summaryrefslogtreecommitdiff
path: root/drivers/usb/dwc3
AgeCommit message (Collapse)Author
12 daysusb: dwc3: clear forceRM when issuing EndTransferElson Serrao
The forceRM bit of the DEPCMD register controls the behavior of the EndTransfer command used to stop an active transfer. Older DWC3 programming guide revisions recommended setting forceRM=1 when issuing EndTransfer. Newer programming guide revisions recommend issuing EndTransfer with forceRM cleared. With forceRM=1 on DWC_usb31 v2.00a and v2.10a controllers, a transfer aborted through the ep_dequeue path was observed to remain active after EndTransfer completion. A subsequent StartTransfer issued on the same endpoint triggered writes associated with the aborted transfer. This resulted in an SMMU fault because the transfer buffer had already been unmapped during EndTransfer command-completion cleanup. Using forceRM=0 eliminates the issue. Although older DWC3 programming guide revisions recommended setting forceRM=1, no issues are known from using forceRM=0. Clear forceRM when issuing EndTransfer to provide consistent EndTransfer behavior and align with newer programming guide recommendations. Fixes: 1e43c86d84fb ("usb: dwc3: core: Add DWC31 version 2.00a controller") Cc: stable <stable@kernel.org> Signed-off-by: Elson Serrao <elson.serrao@oss.qualcomm.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260813151456.867008-1-elson.serrao@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
12 daysusb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIESRadhey Shyam Pandey
dwc3_google_probe() zero initialises struct dwc3_probe_data and never assigns its properties member. The unspecified state of gsbuscfg0_reqinfo is encoded as DWC3_GSBUSCFG0_REQINFO_UNSPECIFIED (0xffffffff), not as zero, so dwc3_get_software_properties() reads the zeroed field as a value the glue explicitly requested: if (properties->gsbuscfg0_reqinfo != DWC3_GSBUSCFG0_REQINFO_UNSPECIFIED) { dwc->gsbuscfg0_reqinfo = properties->gsbuscfg0_reqinfo; return; } Two things follow. dwc3_config_soc_bus() programs GSBUSCFG0.REQINFO with zero on hardware that never asked for it, and the early return skips the walk over the parent devices, so a swnode or device tree supplied snps,gsbuscfg0-reqinfo would be ignored. Assign DWC3_DEFAULT_PROPERTIES so the unset fields carry their unspecified sentinels and the controller is left alone. Fixes: 8995a37371bf ("usb: dwc3: Add Google Tensor SoC DWC3 glue driver") Cc: stable <stable@kernel.org> Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260819182158.1351869-1-radhey.shyam.pandey@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-14usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to ↵Pei Xiao
race condition In dwc3_gadget_init_endpoint, &dep->nostream_work is bound with dwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue this delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM event is received. If we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and the memory allocated for dep with kzalloc() is released by kfree(dep), while the delayed work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | dwc3_thread_interrupt | dwc3_endpoint_interrupt | dwc3_gadget_endpoint_stream_event | queue_delayed_work(system_percpu_wq, | &dep->nostream_work) dwc3_gadget_free_endpoints | dwc3_free_trb_pool(dep) | list_del(&dep->endpoint.ep_list) | dwc3_debugfs_remove_endpoint_dir(dep) | kfree(dep) | // dep is freed | | dwc3_nostream_work | // use dep (use-after-free) Fix it by canceling the delayed work before kfree(dep) in dwc3_gadget_free_endpoints. Fixes: dcfe437492e2 ("usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior") Assisted-by: Codex:deepseek-v4-flash Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Cc: stable@vger.kernel.org Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Link: https://patch.msgid.link/331d1d5133496d2b4184e05f8848adb06930a138.1785893865.git.xiaopei01@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-14usb: xhci: standardize multi bit-field macrosNiklas Neronin
This patch aims to unify the format of register macros and masks within the xHCI driver. Currently, register macros have inconsistent bit-field masks, get macros, and set macros, with varying naming conventions and functionalities. ==================== Proposal ==================== * Introduce a standardized approach by using only mask macros for each bit field, leveraging GENMASK() for enhanced clarity. #define HCC_MAX_PSA GENMASK(15, 12) * Utilize FIELD_GET() and FIELD_PREP() macros directly in the C code for getting and setting values, ensuring consistency and readability. u32 psa = FIELD_GET(HCC_MAX_PSA, reg); * Maintain exceptions for macros that perform custom operations. #define CTX_SIZE(_hcc) (_hcc & HCC_64BYTE_CONTEXT ? 64 : 32) * Note, while FIELD_*() macros are beneficial, I am not suggesting that they should always be used. Instead, use them where they simplify the code and eliminate the necessity for custom get/set macros. In the example below, additional FIELD_PREP() or FIELD_MODIFY() is not beneficial. #define HCS_MAX_SCRATCHPAD(p) (FIELD_GET(HCS_MAX_SP_HI, (p)) << 5 | \ FIELD_GET(HCS_MAX_SP_LO, (p))) ==================== Improvements ==================== Simplified Macros: By reducing custom macros, the code becomes more straightforward. Macros FIELD_GET() and FIELD_PREP() are commonly used, which contributes to the code readability and consistency. $ git grep -n 'FIELD_GET' | wc -l 9027 $ git grep -n 'FIELD_PREP' | wc -l 15407 Consistent Return Type: All bit macros will return unsigned 64-bit values, mitigating potential cross-architecture issues. Unified Bit Range Definition: The mask macro will define bit ranges, eliminating separate definitions for get/set macros. Because, FIELD_GET() & FIELD_PREP() use mask macro. Cleaner header file with less macros: Fewer macros result in a cleaner and more manageable header file. Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://patch.msgid.link/20260806142113.2436238-12-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-13Merge 7.2-rc3 into usb-nextGreg Kroah-Hartman
We need the USB fixes in here as well to build on top of. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-10usb: dwc3: am62: Propagate USB2 refclk enable failuresPengpeng Hou
The AM62 wrapper requires the USB2 ref clock, but dwc3_ti_init() ignores clk_prepare_enable() failures before marking the mode valid. Probe can then populate the child DWC3 device even though the wrapper clock transition failed. Resume has the same issue after context loss or direct refclk re-enable. Check and propagate the refclk enable errors so the wrapper does not publish or resume a child provider without parent readiness. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260624055612.43319-1-pengpeng@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-10usb: dwc3: fix kernel-doc string in struct dwc3_epJakov Novak
Building the documentation currently with make htmldocs gives the following errors: WARNING: ./drivers/usb/dwc3/core.h:803 Excess struct member 'regs' description in 'dwc3_ep' WARNING: ./drivers/usb/dwc3/core.h:803 Excess struct member 'regs' description in 'dwc3_ep' This is because the member variable regs of the struct dwc3_ep was removed in a previous patch. Remove regs from the kernel-doc string, fixing the warning. Fixes: abdd1eef04f0cb3b ("usb: dwc3: Remove of dep->regs") Signed-off-by: Jakov Novak <jakovnovak30@gmail.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260624114615.18593-1-jakovnovak30@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-10usb: dwc3: qcom: make dwc3_qcom_glue_ops staticBen Dooks
The dwc3_qcom_glue_ops is not used outside of the file it is declared in , so make it static to avoid the following warning: drivers/usb/dwc3/dwc3-qcom.c:605:22: warning: symbol 'dwc3_qcom_glue_ops' was not declared. Should it be static? Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20260623100000.718126-1-ben.dooks@codethink.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-10usb: dwc3: avoid probe deferral when USB power supply is not availableElson Serrao
The dwc3 driver currently defers probe if the USB power supply is not yet registered. On some platforms, even though charging and power supply functionality is available during normal operation, there may exist minimal booting modes (such as recovery or diagnostic environments) where the relevant USB power supply device is not registered. In such cases, probe deferral prevents USB gadget operation entirely. USB data functionality for basic operation does not inherently depend on the power supply framework, which is only required for enforcing VBUS current control. The configured VBUS current limit is typically enforced through the charger or PMIC power path. When charging functionality is unavailable, applying a current limit has no practical effect, reducing the benefit of strict probe-time enforcement in these environments. Instead of deferring probe, register a power supply notifier when the USB power supply is not yet available. Cache the requested VBUS current limit and apply it once the matching power supply becomes available, as notified through the registered callback. Signed-off-by: Elson Serrao <elson.serrao@oss.qualcomm.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260608171953.1717369-1-elson.serrao@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-08usb: dwc3: xilinx: use reset_control_reset() in versal initRadhey Shyam Pandey
