linux/drivers/usb/typec, branch v6.16

usb: typec: displayport: Fix potential deadlock

2025-06-24T14:43:15Z

The deadlock can occur due to a recursive lock acquisition of `cros_typec_altmode_data::mutex`. The call chain is as follows: 1. cros_typec_altmode_work() acquires the mutex 2. typec_altmode_vdm() -> dp_altmode_vdm() -> 3. typec_altmode_exit() -> cros_typec_altmode_exit() 4. cros_typec_altmode_exit() attempts to acquire the mutex again To prevent this, defer the `typec_altmode_exit()` call by scheduling it rather than calling it directly from within the mutex-protected context. Cc: stable Fixes: b4b38ffb38c9 ("usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode") Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250624133246.3936737-1-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman

usb: typec: altmodes/displayport: do not index invalid pin_assignments

2025-06-24T14:42:55Z

A poorly implemented DisplayPort Alt Mode port partner can indicate that its pin assignment capabilities are greater than the maximum value, DP_PIN_ASSIGN_F. In this case, calls to pin_assignment_show will cause a BRK exception due to an out of bounds array access. Prevent for loop in pin_assignment_show from accessing invalid values in pin_assignments by adding DP_PIN_ASSIGN_MAX value in typec_dp.h and using i < DP_PIN_ASSIGN_MAX as a loop condition. Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode") Cc: stable Signed-off-by: RD Babiera Reviewed-by: Badhri Jagan Sridharan Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250618224943.3263103-2-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman

usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach

2025-06-24T14:42:24Z

This patch fixes Type-C compliance test TD 4.7.6 - Try.SNK DRP Connect SNKAS. tVbusON has a limit of 275ms when entering SRC_ATTACHED. Compliance testers can interpret the TryWait.Src to Attached.Src transition after Try.Snk as being in Attached.Src the entire time, so ~170ms is lost to the debounce timer. Setting the data role can be a costly operation in host mode, and when completed after 100ms can cause Type-C compliance test check TD 4.7.5.V.4 to fail. Turn VBUS on before tcpm_set_roles to meet timing requirement. Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)") Cc: stable Signed-off-by: RD Babiera Reviewed-by: Badhri Jagan Sridharan Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250618230606.3272497-2-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman

Merge tag 'usb-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2025-06-06T19:45:35Z

Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt changes for 6.16-rc1. Included in here are the following: - USB offload support for audio devices. I think this takes the record for the most number of patch series (30+) over the longest period of time (2+ years) to get merged properly. Many props go to Wesley Cheng for seeing this effort through, they took a major out-of-tree hacked-up-monstrosity that was created by multiple vendors for their specific devices, got it all merged into a semi-coherent set of changes, and got all of the different major subsystems to agree on how this should be implemented both with changes to their code as well as userspace apis, AND wrangled the hardware companies into agreeing to go forward with this, despite making them all redo work they had already done in their private device trees. This feature offers major power savings on embedded devices where a USB audio stream can continue to flow while the rest of the system is sleeping, something that devices running on battery power really care about. There are still some more small tweaks left to be done here, and those patches are still out for review and arguing among the different hardware companies, but this is a major step forward and a great example of how to do upstream development well. - small number of thunderbolt fixes and updates, things seem to be slowing down here (famous last words...) - xhci refactors and reworking to try to handle some rough corner cases in some hardware implementations where things don't always work properly - typec driver updates - USB3 power management reworking and updates - Removal of some old and orphaned UDC gadget drivers that had not been used in a very long time, dropping over 11 thousand lines from the tree, always a nice thing, making up for the 12k lines added for the USB offload feature. - lots of little updates and fixes in different drivers All of these have been in linux-next for over 2 weeks, the USB offload logic has been in there for 8 weeks now, with no reported issues" * tag 'usb-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (172 commits) ALSA: usb-audio: qcom: fix USB_XHCI dependency ASoC: qdsp6: fix compile-testing without CONFIG_OF usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n usb: typec: tipd: fix typo in TPS_STATUS_HIGH_VOLAGE_WARNING macro USB: typec: fix const issue in typec_match() USB: gadget: udc: fix const issue in gadget_match_driver() USB: gadget: fix up const issue with struct usb_function_instance USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB USB: serial: bus: fix const issue in usb_serial_device_match() usb: usbtmc: Fix timeout value in get_stb usb: usbtmc: Fix read_stb function and get_stb ioctl ALSA: qc_audio_offload: try to reduce address space confusion ALSA: qc_audio_offload: avoid leaking xfer_buf allocation ALSA: qc_audio_offload: rename dma/iova/va/cpu/phys variables ALSA: usb-audio: qcom: Fix an error handling path in qc_usb_audio_probe() usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence dt-bindings: usb: ti,usb8041: Add binding for TI USB8044 hub controller usb: misc: onboard_usb_dev: Add support for TI TUSB8044 hub usb: gadget: lpc32xx_udc: Use USB API functions rather than constants usb: gadget: epautoconf: Use USB API functions rather than constants ...

Merge tag 'leds-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds

2025-06-03T19:10:31Z

Pull LED updates from Lee Jones: "LED Triggers: - Allow writing "default" to the sysfs 'trigger' attribute to set an LED to its default trigger - If the default trigger is "none", writing "default" will remove the current trigger - Updated sysfs ABI documentation for the new "default" trigger functionality LED KUnit Testing: - Provide a skeleton KUnit test suite for the LEDs framework - Expand the LED class device registration KUnit test to cover more scenarios, including 'brightness_get' behavior - Add KUnit tests for the LED lookup and get API ('led_add_lookup', 'devm_led_get') LED Flash Class: - Add support for setting flash/strobe duration through a new 'duration_set' op and 'led_set_flash_duration()' function, aligning with 'V4L2_CID_FLASH_DURATION' Texas Instruments TPS6131x: - Add a new driver for the TPS61310/TPS61311 flash LED controllers - The driver supports the device's three constant-current sinks for flash and torch modes LED Core: - Prevent potential 'snprintf()' truncations in LED names by checking for buffer overflows ChromeOS EC LEDs: - Avoid a -Wflex-array-member-not-at-end GCC warning by replacing an on-stack flexible structure definition with a utility function call Multicolor LEDs: - Fix issue where setting multi_intensity while software blinking is active could stop blinking PCA955x LEDs: - Avoid potential buffer overflow when creating default labels by changing a field's type to 'u8' and updating format specifiers PCA995x LEDs: - Fix a typo (stray space) in an 'of_device_id' entry in the 'pca995x_of_match' table Kconfig: - Prevent LED drivers from being enabled by default when 'COMPILE_TEST' is set Device Property API: - Split 'device_get_child_node_count()' into a new helper 'fwnode_get_child_node_count()' that doesn't require a device struct, making the API more symmetrical Driver Modernization (using 'fwnode_get_child_node_count()'): - Update 'leds-pwm-multicolor', 'leds-ncp5623' and 'leds-ncp5623' to use the new 'fwnode_get_child_node_count()' helper, removing their custom implementation - As above in the USB Type-C TCPM driver Driver Modernization (using new GPIO setter callbacks): - Convert 'leds-lgm-sso' to use new GPIO line value setter callbacks which return an integer for error handling - Convert 'leds-pca955x', 'leds-pca9532' and 'leds-tca6507' to use new GPIO setter callbacks Documentation: - Remove the '.rst' extension for 'leds-st1202' in the documentation index for consistency LP8860 LEDs: - Use 'regmap_multi_reg_write()' for EEPROM writes instead of manual looping - Use scoped mutex guards and 'devm_mutex_init()' to simplify function exits and ensure automatic cleanup - Remove default register definitions that are unused when regmap caching is not active - Use 'devm_regulator_get_enable_optional()' to handle the optional regulator, simplifying enabling and removing manual disabling - Refactor 'lp8860_unlock_eeprom()' to only perform the unlock operation, removing the lock part and an unnecessary parameter - Use a 'devm' action to disable the enable-GPIO, simplifying cleanup and error paths, and remove the now-empty '.remove()' function Turris Omnia LEDs: - Drop unnecessary commas in terminator entries of 'struct attribute' and 'struct of_device_id' arrays MT6370 RGB LEDs: - Use the 'LINEAR_RANGE()' for defining 'struct linear_range' entries to improve robustness Texas Instruments TPS6131x: - Add new devicetree bindings for the TI TPS61310/TPS61311 flash LED driver" * tag 'leds-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (31 commits) leds: tps6131x: Add support for Texas Instruments TPS6131X flash LED driver dt-bindings: leds: Add Texas Instruments TPS6131x flash LED driver leds: flash: Add support for flash/strobe duration leds: rgb: leds-mt6370-rgb: Improve definition of some struct linear_range leds: led-test: Provide tests for the lookup and get infrastructure leds: led-test: Fill out the registration test to cover more test cases leds: led-test: Remove standard error checking after KUNIT_ASSERT_*() leds: pca995x: Fix typo in pca995x_of_match's of_device_id entry leds: Provide skeleton KUnit testing for the LEDs framework leds: tca6507: Use new GPIO line value setter callbacks leds: pca9532: Use new GPIO line value setter callbacks leds: pca955x: Use new GPIO line value setter callbacks leds: lgm-sso: Use new GPIO line value setter callbacks leds: Do not enable by default during compile testing leds: turris-omnia: Drop commas in the terminator entries leds: lp8860: Disable GPIO with devm action leds: lp8860: Only unlock in lp8860_unlock_eeprom() leds: lp8860: Enable regulator using enable_optional helper leds: lp8860: Remove default regs when not caching leds: lp8860: Use new mutex guards to cleanup function exits ...

Merge branches 'pm-runtime' and 'pm-sleep'

2025-05-26T19:21:58Z

Merge updates related to system sleep handling and runtime PM for 6.16-rc1: - Fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla). - Move debug runtime PM attributes to runtime_attrs[] (Rafael Wysocki). - Add new devm_ functions for enabling runtime PM and runtime PM reference counting (Bence Csókás). - Remove size arguments from strscpy() calls in the hibernation core code (Thorsten Blum). - Adjust the handling of devices with asynchronous suspend enabled during system suspend and resume to start resuming them immediately after resuming their parents and to start suspending such a device immediately after suspending its first child (Rafael Wysocki). - Adjust messages printed during tasks freezing to avoid using pr_cont() (Andrew Sayers, Paul Menzel). - Clean up unnecessary usage of !! in pm_print_times_init() (Zihuan Zhang). - Add missing wakeup source attribute relax_count to sysfs and remove the space character at the end ofi the string produced by pm_show_wakelocks() (Zijun Hu). - Add configurable pm_test delay for hibernation (Zihuan Zhang). - Disable asynchronous suspend in ucsi_ccg_probe() to prevent the cypd4226 device on Tegra boards from suspending prematurely (Jon Hunter). - Unbreak printing PM debug messages during hibernation and clean up some related code (Rafael Wysocki). * pm-runtime: PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() PM: sysfs: Move debug runtime PM attributes to runtime_attrs[] PM: runtime: Add new devm functions * pm-sleep: PM: freezer: Rewrite restarting tasks log to remove stray *done.* PM: sleep: Introduce pm_sleep_transition_in_progress() PM: sleep: Introduce pm_suspend_in_progress() PM: sleep: Print PM debug messages during hibernation ucsi_ccg: Disable async suspend in ucsi_ccg_probe() PM: hibernate: add configurable delay for pm_test PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() PM: wakeup: Add missing wakeup source attribute relax_count PM: sleep: Remove unnecessary !! PM: sleep: Use two lines for "Restarting..." / "done" messages PM: sleep: Make suspend of devices more asynchronous PM: sleep: Suspend async parents after suspending children PM: sleep: Resume children after resuming the parent PM: hibernate: Remove size arguments when calling strscpy()

usb: typec: tipd: fix typo in TPS_STATUS_HIGH_VOLAGE_WARNING macro

2025-05-23T10:37:31Z

"VOLAGE" should become "VOLTAGE" Signed-off-by: Jihed Chaibi Reviewed-by: Brigham Campbell Link: https://lore.kernel.org/r/20250521214851.386796-1-jihed.chaibi.dev@gmail.com Signed-off-by: Greg Kroah-Hartman

USB: typec: fix const issue in typec_match()

2025-05-23T10:36:40Z

typec_match() takes a const pointer, and then decides to cast it away into a non-const one, which is not a good thing to do overall. Fix this up by properly setting the pointers to be const to preserve that attribute. Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/2025052126-scholar-stainless-ad55@gregkh Fixes: d69d80484598 ("driver core: have match() callback in struct bus_type take a const *") Signed-off-by: Greg Kroah-Hartman

usb: typec: tcpm: Use configured PD revision for negotiation

2025-05-21T11:07:00Z

Initialize negotiated_rev and negotiated_rev_prime based on the port's configured PD revision (rev_major) rather than always defaulting to PD_MAX_REV. This ensures ports start PD communication using their appropriate revision level. This allows proper communication with devices that require specific PD revision levels, especially for the hardware designed for PD 1.0 or 2.0 specifications. Signed-off-by: Cosmo Chou Reviewed-by: Heikki Krogerus Reviewed-by: Badhri Jagan Sridharan Link: https://lore.kernel.org/r/20250513130834.1612602-1-chou.cosmo@gmail.com Signed-off-by: Greg Kroah-Hartman

usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work

2025-05-21T11:05:41Z

A state check was previously added to tcpm_queue_vdm_unlocked to prevent a deadlock where the DisplayPort Alt Mode driver would be executing work and attempting to grab the tcpm_lock while the TCPM was holding the lock and attempting to unregister the altmode, blocking on the altmode driver's cancel_work_sync call. Because the state check isn't protected, there is a small window where the Alt Mode driver could determine that the TCPM is in a ready state and attempt to grab the lock while the TCPM grabs the lock and changes the TCPM state to one that causes the deadlock. The callstack is provided below: [110121.667392][ C7] Call trace: [110121.667396][ C7] __switch_to+0x174/0x338 [110121.667406][ C7] __schedule+0x608/0x9f0 [110121.667414][ C7] schedule+0x7c/0xe8 [110121.667423][ C7] kernfs_drain+0xb0/0x114 [110121.667431][ C7] __kernfs_remove+0x16c/0x20c [110121.667436][ C7] kernfs_remove_by_name_ns+0x74/0xe8 [110121.667442][ C7] sysfs_remove_group+0x84/0xe8 [110121.667450][ C7] sysfs_remove_groups+0x34/0x58 [110121.667458][ C7] device_remove_groups+0x10/0x20 [110121.667464][ C7] device_release_driver_internal+0x164/0x2e4 [110121.667475][ C7] device_release_driver+0x18/0x28 [110121.667484][ C7] bus_remove_device+0xec/0x118 [110121.667491][ C7] device_del+0x1e8/0x4ac [110121.667498][ C7] device_unregister+0x18/0x38 [110121.667504][ C7] typec_unregister_altmode+0x30/0x44 [110121.667515][ C7] tcpm_reset_port+0xac/0x370 [110121.667523][ C7] tcpm_snk_detach+0x84/0xb8 [110121.667529][ C7] run_state_machine+0x4c0/0x1b68 [110121.667536][ C7] tcpm_state_machine_work+0x94/0xe4 [110121.667544][ C7] kthread_worker_fn+0x10c/0x244 [110121.667552][ C7] kthread+0x104/0x1d4 [110121.667557][ C7] ret_from_fork+0x10/0x20 [110121.667689][ C7] Workqueue: events dp_altmode_work [110121.667697][ C7] Call trace: [110121.667701][ C7] __switch_to+0x174/0x338 [110121.667710][ C7] __schedule+0x608/0x9f0 [110121.667717][ C7] schedule+0x7c/0xe8 [110121.667725][ C7] schedule_preempt_disabled+0x24/0x40 [110121.667733][ C7] __mutex_lock+0x408/0xdac [110121.667741][ C7] __mutex_lock_slowpath+0x14/0x24 [110121.667748][ C7] mutex_lock+0x40/0xec [110121.667757][ C7] tcpm_altmode_enter+0x78/0xb4 [110121.667764][ C7] typec_altmode_enter+0xdc/0x10c [110121.667769][ C7] dp_altmode_work+0x68/0x164 [110121.667775][ C7] process_one_work+0x1e4/0x43c [110121.667783][ C7] worker_thread+0x25c/0x430 [110121.667789][ C7] kthread+0x104/0x1d4 [110121.667794][ C7] ret_from_fork+0x10/0x20 Change tcpm_queue_vdm_unlocked to queue for tcpm_queue_vdm_work, which can perform the state check while holding the TCPM lock while the Alt Mode lock is no longer held. This requires a new struct to hold the vdm data, altmode_vdm_event. Fixes: cdc9946ea637 ("usb: typec: tcpm: enforce ready state when queueing alt mode vdm") Cc: stable Signed-off-by: RD Babiera Reviewed-by: Heikki Krogerus Reviewed-by: Badhri Jagan Sridharan Link: https://lore.kernel.org/r/20250506232853.1968304-2-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman