linux-toradex.git/drivers/usb/host, branch master

Merge tag 'usb-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2026-10-25T01:31:19+00:00

Pull USB / Thunderbolt update from Greg KH:
 "Here is the big set of USB and Thunderbolt changes for 7.4-rc1.
  Included in here are:

   - thunderbolt driver updates and fixes

   - lots of dt schema conversions

   - usb gadget driver fixes (and a new maintainer!)

   - usb core fixups with some interactions with the driver core

   - usb serial updates and fixes for scan-found "issues"

   - xhci driver updates

   - typec driver updates

   - dwc3 driver updates

   - lots of usb gadget driver fixes for syzbot found "problems"

   - lots of other small USB driver fixes for randomly reported problems.

  All of these have been in linux-next with no reported issues"

* tag 'usb-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (158 commits)
  usb: gadget: dummy_hcd: prevent unbind via sysfs
  usb: gadget: dummy_hcd: add tick_us module parameter for timer-rate tuning
  usb: gadget: dummy_hcd: set no_sg_constraint only on the SuperSpeed bus
  usb: gadget: dummy_hcd: fix SuperSpeed ep0 maxpacket
  usb: gadget: fix refcount underflow in gadgetfs_bind() error path
  USB: core: document purpose of interface parent reference
  MAINTAINERS: add Neill Kapron as USB Gadget maintainer
  USB: Documentation: Update description of completion callback context
  USB: serial: mxuport: support RS485 mode configuration
  USB: serial: mxuport: handle SEND_NEXT transmit flow control
  USB: serial: add generic write control callbacks
  USB: serial: mxuport: add MUX50U-based device support
  USB: serial: mxuport: clean up firmware version handling
  USB: serial: mxuport: clean up product ID definitions and device table
  USB: serial: sierra: fix urb leak on write completion
  usb: typec: ucsi_ccg: Add retry mechanism in ccg_read
  usb: host: xhci-tegra: Add Tegra264 XHCI support
  usb: host: xhci-tegra: Skip MBOX MSG_ENABLED on Tegra264
  dt-bindings: usb: Add Tegra264 XUSB host support
  usb: xhci-pci: Add TUSB73x0 definitions
  ...

Merge tag 'soc-drivers-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

2026-10-22T17:52:50+00:00

Pull SoC driver updates from Arnd Bergmann:
 "There are lots of minor updates for driver subsystems managed through
  the soc tree (turris-omnia platform, cache driver, tee drivers,
  arm-cci, bus, memory) as well as soc vendor specific drivers
  (starfive, xilinx, microchip, nxp, amlogic, imx, renesas, samsung, ti,
  nvidia).

  The more notable changes are:

   - Larger updates for Qualcomm SoCs including support for SM8950
     (Maili) SM8975 (Hawi), Glymur, Shikra, and IPQ5424

   - Added SoC support for Exynos5515, Tegra264, Tegra410, R8A774A3, and
     MT8167 in existing drivers

   - Arm SCMI firmware driver support for ACPI PCC transport and module
     autoloading of protocol specific drivers

   - Apple crash log support for CrgA embedded controller"

* tag 'soc-drivers-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (176 commits)
  platform: cznic: turris-omnia-mcu: stop button emulation producers
  cache: Make cpu_cache_invalidate_memregion() error out if there are no handlers
  soc: mpfs: use kref cleanup on probe failure
  arm64: enable HAVE_SHARED_GPIOS for all ARM64 platforms
  bus: arm-cci: Drop cci-control-port node reference in __cci_ace_get_port()
  bus: arm-cci: Drop CPU node reference in cci_ace_init_ports()
  soc: fsl: dpio: Free the IRQ before releasing the I/O object
  soc: fsl: dpio: Fix cleanup on IRQ registration failure
  bus: fsl-mc: Annotate fsl_mc_io.portal_virt_addr with __counted_by_ptr
  bus: fsl-mc: drop the fwnode links of the dpmacs nodes
  soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms()
  soc: qcom: geni-se: Drop unused icc_ddr parameter from geni_icc_get()
  firmware: qcom: scm: Allow QSEECOM on ThinkPad T14s Gen 7
  dt-bindings: mailbox: qcom: Document Maili CPUCP mailbox controller
  dt-bindings: spmi: glymur-spmi-pmic-arb: Add compatible for Qualcomm Maili SoC
  soc: qcom: pmic_pdcharger_ulog: prevent work requeue during remove
  ASoC: dt-bindings: qcom,apr: Add modem_apps GLINK channel for shikra
  firmware: qcom: tzmem: disable SHM bridge for SM7125 platform
  soc: qcom: ubwc: Add Kalambo UBWC config
  firmware: qcom: scm: Allow QSEECOM on Kalambo CRD
  ...

usb: host: xhci-tegra: Add Tegra264 XHCI support

2026-10-11T14:32:44+00:00

This change adds Tegra264 XUSB host mode controller support.
The host controller is very similar to the existing Tegra234 XHCI,
except the number of max_num_wakes.

Signed-off-by: Wayne Chang 
Reviewed-by: Jon Hunter 
Tested-by: Jon Hunter 
Link: https://patch.msgid.link/20260903074539.613220-4-waynec@nvidia.com
Signed-off-by: Greg Kroah-Hartman

usb: host: xhci-tegra: Skip MBOX MSG_ENABLED on Tegra264

2026-10-11T14:32:44+00:00

Tegra264 XUSB does not use the firmware mailbox handshake to enable
controller messages (MBOX_CMD_MSG_ENABLED). Add a per-SoC flag and
short-circuit __tegra_xusb_enable_firmware_messages() so both probe
and resume avoid sending the command.

Signed-off-by: Wayne Chang 
Reviewed-by: Jon Hunter 
Tested-by: Jon Hunter 
Link: https://patch.msgid.link/20260903074539.613220-3-waynec@nvidia.com
Signed-off-by: Greg Kroah-Hartman

usb: xhci-pci: Add TUSB73x0 definitions

2026-10-11T13:51:53+00:00

Instead of hard-coding the TUSB73X0 PCI ID, USB_CTRL register address
and the PWRON_POLARITY, introduce definitions for them to make the code
easier to read.

No functional change.

Signed-off-by: Fabio Estevam 
Acked-by: Bjorn Helgaas 	# pci_ids.h
Link: https://patch.msgid.link/20261009125154.266435-1-festevam@gmail.com
Signed-off-by: Greg Kroah-Hartman

usb: xhci-pci: Add AMD 600 series to xhci-pci-prom21

2026-10-11T13:51:02+00:00

It seems the xhci-pci-prom21 module only has IDs for the 800 series
chipsets. However, the 600 series chipsets also have Promontory 21
chips, so we should add their IDs to the list as well.

I have tested this on my X670 board featuring DID `0x43f7`.

`1022:43f7` also appears on the PCI ID database
(https://pci-ids.ucw.cz/read/PC/1022/43f7).
Device IDs `0x43f9` (B665) & `0x43fa` (A620) were suggested by Shyam.

Also list the new IDs in Documentation/hwmon/prom21-xhci.rst.

Cc: stable@vger.kernel.org # 7.2.x
Cc: Shyam Sundar S K 
Cc: Jihong Min 
Signed-off-by: Stephen Horvath 
Tested-by: Mirko Jechow 
[mirko.jechow@gmx.de: add new IDs to prom21-xhci.rst]
Signed-off-by: Mirko Jechow 
Link: https://patch.msgid.link/20261004002731.49927-1-mirko.jechow@gmx.de
Signed-off-by: Greg Kroah-Hartman

xhci: Prevent invalid vdev dereference during sideband unregister

2026-10-11T13:50:49+00:00

Offloaded USB audio devices using the xhci-sideband API store a pointer to
the xhci virtual device (vdev) in the sideband structure when registering.

This pointer typically remains valid throughout the lifetime of the USB
device. If a configured offloaded device requires a reset, the USB core
usually unbinds or notifies the audio driver beforehand, ensuring that the
sideband is unregistered before the vdev is freed.

An exception occurs when the USB core resets a device to recover from a
failed resume, but a subsequent 'address device' request also fails. To
recover in this specific scenario, the xHCI driver disables and re-enables
the slot, which frees and re-allocates the vdev.

xhci_sideband_unregister() later dereferences the stale, previously freed
vdev pointer during disconnect, triggering a kernel oops:

 Unable to handle kernel paging request at virtual address dead000000000122
 Call trace:
  xhci_get_ep_ctx+0x0/0x38
  xhci_sideband_unregister+0x68/0xf0
  uaudio_disconnect+0x70/0x144
  usb_audio_disconnect+0x7c/0x268
  usb_unbind_interface+0x13c/0x340
  device_release_driver_internal+0x1c4/0x2bc
  usb_disable_device+0x84/0x190
  usb_disconnect+0xe8/0x338
  hub_event+0xbd8/0x19ac

Fix this by preventing the reallocation of the vdev in this specific error
path if the device is registered for sideband use.

Just propagate the error directly to the USB core. It should either retry
enumeration or detect the disconnected device, and handle it accordingly.

Debugging this issue to the dangling vdev pointer, reporting it, testing,
and initial patch with different solution by Lianqin Hu

Reported-by: Lianqin Hu 
Closes: https://lore.kernel.org/linux-usb/TYUPR06MB6217000B59003EDF233D7246D2B22@TYUPR06MB6217.apcprd06.prod.outlook.com/
Tested-by: Lianqin Hu 
Fixes: de66754e9f80 ("xhci: sideband: add initial api to register a secondary interrupter entity")
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman 
Link: https://patch.msgid.link/20261009151624.618967-12-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

usb: xhci: Fix bounce buffer overflow

2026-10-11T13:50:49+00:00

High-speed devices with out of spec 1024 byte bulk endpoints exist and
are allowed by USB core, but xhci-hcd always sets packet size to 512.
The exact nature of these devices isn't documented, commit fb5ee84ea72c
("USB: Accept bulk endpoints with 1024-byte maxpacket") only states
that they "don't work with xHCI host controllers", whatever it means.

But somebody (or a malicious device) can try, and then the driver will
allocate a 512 byte bounce buffer for this endpoint and may write up to
1024 bytes into it if particular scatter-gather URBs are used, because
xhci_align_td() obtains packet size from the descriptor. Fix this.

As a side effect, TRBs will be aligned to the packet size chosen by the
driver on all endpoints of all speeds. Alignment serves the xHC, not
device, so this is fine. Only out of spec devices are affected anyway.

Reported-by: co+fd80bc5967eb22c3@bugs.sh
Link: https://lore.kernel.org/linux-usb/D4tcSGerkYkIV1DmaUo1t8TaR5qQElDLkidn@bugs.sh/
Fixes: f9c589e142d0 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Michal Pecio 
Signed-off-by: Mathias Nyman 
Link: https://patch.msgid.link/20261009151624.618967-11-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

usb: xhci: Rework and improve the TD matching and skipping logic

2026-10-11T13:50:49+00:00

Matching events with TDs and giving back missed TDs is carried out
by a complicated loop. Replace it with a simpler linear logic:

0. Having verified that 'td_list' isn't empty,
1. Scan it to find the matching TD and count missed TDs,
2. Perform necessary adjustments for corner cases,
3. Give back missed TDs, if applicable, using a short and tidy loop,
4. Check if the event refers to the expected TD and proceed as usual.

Besides cleaning up the code, this provides a few improvements:
- when the skip flag is set, no TD is given back unless we found a match
  or otherwise know how many TDs should be given back
- when the skip flag is clear, we know if the event refers to a "future"
  TD so we can log this in the Scary Error Message to aid debugging.

While altering the error message, drop a pointless goto.

Signed-off-by: Michal Pecio 
Signed-off-by: Mathias Nyman 
Link: https://patch.msgid.link/20261009151624.618967-10-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

usb: xhci: Shorten the TD skipping loop

2026-10-11T13:50:49+00:00

Half of this loop is code which only executes once to deal with cases
where no TD matches the event and then it returns. This code needs not
to be in any kind of loop, so get it out.

Optimize conditionals remaining in the loop body.

Signed-off-by: Michal Pecio 
Signed-off-by: Mathias Nyman 
Link: https://patch.msgid.link/20261009151624.618967-9-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman