Commit graph

1234 commits

Author SHA1 Message Date
Linus Torvalds
4eee1520ea USB / Thunderbolt changes for 6.17-rc1
Here is the big set of USB and Thunderbolt driver changes for 6.17-rc1.
 
 Lots of little things in here, mostly all small cleanups and updates, no
 major new features this development cycle.  Stuff included in here is:
   - xhci minor tweaks for error handling
   - typec minor updates and a driver update
   - gadget driver api cleanups
   - unused function removals
   - unbind memory leak fixes
   - a few new device ids added
   - a few new devices supported for some drivers
   - other minor cleanups and changes
 
 All of these have been in linux-next with no reported issues, with the
 leak fixes being in the shortest amount of time, but they are "obviously
 correct" :)
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaIeVLw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yn3RACgg394VU3ENwqvkh1iF95fVwVheJYAn08YUeoM
 98vPdogv4+kuC3B0TbiM
 =7pfy
 -----END PGP SIGNATURE-----

Merge tag 'usb-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt driver changes for
  6.17-rc1.

  Lots of little things in here, mostly all small cleanups and updates,
  no major new features this development cycle. Stuff included in here
  is:

   - xhci minor tweaks for error handling

   - typec minor updates and a driver update

   - gadget driver api cleanups

   - unused function removals

   - unbind memory leak fixes

   - a few new device ids added

   - a few new devices supported for some drivers

   - other minor cleanups and changes

  All of these have been in linux-next with no reported issues, with the
  leak fixes being in the shortest amount of time, but they are
  'obviously correct' :)"

* tag 'usb-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (100 commits)
  usb: musb: omap2430: clean up probe error handling
  usb: musb: omap2430: fix device leak at unbind
  usb: gadget: udc: renesas_usb3: fix device leak at unbind
  usb: dwc3: meson-g12a: fix device leaks at unbind
  usb: dwc3: imx8mp: fix device leak at unbind
  usb: musb: omap2430: enable compile testing
  usb: gadget: udc: renesas_usb3: drop unused module alias
  usb: xhci: print xhci->xhc_state when queue_command failed
  usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
  USB: serial: option: add Foxconn T99W709
  usb: core: add urb->sgt parameter description
  thunderbolt: Fix copy+paste error in match_service_id()
  usb: typec: ucsi: Update power_supply on power role change
  usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
  usb: typec: fusb302: cache PD RX state
  usb: typec: ucsi: yoga-c630: add DRM dependency
  usb: gadget : fix use-after-free in composite_dev_cleanup()
  usb: chipidea: imx: Add a missing blank line
  usb: gadget: f_uac1: replace scnprintf() with sysfs_emit()
  usb: usblp: clean up assignment inside if conditions
  ...
2025-07-29 10:17:10 -07:00
Linus Torvalds
1959e18cc0 Removing subtrees of kernel filesystems is done in quite a few
places; unfortunately, it's easy to get wrong.  A number of open-coded
 attempts are out there, with varying amount of bogosities.
 
 	simple_recursive_removal() had been introduced for doing that with
 all precautions needed; it does an equivalent of rm -rf, with sufficient
 locking, eviction of anything mounted on top of the subtree, etc.
 
 	This series converts a bunch of open-coded instances to using that.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQQqUNBr3gm4hGXdBJlZ7Krx/gZQ6wUCaIRCUwAKCRBZ7Krx/gZQ
 66XWAP9BNyHcvl9uV/ku/mswYiRBxYoVogciIKeugwYTVLuTJgEA7jdh1eyLkvbS
 rwbL7XD+Q35/vXZHEet+RLCGH3ae6wc=
 =yaKF
 -----END PGP SIGNATURE-----

Merge tag 'pull-simple_recursive_removal' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull simple_recursive_removal() update from Al Viro:
 "Removing subtrees of kernel filesystems is done in quite a few places;
  unfortunately, it's easy to get wrong. A number of open-coded attempts
  are out there, with varying amount of bogosities.

  simple_recursive_removal() had been introduced for doing that with all
  precautions needed; it does an equivalent of rm -rf, with sufficient
  locking, eviction of anything mounted on top of the subtree, etc.

  This series converts a bunch of open-coded instances to using that"

* tag 'pull-simple_recursive_removal' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  functionfs, gadgetfs: use simple_recursive_removal()
  kill binderfs_remove_file()
  fuse_ctl: use simple_recursive_removal()
  pstore: switch to locked_recursive_removal()
  binfmt_misc: switch to locked_recursive_removal()
  spufs: switch to locked_recursive_removal()
  add locked_recursive_removal()
  better lockdep annotations for simple_recursive_removal()
  simple_recursive_removal(): saner interaction with fsnotify
2025-07-28 09:43:51 -07:00
Sumanth Gavini
bb76f0d843 usb: gadget: f_uac1: replace scnprintf() with sysfs_emit()
Documentation/filesystems/sysfs.rst mentions that show() should only
use sysfs_emit() or sysfs_emit_at() when formating the value to be
returned to user space. So replace scnprintf() with sysfs_emit().

Signed-off-by: Sumanth Gavini <sumanth.gavini@yahoo.com>
Link: https://lore.kernel.org/r/20250718175037.299710-1-sumanth.gavini@yahoo.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21 16:31:28 +02:00
Akash Kumar
323a80a1a5 usb: gadget: uvc: Initialize frame-based format color matching descriptor
Fix NULL pointer crash in uvcg_framebased_make due to uninitialized color
matching descriptor for frame-based format which was added in
commit f5e7bdd34a ("usb: gadget: uvc: Allow creating new color matching
descriptors") that added handling for uncompressed and mjpeg format.

Crash is seen when userspace configuration (via configfs) does not
explicitly define the color matching descriptor. If color_matching is not
found, config_group_find_item() returns NULL. The code then jumps to
out_put_cm, where it calls config_item_put(color_matching);. If
color_matching is NULL, this will dereference a null pointer, leading to a
crash.

[    2.746440] Unable to handle kernel NULL pointer dereference at virtual address 000000000000008c
[    2.756273] Mem abort info:
[    2.760080]   ESR = 0x0000000096000005
[    2.764872]   EC = 0x25: DABT (current EL), IL = 32 bits
[    2.771068]   SET = 0, FnV = 0
[    2.771069]   EA = 0, S1PTW = 0
[    2.771070]   FSC = 0x05: level 1 translation fault
[    2.771071] Data abort info:
[    2.771072]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[    2.771073]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[    2.771074]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[    2.771075] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000a3e59000
[    2.771077] [000000000000008c] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[    2.771081] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
[    2.771084] Dumping ftrace buffer:
[    2.771085]    (ftrace buffer empty)
[    2.771138] CPU: 7 PID: 486 Comm: ln Tainted: G        W   E      6.6.58-android15
[    2.771139] Hardware name: Qualcomm Technologies, Inc. SunP QRD HDK (DT)
[    2.771140] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[    2.771141] pc : __uvcg_fill_strm+0x198/0x2cc
[    2.771145] lr : __uvcg_iter_strm_cls+0xc8/0x17c
[    2.771146] sp : ffffffc08140bbb0
[    2.771146] x29: ffffffc08140bbb0 x28: ffffff803bc81380 x27: ffffff8023bbd250
[    2.771147] x26: ffffff8023bbd250 x25: ffffff803c361348 x24: ffffff803d8e6768
[    2.771148] x23: 0000000000000004 x22: 0000000000000003 x21: ffffffc08140bc48
[    2.771149] x20: 0000000000000000 x19: ffffffc08140bc48 x18: ffffffe9f8cf4a00
[    2.771150] x17: 000000001bf64ec3 x16: 000000001bf64ec3 x15: ffffff8023bbd250
[    2.771151] x14: 000000000000000f x13: 004c4b40000f4240 x12: 000a2c2a00051615
[    2.771152] x11: 000000000000004f x10: ffffffe9f76b40ec x9 : ffffffe9f7e389d0
[    2.771153] x8 : ffffff803d0d31ce x7 : 000f4240000a2c2a x6 : 0005161500028b0a
[    2.771154] x5 : ffffff803d0d31ce x4 : 0000000000000003 x3 : 0000000000000000
[    2.771155] x2 : ffffffc08140bc50 x1 : ffffffc08140bc48 x0 : 0000000000000000
[    2.771156] Call trace:
[    2.771157]  __uvcg_fill_strm+0x198/0x2cc
[    2.771157]  __uvcg_iter_strm_cls+0xc8/0x17c
[    2.771158]  uvcg_streaming_class_allow_link+0x240/0x290
[    2.771159]  configfs_symlink+0x1f8/0x630
[    2.771161]  vfs_symlink+0x114/0x1a0
[    2.771163]  do_symlinkat+0x94/0x28c
[    2.771164]  __arm64_sys_symlinkat+0x54/0x70
[    2.771164]  invoke_syscall+0x58/0x114
[    2.771166]  el0_svc_common+0x80/0xe0
[    2.771168]  do_el0_svc+0x1c/0x28
[    2.771169]  el0_svc+0x3c/0x70
[    2.771172]  el0t_64_sync_handler+0x68/0xbc
[    2.771173]  el0t_64_sync+0x1a8/0x1ac

Initialize color matching descriptor for frame-based format to prevent
NULL pointer crash by mirroring the handling done for uncompressed and
mjpeg formats.

Fixes: 7b5a58952f ("usb: gadget: uvc: configfs: Add frame-based frame format support")
Cc: stable <stable@kernel.org>
Signed-off-by: Akash Kumar <quic_akakum@quicinc.com>
Link: https://lore.kernel.org/r/20250718085138.1118788-1-quic_akakum@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-21 16:30:00 +02:00
Sumanth Gavini
7168c06d9b usb: gadget: f_uac2: replace scnprintf() with sysfs_emit()
Documentation/filesystems/sysfs.rst mentions that show() should only
use sysfs_emit() or sysfs_emit_at() when formating the value to be
returned to user space. So replace scnprintf() with sysfs_emit().

Signed-off-by: Sumanth Gavini <sumanth.gavini@yahoo.com>
Link: https://lore.kernel.org/r/20250704003425.467299-1-sumanth.gavini@yahoo.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-07 11:05:30 +02:00
Ingo Rohloff
b581e472d9 usb: gadget: f_fs: Remove unnecessary spinlocks.
Commit 24729b307e ("usb: gadget: f_fs: Fix race between aio_cancel()
and AIO request complete") moved the call to usb_ep_free_request() from
ffs_epfile_async_io_complete() to ffs_user_copy_worker().

In ffs_user_copy_worker(), ki_complete() is called before
usb_ep_free_request().  Once ki_complete() returns, ffs_aio_cancel() can
no longer be invoked for the completed kiocb, as ki_complete() removes it
from the &ctx->active_reqs list in aio.c.  ffs_aio_cancel() only applies
to kiocb instances still present on this list.

The potential race between ki_complete() and ffs_aio_cancel() is already
guarded by the &ctx->ctx_lock spinlock in aio.c.

As a result, there is no race condition between the usb_ep_dequeue() call
in ffs_aio_cancel() and the usb_ep_free_request() call in
ffs_user_copy_worker().  Consequently, the spin lock/unlock operations on
&io_data->ffs->eps_lock are no longer necessary.

Signed-off-by: Ingo Rohloff <ingo.rohloff@lauterbach.com>
Link: https://lore.kernel.org/r/20250701113602.33402-2-ingo.rohloff@lauterbach.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-07 11:05:21 +02:00
Yuhao Jiang
62783c30d7 USB: gadget: f_hid: Fix memory leak in hidg_bind error path
In hidg_bind(), if alloc_workqueue() fails after usb_assign_descriptors()
has successfully allocated the USB descriptors, the current error handling
does not call usb_free_all_descriptors() to free the allocated descriptors,
resulting in a memory leak.

Restructure the error handling by adding proper cleanup labels:
- fail_free_all: cleans up workqueue and descriptors
- fail_free_descs: cleans up descriptors only
- fail: original cleanup for earlier failures

This ensures that allocated resources are properly freed in reverse order
of their allocation, preventing the memory leak when alloc_workqueue() fails.

Fixes: a139c98f76 ("USB: gadget: f_hid: Add GET_REPORT via userspace IOCTL")
Cc: stable@vger.kernel.org
Signed-off-by: Yuhao Jiang <danisjiang@gmail.com>
Link: https://lore.kernel.org/r/20250623094844.244977-1-danisjiang@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-07 11:03:33 +02:00
Greg Kroah-Hartman
81c3b7256f Merge merge point of tag 'usb-6.16-rc5' into usb-next
We need the USB fixes in here as well to build on top of for other
changes that depend on them.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-05 07:52:33 +02:00
Al Viro
bad356bb50 functionfs, gadgetfs: use simple_recursive_removal()
usual mount leaks if something had been bound on top of disappearing
files there.

Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2025-07-02 22:36:52 -04:00
Dan Carpenter
e35a5d8145 usb: gadget: u_serial: remove some dead code
There is no need to check if "port" is NULL.  We already verified that it
is non-NULL.  It's a stack variable and can't be modified by a different
thread.  Delete this dead code.

Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Prashanth K <prashanth.k@oss.qualcomm.com>
Link: https://lore.kernel.org/r/685c1413.050a0220.1a8223.d0b9@mx.google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-28 17:24:17 +02:00
Kuen-Han Tsai
c529c3730b usb: gadget: u_serial: Fix race condition in TTY wakeup
A race condition occurs when gs_start_io() calls either gs_start_rx() or
gs_start_tx(), as those functions briefly drop the port_lock for
usb_ep_queue(). This allows gs_close() and gserial_disconnect() to clear
port.tty and port_usb, respectively.

Use the null-safe TTY Port helper function to wake up TTY.

