summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-09-06staging: rtl8723bs: merge rtw_os_recv_resource_free into rtw_recv.cMichael Straube
Merge the functionality of rtw_os_recv_resource_free in os_dep/recv_linux.c into _rtw_free_recv_priv in core/rtw_recv.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube <straube.linux@gmail.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250822135418.118115-7-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: merge rtw_os_recv_resource_alloc into rtw_recv.cMichael Straube
Merge the functionality of rtw_os_recv_resource_alloc into _rtw_init_recv_priv to reduce code in the os_dep directory. Signed-off-by: Michael Straube <straube.linux@gmail.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250822135418.118115-6-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: merge rtw_os_free_recvframe into rtw_recv.cMichael Straube
Merge the functionality of rtw_os_free_recvframe in os_dep/recv_linux.c into rtw_free_recvframe in core/rtw_recv.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube <straube.linux@gmail.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250822135418.118115-5-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: move rtw_handle_tkip_mic_err to rtw_recv.cMichael Straube
Move the function rtw_handle_tkip_mic_err from os_dep/recv_linux.c to core/rtw_recv.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube <straube.linux@gmail.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250822135418.118115-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: move rtw_recv_indicatepkt to rtw_recv.cMichael Straube
Move the function rtw_recv_indicatepkt from os_dep/recv_linux.c to core/rtw_recv.c to reduce code in the os_dep directory. Signed-off-by: Michael Straube <straube.linux@gmail.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250822135418.118115-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove wrapper rtw_init_recv_timerMichael Straube
The function rtw_init_recv_timer in os_dep/recv_linux.c is jsut a wrapper around timer_setup. Use timer_setup directly and remove the wrapper to reduce code in the os_dep directory. Signed-off-by: Michael Straube <straube.linux@gmail.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250822135418.118115-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove efuse_OneByteWriteMichael Straube
The function efuse_OneByteWrite is not used. Remove it and remove related dead code, namely the function Efuse_Write1ByteToFakeContent. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-15-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove bPseudoTest from efuse_OneByteReadMichael Straube
The function efuse_OneByteRead is always called with bPseudoTest set to false. Remove the pPseudoTest parameter and reomve resulting dead code to reduce code complexity. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-14-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: clean up variable initializationsMichael Straube
After previous cleanup patches the variable initializations in hal_EfuseSwitchToBank are messed up a little, but were left as-is to make reviewing easier. For example bRet is initialized to false and immediately set to true. This patch cleans up the variable initializations. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-13-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove bPseudoTest from hal_EfuseSwitchToBankMichael Straube
The function hal_EfuseSwitchToBank is always called with bPseudoTest set to false. Remove the pPseudoTest parameter and reomve resulting dead code to reduce code complexity. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-12-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove Hal_EfuseGetCurrentSizeMichael Straube
The function Hal_EfuseGetCurrentSize is not used in the driver code, remove it to get rid of dead code. As Hal_EfuseGetCurrentSize is the only caller of hal_EfuseGetCurrentSize_WiFi and hal_EfuseGetCurrentSize_BT we can remove these two functions as well. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-11-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove bPseudoTest from Hal_GetEfuseDefinitionMichael Straube
The bPseudoTEst parameter is not used in Hal_GetEfuseDefinition. Remove the unused parameter and adjust the function calls. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-10-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove wrapper EFUSE_GetEfuseDefinitionMichael Straube