Replace reset_control_assert()/deassert() with reset_control_reset(). For dwc3-xilinx, reset_control_reset() routes via the zynqmp reset driver and uses PM_RESET_ACTION_PULSE, which performs assert and deassert in firmware. This results in a single SMC call issuing a reset pulse and taking the IP out of reset. Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/6a5e4e25d84d6abc971f1669739aae4d3146700f.1779518171.git.radhey.shyam.pandey@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-08usb: dwc3: xilinx: fix missing space before closing comment delimiterRadhey Shyam Pandey
Add missing space before '*/' in an inline comment to follow the kernel coding style. Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Link: https://patch.msgid.link/8e6f53ad4eef8babb3c72ae9fac5130342760da9.1779518171.git.radhey.shyam.pandey@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-08usb: dwc3: run gadget disconnect from sleepable suspend contextRunyu Xiao
dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls dwc3_disconnect_gadget(). For async callbacks that helper only uses plain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback still runs with IRQs disabled and any sleepable callback trips Lockdep. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the dwc3_gadget_suspend() -> dwc3_disconnect_gadget() -> gadget_driver->disconnect() chain, and Lockdep reported: BUG: sleeping function called from invalid context gadget_disconnect+0x21/0x39 [vuln_msv] dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv] Keep the disconnect callback selection in one common helper, but add a sleepable suspend-side wrapper which snapshots the callback under dwc->lock and then runs it after spin_unlock_irqrestore(). The regular event path still uses the existing spin_unlock()/spin_lock() window. Fixes: c8540870af4c ("usb: dwc3: gadget: Improve dwc3_gadget_suspend() and dwc3_gadget_resume()") Cc: stable <stable@kernel.org> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260612052005.3849659-1-runyu.xiao@seu.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-08usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()Ben Dooks
The dwc3_ulpi_setup() calls the register read and write calls with dwc3->regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the following sparse warning, and possibly a nasty bug in the dwc3_ulpi_setup() code: drivers/usb/dwc3/core.c:796:45: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:796:45: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:796:45: got void [noderef] __iomem *regs drivers/usb/dwc3/core.c:798:40: warning: incorrect type in argument 1 (different address spaces) drivers/usb/dwc3/core.c:798:40: expected struct dwc3 *dwc drivers/usb/dwc3/core.c:798:40: got void [noderef] __iomem *regs Cc: stable <stable@kernel.org> Fixes: 9accc68b1cf0 ("usb: dwc3: Add dwc pointer to dwc3_readl/writel") Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Link: https://patch.msgid.link/20260703162033.2847599-1-ben.dooks@codethink.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-25usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()WenTao Liang
If dwc3_meson_g12a_resume() succeeds in calling reset_control_reset(), an internal triggered_count reference is acquired. If any later step fails (usb_init, phy_init, phy_power_on, regulator_enable, or usb_post_init), the function returns the error without rearming the reset control. This leaks the reference and leaves the reset control in a triggered state, causing future reset_control_reset() calls to incorrectly return early as if already reset. Add an error path that calls reset_control_rearm() to balance the reference before returning the error. Cc: stable <stable@kernel.org> Fixes: 5b0ba0caaf3a ("usb: dwc3: meson-g12a: refactor usb init") Signed-off-by: WenTao Liang <vulab@iscas.ac.cn> Link: https://patch.msgid.link/20260611131121.81784-1-vulab@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-06-01Merge tag 'v7.1-rc6' into usb-nextGreg Kroah-Hartman
We need the USB and Thunderbolt fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-21usb: dwc3: dwc3-octeon: Use FIELD_MODIFY()Hans Zhang
Use FIELD_MODIFY() to remove open-coded bit manipulation. No functional change intended. Signed-off-by: Hans Zhang <18255117159@163.com> Link: https://patch.msgid.link/20260430163919.47372-4-18255117159@163.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-21usb: dwc3: google: Use FIELD_MODIFY()Hans Zhang
Use FIELD_MODIFY() to remove open-coded bit manipulation. No functional change intended. Signed-off-by: Hans Zhang <18255117159@163.com> Link: https://patch.msgid.link/20260430163919.47372-3-18255117159@163.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-21usb: dwc3: Use FIELD_MODIFY()Hans Zhang