Example
  CPU1:			      CPU2:
  gserial_connect() // lock
  			      gs_close() // await lock
  gs_start_rx()     // unlock
  usb_ep_queue()
  			      gs_close() // lock, reset port.tty and unlock
  gs_start_rx()     // lock
  tty_wakeup()      // NPE

Fixes: 35f95fd7f2 ("TTY: usb/u_serial, use tty from tty_port")
Cc: stable <stable@kernel.org>
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Reviewed-by: Prashanth K <prashanth.k@oss.qualcomm.com>
Link: https://lore.kernel.org/linux-usb/20240116141801.396398-1-khtsai@google.com/
Link: https://lore.kernel.org/r/20250617050844.1848232-2-khtsai@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-19 12:41:13 +02:00
Kuen-Han Tsai
f6c7bc4a68 Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
This reverts commit ffd603f214.

Commit ffd603f214 ("usb: gadget: u_serial: Add null pointer check in
gs_start_io") adds null pointer checks at the beginning of the
gs_start_io() function to prevent a null pointer dereference. However,
these checks are redundant because the function's comment already
requires callers to hold the port_lock and ensure port.tty and port_usb
are not null. All existing callers already follow these rules.

The true cause of the null pointer dereference is a race condition. When
gs_start_io() calls either gs_start_rx() or gs_start_tx(), the port_lock
is temporarily released for usb_ep_queue(). This allows port.tty and
port_usb to be cleared.

Fixes: ffd603f214 ("usb: gadget: u_serial: Add null pointer check in gs_start_io")
Cc: stable <stable@kernel.org>
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Reviewed-by: Prashanth K <prashanth.k@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250617050844.1848232-1-khtsai@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-19 12:41:09 +02:00
Chen Ni
b0ef41f164 usb: gadget: f_fs: Use USB API functions rather than constants
Use the function usb_endpoint_num() rather than constants.

The Coccinelle semantic patch is as follows:

@@ struct usb_endpoint_descriptor *epd; @@

- (epd->bEndpointAddress & \(USB_ENDPOINT_NUMBER_MASK\|0x0f\))
+ usb_endpoint_num(epd)

Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Link: https://lore.kernel.org/r/20250618070216.817034-1-nichen@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-19 12:24:01 +02:00
Linus Torvalds
c0c9379f23 USB/Thunderbolt changes for 6.16-rc1
Here is the big set of USB and Thunderbolt changes for 6.16-rc1.
 Included in here are the following:
   - USB offload support for audio devices.  I think this takes the
     record for the most number of patch series (30+) over the longest
     period of time (2+ years) to get merged properly.  Many props go to
     Wesley Cheng for seeing this effort through, they took a major
     out-of-tree hacked-up-monstrosity that was created by multiple
     vendors for their specific devices, got it all merged into a
     semi-coherent set of changes, and got all of the different major
     subsystems to agree on how this should be implemented both with
     changes to their code as well as userspace apis, AND wrangled the
     hardware companies into agreeing to go forward with this, despite
     making them all redo work they had already done in their private
     device trees.  This feature offers major power savings on embedded
     devices where a USB audio stream can continue to flow while the rest
     of the system is sleeping, something that devices running on battery
     power really care about.  There are still some more small tweaks
     left to be done here, and those patches are still out for review and
     arguing among the different hardware companies, but this is a major
     step forward and a great example of how to do upstream development
     well.
   - small number of thunderbolt fixes and updates, things seem to be
     slowing down here (famous last words...)
   - xhci refactors and reworking to try to handle some rough corner
     cases in some hardware implementations where things don't always
     work properly
   - typec driver updates
   - USB3 power management reworking and updates
   - Removal of some old and orphaned UDC gadget drivers that had not
     been used in a very long time, dropping over 11 thousand lines from
     the tree, always a nice thing, making up for the 12k lines added for
     the USB offload feature.
   - lots of little updates and fixes in different drivers
 
 All of these have been in linux-next for over 2 weeks, the USB offload
 logic has been in there for 8 weeks now, with no reported issues
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaEKnpA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ym3zQCgz+Oz3DHfLcYOX7evGI2PjI4GNMkAoJa6Kndw
 h4YgL+8MeBpKuHCQvxy8
 =KVAn
 -----END PGP SIGNATURE-----

Merge tag 'usb-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt changes for 6.16-rc1.
  Included in here are the following:

   - USB offload support for audio devices.

     I think this takes the record for the most number of patch series
     (30+) over the longest period of time (2+ years) to get merged
     properly.

     Many props go to Wesley Cheng for seeing this effort through, they
     took a major out-of-tree hacked-up-monstrosity that was created by
     multiple vendors for their specific devices, got it all merged into
     a semi-coherent set of changes, and got all of the different major
     subsystems to agree on how this should be implemented both with
     changes to their code as well as userspace apis, AND wrangled the
     hardware companies into agreeing to go forward with this, despite
     making them all redo work they had already done in their private
     device trees.

     This feature offers major power savings on embedded devices where a
     USB audio stream can continue to flow while the rest of the system
     is sleeping, something that devices running on battery power really
     care about. There are still some more small tweaks left to be done
     here, and those patches are still out for review and arguing among
     the different hardware companies, but this is a major step forward
     and a great example of how to do upstream development well.

   - small number of thunderbolt fixes and updates, things seem to be
     slowing down here (famous last words...)

   - xhci refactors and reworking to try to handle some rough corner
     cases in some hardware implementations where things don't always
     work properly

   - typec driver updates

   - USB3 power management reworking and updates

   - Removal of some old and orphaned UDC gadget drivers that had not
     been used in a very long time, dropping over 11 thousand lines from
     the tree, always a nice thing, making up for the 12k lines added
     for the USB offload feature.

   - lots of little updates and fixes in different drivers

  All of these have been in linux-next for over 2 weeks, the USB offload
  logic has been in there for 8 weeks now, with no reported issues"

