From f386218770fb69dfcad789fcf676d927e8da94e8 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 15 Jul 2024 10:56:57 +0200 Subject: [PATCH] 6.6-stable patches added patches: misc-microchip-pci1xxxx-fix-return-value-of-nvmem-callbacks.patch net-ks8851-fix-deadlock-with-the-spi-chip-variant.patch net-ks8851-fix-potential-tx-stall-after-interface-reopen.patch usb-add-usb_quirk_no_set_intf-quirk-for-start-bp-850k.patch usb-core-fix-duplicate-endpoint-bug-by-clearing-reserved-bits-in-the-descriptor.patch usb-dwc3-pci-add-support-for-the-intel-panther-lake.patch usb-gadget-configfs-prevent-oob-read-write-in-usb_string_copy.patch usb-serial-mos7840-fix-crash-on-resume.patch usb-serial-option-add-fibocom-fm350-gl.patch usb-serial-option-add-netprisma-lcuk54-series-modules.patch usb-serial-option-add-rolling-rw350-gl-variants.patch usb-serial-option-add-support-for-foxconn-t99w651.patch usb-serial-option-add-telit-fn912-rmnet-compositions.patch usb-serial-option-add-telit-generic-core-dump-composition.patch --- ...-fix-return-value-of-nvmem-callbacks.patch | 62 +++++++++ ...x-deadlock-with-the-spi-chip-variant.patch | 115 +++++++++++++++++ ...tial-tx-stall-after-interface-reopen.patch | 61 +++++++++ queue-6.6/series | 14 ++ ..._no_set_intf-quirk-for-start-bp-850k.patch | 34 +++++ ...ring-reserved-bits-in-the-descriptor.patch | 72 +++++++++++ ...d-support-for-the-intel-panther-lake.patch | 45 +++++++ ...nt-oob-read-write-in-usb_string_copy.patch | 40 ++++++ ...b-serial-mos7840-fix-crash-on-resume.patch | 96 ++++++++++++++ ...b-serial-option-add-fibocom-fm350-gl.patch | 121 ++++++++++++++++++ ...-add-netprisma-lcuk54-series-modules.patch | 97 ++++++++++++++ ...option-add-rolling-rw350-gl-variants.patch | 93 ++++++++++++++ ...tion-add-support-for-foxconn-t99w651.patch | 50 ++++++++ ...n-add-telit-fn912-rmnet-compositions.patch | 81 ++++++++++++ ...-telit-generic-core-dump-composition.patch | 42 ++++++ 15 files changed, 1023 insertions(+) create mode 100644 queue-6.6/misc-microchip-pci1xxxx-fix-return-value-of-nvmem-callbacks.patch create mode 100644 queue-6.6/net-ks8851-fix-deadlock-with-the-spi-chip-variant.patch create mode 100644 queue-6.6/net-ks8851-fix-potential-tx-stall-after-interface-reopen.patch create mode 100644 queue-6.6/usb-add-usb_quirk_no_set_intf-quirk-for-start-bp-850k.patch create mode 100644 queue-6.6/usb-core-fix-duplicate-endpoint-bug-by-clearing-reserved-bits-in-the-descriptor.patch create mode 100644 queue-6.6/usb-dwc3-pci-add-support-for-the-intel-panther-lake.patch create mode 100644 queue-6.6/usb-gadget-configfs-prevent-oob-read-write-in-usb_string_copy.patch create mode 100644 queue-6.6/usb-serial-mos7840-fix-crash-on-resume.patch create mode 100644 queue-6.6/usb-serial-option-add-fibocom-fm350-gl.patch create mode 100644 queue-6.6/usb-serial-option-add-netprisma-lcuk54-series-modules.patch create mode 100644 queue-6.6/usb-serial-option-add-rolling-rw350-gl-variants.patch create mode 100644 queue-6.6/usb-serial-option-add-support-for-foxconn-t99w651.patch create mode 100644 queue-6.6/usb-serial-option-add-telit-fn912-rmnet-compositions.patch create mode 100644 queue-6.6/usb-serial-option-add-telit-generic-core-dump-composition.patch diff --git a/queue-6.6/misc-microchip-pci1xxxx-fix-return-value-of-nvmem-callbacks.patch b/queue-6.6/misc-microchip-pci1xxxx-fix-return-value-of-nvmem-callbacks.patch new file mode 100644 index 00000000000..2e69ba463eb --- /dev/null +++ b/queue-6.6/misc-microchip-pci1xxxx-fix-return-value-of-nvmem-callbacks.patch @@ -0,0 +1,62 @@ +From a6a0f04e7d28378c181f76d32e4f965aa6a8b0a5 Mon Sep 17 00:00:00 2001 +From: Joy Chakraborty +Date: Wed, 12 Jun 2024 07:00:30 +0000 +Subject: misc: microchip: pci1xxxx: Fix return value of nvmem callbacks + +From: Joy Chakraborty + +commit a6a0f04e7d28378c181f76d32e4f965aa6a8b0a5 upstream. + +Read/write callbacks registered with nvmem core expect 0 to be returned +on success and a negative value to be returned on failure. + +Currently pci1xxxx_otp_read()/pci1xxxx_otp_write() and +pci1xxxx_eeprom_read()/pci1xxxx_eeprom_write() return the number of +bytes read/written on success. +Fix to return 0 on success. + +Fixes: 9ab5465349c0 ("misc: microchip: pci1xxxx: Add support to read and write into PCI1XXXX EEPROM via NVMEM sysfs") +Fixes: 0969001569e4 ("misc: microchip: pci1xxxx: Add support to read and write into PCI1XXXX OTP via NVMEM sysfs") +Cc: stable@vger.kernel.org +Signed-off-by: Joy Chakraborty +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20240612070031.1215558-1-joychakr@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c ++++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c +@@ -153,7 +153,6 @@ static int pci1xxxx_eeprom_read(void *pr + + buf[byte] = readl(rb + MMAP_EEPROM_OFFSET(EEPROM_DATA_REG)); + } +- ret = byte; + error: + release_sys_lock(priv); + return ret; +@@ -197,7 +196,6 @@ static int pci1xxxx_eeprom_write(void *p + goto error; + } + } +- ret = byte; + error: + release_sys_lock(priv); + return ret; +@@ -258,7 +256,6 @@ static int pci1xxxx_otp_read(void *priv_ + + buf[byte] = readl(rb + MMAP_OTP_OFFSET(OTP_RD_DATA_OFFSET)); + } +- ret = byte; + error: + release_sys_lock(priv); + return ret; +@@ -315,7 +312,6 @@ static int pci1xxxx_otp_write(void *priv + goto error; + } + } +- ret = byte; + error: + release_sys_lock(priv); + return ret; diff --git a/queue-6.6/net-ks8851-fix-deadlock-with-the-spi-chip-variant.patch b/queue-6.6/net-ks8851-fix-deadlock-with-the-spi-chip-variant.patch new file mode 100644 index 00000000000..17f93b27a27 --- /dev/null +++ b/queue-6.6/net-ks8851-fix-deadlock-with-the-spi-chip-variant.patch @@ -0,0 +1,115 @@ +From 0913ec336a6c0c4a2b296bd9f74f8e41c4c83c8c Mon Sep 17 00:00:00 2001 +From: Ronald Wahl +Date: Sat, 6 Jul 2024 12:13:37 +0200 +Subject: net: ks8851: Fix deadlock with the SPI chip variant + +From: Ronald Wahl + +commit 0913ec336a6c0c4a2b296bd9f74f8e41c4c83c8c upstream. + +When SMP is enabled and spinlocks are actually functional then there is +a deadlock with the 'statelock' spinlock between ks8851_start_xmit_spi +and ks8851_irq: + + watchdog: BUG: soft lockup - CPU#0 stuck for 27s! + call trace: + queued_spin_lock_slowpath+0x100/0x284 + do_raw_spin_lock+0x34/0x44 + ks8851_start_xmit_spi+0x30/0xb8 + ks8851_start_xmit+0x14/0x20 + netdev_start_xmit+0x40/0x6c + dev_hard_start_xmit+0x6c/0xbc + sch_direct_xmit+0xa4/0x22c + __qdisc_run+0x138/0x3fc + qdisc_run+0x24/0x3c + net_tx_action+0xf8/0x130 + handle_softirqs+0x1ac/0x1f0 + __do_softirq+0x14/0x20 + ____do_softirq+0x10/0x1c + call_on_irq_stack+0x3c/0x58 + do_softirq_own_stack+0x1c/0x28 + __irq_exit_rcu+0x54/0x9c + irq_exit_rcu+0x10/0x1c + el1_interrupt+0x38/0x50 + el1h_64_irq_handler+0x18/0x24 + el1h_64_irq+0x64/0x68 + __netif_schedule+0x6c/0x80 + netif_tx_wake_queue+0x38/0x48 + ks8851_irq+0xb8/0x2c8 + irq_thread_fn+0x2c/0x74 + irq_thread+0x10c/0x1b0 + kthread+0xc8/0xd8 + ret_from_fork+0x10/0x20 + +This issue has not been identified earlier because tests were done on +a device with SMP disabled and so spinlocks were actually NOPs. + +Now use spin_(un)lock_bh for TX queue related locking to avoid execution +of softirq work synchronously that would lead to a deadlock. + +Fixes: 3dc5d4454545 ("net: ks8851: Fix TX stall caused by TX buffer overrun") +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: Simon Horman +Cc: netdev@vger.kernel.org +Cc: stable@vger.kernel.org # 5.10+ +Signed-off-by: Ronald Wahl +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20240706101337.854474-1-rwahl@gmx.de +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/micrel/ks8851_common.c | 8 ++++---- + drivers/net/ethernet/micrel/ks8851_spi.c | 4 ++-- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/micrel/ks8851_common.c ++++ b/drivers/net/ethernet/micrel/ks8851_common.c +@@ -352,11 +352,11 @@ static irqreturn_t ks8851_irq(int irq, v + netif_dbg(ks, intr, ks->netdev, + "%s: txspace %d\n", __func__, tx_space); + +- spin_lock(&ks->statelock); ++ spin_lock_bh(&ks->statelock); + ks->tx_space = tx_space; + if (netif_queue_stopped(ks->netdev)) + netif_wake_queue(ks->netdev); +- spin_unlock(&ks->statelock); ++ spin_unlock_bh(&ks->statelock); + } + + if (status & IRQ_SPIBEI) { +@@ -635,14 +635,14 @@ static void ks8851_set_rx_mode(struct ne + + /* schedule work to do the actual set of the data if needed */ + +- spin_lock(&ks->statelock); ++ spin_lock_bh(&ks->statelock); + + if (memcmp(&rxctrl, &ks->rxctrl, sizeof(rxctrl)) != 0) { + memcpy(&ks->rxctrl, &rxctrl, sizeof(ks->rxctrl)); + schedule_work(&ks->rxctrl_work); + } + +- spin_unlock(&ks->statelock); ++ spin_unlock_bh(&ks->statelock); + } + + static int ks8851_set_mac_address(struct net_device *dev, void *addr) +--- a/drivers/net/ethernet/micrel/ks8851_spi.c ++++ b/drivers/net/ethernet/micrel/ks8851_spi.c +@@ -340,10 +340,10 @@ static void ks8851_tx_work(struct work_s + + tx_space = ks8851_rdreg16_spi(ks, KS_TXMIR); + +- spin_lock(&ks->statelock); ++ spin_lock_bh(&ks->statelock); + ks->queued_len -= dequeued_len; + ks->tx_space = tx_space; +- spin_unlock(&ks->statelock); ++ spin_unlock_bh(&ks->statelock); + + ks8851_unlock_spi(ks, &flags); + } diff --git a/queue-6.6/net-ks8851-fix-potential-tx-stall-after-interface-reopen.patch b/queue-6.6/net-ks8851-fix-potential-tx-stall-after-interface-reopen.patch new file mode 100644 index 00000000000..c8c11126573 --- /dev/null +++ b/queue-6.6/net-ks8851-fix-potential-tx-stall-after-interface-reopen.patch @@ -0,0 +1,61 @@ +From 7a99afef17af66c276c1d6e6f4dbcac223eaf6ac Mon Sep 17 00:00:00 2001 +From: Ronald Wahl +Date: Tue, 9 Jul 2024 21:58:45 +0200 +Subject: net: ks8851: Fix potential TX stall after interface reopen + +From: Ronald Wahl + +commit 7a99afef17af66c276c1d6e6f4dbcac223eaf6ac upstream. + +The amount of TX space in the hardware buffer is tracked in the tx_space +variable. The initial value is currently only set during driver probing. + +After closing the interface and reopening it the tx_space variable has +the last value it had before close. If it is smaller than the size of +the first send packet after reopeing the interface the queue will be +stopped. The queue is woken up after receiving a TX interrupt but this +will never happen since we did not send anything. + +This commit moves the initialization of the tx_space variable to the +ks8851_net_open function right before starting the TX queue. Also query +the value from the hardware instead of using a hard coded value. + +Only the SPI chip variant is affected by this issue because only this +driver variant actually depends on the tx_space variable in the xmit +function. + +Fixes: 3dc5d4454545 ("net: ks8851: Fix TX stall caused by TX buffer overrun") +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: Simon Horman +Cc: netdev@vger.kernel.org +Cc: stable@vger.kernel.org # 5.10+ +Signed-off-by: Ronald Wahl +Reviewed-by: Jacob Keller +Link: https://patch.msgid.link/20240709195845.9089-1-rwahl@gmx.de +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/micrel/ks8851_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/micrel/ks8851_common.c ++++ b/drivers/net/ethernet/micrel/ks8851_common.c +@@ -482,6 +482,7 @@ static int ks8851_net_open(struct net_de + ks8851_wrreg16(ks, KS_IER, ks->rc_ier); + + ks->queued_len = 0; ++ ks->tx_space = ks8851_rdreg16(ks, KS_TXMIR); + netif_start_queue(ks->netdev); + + netif_dbg(ks, ifup, ks->netdev, "network device up\n"); +@@ -1101,7 +1102,6 @@ int ks8851_probe_common(struct net_devic + int ret; + + ks->netdev = netdev; +- ks->tx_space = 6144; + + ks->gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH); + ret = PTR_ERR_OR_ZERO(ks->gpio); diff --git a/queue-6.6/series b/queue-6.6/series index c993bf951bb..47d8680b943 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -52,3 +52,17 @@ cifs-fix-setting-securityflags-to-true.patch revert-sched-fair-make-sure-to-try-to-detach-at-least-one-movable-task.patch tcp-use-signed-arithmetic-in-tcp_rtx_probe0_timed_out.patch tcp-avoid-too-many-retransmit-packets.patch +net-ks8851-fix-deadlock-with-the-spi-chip-variant.patch +net-ks8851-fix-potential-tx-stall-after-interface-reopen.patch +usb-serial-option-add-telit-generic-core-dump-composition.patch +usb-serial-option-add-telit-fn912-rmnet-compositions.patch +usb-serial-option-add-fibocom-fm350-gl.patch +usb-serial-option-add-support-for-foxconn-t99w651.patch +usb-serial-option-add-netprisma-lcuk54-series-modules.patch +usb-serial-option-add-rolling-rw350-gl-variants.patch +usb-serial-mos7840-fix-crash-on-resume.patch +usb-add-usb_quirk_no_set_intf-quirk-for-start-bp-850k.patch +usb-dwc3-pci-add-support-for-the-intel-panther-lake.patch +usb-gadget-configfs-prevent-oob-read-write-in-usb_string_copy.patch +usb-core-fix-duplicate-endpoint-bug-by-clearing-reserved-bits-in-the-descriptor.patch +misc-microchip-pci1xxxx-fix-return-value-of-nvmem-callbacks.patch diff --git a/queue-6.6/usb-add-usb_quirk_no_set_intf-quirk-for-start-bp-850k.patch b/queue-6.6/usb-add-usb_quirk_no_set_intf-quirk-for-start-bp-850k.patch new file mode 100644 index 00000000000..50131ddcab4 --- /dev/null +++ b/queue-6.6/usb-add-usb_quirk_no_set_intf-quirk-for-start-bp-850k.patch @@ -0,0 +1,34 @@ +From 3859e85de30815a20bce7db712ce3d94d40a682d Mon Sep 17 00:00:00 2001 +From: WangYuli +Date: Tue, 2 Jul 2024 23:44:08 +0800 +Subject: USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k + +From: WangYuli + +commit 3859e85de30815a20bce7db712ce3d94d40a682d upstream. + +START BP-850K is a dot matrix printer that crashes when +it receives a Set-Interface request and needs USB_QUIRK_NO_SET_INTF +to work properly. + +Cc: stable +Signed-off-by: jinxiaobo +Signed-off-by: WangYuli +Link: https://lore.kernel.org/r/202E4B2BD0F0FEA4+20240702154408.631201-1-wangyuli@uniontech.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -506,6 +506,9 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x1b1c, 0x1b38), .driver_info = USB_QUIRK_DELAY_INIT | + USB_QUIRK_DELAY_CTRL_MSG }, + ++ /* START BP-850k Printer */ ++ { USB_DEVICE(0x1bc3, 0x0003), .driver_info = USB_QUIRK_NO_SET_INTF }, ++ + /* MIDI keyboard WORLDE MINI */ + { USB_DEVICE(0x1c75, 0x0204), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, diff --git a/queue-6.6/usb-core-fix-duplicate-endpoint-bug-by-clearing-reserved-bits-in-the-descriptor.patch b/queue-6.6/usb-core-fix-duplicate-endpoint-bug-by-clearing-reserved-bits-in-the-descriptor.patch new file mode 100644 index 00000000000..fdde3dc6556 --- /dev/null +++ b/queue-6.6/usb-core-fix-duplicate-endpoint-bug-by-clearing-reserved-bits-in-the-descriptor.patch @@ -0,0 +1,72 @@ +From a368ecde8a5055b627749b09c6218ef793043e47 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Thu, 27 Jun 2024 15:56:18 -0400 +Subject: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor + +From: Alan Stern + +commit a368ecde8a5055b627749b09c6218ef793043e47 upstream. + +Syzbot has identified a bug in usbcore (see the Closes: tag below) +caused by our assumption that the reserved bits in an endpoint +descriptor's bEndpointAddress field will always be 0. As a result of +the bug, the endpoint_is_duplicate() routine in config.c (and possibly +other routines as well) may believe that two descriptors are for +distinct endpoints, even though they have the same direction and +endpoint number. This can lead to confusion, including the bug +identified by syzbot (two descriptors with matching endpoint numbers +and directions, where one was interrupt and the other was bulk). + +To fix the bug, we will clear the reserved bits in bEndpointAddress +when we parse the descriptor. (Note that both the USB-2.0 and USB-3.1 +specs say these bits are "Reserved, reset to zero".) This requires us +to make a copy of the descriptor earlier in usb_parse_endpoint() and +use the copy instead of the original when checking for duplicates. + +Signed-off-by: Alan Stern +Reported-and-tested-by: syzbot+8693a0bb9c10b554272a@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-usb/0000000000003d868e061bc0f554@google.com/ +Fixes: 0a8fd1346254 ("USB: fix problems with duplicate endpoint addresses") +CC: Oliver Neukum +CC: stable@vger.kernel.org +Link: https://lore.kernel.org/r/205a5edc-7fef-4159-b64a-80374b6b101a@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/config.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -291,6 +291,20 @@ static int usb_parse_endpoint(struct dev + if (ifp->desc.bNumEndpoints >= num_ep) + goto skip_to_next_endpoint_or_interface_descriptor; + ++ /* Save a copy of the descriptor and use it instead of the original */ ++ endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; ++ memcpy(&endpoint->desc, d, n); ++ d = &endpoint->desc; ++ ++ /* Clear the reserved bits in bEndpointAddress */ ++ i = d->bEndpointAddress & ++ (USB_ENDPOINT_DIR_MASK | USB_ENDPOINT_NUMBER_MASK); ++ if (i != d->bEndpointAddress) { ++ dev_notice(ddev, "config %d interface %d altsetting %d has an endpoint descriptor with address 0x%X, changing to 0x%X\n", ++ cfgno, inum, asnum, d->bEndpointAddress, i); ++ endpoint->desc.bEndpointAddress = i; ++ } ++ + /* Check for duplicate endpoint addresses */ + if (config_endpoint_is_duplicate(config, inum, asnum, d)) { + dev_notice(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", +@@ -308,10 +322,8 @@ static int usb_parse_endpoint(struct dev + } + } + +- endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; ++ /* Accept this endpoint */ + ++ifp->desc.bNumEndpoints; +- +- memcpy(&endpoint->desc, d, n); + INIT_LIST_HEAD(&endpoint->urb_list); + + /* diff --git a/queue-6.6/usb-dwc3-pci-add-support-for-the-intel-panther-lake.patch b/queue-6.6/usb-dwc3-pci-add-support-for-the-intel-panther-lake.patch new file mode 100644 index 00000000000..dcd9933b08e --- /dev/null +++ b/queue-6.6/usb-dwc3-pci-add-support-for-the-intel-panther-lake.patch @@ -0,0 +1,45 @@ +From 2bf35ea46d0bc379c456e14c0ec1dc1e003b39f1 Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Fri, 28 Jun 2024 14:18:34 +0300 +Subject: usb: dwc3: pci: add support for the Intel Panther Lake + +From: Heikki Krogerus + +commit 2bf35ea46d0bc379c456e14c0ec1dc1e003b39f1 upstream. + +This patch adds the necessary PCI IDs for Intel Panther Lake +devices. + +Signed-off-by: Heikki Krogerus +Cc: stable +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20240628111834.1498461-1-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-pci.