linux-kernel - [PATCH 3.16 323/370] cdc_ncm: workaround for EM7455 "silent" data interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <lsq.1489146383.18769687@decadent.org.uk>
Date:   Fri, 10 Mar 2017 11:46:23 +0000
From:   Ben Hutchings <ben@...adent.org.uk>
To:     linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC:     akpm@...ux-foundation.org,
        "Andreas Fett" <andreas.fett@...unet.com>,
        "Rasmus Lerdorf" <rasmus@...dorf.com>,
        "Bjørn Mork" <bjorn@...k.no>,
        "Samo Ratnik" <samo.ratnik@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        "Ralph Plawetzki" <ralph@...ejava.org>,
        "Stefan Armbruster" <ml001@...bruster-it.de>
Subject: [PATCH 3.16 323/370] cdc_ncm: workaround for EM7455 "silent" data
 interface

3.16.42-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Bjørn Mork <bjorn@...k.no>

[ Upstream commit c086e7096170390594c425114d98172bc9aceb8a ]

Several Lenovo users have reported problems with their Sierra
Wireless EM7455 modem. The driver has loaded successfully and
the MBIM management channel has appeared to work, including
establishing a connection to the mobile network. But no frames
have been received over the data interface.

The problem affects all EM7455 and MC7455, and is assumed to
affect other modems based on the same Qualcomm chipset and
baseband firmware.

Testing narrowed the problem down to what seems to be a
firmware timing bug during initialization. Adding a short sleep
while probing is sufficient to make the problem disappear.
Experiments have shown that 1-2 ms is too little to have any
effect, while 10-20 ms is enough to reliably succeed.

Reported-by: Stefan Armbruster <ml001@...bruster-it.de>
Reported-by: Ralph Plawetzki <ralph@...ejava.org>
Reported-by: Andreas Fett <andreas.fett@...unet.com>
Reported-by: Rasmus Lerdorf <rasmus@...dorf.com>
Reported-by: Samo Ratnik <samo.ratnik@...il.com>
Reported-and-tested-by: Aleksander Morgado <aleksander@...ksander.es>
Signed-off-by: Bjørn Mork <bjorn@...k.no>
Signed-off-by: David S. Miller <davem@...emloft.net>
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
 drivers/net/usb/cdc_ncm.c | 7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -830,6 +830,13 @@ advance:
 	if (cdc_ncm_init(dev))
 		goto error2;

+	/* Some firmwares need a pause here or they will silently fail
+	 * to set up the interface properly.  This value was decided
+	 * empirically on a Sierra Wireless MC7455 running 02.08.02.00
+	 * firmware.
+	 */
+	usleep_range(10000, 20000);
+
 	/* configure data interface */
 	temp = usb_set_interface(dev->udev, iface_no, data_altsetting);
 	if (temp) {