* tag 'usb-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (172 commits)
  ALSA: usb-audio: qcom: fix USB_XHCI dependency
  ASoC: qdsp6: fix compile-testing without CONFIG_OF
  usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n
  usb: typec: tipd: fix typo in TPS_STATUS_HIGH_VOLAGE_WARNING macro
  USB: typec: fix const issue in typec_match()
  USB: gadget: udc: fix const issue in gadget_match_driver()
  USB: gadget: fix up const issue with struct usb_function_instance
  USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB
  USB: serial: bus: fix const issue in usb_serial_device_match()
  usb: usbtmc: Fix timeout value in get_stb
  usb: usbtmc: Fix read_stb function and get_stb ioctl
  ALSA: qc_audio_offload: try to reduce address space confusion
  ALSA: qc_audio_offload: avoid leaking xfer_buf allocation
  ALSA: qc_audio_offload: rename dma/iova/va/cpu/phys variables
  ALSA: usb-audio: qcom: Fix an error handling path in qc_usb_audio_probe()
  usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence
  dt-bindings: usb: ti,usb8041: Add binding for TI USB8044 hub controller
  usb: misc: onboard_usb_dev: Add support for TI TUSB8044 hub
  usb: gadget: lpc32xx_udc: Use USB API functions rather than constants
  usb: gadget: epautoconf: Use USB API functions rather than constants
  ...
2025-06-06 12:45:35 -07:00
Linus Torvalds
2043ae9019 hid-for-linus-2025060301
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEL65usyKPHcrRDEicpmLzj2vtYEkFAmg+pVMACgkQpmLzj2vt
 YEn8YxAAsCe6HLZ6OJumeK9YqyIjvxahJc2O/OoJkeSNvsAu4/IOdIncWxsSy6R1
 /jR8K/E5VMycuoKUsdKWyLuTr+Kv0GKSjSb7sJ5t6sGyECosaz8SiNzZvVsRNn6+
 oYd/4A739og+SoRDhU7wliQNoj32yHZR4X9n0rtvkd8AQ8jb0cS9KFtNdVCKy2vi
 vwbqiIjHWBwwr34GFlRYkcQKku0MfSgo1ZzppdvalQmwdZltQDDvfOK0zo1Xno/i
 5BRfhI7+nf+gXk3PTU4bx1MA1GBMtuCeaW2/tgK7FWC7SrB6H4U36OajsaIisynf
 uX8itqtLivW/gLs1wmi+UwgGFMwyyuipb2fJrIRZlAeYg7wyaMM4GN6jMEec/yEZ
 6dDoVP84RFT8TPFm6aKC0pvI8jcnA+yz9qoohXKwxbTmU4aRsREIkF0x6eKrT8uM
 xm/5OtIVxPXHZUHq7P9cazVwteglELvKfWa4eO4c6DRDg6d1FukHT1N1jqxneBME
 jgVDS0jJxTkEDBkm+y8mN9LZQ84jj3wE3QJBKWMlxbE2/yI0sqqtsNm/MUZi3YZS
 OE2GkYrA3qcyu4Luyu1GU72OYjE4wmPYwAh+NkOKqG9sMBKnxKGTdMGQOlIqh8aJ
 60WODUR7GsWpZ+NxJIMMhGaDJt3bxhMD2hz53ImAqQXJYUR2yMc=
 =qI/U
 -----END PGP SIGNATURE-----

Merge tag 'hid-for-linus-2025060301' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

Pull HID updates from Jiri Kosina:

 - support for Apple Magic Mouse 2 USB-C (Aditya Garg)

 - power management improvement for multitouch devices (Werner Sembach)

 - fix for ACPI initialization in intel-thc driver (Wentao Guan)

 - adaptation of HID drivers to use new gpio_chip's line setter
   callbacks (Bartosz Golaszewski)

 - fix potential OOB in usbhid_parse() (Terry Junge)

 - make it possible to set hid_mouse_ignore_list dynamically (the same
   way we handle other quirks) (Aditya Garg)

 - other small assorted fixes and device ID additions

* tag 'hid-for-linus-2025060301' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: multitouch: Disable touchpad on firmware level while not in use
  HID: core: Add functions for HID drivers to react on first open and last close call
  HID: HID_APPLETB_BL should depend on X86
  HID: HID_APPLETB_KBD should depend on X86
  HID: appletb-kbd: Use secs_to_jiffies() instead of msecs_to_jiffies()
  HID: intel-thc-hid: intel-thc: make read-only arrays static const
  HID: magicmouse: Apple Magic Mouse 2 USB-C support
  HID: mcp2221: use new line value setter callbacks
  HID: mcp2200: use new line value setter callbacks
  HID: cp2112: use new line value setter callbacks
  HID: cp2112: use lock guards
  HID: cp2112: hold the lock for the entire direction_output() call
  HID: cp2112: destroy mutex on driver detach
  HID: intel-thc-hid: intel-quicki2c: pass correct arguments to acpi_evaluate_object
  HID: corsair-void: Use to_delayed_work()
  HID: hid-logitech: use sysfs_emit_at() instead of scnprintf()
  HID: quirks: Add HID_QUIRK_IGNORE_MOUSE quirk
  HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
  HID: Kysona: Add periodic online check
2025-06-03 10:34:36 -07:00
Greg Kroah-Hartman
d1d89e8eee USB: gadget: fix up const issue with struct usb_function_instance
In struct usb_function, the struct usb_function_instance pointer
variable "fi" is listed as const, but it is written to in numerous
places, making the const marking of it a total lie.  Fix this up by just
removing the const pointer attribute as this is modified in numerous
places.

Link: https://lore.kernel.org/r/2025052145-undress-puma-f7cf@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-23 12:31:34 +02:00
Prashanth K
1c06aff9b8 usb: gadget: u_serial: Avoid double unlock of serial_port_lock
Avoid unlocking serial_port_lock twice in gserial_suspend(), this can
occur if gserial_wakeup_host() fails. And since wakeup is performed
outside spinlock, check if the port is valid before proceeding again.

Fixes: 3baea29dc0 ("usb: gadget: u_serial: Implement remote wakeup capability")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/aBHatifO5bjR1yPt@stanley.mountain/
Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250506104912.3750934-1-prashanth.k@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21 13:10:07 +02:00
Linus Torvalds
04811c3eb6 sound fixes for 6.15-rc7
A handful small fixes.  The only significant change is the fix for
 MIDI 2.0 UMP handling in ALSA sequencer, but as MIDI 2.0 stuff is
 still new and rarely used, the impact should be pretty limited.
 
 Other than that, quirks for USB-audio and a few cosmetic fixes and
 changes in drivers that should be safe to apply.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmgm7GQOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE/E1w//RT8tVE3WCHTtbexFRoBp7DyvGM0Lx28vdxnc
 TRAc70Cnmf0QRBB7ddZGSV+nXHheb1nktgoYitiSTu16rXvwD7xQjeji+I/BlCiD
 +CpkWW/Z1zN++M//do0tSmnqosrvDSzWc/8G5Lp2IwqhXqVhjtoS2YYauJuvw8XM
 WoN+6jpZVg3gVK4qniah2nTFAGX2c9bHJKcn/zykRzyq224VzM8YMOYI1tvjW1ni
 Wfbm/z/q8mclwfIhq8s2UMy5adR2szbyutSgOLAO2A0BGTNiQgvKLlMZOpivsTHL
 nxkxUJ7bU9NnQyGP5Nb56fvQAb9hN+s4f4SDvEoFdNb94yYbn5IEvVIbVSBDcTl9
 nadwD06R7XeD1EZeVgVoXrfR+kXLknNm9hlstJRkmBRKxJO6yDNkwKbZ+NNXqrvr
 AOPBunF+QI3HyBsK80SKjSLUTllQ+NI7MDT9aF30LZ7m26rX9t+gAmp9yP/aqxqX
 qclowxc9UuMgrgj7isq4VaEFJQ0g2ev9C/oZJLleJjHvtebkj9zGoZPr1NMTX2Mh
 sgVU8s0mnaGnFpiZ6SXDoSyyK2fKwWHzIQuBmKrz/x801FB4KS/IILg+VunFeC6a
 OeNI3pRpc9jKPnI7GEH5eUoPF4cFFhMqs6h2o/IEl8LH+VDoGfpqD2cpcOyJlMUe
 Tz82Pd4=
 =kbgJ
 -----END PGP SIGNATURE-----

Merge tag 'sound-6.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A handful small fixes. The only significant change is the fix for MIDI
  2.0 UMP handling in ALSA sequencer, but as MIDI 2.0 stuff is still new
  and rarely used, the impact should be pretty limited.