Use FIELD_MODIFY() to remove open-coded bit manipulation. No functional change intended. Signed-off-by: Hans Zhang <18255117159@163.com> Link: https://patch.msgid.link/20260430163919.47372-2-18255117159@163.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-21usb: dwc3: core: Fix incorrect kernel-doc comment for dwc3_alloc_event_buffersShuping Bu
The kernel-doc comment for dwc3_alloc_event_buffers states that the function "Allocates @num event buffers", but the function does not have a @num parameter and only allocates a single event buffer. Remove the misleading "@num" reference from the brief description to accurately reflect the function's behavior. Signed-off-by: Shuping Bu <bushuping007@163.com> Link: https://patch.msgid.link/20260520055023.2415635-1-bushuping007@163.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-21usb: dwc3: xilinx: fix error handling in zynqmp init error pathsRadhey Shyam Pandey
Fix error handling and resource cleanup i.e remove invalid phy_exit() after failed phy_init(), route failures through proper cleanup paths and return 0 explicitly on success. Fixes: 84770f028fab ("usb: dwc3: Add driver for Xilinx platforms") Cc: stable@vger.kernel.org Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Link: https://patch.msgid.link/20260519115529.2980421-1-radhey.shyam.pandey@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-27usb: dwc3: Move GUID programming after PHY initializationSelvarasu Ganesan
The Linux Version Code is currently written to the GUID register before PHY initialization. Certain PHY implementations (such as Synopsys eUSB PHY performing link_sw_reset) clear the GUID register to its default value during initialization, causing the kernel version information to be lost. Move the GUID register programming to occur after PHY initialization completes to ensure the Linux version information persists. Fixes: fa0ea13e9f1c ("usb: dwc3: core: write LINUX_VERSION_CODE to our GUID register") Cc: stable <stable@kernel.org> Reported-by: Pritam Manohar Sutar <pritam.sutar@samsung.com> Signed-off-by: Selvarasu Ganesan <selvarasu.g@samsung.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260417063314.2359-1-selvarasu.g@samsung.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-11usb: dwc3: starfive: Add JHB100 USB 2.0 DRD controllerMinda Chen
JHB100 contains 2 dwc3 USB controllers and PHYs and working as USB 2.0 speed. It can working in generic platform and setting default properties. Signed-off-by: Minda Chen <minda.chen@starfivetech.com> Link: https://patch.msgid.link/20260410112500.90432-3-minda.chen@starfivetech.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-06Merge tag 'v7.0-rc7' into usb-nextGreg Kroah-Hartman
We need the USB fixes in here to build on and for testing Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-02usb: dwc3: imx8mp: fix memory leak on probe failure pathXiaolei Wang
When platform_get_drvdata() returns NULL and probe defers, the error path jumps to the 'depopulate' label, skipping put_device() for the reference acquired by of_find_device_by_node(). This extra reference prevents the child platform device from being freed when of_platform_depopulate() is called, resulting in memory leaks reported by kmemleak: unreferenced object 0xffff0000c92c1480 (size 64): comm "kworker/u16:2", pid 50, jiffies 4294895789 backtrace (crc 49d507d0): kmemleak_alloc+0x34/0x40 __kmalloc_noprof+0x430/0x670 of_device_alloc+0xec/0x26c of_platform_device_create_pdata+0x60/0x1f0 of_platform_bus_create+0x290/0x610 of_platform_populate+0x74/0x118 dwc3_imx8mp_probe+0x228/0x734 Fixes: 86767625f525 ("usb: dwc3: imx8mp: disable auto suspend for host role") Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260401134938.686748-1-xiaolei.wang@windriver.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-30usb: dwc3: Add optional VBUS regulator support to SpacemiT K1Chukun Pan
Some SpacemiT K1 boards (like OrangePi R2S) provide USB VBUS through a controllable regulator. Add support for the optional vbus-supply property so the regulator can be properly managed in host mode instead of left always-on. Note that this doesn't apply to USB Hub downstream ports with different VBUS supplies. The enabled and disabled actions of the regulator are handled automatically by devm_regulator_get_enable_optional(). Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Reviewed-by: Anand Moon <linux.amoon@gmail.com> Link: https://patch.msgid.link/20260326100010.3588454-2-amadeus@jmu.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-30usb: dwc3: dwc3-generic-plat: spacemit: add support for K3 SoCYixun Lan
Add support for the DWC3 USB controller which found in SpacemiT K3 SoC. Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Signed-off-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260320-02-k3-usb20-support-v2-2-308ea0e44038@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-18usb: dwc3: imx: avoid calling imx suspend/resume callbacks twiceXu Yang
If a runtime suspend is executed followed by a system suspend, the driver may invoke dwc3_imx_suspend() twice, which causes enable_irq() to be called twice as well. This leads to an unbalanced IRQ state and may trigger warnings or malfunction. Prevent this by checking the pm_suspended flag before running the imx suspend/resume path. Fixes: 76fc9452a6bf ("usb: dwc3: introduce flatten model driver of i.MX Soc") Signed-off-by: Xu Yang <xu.yang_2@nxp.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260317030546.1665206-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-18dwc3: google: Fix PM domain leak in dwc3_google_probe()Felix Gu
When syscon_regmap_lookup_by_phandle_args() fails, the function was returning directly without cleaning up the power domain initialized earlier by dwc3_google_pm_domain_init(). Fix by jumping to err_deinit_pdom to properly clean up resources. Fixes: 8995a37371bf4 ("usb: dwc3: Add Google Tensor SoC DWC3 glue driver") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260316-dwc3-google-v1-1-c9bde1b02f62@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-16Merge 7.0-rc4 into usb-nextGreg Kroah-Hartman
We need the USB fixes in this branch as well to build on top of Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: dwc3: pci: add support for the Intel Nova Lake -HHeikki Krogerus
This patch adds the necessary PCI ID for Intel Nova Lake -H devices. Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Cc: stable <stable@kernel.org> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260309130204.208661-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: dwc3: gadget: use explicit 0 for success in __dwc3_gadget_kick_transfer()Zeeshan Ahmad
Smatch warns that __dwc3_gadget_kick_transfer() might be missing an error code when returning 'ret' at line 1691. While 'ret' is guaranteed to be 0 at this point, returning an explicit 0 improves readability by removing a level of indirection and clarifies the intent that this is a successful "no-op" path. This change also silences the Smatch warning. Suggested-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Zeeshan Ahmad <zeeshanahmad022019@gmail.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260306090643.47383-1-zeeshanahmad022019@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: dwc3: qcom: simplify error check in dwc3_qcom_find_num_ports()Zeeshan Ahmad
The platform_get_irq_byname_optional() function returns a non-zero IRQ number on success and a negative error code on failure. It never returns zero. The current implementation in the modern dwc3-qcom driver checks for a return value less than or equal to zero. Since zero is not a valid return value, simplify the check to only look for negative error codes. This aligns the logic with the standard return contract of the platform IRQ APIs. Signed-off-by: Zeeshan Ahmad <zeeshanahmad022019@gmail.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260225065157.8952-1-zeeshanahmad022019@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: dwc3: fix a typo 'HishSpeed'Xu Yang
It should be 'HighSpeed' instead of 'HishSpeed'. Signed-off-by: Xu Yang <xu.yang_2@nxp.com> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260304113916.856841-2-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: dwc3: fix a kernel-doc issueXu Yang
Add '*' to needs_full_reinit comment line to fix a kernel-doc issue. Signed-off-by: Xu Yang <xu.yang_2@nxp.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Link: https://patch.msgid.link/20260304113916.856841-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-11usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation.Ingo Rohloff
The Microchip USB3340x ULPI PHY requires a delay when switching to the high-speed transmitter. See: http://ww1.microchip.com/downloads/en/DeviceDoc/80000645A.pdf Module 2 "Device Enumeration Failure with Link IP Systems" For details on the behavior and fix, refer to the AMD (formerly Xilinx) forum post: "USB stuck in full speed mode with USB3340 ULPI PHY, ZynqMP." This patch uses the USB PHY Vendor-ID and Product-ID to detect the USB3340 PHY and then applies the necessary fix if this PHY is found. Signed-off-by: Ingo Rohloff <ingo.rohloff@lauterbach.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260305121452.54082-2-ingo.rohloff@lauterbach.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-02-25usb: dwc3: introduce flatten model driver of i.MX SocXu Yang
The i.MX USB glue and DWC3 core are closely coupled. Describe the i.MX USB block in a single block will bring more benefits than a parent- child relation. To support the flatten model devicetree, DWC3 USB core driver already support to directly register and initialize the core in glue layer using one device. And many notification can be received in glue layer timely and proper actions can be executed accordingly. To align with mainstream, introduce a new driver to support flatten dwc3 devicetree model for i.MX Soc. Besides this driver disables wakeup irq when system is active, no other function change in this version compared to dwc3-imx8mp.c. After this new driver is settled, only maintenance fixes will be added to dwc3-imx8mp.c, new features will only be added to this new driver. Once all users switch to this new one, the legacy driver will be removed at proper time. Signed-off-by: Xu Yang <xu.yang_2@nxp.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260212-add-flatten-dts-based-dwc3-imx-driver-v5-3-ff04a75ce221@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-02-25usb: dwc3: add needs_full_reinit flagXu Yang
The current design assumes that the controller remains powered when wakeup is enabled. However, some SoCs provide wakeup capability even when the controller itself is powered down, using separate dedicated wakeup logic. This allows additional power savings, but requires the controller to be fully re‑initialized after system resume. To support these SoCs, introduce a flag needs_full_reinit for the purpose. And the glue layer needs to indicate if the controller needs this behavior by setting a same flag needs_full_reinit in dwc3_properties. Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Xu Yang <xu.yang_2@nxp.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260212-add-flatten-dts-based-dwc3-imx-driver-v5-2-ff04a75ce221@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-02-21Convert 'alloc_obj' family to use the new default GFP_KERNEL argumentLinus Torvalds
This was done entirely with mindless brute force, using git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' | xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/' to convert the new alloc_obj() users that had a simple GFP_KERNEL argument to just drop that argument. Note that due to the extreme simplicity of the scripting, any slightly more complex cases spread over multiple lines would not be triggered: they definitely exist, but this covers the vast bulk of the cases, and the resulting diff is also then easier to check automatically. For the same reason the 'flex' versions will be done as a separate conversion. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21treewide: Replace kmalloc with kmalloc_obj for non-scalar typesKees Cook
This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org>
2026-02-05usb: dwc3: gadget: Move vbus draw to workqueue contextPrashanth K
Currently dwc3_gadget_vbus_draw() can be called from atomic context, which in turn invokes power-supply-core APIs. And some these PMIC APIs have operations that may sleep, leading to kernel panic. Fix this by moving the vbus_draw into a workqueue context. Fixes: 99288de36020 ("usb: dwc3: add an alternate path in vbus_draw callback") Cc: stable <stable@kernel.org> Tested-by: Samuel Wu <wusamuel@google.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com> Link: https://patch.msgid.link/20260204054155.3063825-1-prashanth.k@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-27usb: dwc3: Log dwc3 address in tracesPrashanth K
When multiple DWC3 controllers are being used, trace events from different instances get mixed up making debugging difficult as there's no way to distinguish which instance generated the trace. Use the register base address of dwc3 controller and append it to trace events, so that the source instance is clearly identifiable. Example trace output, before -> dwc3_event: event (00000101): Reset [U0] after -> dwc3_event: 0x000000000a600000: event (00000101): Reset [U0] Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260122105000.4126769-1-prashanth.k@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-23usb: dwc3: google: Remove redundant dev_err()Chen Ni
The platform_get_irq_byname() function already prints an error message internally upon failure using dev_err_probe(). Therefore, the explicit dev_err() is redundant and results in duplicate error logs. Remove the redundant dev_err() call to clean up the error path. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260115023800.4142416-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-19Merge 6.19-rc6 usb-nextGreg Kroah-Hartman
We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16usb: dwc3: Add dwc pointer to dwc3_readl/writelPrashanth K
