blox LARA-L6 (ECM) */ ++ .driver_info = RSVD(4) }, + /* Quectel products using Quectel vendor ID */ + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21, 0xff, 0xff, 0xff), + .driver_info = NUMEP2 }, diff --git a/queue-4.14/usb-serial-option-add-u-blox-lara-r6-00b-modem.patch b/queue-4.14/usb-serial-option-add-u-blox-lara-r6-00b-modem.patch new file mode 100644 index 00000000000..7c951a19b27 --- /dev/null +++ b/queue-4.14/usb-serial-option-add-u-blox-lara-r6-00b-modem.patch @@ -0,0 +1,38 @@ +From d9e37a5c4d80ea25a7171ab8557a449115554e76 Mon Sep 17 00:00:00 2001 +From: Davide Tronchin +Date: Wed, 16 Nov 2022 16:59:49 +0100 +Subject: USB: serial: option: add u-blox LARA-R6 00B modem + +From: Davide Tronchin + +commit d9e37a5c4d80ea25a7171ab8557a449115554e76 upstream. + +The official LARA-R6 (00B) modem uses 0x908b PID. LARA-R6 00B does not +implement a QMI interface on port 4, the reservation (RSVD(4)) has been +added to meet other companies that implement QMI on that interface. + +LARA-R6 00B USB composition exposes the following interfaces: +If 0: Diagnostic +If 1: AT parser +If 2: AT parser +If 3: AT parser/alternative functions + +Signed-off-by: Davide Tronchin +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1129,6 +1129,8 @@ static const struct usb_device_id option + /* u-blox products using Qualcomm vendor ID */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M), + .driver_info = RSVD(1) | RSVD(3) }, ++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x908b), /* u-blox LARA-R6 00B */ ++ .driver_info = RSVD(4) }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa), + .driver_info = RSVD(3) }, + /* Quectel products using Quectel vendor ID */ diff --git a/queue-4.14/usb-serial-option-remove-old-lara-r6-pid.patch b/queue-4.14/usb-serial-option-remove-old-lara-r6-pid.patch new file mode 100644 index 00000000000..617dc5be341 --- /dev/null +++ b/queue-4.14/usb-serial-option-remove-old-lara-r6-pid.patch @@ -0,0 +1,45 @@ +From 2ec106b96afc19698ff934323b633c0729d4c7f8 Mon Sep 17 00:00:00 2001 +From: Davide Tronchin +Date: Wed, 16 Nov 2022 16:59:48 +0100 +Subject: USB: serial: option: remove old LARA-R6 PID + +From: Davide Tronchin + +commit 2ec106b96afc19698ff934323b633c0729d4c7f8 upstream. + +Remove the UBLOX_PRODUCT_R6XX 0x90fa association since LARA-R6 00B final +product uses a new USB composition with different PID. 0x90fa PID used +only by LARA-R6 internal prototypes. + +Move 0x90fa PID directly in the option_ids array since used by other +Qualcomm based modem vendors as pointed out in: + + https://lore.kernel.org/all/6572c4e6-d8bc-b8d3-4396-d879e4e76338@gmail.com + +Signed-off-by: Davide Tronchin +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -243,7 +243,6 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_UC15 0x9090 + /* These u-blox products use Qualcomm's vendor ID */ + #define UBLOX_PRODUCT_R410M 0x90b2 +-#define UBLOX_PRODUCT_R6XX 0x90fa + /* These Yuga products use Qualcomm's vendor ID */ + #define YUGA_PRODUCT_CLM920_NC5 0x9625 + +@@ -1130,7 +1129,7 @@ static const struct usb_device_id option + /* u-blox products using Qualcomm vendor ID */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M), + .driver_info = RSVD(1) | RSVD(3) }, +- { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R6XX), ++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa), + .driver_info = RSVD(3) }, + /* Quectel products using Quectel vendor ID */ + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21, 0xff, 0xff, 0xff),