  Other than that, quirks for USB-audio and a few cosmetic fixes and
  changes in drivers that should be safe to apply"

* tag 'sound-6.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera
  ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
  ALSA: sh: SND_AICA should depend on SH_DMA_API
  ALSA: usb-audio: Add sample rate quirk for Audioengine D1
  ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info
  ALSA/hda: intel-sdw-acpi: Correct sdw_intel_acpi_scan() function parameter
  ALSA: seq: Fix delivery of UMP events to group ports
2025-05-16 09:06:12 -07:00
Greg Kroah-Hartman
ab6dc9a6c7 Merge 6.15-rc6 into usb-next
We need the USB fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-13 08:26:58 +02:00
Takashi Iwai
dd33993a97 ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info
s/devince/device/

It's used only internally, so no any behavior changes.

Fixes: 37e0e14128 ("ALSA: ump: Support UMP Endpoint and Function Block parsing")
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20250511141147.10246-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-05-11 16:27:55 +02:00
Prashanth K
8e3820271c usb: gadget: f_ecm: Add get_status callback
When host sends GET_STATUS to ECM interface, handle the request
from the function driver. Since the interface is wakeup capable,
set the corresponding bit, and set RW bit if the function is
already armed for wakeup by the host.

Cc: stable <stable@kernel.org>
Fixes: 481c225c48 ("usb: gadget: Handle function suspend feature selector")
Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
Reviewed-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/20250422103231.1954387-2-prashanth.k@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-01 17:38:41 +02:00
Ben Hoff
ea34925f5b usb: gadget: hid: allow dynamic interval configuration via configfs
This patch enhances the HID gadget driver to support dynamic configuration
of the interrupt polling interval (bInterval) via configfs.  A new
‘interval’ attribute is exposed under each HID function’s configfs
directory, and any write to it will adjust the poll rate for all endpoints
without requiring a rebuild.

When the attribute has never been written, legacy defaults are preserved:
  • Full-Speed (FS) endpoints (IN & OUT) poll every 10 ms
  • High-Speed (HS) endpoints (IN & OUT) poll every 4 micro-frames
    (~1 ms)

To implement this cleanly:
  • Add two new fields to f_hid_opts and f_hidg:
      – unsigned char interval
      – bool           interval_user_set
  • Introduce dedicated f_hid_opts_interval_show/store functions.
    The store routine parses into an unsigned int, bounds‐checks,
    assigns to opts->interval, and sets opts->interval_user_set = true.
  • Initialize opts->interval = 4 and opts->interval_user_set = false in
    hidg_alloc_inst(), then copy both into the live f_hidg instance in
    hidg_alloc().
  • In hidg_bind(), set each endpoint’s bInterval based on whether the
  user has written the attribute:
      – If interval_user_set == false, use FS=10 / HS=4
      – If interval_user_set == true, use the user’s value for both FS
        & HS

Signed-off-by: Ben Hoff <hoff.benjamin.k@gmail.com>
Link: https://lore.kernel.org/r/20250429182809.811786-1-hoff.benjamin.k@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-01 17:30:48 +02:00
Prashanth K
3baea29dc0 usb: gadget: u_serial: Implement remote wakeup capability
Implement the remote wakeup capability for u_serial. The newly added
function gserial_wakeup_host() wakes up the host when there is some
data to be sent while the device is suspended. Add gser_get_status()
callbacks to advertise f_serial interface as function wakeup capable.

Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250424121142.4180241-1-prashanth.k@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-04-25 13:42:04 +02:00
Terry Junge
fe7f7ac8e0 HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
Update struct hid_descriptor to better reflect the mandatory and
optional parts of the HID Descriptor as per USB HID 1.11 specification.
Note: the kernel currently does not parse any optional HID class
descriptors, only the mandatory report descriptor.

Update all references to member element desc[0] to rpt_desc.

Add test to verify bLength and bNumDescriptors values are valid.

Replace the for loop with direct access to the mandatory HID class
descriptor member for the report descriptor. This eliminates the
possibility of getting an out-of-bounds fault.

Add a warning message if the HID descriptor contains any unsupported
optional HID class descriptors.

Reported-by: syzbot+c52569baf0c843f35495@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495
Fixes: f043bfc98c ("HID: usbhid: fix out-of-bounds bug")
Cc: stable@vger.kernel.org
Signed-off-by: Terry Junge <linuxhid@cosmicgizmosystems.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-04-24 11:31:25 +02:00
Chen Yufeng
1538740103 usb: potential integer overflow in usbg_make_tpg()
The variable tpgt in usbg_make_tpg() is defined as unsigned long and is
assigned to tpgt->tport_tpgt, which is defined as u16. This may cause an
integer overflow when tpgt is greater than USHRT_MAX (65535). I
haven't tried to trigger it myself, but it is possible to trigger it
by calling usbg_make_tpg() with a large value for tpgt.

I modified the type of tpgt to match tpgt->tport_tpgt and adjusted the
relevant code accordingly.

This patch is similar to commit 59c816c1f2 ("vhost/scsi: potential
memory corruption").

Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
Link: https://lore.kernel.org/r/20250415065857.1619-1-chenyufeng@iie.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-04-15 14:29:33 +02:00
Peter Korsgaard
937a8a3a8d usb: gadget: f_hid: wake up readers on disable/unbind
Similar to how it is done in the write path.

Add a disabled flag to track the function state and use it to exit the read
loops to ensure no readers get stuck when the function is disabled/unbound,
protecting against corruption when the waitq and spinlocks are reinitialized
in hidg_bind().

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Link: https://lore.kernel.org/r/20250318152207.330997-1-peter@korsgaard.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-04-11 16:08:33 +02:00
Gustavo A. R. Silva
24454a11dd usb: gadget: uvc: Avoid -Wflex-array-member-not-at-end warnings
-Wflex-array-member-not-at-end was introduced in GCC-14, and we are
getting ready to enable it, globally.

Move the conflicting declaration to the end of the structure. Notice
that `struct uvc_input_header_descriptor` is a flexible structure --a
structure that contains a flexible-array member.

