summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-08-03usb: quirks: Add ShanWan gamepad to quirk listIshaan Dandekar1-0/+3
The ShanWan Wireless Gamepad (dongle ID 2563:0575) crashes with a -71 EPROTO error during standard enumeration because it expects a 255-byte initial configuration request. Add this device to the quirk list to use the USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE flag. Signed-off-by: Ishaan Dandekar <ishaan.dandekar@gmail.com> Cc: stable <stable@kernel.org> Link: https://patch.msgid.link/20260802120128.38302-1-ishaan.dandekar@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03usb: hub: Split announce_device() to log device identity before enumerationNikhil Solanke1-4/+12
announce_device() currently logs the device VID:PID and string descriptors only after successful enumeration. This means that if enumeration fails, no identifying information about the device appears in the kernel log, making it difficult to diagnose failures. Split announce_device() into announce_device_ids(), which logs the VID:PID and bcdDevice immediately after the device descriptor is read, and announce_device_strings(), which logs the product, manufacturer, and serial number strings after successful enumeration. This ensures that a device's identity is always visible in the log regardless of whether enumeration succeeds or fails. Suggested-by: Michal Pecio <michal.pecio@gmail.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Nikhil Solanke <nikhilsolanke5@gmail.com> Link: https://patch.msgid.link/20260728195158.65162-3-nikhilsolanke5@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03usb: core: Add quirk for 255-bytes initial config readNikhil Solanke2-8/+28
Certain third-party USB game controllers exposing (or spoofing) an Xbox 360-compatible interface (VID:PID 045e:028e) fail to enumerate under Linux. The device disconnects from the bus without responding to the initial GET_DESCRIPTOR(CONFIGURATION) request, and the kernel logs 'unable to read config index 0 descriptor/start: -71'. The device then falls back to a secondary Android HID mode (with a different VID:PID), losing XInput functionality including rumble support. The failure reproduces across multiple machines, host controller types, and kernel versions including current mainline and LTS. The device enumerates correctly and remains in XInput mode under Windows. Notably, the device enumerates correctly in Android mode when the same 9-byte request is issued for that mode's configuration descriptor, confirming the firmware bug is specific to the XInput mode. usbmon traces from Linux and Wireshark/USBPcap traces from Windows are identical up to the point of failure, with no visible protocol-level difference explaining the divergence. The root cause was identified when Michal Pecio discovered via a QEMU bus-level capture that Windows does not use wLength=9 for the initial config descriptor request; it uses wLength=255. Alan Stern subsequently confirmed this with a bus analyzer on a different USB 2.0 device, and Michal verified the behavior goes back to Windows 95 OSR2.1. So, add a new quirk flag USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE which causes usb_get_configuration() to issue a 255 byte sized configuration request instead of USB_DT_CONFIG_SIZE (9) for the initial GET_DESCRIPTOR(CONFIGURATION) request, mimicking long-standing Windows behavior. This patch intentionally does not add any new VID:PID entries using this quirk. Some affected Xbox 360-compatible controllers spoof Microsoft's VID:PID, while genuine Microsoft controllers already enumerate correctly and do not require this quirk. Other affected clone devices use their own VID:PID pairs and can be added individually as they are identified. Suggested-by: Alan Stern <stern@rowland.harvard.edu> Suggested-by: Michal Pecio <michal.pecio@gmail.com> Closes: https://lore.kernel.org/linux-usb/CAFgddh+JWdT4LLwMc5qjM8q_pBu-fRo2qADR5ovAKoGHWMQrRw@mail.gmail.com/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable <stable@kernel.org> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Nikhil Solanke <nikhilsolanke5@gmail.com> Link: https://patch.msgid.link/20260728195158.65162-2-nikhilsolanke5@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()Aleksandr Nogikh1-0/+2
If cxacru_cm() encounters an error while submitting or waiting for snd_urb, it aborts and returns the error without killing the already submitted rcv_urb. This leaves the rcv_urb active. When this happens during initialization (e.g., in cxacru_atm_start()), the driver may ignore the error and proceed to call cxacru_poll_status(), which invokes cxacru_cm() again. Attempting to submit the still-active rcv_urb triggers a warning in usb_submit_urb(): cxacru 1-1:1.0: send of cm 0x84 failed (-104) ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104 ------------[ cut here ]------------ URB ffff88812658d200 submitted while active WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0 drivers/usb/core/urb.c:379 ... Call Trace: <TASK> cxacru_cm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631 cxacru_cm_get_array drivers/usb/atm/cxacru.c:722 [inline] cxacru_poll_status+0x178/0x1110 drivers/usb/atm/cxacru.c:828 cxacru_atm_start+0x185/0x360 drivers/usb/atm/cxacru.c:814 usbatm_atm_init+0x144/0x3a0 drivers/usb/atm/usbatm.c:927 usbatm_usb_probe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178 cxacru_usb_probe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370 ... To fix this, ensure that rcv_urb is properly killed if cxacru_cm() aborts early. We can safely call usb_kill_urb() on rcv_urb in the error path, as it is safe to call even if the URB is not active (e.g., if it failed to submit in the first place, or if it already completed). Fixes: 1b0e61465234 ("[PATCH] USB ATM: driver for the Conexant AccessRunner chipset cxacru") Cc: stable <stable@kernel.org> Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot Reported-by: syzbot+c9dff578c3a41775176a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c9dff578c3a41775176a Link: https://syzkaller.appspot.com/ai_job?id=75fec6f2-c8a6-43b1-b184-4d26baba86cc Signed-off-by: Aleksandr Nogikh <nogikh@google.com> Link: https://patch.msgid.link/91edfa4c-a63d-400c-9f00-31f3e1f98c00@mail.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msgJiangshan Yi1-1/+1
ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT endpoint size. Both are taken independently from different endpoints in usbio_probe(), so the check is wrong when they differ. Use rxbuf_len for the IN direction. This matches the buffer that actually holds the response data. Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver") Cc: stable <stable@kernel.org> Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn> Tested-by: Antti Laakso <antti.laakso@linux.intel.com> Link: https://patch.msgid.link/20260722101810.458634-1-yijiangshan@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03usb: gadget: f_ncm: Use unsigned int for ndp_indexSonali Pradhan1-1/+1
The variable ndp_index is declared as a signed integer, but it stores the return value of get_ncm(), which is unsigned. A malicious host can supply a large offset that overflows the signed ndp_index, making it negative. Because ndp_index is compared against unsigned bounds, this negative value bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block (ntb_ptr + ndp_index). Fix this by changing ndp_index to unsigned int to ensure consistent unsigned comparisons throughout the function. Fixes: 370af734dfaf ("usb: gadget: NCM: RX function support multiple NDPs") Cc: stable <stable@kernel.org> Signed-off-by: Sonali Pradhan <sonalipradhan@google.com> Link: https://patch.msgid.link/20260720165654.2224591-1-sonalipradhan@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03usb: cdnsp: fix incorrect endian conversions for APB timeout registerPawel Laszczak1-2/+2
readl() already returns a CPU-endian value. Passing its return value to le32_to_cpu() is therefore redundant and causes an incorrect double byte swap on big-endian systems. Similarly, writel() expects a CPU-endian value, so passing the result of cpu_to_le32() is incorrect. Remove the unnecessary conversions and operate on the MMIO register value as a CPU-endian u32. Fixes: 241e2ce88e5a ("usb: cdnsp: Fix issue with resuming from L1") Suggested-by: Arnd Bergmann <arnd@arndb.de> Cc: stable <stable@kernel.org> Signed-off-by: Pawel Laszczak <pawell@cadence.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Link: https://patch.msgid.link/20260720-endian-fix-v1-v1-1-b5681fa1ea9f@cadence.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: imx: serialize imx_uart_ports[] lifetimeKarl Mehltretter1-3/+17
imx_uart_probe() publishes its devm-allocated port in imx_uart_ports[] before uart_add_one_port() because console setup uses the table. The entry is not cleared when adding the port fails or after removal, leaving a dangling pointer. A sibling probe can register the shared console through that stale entry. This was reproduced under KASAN on QEMU mcimx6ul-evk by unbinding a sibling UART, unbinding the console UART and rebinding the sibling. Keep the entry valid through uart_remove_one_port(), then clear it. Protect port addition and removal together with their table updates so sibling operations cannot interleave. Reject an occupied slot rather than clobbering an active port during a duplicate-line probe. Fixes: dbff4e9ea2e8 ("IMX UART: remove statically initialized tables") Fixes: 9f322ad064f9 ("imx: serial: handle initialisation failure correctly") Reported-by: Sashiko <sashiko-bot@kernel.org> Link: https://lore.kernel.org/all/20260719162850.043B41F000E9@smtp.kernel.org Link: https://lore.kernel.org/all/20260719222501.CB4CB1F000E9@smtp.kernel.org Cc: stable@vger.kernel.org Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260731181844.11330-6-kmehltretter@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03tty: clear cdev pointer after cdev_add() failureKarl Mehltretter1-1/+3
