kernel/linux.git/drivers/usb/chipidea, branch v7.2-rc1

Merge tag 'v7.1-rc6' into usb-next

2026-06-01T15:39:51+00:00

We need the USB and Thunderbolt fixes in here as well. Signed-off-by: Greg Kroah-Hartman

usb: chipidea: udc: support dynamic gadget add/remove

2026-05-22T09:28:10+00:00

An asynchronous vbus_event_work() keep running when switch the role from device to host. This affects EHCI host controller initialization. USBCMD.RUNSTOP bit is set at ehci_run() and cleared by following vbus_event_work() if bus_event_work() run after ehci_run(). The log below shows what happens: [ 87.819925] ci_hdrc ci_hdrc.0: EHCI Host Controller [ 87.819963] ci_hdrc ci_hdrc.0: new USB bus registered, assigned bus number 1 [ 87.955634] ci_hdrc ci_hdrc.0: USB 2.0, controller refused to start: -110 [ 87.955658] ci_hdrc ci_hdrc.0: startup error -110 [ 87.955682] ci_hdrc ci_hdrc.0: USB bus 1 deregistered The problem is that the chipidea UDC driver call usb_udc_vbus_handler() to pull down data line but it don't wait for completion before host controller starts running. Now UDC core can properly delete usb gadget device and make sure that vbus work is cancelled or completed after usb_del_gadget_udc() is returned. But the udc.c only call usb_del_gadget_udc() in ci_hdrc_gadget_destroy(). To avoid above issue, add/remove the gadget device dynamically during USB role switching. To support dynamic gadget add/remove, do below steps: - clear ci->gadget and ci->ci_hw_ep at initialization. - assign udc_[start|stop]() to rdrv->[start|stop] and properly merge the operations in udc_id_switch_for_[device|host]() to udc_[start|stop]() Adjust the order ci_handle_vbus_change() and ci_role_start() to avoid NULL pointer reference since ci_hdrc_gadget_init() doesn't add gadget anymore. Acked-by: Peter Chen Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260427075653.3611180-2-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: udc: add a helper ci_udc_enable_vbus_irq()

2026-05-22T09:28:10+00:00

The VBUS interrupt is configured in multiple places, add a helper function ci_udc_enable_vbus_irq() to simplify the code. Acked-by: Peter Chen Reviewed-by: Frank Li Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260427075653.3611180-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: core: convert ci_role_switch to local variable

2026-05-22T09:20:56+00:00

When a system contains multiple USB controllers, the global ci_role_switch variable may be overwritten by subsequent driver initialization code. This can cause issues in the following cases: - The 2nd ci_hdrc_probe() sees ci_role_switch.fwnode as non-NULL even though the "usb-role-switch" property is not present for the controller. - When the ci_hdrc device is unbound and bound again, ci_role_switch fwnode will not be reassigned, and the old value will be used instead. Convert ci_role_switch to a local variable to fix these issues. Fixes: 05559f10ed79 ("usb: chipidea: add role switch class support") Cc: stable Acked-by: Peter Chen Reviewed-by: Frank Li Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260427075755.3611217-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: otg: not wait vbus drop if use role_switch

2026-04-07T11:46:54+00:00

The usb role switch will update ID and VBUS states at the same time, and vbus will not drop when execute data role swap in Type-C usecase. So lets not wait vbus drop in usb role switch case too. Fixes: e1b5d2bed67c ("usb: chipidea: core: handle usb role switch in a common way") Cc: stable@vger.kernel.org Acked-by: Peter Chen Reviewed-by: Jun Li Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260402071457.2516021-3-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change

2026-04-07T11:46:54+00:00

For USB role switch-triggered IRQ, ID and VBUS change come together, for example when switching from host to device mode. ID indicate a role switch and VBUS is required to determine whether the device controller can start operating. Currently, ci_irq_handler() handles only a single event per invocation. This can cause an issue where switching to device mode results in the device controller not working at all. Allowing ci_irq_handler() to handle both ID and VBUS change in one call resolves this issue. Meanwhile, this change also affects the VBUS event handling logic. Previously, if an ID event indicated host mode the VBUS IRQ will be ignored as the device disable BSE when stop() is called. With the new behavior, if ID and VBUS IRQ occur together and the target mode is host, the VBUS event is queued and ci_handle_vbus_change() will call usb_gadget_vbus_connect(), after which USBMODE is switched to device mode, causing host mode to stop working. To prevent this, an additional check is added to skip handling VBUS event when current role is not device mode. Suggested-by: Peter Chen Fixes: e1b5d2bed67c ("usb: chipidea: core: handle usb role switch in a common way") Cc: stable@vger.kernel.org Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260402071457.2516021-2-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: core: refactor ci_usb_role_switch_set()

2026-04-07T11:46:54+00:00

Current code is redundant, refactor the code, no function change. Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260402071457.2516021-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()

2026-01-14T15:00:12+00:00

The ChipIdea UDC driver can encounter "not page aligned sg buffer" errors when a USB device is reconnected after being disconnected during an active transfer. This occurs because _ep_nuke() returns requests to the gadget layer without properly unmapping DMA buffers or cleaning up scatter-gather bounce buffers. Root cause: When a disconnect happens during a multi-segment DMA transfer, the request's num_mapped_sgs field and sgt.sgl pointer remain set with stale values. The request is returned to the gadget driver with status -ESHUTDOWN but still has active DMA state. If the gadget driver reuses this request on reconnect without reinitializing it, the stale DMA state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero num_mapped_sgs) and attempt to use freed/invalid DMA addresses, leading to alignment errors and potential memory corruption. The normal completion path via _hardware_dequeue() properly calls usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before returning the request. The _ep_nuke() path must do the same cleanup to ensure requests are returned in a clean, reusable state. Fix: Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror the cleanup sequence in _hardware_dequeue(): - Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set - Call sglist_do_debounce() with copy=false if bounce buffer exists This ensures that when requests are returned due to endpoint shutdown, they don't retain stale DMA mappings. The 'false' parameter to sglist_do_debounce() prevents copying data back (appropriate for shutdown path where transfer was aborted). Signed-off-by: Mario Peter Reviewed-by: Xu Yang Acked-by: Peter Chen Link: https://patch.msgid.link/20260108165902.795354-1-mario.peter@leica-geosystems.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: ci_hdrc_imx: use "wakeup" suffix for wakeup interrupt name

2026-01-14T15:00:09+00:00

Currently the wakeup and controller interrupt name are same. It's not easy to find the correct one in /proc/interrupt at the first glance. Rename the wakeup interrupt name for better distinction. Signed-off-by: Xu Yang Reviewed-by: Frank Li Acked-by: Peter Chen Link: https://patch.msgid.link/20260112110408.3263954-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman