netdev - [PATCH net,stable] cdc_ncm: workaround for EM7455 "silent" data interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1467577490-27810-1-git-send-email-bjorn@mork.no>
Date:	Sun,  3 Jul 2016 22:24:50 +0200
From:	Bjørn Mork <bjorn@...k.no>
To:	netdev@...r.kernel.org
Cc:	Oliver Neukum <oliver@...kum.org>, linux-usb@...r.kernel.org,
	Bjørn Mork <bjorn@...k.no>
Subject: [PATCH net,stable] cdc_ncm: workaround for EM7455 "silent" data interface

Several Lenovo users have reported problems with their Sierra
Wireless EM7455 modem. The driver has loaded successfully and
the MBIM management channel has appeared to work, including
establishing a connection to the mobile network. But no frames
have been received over the data interface.

The problem affects all EM7455 and MC7455, and is assumed to
affect other modems based on the same Qualcomm chipset and
baseband firmware.

Testing narrowed the problem down to what seems to be a
firmware timing bug during initialization. Adding a short sleep
while probing is sufficient to make the problem disappear.
Experiments have shown that 1-2 ms is too little to have any
effect, while 10-20 ms is enough to reliably succeed.

Reported-by: Stefan Armbruster <ml001@...bruster-it.de>
Reported-by: Ralph Plawetzki <ralph@...ejava.org>
Reported-by: Andreas Fett <andreas.fett@...unet.com>
Reported-by: Rasmus Lerdorf <rasmus@...dorf.com>
Reported-by: Samo Ratnik <samo.ratnik@...il.com>
Reported-and-tested-by: Aleksander Morgado <aleksander@...ksander.es>
Signed-off-by: Bjørn Mork <bjorn@...k.no>
---
I hope this unconditional short sleep during probing is acceptable,
as I don't want to start a new non-maintainable quirk device list for
this.  The EM7455 is already used by a number of laptop vendors, each
using their own device ID.  More are likely to come.  And that's only
the modems we *know* are affected...

 drivers/net/usb/cdc_ncm.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 53759c315b97..877c9516e781 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -854,6 +854,13 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
 	if (cdc_ncm_init(dev))
 		goto error2;
 
+	/* Some firmwares need a pause here or they will silently fail
+	 * to set up the interface properly.  This value was decided
+	 * empirically on a Sierra Wireless MC7455 running 02.08.02.00
+	 * firmware.
+	 */
+	usleep_range(10000, 20000);
+
 	/* configure data interface */
 	temp = usb_set_interface(dev->udev, iface_no, data_altsetting);
 	if (temp) {
-- 
2.1.4