tty_cdev_add() drops the cdev reference when cdev_add() fails, but leaves driver->cdevs[index] pointing to freed memory. tty_unregister_device() later passes that stale pointer to cdev_del(), causing a use-after-free. Clear the slot after dropping the reference. Fixes: c1a752ba2d6b ("tty: don't leak cdev in tty_cdev_add()") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260731181844.11330-5-kmehltretter@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03tty: skip cdev_del() when no cdev is registeredKarl Mehltretter1-1/+1
TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdev_del(), causing a NULL-pointer dereference. Only delete the cdev when the slot is not NULL. Fixes: a3a10ce3429e ("Avoid usb reset crashes by making tty_io cdevs truly dynamic") Fixes: da4c279942b0 ("serial: enable serdev support") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260731181844.11330-4-kmehltretter@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: core: clear freed pointers on uart_register_driver() failureKarl Mehltretter1-0/+2
uart_register_driver() leaves drv->state pointing to freed memory when tty_alloc_driver() fails. If tty_register_driver() fails, drv->tty_driver also retains a pointer after its reference is dropped. Drivers that use drv->state as an "already registered" flag can then skip registration on the next probe and pass the freed state to uart_add_one_port(). This issue was found with failslab on QEMU's raspi1ap board by failing registration and binding the PL011 port again. Clear both pointers on their failure paths, as uart_unregister_driver() already does. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 9e845abfc8a8 ("serial: fix NULL pointer dereference") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260731181844.11330-3-kmehltretter@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: core: do fallible allocations before the console can be registeredKarl Mehltretter1-14/+16
serial_core_add_one_port() allocates uport->tty_groups after uart_configure_port(), which may register the console. If the allocation fails, the driver unwinds the port while its console remains registered. The earlier uport->name allocation has a related failure path that leaves state->uart_port linked to a port being freed. Failslab reproduced a NULL dereference in PL011 console output and a KASAN use-after-free in i.MX console output after failed binds. Allocate the name and tty_groups before linking the port and configuring it. Reserve space for the optional driver attribute group because config_port() may populate uport->attr_group during configuration. Fixes: 266dcff03eed ("Serial: allow port drivers to have a default attribute group") Fixes: f7048b15900f ("tty: serial_core: Add name field to uart_port struct") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/all/20260719070454.D6FA21F000E9@smtp.kernel.org/ Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260731181844.11330-2-kmehltretter@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250_mxpcie: implement rx_trig_bytes callbacks via MUEx50 RTLCrescent Hsieh1-1/+24
The MUEx50 UART exposes a programmable RX trigger level via the RTL register. Implement uart_port RX trigger set/get callbacks for the mxpcie driver and wire them up to the generic rx_trig_bytes sysfs interface. Store the configured trigger level in the per-port private data. Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Link: https://patch.msgid.link/20260731074820.735619-15-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250_mxpcie: introduce per-port private data structureCrescent Hsieh1-6/+10
Introduce a private per-port data structure for the mxpcie driver and replace the shared flexible array of registered lines with an array of per-port objects. This prepares the driver for storing per-port state needed by subsequent features. No functional change intended. Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Link: https://patch.msgid.link/20260731074820.735619-14-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250: allow UART drivers to override rx_trig_bytes handlingCrescent Hsieh2-2/+16