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -54,6 +54,10 @@ + #define PCI_DEVICE_ID_INTEL_MTL 0x7e7e + #define PCI_DEVICE_ID_INTEL_ARLH_PCH 0x777e + #define PCI_DEVICE_ID_INTEL_TGL 0x9a15 ++#define PCI_DEVICE_ID_INTEL_PTLH 0xe332 ++#define PCI_DEVICE_ID_INTEL_PTLH_PCH 0xe37e ++#define PCI_DEVICE_ID_INTEL_PTLU 0xe432 ++#define PCI_DEVICE_ID_INTEL_PTLU_PCH 0xe47e + #define PCI_DEVICE_ID_AMD_MR 0x163a + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" +@@ -430,6 +434,10 @@ static const struct pci_device_id dwc3_p + { PCI_DEVICE_DATA(INTEL, MTLS, &dwc3_pci_intel_swnode) }, + { PCI_DEVICE_DATA(INTEL, ARLH_PCH, &dwc3_pci_intel_swnode) }, + { PCI_DEVICE_DATA(INTEL, TGL, &dwc3_pci_intel_swnode) }, ++ { PCI_DEVICE_DATA(INTEL, PTLH, &dwc3_pci_intel_swnode) }, ++ { PCI_DEVICE_DATA(INTEL, PTLH_PCH, &dwc3_pci_intel_swnode) }, ++ { PCI_DEVICE_DATA(INTEL, PTLU, &dwc3_pci_intel_swnode) }, ++ { PCI_DEVICE_DATA(INTEL, PTLU_PCH, &dwc3_pci_intel_swnode) }, + + { PCI_DEVICE_DATA(AMD, NL_USB, &dwc3_pci_amd_swnode) }, + { PCI_DEVICE_DATA(AMD, MR, &dwc3_pci_amd_mr_swnode) }, diff --git a/queue-6.6/usb-gadget-configfs-prevent-oob-read-write-in-usb_string_copy.patch b/queue-6.6/usb-gadget-configfs-prevent-oob-read-write-in-usb_string_copy.patch new file mode 100644 index 00000000000..ee35d94633f --- /dev/null +++ b/queue-6.6/usb-gadget-configfs-prevent-oob-read-write-in-usb_string_copy.patch @@ -0,0 +1,40 @@ +From 6d3c721e686ea6c59e18289b400cc95c76e927e0 Mon Sep 17 00:00:00 2001 +From: Lee Jones +Date: Fri, 5 Jul 2024 08:43:39 +0100 +Subject: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() + +From: Lee Jones + +commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 upstream. + +Userspace provided string 's' could trivially have the length zero. Left +unchecked this will firstly result in an OOB read in the form +`if (str[0 - 1] == '\n') followed closely by an OOB write in the form +`str[0 - 1] = '\0'`. + +There is already a validating check to catch strings that are too long. +Let's supply an additional check for invalid strings that are too short. + +Signed-off-by: Lee Jones +Cc: stable +Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/configfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -115,9 +115,12 @@ static int usb_string_copy(const char *s + int ret; + char *str; + char *copy = *s_copy; ++ + ret = strlen(s); + if (ret > USB_MAX_STRING_LEN) + return -EOVERFLOW; ++ if (ret < 1) ++ return -EINVAL; + + if (copy) { + str = copy; diff --git a/queue-6.6/usb-serial-mos7840-fix-crash-on-resume.patch b/queue-6.6/usb-serial-mos7840-fix-crash-on-resume.patch new file mode 100644 index 00000000000..7f5f9d1c10c --- /dev/null +++ b/queue-6.6/usb-serial-mos7840-fix-crash-on-resume.patch @@ -0,0 +1,96 @@ +From c15a688e49987385baa8804bf65d570e362f8576 Mon Sep 17 00:00:00 2001 +From: Dmitry Smirnov +Date: Sat, 15 Jun 2024 01:45:56 +0300 +Subject: USB: serial: mos7840: fix crash on resume + +From: Dmitry Smirnov + +commit c15a688e49987385baa8804bf65d570e362f8576 upstream. + +Since commit c49cfa917025 ("USB: serial: use generic method if no +alternative is provided in usb serial layer"), USB serial core calls the +generic resume implementation when the driver has not provided one. + +This can trigger a crash on resume with mos7840 since support for +multiple read URBs was added back in 2011. Specifically, both port read +URBs are now submitted on resume for open ports, but the context pointer +of the second URB is left set to the core rather than mos7840 port +structure. + +Fix this by implementing dedicated suspend and resume functions for +mos7840. + +Tested with Delock 87414 USB 2.0 to 4x serial adapter. + +Signed-off-by: Dmitry Smirnov +[ johan: analyse crash and rewrite commit message; set busy flag on + resume; drop bulk-in check; drop unnecessary usb_kill_urb() ] +Fixes: d83b405383c9 ("USB: serial: add support for multiple read urbs") +Cc: stable@vger.kernel.org # 3.3 +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/mos7840.c | 45 +++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 45 insertions(+) + +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -1737,6 +1737,49 @@ static void mos7840_port_remove(struct u + kfree(mos7840_port); + } + ++static int mos7840_suspend(struct usb_serial *serial, pm_message_t message) ++{ ++ struct moschip_port *mos7840_port; ++ struct usb_serial_port *port; ++ int i; ++ ++ for (i = 0; i < serial->num_ports; ++i) { ++ port = serial->port[i]; ++ if (!tty_port_initialized(&port->port)) ++ continue; ++ ++ mos7840_port = usb_get_serial_port_data(port); ++ ++ usb_kill_urb(mos7840_port->read_urb); ++ mos7840_port->read_urb_busy = false; ++ } ++ ++ return 0; ++} ++ ++static int mos7840_resume(struct usb_serial *serial) ++{ ++ struct moschip_port *mos7840_port; ++ struct usb_serial_port *port; ++ int res; ++ int i; ++ ++ for (i = 0; i < serial->num_ports; ++i) { ++ port = serial->port[i]; ++ if (!tty_port_initialized(&port->port)) ++ continue; ++ ++ mos7840_port = usb_get_serial_port_data(port); ++ ++ mos7840_port->read_urb_busy = true; ++ res = usb_submit_urb(mos7840_port->read_urb, GFP_NOIO); ++ if (res) ++ mos7840_port->read_urb_busy = false; ++ } ++ ++ return 0; ++} ++ + static struct usb_serial_driver moschip7840_4port_device = { + .driver = { + .owner = THIS_MODULE, +@@ -1764,6 +1807,8 @@ static struct usb_serial_driver moschip7 + .port_probe = mos7840_port_probe, + .port_remove = mos7840_port_remove, + .read_bulk_callback = mos7840_bulk_in_callback, ++ .suspend = mos7840_suspend, ++ .resume = mos7840_resume, + }; + + static struct usb_serial_driver * const serial_drivers[] = { diff --git a/queue-6.6/usb-serial-option-add-fibocom-fm350-gl.patch b/queue-6.6/usb-serial-option-add-fibocom-fm350-gl.patch new file mode 100644 index 00000000000..f6fe81a88d8 --- /dev/null +++ b/queue-6.6/usb-serial-option-add-fibocom-fm350-gl.patch @@ -0,0 +1,121 @@ +From 2604e08ff251dba330e16b65e80074c9c540aad7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= +Date: Wed, 26 Jun 2024 15:32:23 +0200 +Subject: USB: serial: option: add Fibocom FM350-GL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjørn Mork + +commit 2604e08ff251dba330e16b65e80074c9c540aad7 upstream. + +FM350-GL is 5G Sub-6 WWAN module which uses M.2 form factor interface. +It is based on Mediatek's MTK T700 CPU. The module supports PCIe Gen3 +x1 and USB 2.0 and 3.0 interfaces. + +The manufacturer states that USB is "for debug" but it has been +confirmed to be fully functional, except for modem-control requests on +some of the interfaces. + +USB device composition is controlled by AT+GTUSBMODE= command. +Two values are currently supported for the : + +40: RNDIS+AT+AP(GNSS)+META+DEBUG+NPT+ADB +41: RNDIS+AT+AP(GNSS)+META+DEBUG+NPT+ADB+AP(LOG)+AP(META) (default value) + +[ Note that the functions above are not ordered by interface number. ] + +Mode 40 corresponds to: + +T: Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 22 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0e8d ProdID=7126 Rev= 0.01 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=FM350-GL +C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=02 Prot=ff Driver=rndis_host +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=125us +I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Mode 41 corresponds to: + +T: Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0e8d ProdID=7127 Rev= 0.01 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=FM350-GL +C:* #Ifs=10 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=02 Prot=ff Driver=rndis_host +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=125us +I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: stable@vger.kernel.org +Signed-off-by: Bjørn Mork +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2230,6 +2230,10 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7106_2COM, 0x02, 0x02, 0x01) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7126, 0xff, 0x00, 0x00), ++ .driver_info = NCTRL(2) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7127, 0xff, 0x00, 0x00), ++ .driver_info = NCTRL(2) | NCTRL(3) | NCTRL(4) }, + { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, + { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200), + .driver_info = RSVD(1) | RSVD(4) }, diff --git a/queue-6.6/usb-serial-option-add-netprisma-lcuk54-series-modules.patch b/queue-6.6/usb-serial-option-add-netprisma-lcuk54-series-modules.patch new file mode 100644 index 00000000000..c7e06d31a11 --- /dev/null +++ b/queue-6.6/usb-serial-option-add-netprisma-lcuk54-series-modules.patch @@ -0,0 +1,97 @@ +From dc6dbe3ed28795b01c712ad8f567728f9c14b01d Mon Sep 17 00:00:00 2001 +From: Mank Wang +Date: Sat, 29 Jun 2024 01:54:45 +0000 +Subject: USB: serial: option: add Netprisma LCUK54 series modules + +From: Mank Wang + +commit dc6dbe3ed28795b01c712ad8f567728f9c14b01d upstream. + +Add support for Netprisma LCUK54 series modules. + +LCUK54-WRD-LWW(0x3731/0x0100): NetPrisma LCUK54-WWD for Global +LCUK54-WRD-LWW(0x3731/0x0101): NetPrisma LCUK54-WRD for Global SKU +LCUK54-WRD-LCN(0x3731/0x0106): NetPrisma LCUK54-WRD for China SKU +LCUK54-WRD-LWW(0x3731/0x0111): NetPrisma LCUK54-WWD for SA +LCUK54-WRD-LWW(0x3731/0x0112): NetPrisma LCUK54-WWD for EU +LCUK54-WRD-LWW(0x3731/0x0113): NetPrisma LCUK54-WWD for NA +LCUK54-WWD-LCN(0x3731/0x0115): NetPrisma LCUK54-WWD for China EDU +LCUK54-WWD-LWW(0x3731/0x0116): NetPrisma LCUK54-WWD for Golbal EDU + +Above products use the exact same interface layout and option +driver: +MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL + +T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=3731 ProdID=0101 Rev= 5.04 +S: Manufacturer=NetPrisma +S: Product=LCUK54-WRD +S: SerialNumber=b6250c36 +C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Mank Wang +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2333,6 +2333,30 @@ static const struct usb_device_id option + .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ + .driver_info = RSVD(5) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for Global SKU */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for China SKU */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for SA */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for EU */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for NA */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for China EDU */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Golbal EDU */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) }, diff --git a/queue-6.6/usb-serial-option-add-rolling-rw350-gl-variants.patch b/queue-6.6/usb-serial-option-add-rolling-rw350-gl-variants.patch new file mode 100644 index 00000000000..d4445d0ba53 --- /dev/null +++ b/queue-6.6/usb-serial-option-add-rolling-rw350-gl-variants.patch @@ -0,0 +1,93 @@ +From ae420771551bd9f04347c59744dd062332bdec3e Mon Sep 17 00:00:00 2001 +From: Vanillan Wang +Date: Fri, 31 May 2024 10:40:12 +0800 +Subject: USB: serial: option: add Rolling RW350-GL variants + +From: Vanillan Wang + +commit ae420771551bd9f04347c59744dd062332bdec3e upstream. + +Update the USB serial option driver support for the Rolling +RW350-GL +- VID:PID 33f8:0802, RW350-GL are laptop M.2 cards (with +MBIM interfaces for /Linux/Chrome OS) + +Here are the outputs of usb-devices: + +usbmode=63: mbim, pipe + +T: Bus=02 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=33f8 ProdID=0802 Rev=00.01 +S: Manufacturer=Rolling Wireless S.a.r.l. +S: Product=USB DATA CARD +C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +usbmode=64: mbim, others at (If#= 5 adb) + +MBIM(MI0) + GNSS(MI2) + AP log(MI3) + AP META(MI4) + ADB(MI5) + +MD AT(MI6) + MD META(MI7) + NPT(MI8) + Debug(MI9) + +T: Bus=02 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 5 Spd=5000 MxCh= 0 +D: Ver= 3.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=33f8 ProdID=0802 Rev=00.01 +S: Manufacturer=Rolling Wireless S.a.r.l. +S: Product=USB DATA CARD +C: #Ifs=10 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=07(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=08(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=09(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=8a(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +Signed-off-by: Vanillan Wang +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2333,6 +2333,8 @@ static const struct usb_device_id option + .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ + .driver_info = RSVD(5) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff), /* Rolling RW350-GL (laptop MBIM) */ ++ .driver_info = RSVD(5) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x40) }, diff --git a/queue-6.6/usb-serial-option-add-support-for-foxconn-t99w651.patch b/queue-6.6/usb-serial-option-add-support-for-foxconn-t99w651.patch new file mode 100644 index 00000000000..2810d3e6a0e --- /dev/null +++ b/queue-6.6/usb-serial-option-add-support-for-foxconn-t99w651.patch @@ -0,0 +1,50 @@ +From 3c841d54b63e4446383de3238399a3910e47d8e2 Mon Sep 17 00:00:00 2001 +From: Slark Xiao +Date: Fri, 5 Jul 2024 16:17:09 +0800 +Subject: USB: serial: option: add support for Foxconn T99W651 + +From: Slark Xiao + +commit 3c841d54b63e4446383de3238399a3910e47d8e2 upstream. + +T99W651 is a RNDIS based modem device. There are 3 serial ports +need to be enumerated: Diag, NMEA and AT. + +Test evidence as below: +T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0489 ProdID=e145 Rev=05.15 +S: Manufacturer=QCOM +S: Product=SDXPINN-IDP _SN:93B562B2 +S: SerialNumber=82e6fe26 +C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host +I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +I: If#=0x5 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +I: If#=0x6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) + +0&1: RNDIS, 2:AT, 3:NMEA, 4:DIAG, 5:QDSS, 6:ADB +QDSS is not a serial port. + +Signed-off-by: Slark Xiao +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2294,6 +2294,8 @@ static const struct usb_device_id option + .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff), /* Foxconn T99W373 MBIM */ + .driver_info = RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */ ++ .driver_info = RSVD(5) | RSVD(6) }, + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, + { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */ diff --git a/queue-6.6/usb-serial-option-add-telit-fn912-rmnet-compositions.patch b/queue-6.6/usb-serial-option-add-telit-fn912-rmnet-compositions.patch new file mode 100644 index 00000000000..52bfc7d518c --- /dev/null +++ b/queue-6.6/usb-serial-option-add-telit-fn912-rmnet-compositions.patch @@ -0,0 +1,81 @@ +From 9a590ff283421b71560deded2110dbdcbe1f7d1d Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Tue, 25 Jun 2024 12:27:16 +0200 +Subject: USB: serial: option: add Telit FN912 rmnet compositions + +From: Daniele Palmas + +commit 9a590ff283421b71560deded2110dbdcbe1f7d1d upstream. + +Add the following Telit FN912 compositions: + +0x3000: rmnet + tty (AT/NMEA) + tty (AT) + tty (diag) +T: Bus=03 Lev=01 Prnt=03 Port=07 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=3000 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN912 +S: SerialNumber=92c4c4d8 +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x3001: rmnet + tty (AT) + tty (diag) + DPL (data packet logging) + adb +T: Bus=03 Lev=01 Prnt=03 Port=07 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=3001 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN912 +S: SerialNumber=92c4c4d8 +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Daniele Palmas +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1425,6 +1425,10 @@ static const struct usb_device_id option + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ + .driver_info = NCTRL(0) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x3000, 0xff), /* Telit FN912 */ ++ .driver_info = RSVD(0) | NCTRL(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x3001, 0xff), /* Telit FN912 */ ++ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7010, 0xff), /* Telit LE910-S1 (RNDIS) */ + .driver_info = NCTRL(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff), /* Telit LE910-S1 (ECM) */ diff --git a/queue-6.6/usb-serial-option-add-telit-generic-core-dump-composition.patch b/queue-6.6/usb-serial-option-add-telit-generic-core-dump-composition.patch new file mode 100644 index 00000000000..f2cf7d12621 --- /dev/null +++ b/queue-6.6/usb-serial-option-add-telit-generic-core-dump-composition.patch @@ -0,0 +1,42 @@ +From 4298e400dbdbf259549d69c349e060652ad53611 Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Thu, 30 May 2024 10:00:53 +0200 +Subject: USB: serial: option: add Telit generic core-dump composition + +From: Daniele Palmas + +commit 4298e400dbdbf259549d69c349e060652ad53611 upstream. + +Add the following core-dump composition, used in different Telit modems: + +0x9000: tty (sahara) +T: Bus=03 Lev=01 Prnt=03 Port=07 Cnt=01 Dev#= 41 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=9000 Rev=00.00 +S: Manufacturer=Telit Cinterion +S: Product=FN990-dump +S: SerialNumber=e815bdde +C: #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr=2mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=10 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Daniele Palmas +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1433,6 +1433,8 @@ static const struct usb_device_id option + .driver_info = NCTRL(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701b, 0xff), /* Telit LE910R1 (ECM) */ + .driver_info = NCTRL(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x9000, 0xff), /* Telit generic core-dump device */ ++ .driver_info = NCTRL(0) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ + .driver_info = NCTRL(0) | ZLP }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */ -- 2.47.3