linux/drivers/usb/typec/ucsi, branch master

Merge tag 'usb-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2026-04-19T15:47:40Z

Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt changes for 7.1-rc1. Lots of little things in here, nothing major, just constant improvements, updates, and new features. Highlights are: - new USB power supply driver support. These changes did touch outside of drivers/usb/ but got acks from the relevant mantainers for them. - dts file updates and conversions - string function conversions into "safer" ones - new device quirks - xhci driver updates - usb gadget driver minor fixes - typec driver additions and updates - small number of thunderbolt driver changes - dwc3 driver updates and additions of new hardware support - other minor driver updates All of these have been in the linux-next tree for a while with no reported issues" * tag 'usb-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (176 commits) usb: dwc3: starfive: Add JHB100 USB 2.0 DRD controller dt-bindings: usb: dwc3: add support for StarFive JHB100 dt-bindings: usb: atmel,at91sam9rl-udc: convert to DT schema dt-bindings: usb: atmel,at91rm9200-udc: convert to DT schema dt-bindings: usb: generic-ehci: fix schema structure and add at91sam9g45 constraints dt-bindings: usb: generic-ohci: add AT91RM9200 OHCI binding support arm: dts: at91: remove unused #address-cells/#size-cells from sam9x60 udc node drivers/usb/host: Fix spelling error 'seperate' -> 'separate' usbip: tools: add hint when no exported devices are found USB: serial: iuu_phoenix: fix iuutool author name usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() usb: gadget: f_hid: Add missing error code usb: typec: cros_ec_ucsi: Load driver from OF and ACPI definitions dt-bindings: chrome: Add cros-ec-ucsi compatibility to typec binding USB: of: Simplify with scoped for each OF child loop usbip: validate number_of_packets in usbip_pack_ret_submit() usb: gadget: renesas_usb3: validate endpoint index in standard request handlers usb: core: config: reverse the size check of the SSP isoc endpoint descriptor usb: typec: ucsi: Set usb mode on partner change ...

usb: typec: cros_ec_ucsi: Load driver from OF and ACPI definitions

2026-04-07T11:49:53Z

Add support for cros_ec_ucsi to load based on "google,cros-ec-ucsi" compatible devices and "GOOG0021" ACPI nodes. Signed-off-by: Jameson Thies Reviewed-by: Benson Leung Reviewed-by: Abhishek Pandit-Subedi Link: https://patch.msgid.link/20260403223357.1896403-3-jthies@google.com Signed-off-by: Greg Kroah-Hartman

usb: typec: ucsi: Set usb mode on partner change

2026-04-07T11:47:59Z

Currently the partner usb_mode is only set in ucsi_register_partner(). If the partner enters USB4 operation after it is registered, this is not reported to the typec class. The UCSI spec states that the Connector Partner Changed bit can represent a Connector Partner Flags change. When handling a UCSI partner change, check the partner flags for USB4 operation. Signed-off-by: Jameson Thies Reviewed-by: Benson Leung Link: https://patch.msgid.link/20260402182438.867396-1-jthies@google.com Signed-off-by: Greg Kroah-Hartman

usb: typec: ucsi: skip connector validation before init

2026-04-07T11:35:44Z

Notifications can arrive before ucsi_init() has populated ucsi->cap.num_connectors via GET_CAPABILITY. At that point num_connectors is still 0, causing all valid connector numbers to be incorrectly rejected as bogus. Skip the bounds check when num_connectors is 0 (not yet initialized). Pre-init notifications are already handled safely by the early-event guard in ucsi_connector_change(). Reported-by: Takashi Iwai Fixes: d2d8c17ac01a ("usb: typec: ucsi: validate connector number in ucsi_notify_common()") Cc: stable@vger.kernel.org Signed-off-by: Nathan Rebello Tested-by: Takashi Iwai Link: https://patch.msgid.link/20260407063958.863-1-nathan.c.rebello@gmail.com Signed-off-by: Greg Kroah-Hartman

Merge tag 'v7.0-rc7' into usb-next

2026-04-06T07:06:39Z

We need the USB fixes in here to build on and for testing Signed-off-by: Greg Kroah-Hartman

usb: typec: ucsi: validate connector number in ucsi_notify_common()

2026-03-18T15:15:49Z

The connector number extracted from CCI via UCSI_CCI_CONNECTOR() is a 7-bit field (0-127) that is used to index into the connector array in ucsi_connector_change(). However, the array is only allocated for the number of connectors reported by the device (typically 2-4 entries). A malicious or malfunctioning device could report an out-of-range connector number in the CCI, causing an out-of-bounds array access in ucsi_connector_change(). Add a bounds check in ucsi_notify_common(), the central point where CCI is parsed after arriving from hardware, so that bogus connector numbers are rejected before they propagate further. Fixes: bdc62f2bae8f ("usb: typec: ucsi: Simplified registration and I/O API") Cc: stable Reviewed-by: Heikki Krogerus Signed-off-by: Nathan Rebello Link: https://patch.msgid.link/20260313222453.123-1-nathan.c.rebello@gmail.com Signed-off-by: Greg Kroah-Hartman

usb: typec: ucsi: Add UCSI_USB4_IMPLIES_USB quirk for X1E80100

2026-03-18T15:03:14Z

On X1E80100, when we connect a USB4 capable dock, the PARTNER_FLAGS indicate USB4_GEN3 being set whilst keeping the PARTNER_FLAGS_USB cleared. Due to this, during ucsi_partner_change call, the usb role is marked as ROLE_NONE and passed to DWC3 controller the same way. Fix this by adding UCSI_USB4_IMPLIES_USB quirk and check for it to decide and pass on proper ROLE information to DWC3 layer. Signed-off-by: Krishna Kurapati Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260312101431.2375709-1-krishna.kurapati@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman

usb: typec: ucsi: Invoke ucsi_run_command tracepoint

2026-03-11T14:38:19Z

The ucsi_run_command trace event is exposed in tracefs, but it never produces any output because the UCSI core never invokes the associated tracepoint. As a result, enabling the event under events/ucsi/ yields no traces, preventing users from inspecting UCSI command sequencing. Wire the tracepoint into the UCSI command path so that commands are properly reported. Example: 50.692342: ucsi_run_command: GET_CONNECTOR_STATUS -> OK (err=0) 50.692345: ucsi_connector_change: port0 status: change=4800, ... 51.750298: ucsi_run_command: GET_CABLE_PROPERTY -> FAIL (err=-5) 51.773360: ucsi_run_command: GET_CONNECTOR_STATUS -> OK (err=0) Signed-off-by: Loic Poulain Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260217103403.1956-1-loic.poulain@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman

usb: ucsi: huawei_gaokun: make gaokun_ucsi_ops static

2026-03-11T14:01:17Z

The gaokun_ucsi_ops structure is only used within its translation unit and is not referenced from any other file. Add the 'static' qualifier to avoid unnecessary symbol export. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603050203.KD4RWA00-lkp@intel.com Signed-off-by: Pengyu Luo Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260305144054.27848-1-mitltlatltl@gmail.com Signed-off-by: Greg Kroah-Hartman

usb: typec: ucsi: ucsi_glink: Add support for Glymur and Kaanapali

2026-03-11T13:59:09Z

Add Glymur and Kaanapali compatible strings which both need UCSI_DELAY_DEVICE_PDOS quirk. Signed-off-by: Anjelique Melendez Reviewed-by: Dmitry Baryshkov Reviewed-by: Heikki Krogerus Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260209204915.1983997-5-anjelique.melendez@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman