kernel/linux.git/drivers/usb/chipidea, branch v6.19.11

usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()

2026-03-04T12:20:41+00:00

[ Upstream commit cea2a1257a3b5ea3e769a445b34af13e6aa5a123 ] The ChipIdea UDC driver can encounter "not page aligned sg buffer" errors when a USB device is reconnected after being disconnected during an active transfer. This occurs because _ep_nuke() returns requests to the gadget layer without properly unmapping DMA buffers or cleaning up scatter-gather bounce buffers. Root cause: When a disconnect happens during a multi-segment DMA transfer, the request's num_mapped_sgs field and sgt.sgl pointer remain set with stale values. The request is returned to the gadget driver with status -ESHUTDOWN but still has active DMA state. If the gadget driver reuses this request on reconnect without reinitializing it, the stale DMA state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero num_mapped_sgs) and attempt to use freed/invalid DMA addresses, leading to alignment errors and potential memory corruption. The normal completion path via _hardware_dequeue() properly calls usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before returning the request. The _ep_nuke() path must do the same cleanup to ensure requests are returned in a clean, reusable state. Fix: Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror the cleanup sequence in _hardware_dequeue(): - Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set - Call sglist_do_debounce() with copy=false if bounce buffer exists This ensures that when requests are returned due to endpoint shutdown, they don't retain stale DMA mappings. The 'false' parameter to sglist_do_debounce() prevents copying data back (appropriate for shutdown path where transfer was aborted). Signed-off-by: Mario Peter Reviewed-by: Xu Yang Acked-by: Peter Chen Link: https://patch.msgid.link/20260108165902.795354-1-mario.peter@leica-geosystems.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

Merge tag 'usb-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2025-12-07T02:42:12+00:00

Pull USB/Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt driver updates for 6.19-rc1. Nothing major here, just lots of tiny updates for most of the common USB drivers. Included in here are: - more xhci driver updates and fixes - Thunderbolt driver cleanups - usb serial driver updates - typec driver updates - USB tracepoint additions - dwc3 driver updates, including support for Apple hardware - lots of other smaller driver updates and cleanups All of these have been in linux-next for a while with no reported issues" * tag 'usb-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (161 commits) usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt USB: serial: option: move Telit 0x10c7 composition in the right place USB: serial: option: add Telit Cinterion FE910C04 new compositions usb: typec: ucsi: fix use-after-free caused by uec->work usb: typec: ucsi: fix probe failure in gaokun_ucsi_probe() usb: dwc3: core: Remove redundant comment in core init usb: phy: Initialize struct usb_phy list_head USB: serial: option: add Foxconn T99W760 usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. usb: typec: hd3ss3220: Enable VBUS based on ID pin state dt-bindings: usb: ti,hd3ss3220: Add support for VBUS based on ID state usb: typec: anx7411: add WQ_PERCPU to alloc_workqueue users USB: add WQ_PERCPU to alloc_workqueue users dt-bindings: usb: dwc3-xilinx: Describe the reset constraint for the versal platform drivers/usb/storage: use min() instead of min_t() usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE usb: ohci-da8xx: remove unused platform data usb: gadget: functionfs: use dma_buf_unmap_attachment_unlocked() helper usb: uas: reduce time under spinlock usb: dwc3: eic7700: Add EIC7700 USB driver ...

usb: Remove redundant pm_runtime_mark_last_busy() calls

2025-11-21T14:11:53+00:00

pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Acked-by: Thierry Reding Reviewed-by: AngeloGioacchino Del Regno Acked-by: Peter Chen Link: https://patch.msgid.link/20251111095117.95023-1-sakari.ailus@linux.intel.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: ci_hdrc_imx: Set out of band wakeup for i.MX95

2025-11-19T17:06:49+00:00

i.MX95 USB2 inside HSIOMIX could still wakeup Linux, even if HSIOMIX power domain(Digital logic) is off. There is still always on logic have the wakeup capability which is out band wakeup capbility. So use device_set_out_band_wakeup for i.MX95 to make sure usb2 could wakeup system even if HSIOMIX power domain is in off state. Tested-by: Xu Yang Reviewed-by: Xu Yang Signed-off-by: Peng Fan Acked-by: Peter Chen Signed-off-by: Ulf Hansson

usb: chipidea: core: detach power domain for ci_hdrc platform device

2025-11-19T17:06:49+00:00

When add a platform device by calling ci_hdrc_add_device(), this device will reuse OF node of its parent device. If power-domains property is provided in the OF node, both two platform devices will be attached to the same power domain. This should be unnecessary and may bring other inconsistent behavior. For example, to support wakeup capability, these two platform device need different power domain state. The parent device need NOT power domain on for out-band interrupt, but the ci_hdrc device need power domain on for in-band interrupt. The i.MX95 Soc support out-band wakeup interrupt, the user need to enable wakeup for the parent device, but if the user also enable wakeup for ci_hdrc device, the power domain will keep at on state finally. To exclude such inconsistent behavior and simplify the power management, detach power domain for ci_hdrc platform device. Reviewed-by: Ulf Hansson Signed-off-by: Xu Yang Acked-by: Peter Chen Tested-by: Xu Yang Signed-off-by: Ulf Hansson

usb: chipidea: imx: add USB support for i.MX94

2025-10-13T07:11:50+00:00

Add new imx94_usbmisc_ops for i.MX94 due to it has same wakeup logic as i.MX95, but it doesn't need workaround for ERR051725, so pullup is not needed. Signed-off-by: Xu Yang Reviewed-by: Frank Li Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250919071111.2558628-2-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: imx: improve usbmisc_imx7d_pullup()

2025-08-13T15:19:10+00:00

When add workaround for ERR051725, the usbmisc will put PHY to Non-driving mode (OPMODE = 01) after stopping the device controller and put PHY back to Normal mode (OPMODE = 00) after starting the device controller. However, this will bring issue for host controller. Because the PHY may stay in Non-driving mode after switching the role from device to host. Then the port will not work if USB device is attached. To fix this issue, improving the workaround by putting PHY to Non-driving mode for a certain period and back to Normal mode finally. To make host detect a disconnect signal, the period should be at least 125us (a micro-frame time) for high-speed link. And only working as high-speed mode will need workaround for ERR051725. So this will also filter the pullup event for high-speed. Fixes: 11992b410083 ("usb: chipidea: imx: implement workaround for ERR051725") Reviewed-by: Jun Li Signed-off-by: Xu Yang Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250811100833.862876-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: imx: Add a missing blank line

2025-07-21T14:31:37+00:00

Fix a checkpatch warning: CHECK: Please use a blank line after function/struct/union/enum declarations Reported-by: Xu Yang Acked-by: Peter Chen Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/36d1c961-319e-4457-bdc1-69f8b6bed33e@sabinyo.mountain Signed-off-by: Greg Kroah-Hartman

usb: chipidea: s32g: Add usb support for s32g3

2025-07-07T09:06:13+00:00

Enable USB driver for the s32g3 USB device. Signed-off-by: Ghennadi Procopciuc Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/1733ae21-7257-4fdd-8249-7eaebbf769a2@sabinyo.mountain Signed-off-by: Greg Kroah-Hartman

usb: chipidea: s32g: Add usb support for s32g2

2025-07-07T09:06:13+00:00

Enable USB driver for s32g2. This chip has an errata ERR050474[1] so we need to set S32G_UCMALLBE to avoid some memory corruption. I have include the description below: ERR050474: USB : USB data may be corrupted if transaction size is non-multiple of 32bits Description When USB issues narrow length transfers i.e. AHB transaction size is less than 4bytes, data for that transaction will get corrupted. Narrow length transactions can occur if the transaction size is non-multiple of four bytes, error scenarios terminate the transactions early or if the address offset programmed in QTD is 4 Byte unaligned. This happens because the SoC NOC is not able to handle the byte strobes generated by USB controller and is dependent on its internally generates byte strobes. Workaround Narrow transfers work properly on bypassing USB controller’s byte generation logic. This can be done by setting UCMALLBE (bit 15, USB Core Master All Byte Enable) bit of UOTGNC_CR. Link: https://www.nxp.com/webapp/Download?colCode=S32G2_1P77B Signed-off-by: Ghennadi Procopciuc Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/abb2ed5d-f01a-48f6-b1ae-6f8f39ae40fa@sabinyo.mountain Signed-off-by: Greg Kroah-Hartman