The function EFUSE_GetEfuseDefinition is just a wrapper around Hal_GetEfuseDefinition. Remove the wrapper and use Hal_GetEfuseDefinition directly. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-9-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove bPseudoTest from hal_ReadEFuse_BTMichael Straube
The function hal_ReadEFuse_BT is always called with bPseudoTest set to false. Remove the pPseudoTest parameter, replace its usage in the function with false, and reomve resulting dead code to reduce code complexity. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-8-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove bPseudoTest from hal_ReadEFuse_WiFiMichael Straube
The function hal_ReadEFuse_WiFi is always called with bPseudoTest set to false. Remove the pPseudoTest parameter, replace its usage in the function with false, and reomve resulting dead code to reduce code complexity. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-7-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove bPseudoTest from Hal_ReadEFuseMichael Straube
The function Hal_ReadEFuse is always called with bPseudoTest set to false. Remove the pPseudoTest parameter and replace its usage in the function with false to reduce code complexity. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-6-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove wrapper efuse_ReadEFuseMichael Straube
The function efuse_ReadEFuse is just a wrapper around Hal_ReadEFuse. Remove the wrapper and use Hal_ReadEFuse directly. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-5-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove bPseudoTest from Efuse_ReadAllMapMichael Straube
The function Efuse_ReadAllMap is always called with bPseudoTest set to false. Remove the pPseudoTest parameter and replace its usage in the function with false to reduce code complexity. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: make Efuse_ReadAllMap staticMichael Straube
Make the function Efuse_ReadAllMap static and remove its unnecessary forawrd declaration. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: rtl8723bs: remove bPseudoTest from EFUSE_ShadowMapUpdateMichael Straube
The function EFUSE_ShadowMapUpdate is always called with bPseudoTest set to false. Remove the pPseudoTest parameter and replace its usage in the function with false to reduce code complexity. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20250823124321.485910-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06staging: gpib: tnt4882: Remove redundant header filesLiao Yuanhong
The header file <linux/ioport.h> is already included on line 12, outside of the #ifdef CONFIG_GPIB_PCMCIA block. It does not need to be included again inside the #ifdef CONFIG_GPIB_PCMCIA block. Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com> Link: https://lore.kernel.org/r/20250819131203.152724-1-liaoyuanhong@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06serial: xilinx_uartps: read reg size from DTSHarshit Shah
Current implementation uses `CDNS_UART_REGISTER_SPACE(0x1000)` for request_mem_region() and ioremap() in cdns_uart_request_port() API. The cadence/xilinx IP has register space defined from offset 0x0 to 0x48. It also mentions that the register map is defined as [6:0]. So, the upper region may/maynot be used based on the IP integration. In Axiado AX3000 SoC two UART instances are defined 0x100 apart. That is creating issue in some other instance due to overlap with addresses. Since, this address space is already being defined in the devicetree, use the same when requesting the register space. Fixes: 1f7055779001 ("arm64: dts: axiado: Add initial support for AX3000 SoC and eval board") Acked-by: Michal Simek <michal.simek@amd.com> Signed-off-by: Harshit Shah <hshah@axiado.com> Link: https://lore.kernel.org/r/20250902-xilinx-uartps-reg-size-v3-1-d11cfa7258e3@axiado.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06tty: remove redundant condition checksXichao Zhao
Remove redundant condition checks and replace else if with else. Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com> Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu> Link: https://lore.kernel.org/r/20250905091321.437476-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06tty/vt: Add missing return value for VT_RESIZE in vt_ioctl()Zizhi Wo
In vt_ioctl(), the handler for VT_RESIZE always returns 0, which prevents users from detecting errors. Add the missing return value so that errors can be properly reported to users like vt_resizex(). Signed-off-by: Zizhi Wo <wozizhi@huaweicloud.com> Link: https://lore.kernel.org/r/20250904023955.3892120-1-wozizhi@huaweicloud.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06vt: remove redundant check on vc_mode in con_font_set()Wang Liang
Previous commit edab558feba1 ("vt: sort out locking for font handling") move the vc_mode check into console_lock protect, but forget to remove the old check in con_font_set(). Just remove the redundant check. Signed-off-by: Wang Liang <wangliang74@huawei.com> Link: https://lore.kernel.org/r/20250904023345.13731-1-wangliang74@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06serial: qcom-geni: Add DFS clock mode support to GENI UART driverViken Dadhaniya
GENI UART driver currently supports only non-DFS (Dynamic Frequency Scaling) mode for source frequency selection. However, to operate correctly in DFS mode, the GENI SCLK register must be programmed with the appropriate DFS index. Failing to do so can result in incorrect frequency selection Add support for Dynamic Frequency Scaling (DFS) mode in the GENI UART driver by configuring the GENI_CLK_SEL register with the appropriate DFS index. This ensures correct frequency selection when operating in DFS mode. Replace the UART driver-specific logic for clock selection with the GENI common driver function to obtain the desired frequency and corresponding clock index. This improves maintainability and consistency across GENI-based drivers. Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com> Link: https://lore.kernel.org/r/20250903063136.3015237-1-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06tty: n_gsm: Don't block input queue by waiting MSCSeppo Takalo
Currently gsm_queue() processes incoming frames and when opening a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). If basic mode is used it calls gsm_modem_upd_via_msc() and it cannot block the input queue by waiting the response to come into the same input queue. Instead allow sending Modem Status Command without waiting for remote end to respond. Define a new function gsm_modem_send_initial_msc() for this purpose. As MSC is only valid for basic encoding, it does not do anything for advanced or when convergence layer type 2 is used. Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") Signed-off-by: Seppo Takalo <seppo.takalo@nordicsemi.no> Link: https://lore.kernel.org/r/20250827123221.1148666-1-seppo.takalo@nordicsemi.no Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06serial: qcom-geni: Fix off-by-one error in ida_alloc_range()Zong Jiang
The ida_alloc_range() function expects an inclusive range, meaning both the start and end values are valid allocation targets. Passing nr_ports as the upper bound allows allocation of an ID equal to nr_ports, which is out of bounds when used as an index into the port array. Fix this by subtracting 1 from nr_ports in both calls to ida_alloc_range(), ensuring the allocated ID stays within the valid range [start, nr_ports - 1]. This prevents potential out-of-bounds access when the allocated ID is used as an index. Fixes: 9391ab1ed9b3 ("serial: qcom-geni: Make UART port count configurable via Kconfig") Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/r/202508180815.R2nDyajs-lkp@intel.com/ Signed-off-by: Zong Jiang <quic_zongjian@quicinc.com> Link: https://lore.kernel.org/r/20250827120319.1682835-1-quic_zongjian@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06serdev: Drop dev_pm_domain_detach() callClaudiu Beznea
Starting with commit f99508074e78 ("PM: domains: Detach on device_unbind_cleanup()"), there is no longer a need to call dev_pm_domain_detach() in the bus remove function. The device_unbind_cleanup() function now handles this to avoid invoking devres cleanup handlers while the PM domain is powered off, which could otherwise lead to failures as described in the above-mentioned commit. Drop the explicit dev_pm_domain_detach() call and rely instead on the flags passed to dev_pm_domain_attach() to power off the domain. Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Link: https://lore.kernel.org/r/20250827101747.928265-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06serial: sc16is7xx: drop redundant conversion to boolXichao Zhao
The result of integer comparison already evaluates to bool. No need for explicit conversion. Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com> Link: https://lore.kernel.org/r/20250827024514.76149-1-zhao.xichao@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06vt: add support for smput/rmput escape codesCalixte Pernot
Support "\e[?1049h" and "\e[?1049l" escape codes. This patch allows programs to enter and leave alternate screens. This feature is widely available in graphical terminal emulators and mostly used by fullscreen terminal-based user interfaces such as text editors. Most editors such as vim and nano assume this escape code in not supported and will not try to print the escape sequence if TERM=linux. To try out this patch, run `TERM=xterm-256color vim` inside a VT. Signed-off-by: Calixte Pernot <calixte.pernot@grenoble-inp.org> Link: https://lore.kernel.org/r/20250825125607.2478-3-calixte.pernot@grenoble-inp.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06serial: stm32: allow selecting console when the driver is moduleRaphael Gallais-Pou
Console can be enabled on the UART compile as module. Change dependency to allow console mode when the driver is built as module. Fixes: 48a6092fb41fa ("serial: stm32-usart: Add STM32 USART Driver") Cc: stable@vger.kernel.org Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com> Link: https://lore.kernel.org/r/20250822141923.61133-1-raphael.gallais-pou@foss.st.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06serial: 8250_core: fix coding style issueOsama Abdelkader
Fix a coding style issue in 8250_core.c: - Remove redundant NULL initialization of a global pointer Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> Reviewed-by: Jiri Slaby <jirislaby@kernel.org> Link: https://lore.kernel.org/r/20250822095614.18108-1-osama.abdelkader@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06usb: gadget: tegra-xudc: Remove redundant ternary operatorsLiao Yuanhong
For ternary operators in the form of "a ? true : false", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com> Link: https://lore.kernel.org/r/20250902132613.84876-1-liaoyuanhong@vivo.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06usb: gadget: midi2: Fix MIDI2 IN EP max packet sizeTakashi Iwai
The EP-IN of MIDI2 (altset 1) wasn't initialized in f_midi2_create_usb_configs() as it's an INT EP unlike others BULK EPs. But this leaves rather the max packet size unchanged no matter which speed is used, resulting in the very slow access. And the wMaxPacketSize values set there look legit for INT EPs, so let's initialize the MIDI2 EP-IN there for achieving the equivalent speed as well. Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver") Cc: stable <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://lore.kernel.org/r/20250905133240.20966-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06usb: gadget: midi2: Fix missing UMP group attributes initializationTakashi Iwai
The gadget card driver forgot to call snd_ump_update_group_attrs() after adding FBs, and this leaves the UMP group attributes uninitialized. As a result, -ENODEV error is returned at opening a legacy rawmidi device as an inactive group. This patch adds the missing call to address the behavior above. Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver") Cc: stable <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://lore.kernel.org/r/20250904153932.13589-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06usb: typec: tcpm: properly deliver cable vdms to altmode driversRD Babiera
tcpm_handle_vdm_request delivers messages to the partner altmode or the cable altmode depending on the SVDM response type, which is incorrect. The partner or cable should be chosen based on the received message type instead. Also add this filter to ADEV_NOTIFY_USB_AND_QUEUE_VDM, which is used when the Enter Mode command is responded to by a NAK on SOP or SOP' and when the Exit Mode command is responded to by an ACK on SOP. Fixes: 7e7877c55eb1 ("usb: typec: tcpm: add alt mode enter/exit/vdm support for sop'") Cc: stable@vger.kernel.org Signed-off-by: RD Babiera <rdbabiera@google.com> Reviewed-by: Badhri Jagan Sridharan <badhri@google.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://lore.kernel.org/r/20250821203759.1720841-2-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernelsAlan Stern