With this, fix three of the following warnings:

drivers/usb/gadget/function/uvc_configfs.h:77:57: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <kees@kernel.org>
Link: https://lore.kernel.org/r/Z9dyY7_ydJiGqh_d@kspp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-04-11 16:08:33 +02:00
Linus Torvalds
a1b5bd45d4 USB/Thunderbolt update for 6.15-rc1
Here is the big set of USB and Thunderbolt driver updates for 6.15-rc1.
 Included in here are:
   - Thunderbolt driver and core api updates for new hardware and
     features
   - usb-storage const array cleanups
   - typec driver updates
   - dwc3 driver updates
   - xhci driver updates and bugfixes
   - small USB documentation updates
   - usb cdns3 driver updates
   - usb gadget driver updates
   - other small driver updates and fixes
 
 All of these have been in linux-next for a while with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCZ+2Zaw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ynIgQCaAyMozdrZtTiOs1OcZEuTkoCtKrEAniqe0OiL
 s7R6j2NoOIwo9d6hBsjh
 =IH7I
 -----END PGP SIGNATURE-----

Merge tag 'usb-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt driver updates for
  6.15-rc1. Included in here are:

   - Thunderbolt driver and core api updates for new hardware and
     features

   - usb-storage const array cleanups

   - typec driver updates

   - dwc3 driver updates

   - xhci driver updates and bugfixes

   - small USB documentation updates

   - usb cdns3 driver updates

   - usb gadget driver updates

   - other small driver updates and fixes

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'usb-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (92 commits)
  thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer
  thunderbolt: Scan retimers after device router has been enumerated
  usb: host: cdns3: forward lost power information to xhci
  usb: host: xhci-plat: allow upper layers to signal power loss
  usb: xhci: change xhci_resume() parameters to explicit the desired info
  usb: cdns3-ti: run HW init at resume() if HW was reset
  usb: cdns3-ti: move reg writes to separate function
  usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
  usb: cdns3: rename hibernated argument of role->resume() to lost_power
  usb: xhci: tegra: rename `runtime` boolean to `is_auto_runtime`
  usb: host: xhci-plat: mvebu: use ->quirks instead of ->init_quirk() func
  usb: dwc3: Don't use %pK through printk
  usb: core: Don't use %pK through printk
  usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
  dt-bindings: usb: qcom,dwc3: Synchronize minItems for interrupts and -names
  usb: common: usb-conn-gpio: switch psy_cfg from of_node to fwnode
  usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running
  usb: xhci: Don't change the status of stalled TDs on failed Stop EP
  xhci: Avoid queuing redundant Stop Endpoint command for stalled endpoint
  xhci: Handle spurious events on Etron host isoc enpoints
  ...
2025-04-02 18:23:31 -07:00
Linus Torvalds
2e3fcbcc3b SCSI misc on 20250326
Updates to the usual drivers (scsi_debug, ufs, lpfc, st, fnic, mpi3mr,
 mpt3sas) and the removal of cxlflash. The only non-trivial core change
 is an addition to unit attention handling to recognize UAs for power
 on/reset and new media so the tape driver can use it.
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCZ+RQ2yYcamFtZXMuYm90
 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pishe6DAQCdW/21
 S1Y6BDlJLQfpWChGv6GIzanC+5sMfylw4d6ULgEA8upOE5L3fC29IY958jXig0o1
 uLjxylwYEfVLDf8gwJ0=
 =mkM+
 -----END PGP SIGNATURE-----

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI updates from James Bottomley:
 "Updates to the usual drivers (scsi_debug, ufs, lpfc, st, fnic, mpi3mr,
  mpt3sas) and the removal of cxlflash.

  The only non-trivial core change is an addition to unit attention
  handling to recognize UAs for power on/reset and new media so the tape
  driver can use it"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (107 commits)
  scsi: st: Tighten the page format heuristics with MODE SELECT
  scsi: st: ERASE does not change tape location
  scsi: st: Fix array overflow in st_setup()
  scsi: target: tcm_loop: Fix wrong abort tag
  scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp->nlp_flag
  scsi: hisi_sas: Fixed failure to issue vendor specific commands
  scsi: fnic: Remove unnecessary NUL-terminations
  scsi: fnic: Remove redundant flush_workqueue() calls
  scsi: core: Use a switch statement when attaching VPD pages
  scsi: ufs: renesas: Add initialization code for R-Car S4-8 ES1.2
  scsi: ufs: renesas: Add reusable functions
  scsi: ufs: renesas: Refactor 0x10ad/0x10af PHY settings
  scsi: ufs: renesas: Remove register control helper function
  scsi: ufs: renesas: Add register read to remove save/set/restore
  scsi: ufs: renesas: Replace init data by init code
  scsi: ufs: dt-bindings: renesas,ufs: Add calibration data
  scsi: mpi3mr: Task Abort EH Support
  scsi: storvsc: Don't report the host packet status as the hv status
  scsi: isci: Make most module parameters static
  scsi: megaraid_sas: Make most module parameters static
  ...
2025-03-26 19:57:34 -07:00
Linus Torvalds
a50b4fe095 A treewide hrtimer timer cleanup
hrtimers are initialized with hrtimer_init() and a subsequent store to
   the callback pointer. This turned out to be suboptimal for the upcoming
   Rust integration and is obviously a silly implementation to begin with.
 
   This cleanup replaces the hrtimer_init(T); T->function = cb; sequence
   with hrtimer_setup(T, cb);
 
   The conversion was done with Coccinelle and a few manual fixups.
 
   Once the conversion has completely landed in mainline, hrtimer_init()
   will be removed and the hrtimer::function becomes a private member.
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCgAxFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmff5jQTHHRnbHhAbGlu
 dXRyb25peC5kZQAKCRCmGPVMDXSYoVvRD/wKtuwmiA66NJFgXC0qVq82A6fO3bY8
 GBdbfysDJIbqGu5PTcULTbJ8qkqv3jeLUv6CcXvS4sZ7y/uJQl2lzf8yrD/0bbwc
 rLI6sHiPSZmK93kNVN4X5H7kvt7cE/DYC9nnEOgK3BY5FgKc4n9887d4aVBhL8Lv
 ODwVXvZ+xi351YCj7qRyPU24zt/p4tkkT1o2k4a0HBluqLI0D+V20fke9IERUL8r
 d1uWKlcn0TqYDesE8HXKIhbst3gx52rMJrXBJDHwFmG6v8Pj1fkTXCVpPo8QcBz8
 OTVkpomN9f/Tx4+GZwhZOF86LhLL3OhxD6pT7JhFCXdmSGv+Ez8uyk1YZysM/XpV
 Juy/1yAcBpDIDkmhMFGdAAn48Nn9Fotty0r4je60zSEp1d/4QMXcFme29qr2JTUE
 iWnQ/HD6DxUjVHqy7CYvvo26Xegg1C7qgyOVt4PYZwAM1VKF5P3kzYTb4SAdxtop
 Tpji1sfW9QV08jqMNo6XntD32DSP9S2HqjO9LwBw700jnx2jjJ35fcJs6iodMOUn
 gckIZLMn3L0OoglPdyA5O7SNTbKE7aFiRKdnT/cJtR3Fa39Qu27CwC5gfiyuie9I
 Q+LG8GLuYSBHXAR+PBK4GWlzJ7Dn8k3eqmbnLeKpRMsU6ZzcttgA64xhaviN2wN0
 iJbvLJeisXr3GA==
 =bYAX
 -----END PGP SIGNATURE-----

Merge tag 'timers-cleanups-2025-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer cleanups from Thomas Gleixner:
 "A treewide hrtimer timer cleanup

  hrtimers are initialized with hrtimer_init() and a subsequent store to
  the callback pointer. This turned out to be suboptimal for the
  upcoming Rust integration and is obviously a silly implementation to
  begin with.

  This cleanup replaces the hrtimer_init(T); T->function = cb; sequence
  with hrtimer_setup(T, cb);

  The conversion was done with Coccinelle and a few manual fixups.

  Once the conversion has completely landed in mainline, hrtimer_init()
  will be removed and the hrtimer::function becomes a private member"

* tag 'timers-cleanups-2025-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (100 commits)
  wifi: rt2x00: Switch to use hrtimer_update_function()
  io_uring: Use helper function hrtimer_update_function()
  serial: xilinx_uartps: Use helper function hrtimer_update_function()
  ASoC: fsl: imx-pcm-fiq: Switch to use hrtimer_setup()
  RDMA: Switch to use hrtimer_setup()
  virtio: mem: Switch to use hrtimer_setup()
  drm/vmwgfx: Switch to use hrtimer_setup()
  drm/xe/oa: Switch to use hrtimer_setup()
  drm/vkms: Switch to use hrtimer_setup()
  drm/msm: Switch to use hrtimer_setup()
  drm/i915/request: Switch to use hrtimer_setup()
  drm/i915/uncore: Switch to use hrtimer_setup()
  drm/i915/pmu: Switch to use hrtimer_setup()
  drm/i915/perf: Switch to use hrtimer_setup()
  drm/i915/gvt: Switch to use hrtimer_setup()
  drm/i915/huc: Switch to use hrtimer_setup()
  drm/amdgpu: Switch to use hrtimer_setup()
  stm class: heartbeat: Switch to use hrtimer_setup()
  i2c: Switch to use hrtimer_setup()
  iio: Switch to use hrtimer_setup()
  ...
2025-03-25 10:54:15 -07:00
Greg Kroah-Hartman
525b139fb4 Merge v6.14-rc6 into usb-next
Resolves the merge conflict with:
	drivers/usb/typec/ucsi/ucsi_acpi.c

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-03-10 08:16:31 +01:00
Prashanth K
17c2c87c37 usb: gadget: u_ether: Set is_suspend flag if remote wakeup fails
Currently while UDC suspends, u_ether attempts to remote wakeup
the host if there are any pending transfers. However, if remote
wakeup fails, the UDC remains suspended but the is_suspend flag
is not set. And since is_suspend flag isn't set, the subsequent
eth_start_xmit() would queue USB requests to suspended UDC.

To fix this, bail out from gether_suspend() only if remote wakeup
operation is successful.

Cc: stable <stable@kernel.org>
Fixes: 0a1af6dfa0 ("usb: gadget: f_ecm: Add suspend/resume and remote wakeup support")
Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250212100840.3812153-1-prashanth.k@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-19 15:18:41 +01:00
Nam Cao
060baec57c usb: gadget: Switch to use hrtimer_setup()
hrtimer_setup() takes the callback function pointer as argument and
initializes the timer completely.

Replace hrtimer_init() and the open coded initialization of
hrtimer::function with the new setup mechanism.

Patch was created by using Coccinelle.

Signed-off-by: Nam Cao <namcao@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://lore.kernel.org/all/7239d6211ffb0dff6351d0549d065277f2562793.1738746904.git.namcao@linutronix.de
2025-02-18 11:19:02 +01:00
Greg Kroah-Hartman
f8da37e462 Merge 6.14-rc3 into usb-next
We need the USB fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-17 07:33:47 +01:00
Frederic Weisbecker
e5644be407 usb: gadget: uvc: Fix unstarted kthread worker
The behaviour of kthread_create_worker() was recently changed to align
with the one of kthread_create(). The kthread worker is created but not
awaken by default. This is to allow the use of kthread_affine_preferred()
and kthread_bind[_mask]() with kthread workers. In order to keep the
old behaviour and wake the kthread up, kthread_run_worker() must be
used. All the pre-existing users have been converted, except for UVC
that was introduced in the same merge window as the API change.

This results in hangs:

	INFO: task UVCG:82 blocked for more than 491 seconds.
	Tainted: G                T  6.13.0-rc2-00014-gb04e317b5226 #1
	task:UVCG            state:D stack:0     pid:82
	 Call Trace:
	 __schedule
	 schedule
	 schedule_preempt_disabled
	 kthread
	 ? kthread_flush_work
	 ret_from_fork
	 ret_from_fork_asm
	 entry_INT80_32

Fix this with converting UVCG kworker to the new API.

Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202502121025.55bfa801-lkp@intel.com
Fixes: f0bbfbd16b ("usb: gadget: uvc: rework to enqueue in pump worker from encoded queue")
Cc: stable <stable@kernel.org>
Cc: Michael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Link: https://lore.kernel.org/r/20250212135514.30539-1-frederic@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-14 09:26:00 +01:00
Jill Donahue
4ab37fcb42 USB: gadget: f_midi: f_midi_complete to call queue_work
When using USB MIDI, a lock is attempted to be acquired twice through a
re-entrant call to f_midi_transmit, causing a deadlock.

Fix it by using queue_work() to schedule the inner f_midi_transmit() via
a high priority work queue from the completion handler.

Link: https://lore.kernel.org/all/CAArt=LjxU0fUZOj06X+5tkeGT+6RbXzpWg1h4t4Fwa_KGVAX6g@mail.gmail.com/
Fixes: d5daf49b58 ("USB: gadget: midi: add midi function driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Jill Donahue <jilliandonahue58@gmail.com>
Link: https://lore.kernel.org/r/20250211174805.1369265-1-jdonahue@fender.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-14 09:24:20 +01:00
Bart Van Assche
0ea163a18b scsi: usb: Rename the RESERVE and RELEASE constants
The names RESERVE and RELEASE are not only used in <scsi/scsi_proto.h> but
also elsewhere in the kernel:

$ git grep -nHE 'define[[:blank:]]*(RESERVE|RELEASE)[[:blank:]]'
drivers/input/joystick/walkera0701.c:13:#define RESERVE 20000
drivers/s390/char/tape_std.h:56:#define RELEASE			0xD4	/* 3420 NOP, 3480 REJECT */
drivers/s390/char/tape_std.h:58:#define RESERVE			0xF4	/* 3420 NOP, 3480 REJECT */

Additionally, while the names of the symbolic constants RESERVE_10 and
RELEASE_10 include the command length, the command length is not included
in the RESERVE and RELEASE names. Address both issues by renaming the
RESERVE and RELEASE constants into RESERVE_6 and RELEASE_6 respectively.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20250210205031.2970833-1-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-02-12 22:20:55 -05:00
John Keeping
da16689970 usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
While the MIDI jacks are configured correctly, and the MIDIStreaming
endpoint descriptors are filled with the correct information,
bNumEmbMIDIJack and bLength are set incorrectly in these descriptors.

This does not matter when the numbers of in and out ports are equal, but
when they differ the host will receive broken descriptors with
uninitialized stack memory leaking into the descriptor for whichever
value is smaller.

The precise meaning of "in" and "out" in the port counts is not clearly
defined and can be confusing.  But elsewhere the driver consistently
uses this to match the USB meaning of IN and OUT viewed from the host,
so that "in" ports send data to the host and "out" ports receive data
from it.

Cc: stable <stable@kernel.org>
Fixes: c8933c3f79 ("USB: gadget: f_midi: allow a dynamic number of input and output ports")
Signed-off-by: John Keeping <jkeeping@inmusicbrands.com>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20250130195035.3883857-1-jkeeping@inmusicbrands.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-03 16:42:22 +01:00
Selvarasu Ganesan
9e8b21410f usb: gadget: f_midi: Fixing wMaxPacketSize exceeded issue during MIDI bind retries
The current implementation sets the wMaxPacketSize of bulk in/out
endpoints to 1024 bytes at the end of the f_midi_bind function. However,
in cases where there is a failure in the first midi bind attempt,
consider rebinding. This scenario may encounter an f_midi_bind issue due
to the previous bind setting the bulk endpoint's wMaxPacketSize to 1024
bytes, which exceeds the ep->maxpacket_limit where configured dwc3 TX/RX
FIFO's maxpacket size of 512 bytes for IN/OUT endpoints in support HS
speed only.

Here the term "rebind" in this context refers to attempting to bind the
MIDI function a second time in certain scenarios. The situations where
rebinding is considered include:

 * When there is a failure in the first UDC write attempt, which may be
   caused by other functions bind along with MIDI.
 * Runtime composition change : Example : MIDI,ADB to MIDI. Or MIDI to
   MIDI,ADB.

This commit addresses this issue by resetting the wMaxPacketSize before
endpoint claim. And here there is no need to reset all values in the usb
endpoint descriptor structure, as all members except wMaxPacketSize and
bEndpointAddress have predefined values.

This ensures that restores the endpoint to its expected configuration,
and preventing conflicts with value of ep->maxpacket_limit. It also
aligns with the approach used in other function drivers, which treat
endpoint descriptors as if they were full speed before endpoint claim.

Fixes: 46decc82ff ("usb: gadget: unconditionally allocate hs/ss descriptor in bind operation")
Cc: stable@vger.kernel.org
Signed-off-by: Selvarasu Ganesan <selvarasu.g@samsung.com>
Link: https://lore.kernel.org/r/20250118060134.927-1-selvarasu.g@samsung.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-03 16:39:32 +01:00
Hans Verkuil
7abbfe6e69 usb: gadget: uvc: drop vb2_ops_wait_prepare/finish
Since commit 88785982a1 ("media: vb2: use lock if wait_prepare/finish
are NULL") it is no longer needed to set the wait_prepare/finish
vb2_ops callbacks as long as the lock field in vb2_queue is set.

Since the vb2_ops_wait_prepare/finish callbacks already rely on that field,
we can safely drop these callbacks.

This simplifies the code and this is a step towards the goal of deleting
these callbacks.

Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org
Link: https://lore.kernel.org/r/2fb746b8-31c4-44e0-bf7b-7a0758edf52a@xs4all.nl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-03 16:28:42 +01:00
Greg Kroah-Hartman
086fd062bc Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null"
This reverts commit 13014969cb.

It is reported to cause crashes on Tegra systems, so revert it for now.

Link: https://lore.kernel.org/r/1037c1ad-9230-4181-b9c3-167dbaa47644@nvidia.com
Reported-by: Jon Hunter <jonathanh@nvidia.com>
Cc: stable <stable@kernel.org>
Cc: Lianqin Hu <hulianqin@vivo.com>
Link: https://lore.kernel.org/r/2025011711-yippee-fever-a737@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-01-17 12:41:16 +01:00
Krzysztof Kozlowski
5b6dc50e9e USB: gadget: Use str_enable_disable-like helpers
Replace ternary (condition ? "enable" : "disable") syntax with helpers
from string_choices.h because:
1. Simple function call with one argument is easier to read.  Ternary
   operator has three arguments and with wrapping might lead to quite
   long code.
2. Is slightly shorter thus also easier to read.
3. It brings uniformity in the text - same string.
4. Allows deduping by the linker, which results in a smaller binary
   file.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20250114-str-enable-disable-usb-v1-5-c8405df47c19@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-01-15 18:28:13 +01:00
Greg Kroah-Hartman
2919c4a3d8 Merge 6.13-rc7 into usb-next
We need the USB fixes in here as well for testing.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-01-13 06:11:06 +01:00
Thinh Nguyen
d7123c77dc usb: gadget: f_tcm: Refactor goto check_condition
Move the command initialization before the check_condition to after the
goto statement for a cleaner look. No functional change here.

Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/8442364f51f2788d2a191997581a8eda7a143272.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-24 08:56:08 +01:00
Thinh Nguyen
de92fb3fc2 usb: gadget: f_tcm: Track BOT command kref
Set TARGET_SCF_ACK_KREF flag and allow f_tcm to take the BOT command
reference. A usb request may be canceled, the f_tcm knows this. Let it
decides if the command should be freed. This is the same as how the UAS
interface is done.

Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/e791c639e91b5d91a8787f5d6902e8c58f1dc172.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-24 08:56:08 +01:00
Thinh Nguyen
3ce3b2108f usb: gadget: f_tcm: Requeue command request on error
If there's error on command request, make sure to requeue to receive the
next one.

Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/d4e55c13be8f83f99ee55f7b979a99e2c14fc4c8.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-24 08:56:08 +01:00
Thinh Nguyen
a4d7274d07 usb: gadget: f_tcm: Stall on invalid CBW
If the BOT command CBW is invalid, make sure to respond by setting
status endpoint STALL until the next proper CBW or reset.

Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/96022e2d5225f01a20263a4ba9c2e2c8a63328b8.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-24 08:56:07 +01:00
Thinh Nguyen
29ed170538 usb: gadget: f_tcm: Check overlapped command
If there's an overlapped command tag, cancel the command and respond
with RC_OVERLAPPED_TAG to host.

Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/6bffc2903d0cd1e7c7afca837053a48e883d8903.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-24 08:56:07 +01:00
Thinh Nguyen
20e9ab60e6 usb: gadget: f_tcm: Handle TASK_MANAGEMENT commands
Handle target_core_fabric_ops TASK MANAGEMENT functions and their
response. If a TASK MANAGEMENT command is received, the driver will
interpret the function TMF_*, translate to TMR_*, and fire off a command
work executing target_submit_tmr(). On completion, it will handle the
TASK MANAGEMENT response through uasp_send_tm_response().

Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/50339586e36509dadb9c208b3314530993e673b6.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-24 08:56:07 +01:00
Thinh Nguyen
1d5d4e1153 usb: gadget: f_tcm: Send sense on cancelled transfer
If the transfer is cancelled due to a disconnect or driver tear down
(error code -ESHUTDOWN), then just free the command. However, if it got
cancelled due to other reasons, then send a sense CHECK CONDITION status
with TCM_CHECK_CONDITION_ABORT_CMD status to host notifying the delivery
failure. Note that this is separate from TASK MANAGEMENT function abort
task command, which will require a separate response IU.

See UAS-r04 section 8.

Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/f2ae293c1fc39df4d242a2f724584bf4ec105ece.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-24 08:56:07 +01:00