Use dwc pointer in dwc3_readl() dwc3_writel() instead of passing the dwc->regs. This would help us access the dwc structure and log the base address in traces. There's no functional changes in this patch, just refactoring existing APIs. Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260114100748.2950103-3-prashanth.k@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16usb: dwc3: Remove of dep->regsPrashanth K
Remove dep->regs from struct dwc3_ep and reuse dwc->regs instead. Thus eliminating redundant iomem addresses and making register access more consistent across the driver. Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260114100748.2950103-2-prashanth.k@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-14usb: dwc3: apple: Ignore USB role switches to the active roleJanne Grunau
Ignore USB role switches if dwc3-apple is already in the desired state. The USB-C port controller on M2 and M1/M2 Pro/Max/Ultra devices issues additional interrupts which result in USB role switches to the already active role. Ignore these USB role switches to ensure the USB-C port controller and dwc3-apple are always in a consistent state. This matches the behaviour in __dwc3_set_mode() in core.c. Fixes detecting USB 2.0 and 3.x devices on the affected systems. The reset caused by the additional role switch appears to leave the USB devices in a state which prevents detection when the phy and dwc3 is brought back up again. Fixes: 0ec946d32ef7 ("usb: dwc3: Add Apple Silicon DWC3 glue layer driver") Cc: stable <stable@kernel.org> Signed-off-by: Janne Grunau <j@jannau.net> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Reviewed-by: Sven Peter <sven@kernel.org> Tested-by: Sven Peter <sven@kernel.org> # M1 mac mini and macbook air Link: https://patch.msgid.link/20260109-apple-dwc3-role-switch-v1-1-11623b0f6222@jannau.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-14usb: dwc3: apple: Set USB2 PHY mode before dwc3 initSven Peter
Now that the upstream code has been getting broader test coverage by our users we occasionally see issues with USB2 devices plugged in during boot. Before Linux is running, the USB2 PHY has usually been running in device mode and it turns out that sometimes host->device or device->host transitions don't work. The root cause: If the role inside the USB2 PHY is re-configured when it has already been powered on or when dwc3 has already enabled the ULPI interface the new configuration sometimes doesn't take affect until dwc3 is reset again. Fix this rare issue by configuring the role much earlier. Note that the USB3 PHY does not suffer from this issue and actually requires dwc3 to be up before the correct role can be configured there. Reported-by: James Calligeros <jcalligeros99@gmail.com> Reported-by: Janne Grunau <j@jannau.net> Fixes: 0ec946d32ef7 ("usb: dwc3: Add Apple Silicon DWC3 glue layer driver") Cc: stable <stable@kernel.org> Tested-by: Janne Grunau <j@jannau.net> Reviewed-by: Janne Grunau <j@jannau.net> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Signed-off-by: Sven Peter <sven@kernel.org> Link: https://patch.msgid.link/20260109-dwc3-apple-usb2phy-fix-v2-1-ab6b041e3b26@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-14usb: dwc3: Always deassert xilinx resetsSean Anderson
If we don't have a usb3 phy we don't need to assert the core resets. Deassert them even if we didn't assert them to support booting when the bootloader never released the core from reset. Signed-off-by: Sean Anderson <sean.anderson@linux.dev> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://patch.msgid.link/20260106171018.501612-1-sean.anderson@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-14usb: dwc3: imx8mp: disable auto suspend for host roleXu Yang
Do dwc3 core auto suspend enable for device and disable for host , this can make sure dwc3 core device auto suspend setting is correct all the time, the background of disable dwc3 core device auto suspend is to make its parent device suspend immediately (so wakeup enable can be enabled) after xhci-plat device suspended, for device mode, we keep the dwc3 core device auto suspend is to give some wait for gadget to be enumerated. Note: It's a temporary solution until we switch to using the new flatten model. Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Signed-off-by: Xu Yang <xu.yang_2@nxp.com> Link: https://patch.msgid.link/20260108081433.2119328-3-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-14usb: dwc3: imx8mp: rename dwc3 to dwc3_pdev in struct dwc3_imx8mpXu Yang
It's confuse to let "dwc3" represent a platform_device, because "dwc3" may also represent a dwc3 core structure. Rename it for better distinction. Reviewed-by: Frank Li <Frank.Li@nxp.com> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Signed-off-by: Xu Yang <xu.yang_2@nxp.com> Link: https://patch.msgid.link/20260108081433.2119328-2-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>