Yunseong Kim and the syzbot fuzzer both reported a problem in RT-enabled kernels caused by the way dummy-hcd mixes interrupt management and spin-locking. The pattern was: local_irq_save(flags); spin_lock(&dum->lock); ... spin_unlock(&dum->lock); ... // calls usb_gadget_giveback_request() local_irq_restore(flags); The code was written this way because usb_gadget_giveback_request() needs to be called with interrupts disabled and the private lock not held. While this pattern works fine in non-RT kernels, it's not good when RT is enabled. RT kernels handle spinlocks much like mutexes; in particular, spin_lock() may sleep. But sleeping is not allowed while local interrupts are disabled. To fix the problem, rewrite the code to conform to the pattern used elsewhere in dummy-hcd and other UDC drivers: spin_lock_irqsave(&dum->lock, flags); ... spin_unlock(&dum->lock); usb_gadget_giveback_request(...); spin_lock(&dum->lock); ... spin_unlock_irqrestore(&dum->lock, flags); This approach satisfies the RT requirements. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Cc: stable <stable@kernel.org> Fixes: b4dbda1a22d2 ("USB: dummy-hcd: disable interrupts during req->complete") Reported-by: Yunseong Kim <ysk@kzalloc.com> Closes: <https://lore.kernel.org/linux-usb/5b337389-73b9-4ee4-a83e-7e82bf5af87a@kzalloc.com/> Reported-by: syzbot+8baacc4139f12fa77909@syzkaller.appspotmail.com Closes: <https://lore.kernel.org/linux-usb/68ac2411.050a0220.37038e.0087.GAE@google.com/> Tested-by: syzbot+8baacc4139f12fa77909@syzkaller.appspotmail.com CC: Sebastian Andrzej Siewior <bigeasy@linutronix.de> CC: stable@vger.kernel.org Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Link: https://lore.kernel.org/r/bb192ae2-4eee-48ee-981f-3efdbbd0d8f0@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06xhci: fix memory leak regression when freeing xhci vdev devices depth firstMathias Nyman
Suspend-resume cycle test revealed a memory leak in 6.17-rc3 Turns out the slot_id race fix changes accidentally ends up calling xhci_free_virt_device() with an incorrect vdev parameter. The vdev variable was reused for temporary purposes right before calling xhci_free_virt_device(). Fix this by passing the correct vdev parameter. The slot_id race fix that caused this regression was targeted for stable, so this needs to be applied there as well. Fixes: 2eb03376151b ("usb: xhci: Fix slot_id resource race conflict") Reported-by: David Wang <00107082@163.com> Closes: https://lore.kernel.org/linux-usb/20250829181354.4450-1-00107082@163.com Suggested-by: Michal Pecio <michal.pecio@gmail.com> Suggested-by: David Wang <00107082@163.com> Cc: stable@vger.kernel.org Tested-by: David Wang <00107082@163.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20250902105306.877476-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06xhci: dbc: Fix full DbC transfer ring after several reconnectsMathias Nyman
Pending requests will be flushed on disconnect, and the corresponding TRBs will be turned into No-op TRBs, which are ignored by the xHC controller once it starts processing the ring. If the USB debug cable repeatedly disconnects before ring is started then the ring will eventually be filled with No-op TRBs. No new transfers can be queued when the ring is full, and driver will print the following error message: "xhci_hcd 0000:00:14.0: failed to queue trbs" This is a normal case for 'in' transfers where TRBs are always enqueued in advance, ready to take on incoming data. If no data arrives, and device is disconnected, then ring dequeue will remain at beginning of the ring while enqueue points to first free TRB after last cancelled No-op TRB. s Solve this by reinitializing the rings when the debug cable disconnects and DbC is leaving the configured state. Clear the whole ring buffer and set enqueue and dequeue to the beginning of ring, and set cycle bit to its initial state. Cc: stable@vger.kernel.org Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20250902105306.877476-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06xhci: dbc: decouple endpoint allocation from initializationMathias Nyman
Decouple allocation of endpoint ring buffer from initialization of the buffer, and initialization of endpoint context parts from from the rest of the contexts. It allows driver to clear up and reinitialize endpoint rings after disconnect without reallocating everything. This is a prerequisite for the next patch that prevents the transfer ring from filling up with cancelled (no-op) TRBs if a debug cable is reconnected several times without transferring anything. Cc: stable@vger.kernel.org Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20250902105306.877476-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06Merge patch series "eUSB2 Double Isochronous IN Bandwidth support"Greg Kroah-Hartman
Sakari Ailus <sakari.ailus@linux.intel.com> says: This series enables support for eUSB2 Double Isochronous IN Bandwidth UVC devices specified in 'USB 2.0 Double Isochronous IN Bandwidth' ECN. In short, it adds support for new integrated USB2 webcams that can send twice the data compared to conventional USB2 webcams. These devices are identified by the device descriptor bcdUSB 0x0220 value. They have an additional eUSB2 Isochronous Endpoint Companion Descriptor, and a zero max packet size in regular isoc endpoint descriptor. Support for parsing that new descriptor was added in commit c749f058b437 ("USB: core: Add eUSB2 descriptor and parsing in USB core") This series adds support to UVC, USB core, and xHCI to identify eUSB2 double isoc devices, and allow and set proper max packet, iso frame desc sizes, bytes per interval, and other values in URBs and xHCI endpoint contexts needed to support the double data rates for eUSB2 double isoc devices. since v4: https://lore.kernel.org/linux-usb/20250812132445.3185026-1-sakari.ailus@linux.intel.com - New patch: use le16_to_cpu() to access endpoint descriptor's wMaxPacketSize field, which is an __le16. This isn't a bugfix as the value was compared to 0. - New patch: add USB device speed check for eUSB2 isochronous endpoint companion parsing. The check is then removed from sites checking the existence of the companion (through companion's bDescriptorType field, which is non-zero for valid descriptors). - New patch: do not parse eUSB2 isoc double BW companion descriptor on interrupt or OUT endpoints. It is not supposed to be found there, according to the ECN. - Rename usb_endpoint_max_isoc_bpi() as usb_endpoint_max_periodic_payload() and move it right after usb_maxpacket(). - Fixed @ep reference in kernel-doc documentation for usb_endpoint_max_periodic_payload(). - In usb_endpoint_max_periodic_payload(), call struct usb_device pointer argument "udev" instead of "dev", to align with naming elsewhere. - Add support for interrupt endpoints in usb_endpoint_max_periodic_payload(); eUSB2 double isoc BW is still limited to isochronous endpoints though. - In usb_endpoint_max_periodic_payload(), remove the separate case for USB_SPEED_HIGH as the check is already done in parsing the eUSB isoc double BW companion, which is checked for. - New patch: use usb_endpoint_max_periodic_payload() in xHCI driver, replacing xhci_get_max_esit_payload(). - Check non-zero bDescriptorType field of ep->eusb2_isoc_ep_comp instead of dwBytesPerInterval value exceeding 3072, where xhci_eusb2_is_isoc_bw_double() was used. This aligns the checks of eUSB2 isochronous double bandwidth support for an endpoint. - New patch: introduce usb_endpoint_is_hs_isoc_double() to figure out whether an endpoint uses isochronous double bandwidth and use the function in the xHCI driver and the usb core. xhci_eusb2_is_isoc_bw_double() is dropped, as well as the MAX_ISOC_XFER_SIZE_HS macro. usb_endpoint_is_hs_isoc_double() also includes check for bcdUSB == 0x220, to anticipate adding support for eUSB2V2. - Merge condition for checking eUSB2 isoc double bw support for xHCI/endpoint in xhci_get_endpoint_mult(). - Improve comment regarding maximum packet size bits 12:11 in xhci_get_endpoint_max_burst(). - Aligned subject prefixes with the recent patches to the same files. since v3: https://lore.kernel.org/linux-usb/20250807055355.1257029-1-sakari.ailus@linux.intel.com/ - Use spaces in aligning macro body for HCC2_EUSB2_DIC() (1st patch). - Move usb_endpoint_max_isoc_bpi() to drivers/usb/core/usb.c (3rd patch). since v2: https://lore.kernel.org/linux-usb/20250711083413.1552423-1-sakari.ailus@linux.intel.com - Use ep->eusb2_isoc_ep_comp.bDescriptorType to determined whether the eUSB2 isochronous endpoint companion descriptor exists. - Clean up eUSB2 double isoc bw maxp calculation. - Drop le16_to_cpu(udev->descriptor.bcdUSB) == 0x220 check from xhci_eusb2_is_isoc_bw_double() -- it's redundant as ep->eusb2_isoc_ep_comp.dwBytesPerInterval will be zero otherwise. - Add kernel-doc documentation for usb_endpoint_max_isoc_bpi(). - Check the endpoint has IN direction in usb_endpoint_max_isoc_bpi() and usb_submit_urb() as a condition for eUSB2 isoc double bw. since v1: https://lore.kernel.org/linux-usb/20250616093730.2569328-2-mathias.nyman@linux.intel.com - Introduce uvc_endpoint_max_isoc_bpi() to obtain maximum bytes per interval value for an endpoint, in a new patch (3rd). This code has been slightly reworked from the instance in the UVC driver, including support for SuperSpeedPlus Isochronous Endpoint Companion. - Use usb_endpoint_max_isoc_bpi() in the UVC driver instead of open-coding eUSB2 support there, also drop now-redundant uvc_endpoint_max_bpi(). - Use u32 for maximum bpi and related information in the UVC driver -- the value could be larger than a 16-bit type can hold. - Assume max in usb_submit_urb() is a natural number as usb_endpoint_maxp() returns only natural numbers (2nd patch). Link: https://lore.kernel.org/r/20250820143824.551777-1-sakari.ailus@linux.intel.com Cc: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06media: uvcvideo: eUSB2 double isochronous bandwidth supportTao Q Tao
Use usb_endpoint_max_esit_payload() from the USB framework to find the maximum bytes per interval for the endpoint. Consequently this adds eUSB2 isochronous mode and SuperSpeedPlus Isochronous Endpoint Companion support where larger payloads within a service interval are possible. Co-developed-by: Amardeep Rai <amardeep.rai@intel.com> Signed-off-by: Amardeep Rai <amardeep.rai@intel.com> Signed-off-by: Tao Q Tao <tao.q.tao@intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Co-developed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20250820143824.551777-10-sakari.ailus@linux.intel.com
2025-09-06usb: core: support eUSB2 double bandwidth large isoc URB framesRai, Amardeep
eUSB2 double isochronous in bandwidth devices support up to 6 transactions per microframe, and thus doubles the total bytes possible to receive per microframe. Support larger URB isoc frame sizes for eUSB2 double isoc in endpoints. Also usb_endpoint_maxp() returns a natural number so there's no need to assume it could be < 0. Signed-off-by: Rai, Amardeep <amardeep.rai@intel.com> Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Co-developed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20250820143824.551777-9-sakari.ailus@linux.intel.com
2025-09-06usb: xhci: Add host support for eUSB2 double isochronous bandwidth devicesRai, Amardeep
Detect eUSB2 double isoc bw capable hosts and devices, and set the proper xhci endpoint context values such as 'Mult', 'Max Burst Size', and 'Max ESIT Payload' to enable the double isochronous bandwidth endpoints. Intel xHC uses the endpoint context 'Mult' field for eUSB2 isoc endpoints even if hosts supporting Large ESIT Payload Capability should normally ignore the mult field. Signed-off-by: Rai, Amardeep <amardeep.rai@intel.com> Co-developed-by: Kannappan R <r.kannappan@intel.com> Signed-off-by: Kannappan R <r.kannappan@intel.com> Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Co-developed-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Co-developed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20250820143824.551777-8-sakari.ailus@linux.intel.com
2025-09-06usb: core: Introduce usb_endpoint_is_hs_isoc_double()Sakari Ailus
Introduce usb_endpoint_is_hs_isoc_double() tell whether an endpoint conforms to USB 2.0 Isochronous Double IN Bandwidth ECN. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20250820143824.551777-7-sakari.ailus@linux.intel.com
2025-09-06usb: xhci: Use usb_endpoint_max_periodic_payload()Sakari Ailus
Use the newly added usb_endpoint_max_periodic_payload() to obtain the maximum number of bytes to transfer during a service interval for isochronous and interrupt endpoints. This will replace the xhci-specific xhci_get_max_esit_payload() which is removed as redundant. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Mathias Nyman <mathias.nyman@linux.intel.com> Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20250820143824.551777-6-sakari.ailus@linux.intel.com
2025-09-06usb: core: Add a function to get USB version independent periodic payloadRai, Amardeep
Add usb_endpoint_max_periodic_payload() to obtain maximum payload bytes in a service interval for isochronous and interrupt endpoints in a USB version independent way. Signed-off-by: Rai, Amardeep <amardeep.rai@intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Co-developed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20250820143824.551777-5-sakari.ailus@linux.intel.com
2025-09-06usb: core: eUSB2 companion descriptor is for isoc IN endpoints onlySakari Ailus
The eUSB2 isochronous double bandwidth endpoint descriptor is allowed for the isochronous IN endpoints, according to the ECN. Do not parse these descriptors if they are found in interrupt or OUT endpoints. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20250820143824.551777-4-sakari.ailus@linux.intel.com
2025-09-06usb: core: Parse eUSB2 companion descriptors for high speed devices onlySakari Ailus
Check that a device is a high-speed one before proceeding to parse the eUSB2 isochronous endpoint companion descriptors. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20250820143824.551777-3-sakari.ailus@linux.intel.com