The rx_trig_bytes sysfs attribute currently relies on 8250-internal helper functions and assumes a fixed mapping between trigger levels and FIFO behavior. Some UARTs provide hardware-specific RX trigger mechanisms that do not fit this model. Add optional uart_port callbacks for setting and getting the RX trigger level, and use them when provided, while preserving the existing 8250 helpers as the default fallback. Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Link: https://patch.msgid.link/20260731074820.735619-13-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250_mxpcie: add break support for RS485 using MUEx50 featuresCrescent Hsieh1-0/+48
On MUEx50, break signaling under RS485 requires a driver-specific sequence and cannot be handled correctly by the generic 8250 break implementation alone. Implement a mxpcie break_ctl callback that performs MUEx50-specific break handling when RS485 is enabled and fall back to the default 8250 break handling for other modes. Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Link: https://patch.msgid.link/20260731074820.735619-12-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250: allow low-level drivers to override break controlCrescent Hsieh2-1/+12
Some UARTs require driver-specific handling for break signaling, which cannot be expressed by the generic 8250 break implementation alone. Add an optional uart_port break_ctl callback and route serial8250_break_ctl() through it when provided. Rename the existing 8250 implementation to serial8250_do_break_ctl() and export it so low-level drivers can reuse the default 8250 behavior when appropriate. Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Link: https://patch.msgid.link/20260731074820.735619-11-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250_mxpcie: support serial interface mode switchingCrescent Hsieh1-2/+43
Moxa PCIe multiport serial boards support switching the serial interface mode between RS232, RS422, RS485-2W, and RS485-4W via on-board control registers. Implement an rs485_config() callback and map TIOCSRS485 requests to the corresponding hardware modes using serial_rs485 flags: - RS232 = (no flags set) - RS422 = SER_RS485_ENABLED | SER_RS485_MODE_RS422 - RS485_2W (half-duplex) = SER_RS485_ENABLED - RS485_4W (full-duplex) = SER_RS485_ENABLED | SER_RS485_RX_DURING_TX This allows users to reconfigure the serial mode at runtime via ioctl(). Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Link: https://patch.msgid.link/20260731074820.735619-10-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250_mxpcie: speed up TX using memory-mapped FIFO windowCrescent Hsieh1-1/+15
The MUEx50 UART provides a memory-mapped TX FIFO data window along with a TX FIFO level counter. Fill the TX FIFO in bulk via the MMIO FIFO window based on available FIFO space, using uart_port_tx_limited() for the common serial-core TX handling. Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Link: https://patch.msgid.link/20260731074820.735619-9-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250_mxpcie: speed up RX using memory-mapped FIFO windowCrescent Hsieh1-2/+30
The MUEx50 UART provides a memory-mapped RX FIFO data window along with an RX FIFO byte counter. When no break or error conditions are present, read received data in bulk via the MMIO FIFO window and push it to the tty layer in one operation. Fall back to the generic 8250 RX path for break and error handling. Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Link: https://patch.msgid.link/20260731074820.735619-8-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250_mxpcie: add custom handle_irq callbackCrescent Hsieh1-0/+42
Add a mxpcie-specific handle_irq() implementation for Moxa PCIe serial ports. This keeps the interrupt handling self-contained in the driver and provides a hook point for MUEx50-specific RX/TX paths added in subsequent patches. The handler processes RX, updates modem status, and handles TX when THRE is asserted. Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Link: https://patch.msgid.link/20260731074820.735619-7-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250_mxpcie: offload XON/XOFF flow control to MUEx50 hardwareCrescent Hsieh1-2/+49
The MUEx50 UART can handle in-band software flow control (XON/XOFF) directly in hardware. Program the on-chip XON/XOFF characters from termios settings and enable the corresponding MUEx50 flow control modes when IXON or IXOFF is requested. Provide throttle and unthrottle callbacks so RX can be stopped and resumed cleanly. Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Link: https://patch.msgid.link/20260731074820.735619-6-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250_mxpcie: enable automatic RTS/CTS flow controlCrescent Hsieh1-0/+28
The MUEx50 UART supports automatic RTS/CTS flow control via the enhanced feature register. Implement a mxpcie-specific set_termios() callback that enables MUEx50 auto-RTS/auto-CTS when CRTSCTS is requested and disables it otherwise. Keep the 8250 port status flags in sync with the hardware configuration. Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Link: https://patch.msgid.link/20260731074820.735619-5-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250_mxpcie: enable enhanced mode and program FIFO trigger levelsCrescent Hsieh1-0/+63
The MUEx50 UART provides an enhanced register set and programmable FIFO trigger levels for RX, TX, and flow control. Enable enhanced mode during port startup and program the MUEx50 FIFO trigger registers according to the configured port settings. Clear the programmed state again during shutdown to restore the default UART configuration. The TX FIFO write pointer and read pointer are driven by different clocks. Clear the FIFOs repeatedly during startup so both pointers are reset before programming the trigger levels. Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Link: https://patch.msgid.link/20260731074820.735619-4-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250: add Moxa MUEx50 UART port typeCrescent Hsieh2-1/+10
Add a new 8250 port type for the Moxa MUEx50 UART and describe its basic FIFO size and trigger characteristics in the 8250 port configuration table. The 8250_mxpcie driver sets UPF_FIXED_TYPE and uses PORT_MUEX50 so that the generic 8250 core applies the correct defaults. Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Link: https://patch.msgid.link/20260731074820.735619-3-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250: split Moxa PCIe serial board support out of 8250_pciCrescent Hsieh4-242/+302
The Moxa PCIe multiport serial boards are currently handled as part of 8250_pci.c. In preparation for adding Moxa-specific UART features and optimizations, move the Moxa PCIe implementation into a dedicated driver. This introduces drivers/tty/serial/8250/8250_mxpcie.c and wires it up via Kconfig and Makefile, while preserving the existing probe flow and device IDs. This change was suggested during earlier reviews by Andy Shevchenko [1][2]. No functional change intended. Link: https://lore.kernel.org/all/ZmQovC6TbDpTb3c8@surfacebook.localdomain/ [1] Link: https://lore.kernel.org/all/CAHp75VeDsVt0GQYUFxLM+obfmqXBPa3hM3YMsFbc26uzWZG-SQ@mail.gmail.com/ [2] Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Link: https://patch.msgid.link/20260731074820.735619-2-crescentcy.hsieh@moxa.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: qcom-geni: Use geni_se_set_perf_level() for baud rate perf levelPraveen Talari1-45/+8
The driver implements its own helper to select the performance level corresponding to a requested baud rate. The helper duplicates functionality already provided by geni_se_set_perf_level() in the GENI core. Replace the local implementation with the common helper and remove the associated duplicate definitions and code. This consolidates performance-level management in the GENI framework and reduces driver specific code. Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com> Link: https://patch.msgid.link/20260801-reuse_common_geni_framework_helpers-v2-3-13753256ef71@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: qcom-geni: Use resources helper APIs in runtime PM functionsPraveen Talari1-54/+18
To manage GENI serial engine resources during runtime power management, drivers currently need to call functions for ICC, clock, and SE resource operations in both suspend and resume paths, resulting in code duplication across drivers. The new geni_se_resources_activate() and geni_se_resources_deactivate() helper APIs addresses this issue by providing a streamlined method to enable or disable all resources based, thereby eliminating redundancy across drivers. Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com> Link: https://patch.msgid.link/20260801-reuse_common_geni_framework_helpers-v2-2-13753256ef71@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: qcom-geni: Use common GENI resource initialisation helpersPraveen Talari1-72/+9
The UART driver maintains local helpers for resource and power-domain initialisation that duplicate functionality already provided by the common GENI framework. Replace the driver-specific implementations with geni_se_resources_init() and geni_se_domain_attach(), and use the power-domain list stored in struct geni_se. This reduces code duplication and centralises GENI resource management without functional changes. Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com> Link: https://patch.msgid.link/20260801-reuse_common_geni_framework_helpers-v2-1-13753256ef71@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: amba-pl011: keep console clock enabled for atomic writesKarl Mehltretter1-12/+28
pl011_console_write_atomic() runs from nbcon atomic context, where sleeping is not allowed. It calls clk_enable(), which takes the common-clk enable_lock. Under PREEMPT_RT that is a sleeping lock: clk_enable_lock() first tries spin_trylock_irqsave(), but on contention falls back to spin_lock_irqsave(). Therefore, an atomic-context printk on an RT kernel with a clk-backed pl011 can trip: BUG: sleeping function called from invalid context at spinlock_rt.c:48 __might_resched from rt_spin_lock rt_spin_lock from clk_enable_lock clk_enable_lock from clk_enable clk_enable from pl011_console_write_atomic ... from vprintk_emit This was found and reproduced on PREEMPT_RT. Arm32 and arm64 DT SoCs are affected; arm64 SBSA/ACPI has no clk, so clk_enable(NULL) short-circuits before the lock. In addition, write_atomic() may be invoked from NMI context and is documented to avoid locking. Removing clk_enable() from the callback also avoids a potentially unsafe NMI acquisition of the common-clock enable_lock. An nbcon atomic-capable console must be printable from any context, so the clock cannot be gated between writes. Enable the clock while the console is available for output: use clk_prepare_enable() in pl011_console_setup(), release it via clk_disable_unprepare() in the console .exit() callback, and drop the per-write clk_enable()/clk_disable() pairs from write_atomic() and write_thread(). When printk suspends consoles, drop the reference after uart_suspend_port() stops console access and restore it before uart_resume_port() -- but only if suspend actually marked the port suspended (a wake-capable tty stays running and must keep its clock), and keep it when console_suspend_enabled is false so no_console_suspend works. The active power cost of keeping the clock enabled is platform-dependent: none where the UART clock is a fixed always-on oscillator, real where it is a gateable clock branch, which then cannot be gated (nor possibly can its parent clocks) while the console is available for output. When serial core actually suspends the port, the reference is released so the clock provider can gate the clock tree. Fixes: 2eb2608618ce ("serial: amba-pl011: Implement nbcon console") Suggested-by: John Ogness <john.ogness@linutronix.de> Link: https://lore.kernel.org/all/8733xeaxix.fsf@jogness.linutronix.de/ Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260724213348.77418-3-kmehltretter@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: amba-pl011: unprepare console clock on unregisterKarl Mehltretter1-0/+10
pl011_console_setup() calls clk_prepare() on the UART clock, but the console provides no matching teardown, so the clock is never unprepared when the console is unregistered -- via the sysfs "console" attribute or a driver unbind. Each re-registration prepares the clock again, leaking one prepare reference per cycle. Even where preparing the clock has no hardware effect, the stale reference leaves the clock framework's prepare count unbalanced. For providers with prepare/unprepare operations or runtime-PM integration, it may also retain resources after the console is unregistered. Add a console .exit() callback that clk_unprepare()s the clock, balancing the clk_prepare() in pl011_console_setup(). Fixes: 4b4851c65d92 ("clk: amba-pl011: convert to clk_prepare()/clk_unprepare()") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260724213348.77418-2-kmehltretter@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250_mtk: honor DT serial aliasesCarlo Caione1-1/+6
The Genio board DTs provide serial aliases for all enabled UARTs, but the MTK 8250 driver still registered every port with the default line number. If uart0 deferred and another UART probed first, the 8250 core could still assign ttyS0 to the wrong port despite the DT aliases. Read the serial alias during OF probe and seed uart.port.line before registering the port so the 8250 core reserves the requested ttyS slot. Signed-off-by: Carlo Caione <ccaione@baylibre.com> Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> Link: https://patch.msgid.link/20260727-ccaione-genio-serial-aliases-v2-2-0f2ae41a8e89@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: amba-pl011: synchronize DMA teardownFan Wu1-4/+4
dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable <stable@kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: amba-pl011: cancel RS485 hrtimers after freeing IRQFan Wu1-17/+35
The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel both timers. Complete the RS485 stop without arming a timer, and cancel the timers in remove() for the suspend-then-unbind path, where shutdown is not called. This issue was found by an in-house static analysis tool. Fixes: 2c1fd53af21b ("serial: amba-pl011: Fix RTS handling in RS485 mode") Cc: stable <stable@kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-3-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: amba-pl011: fix indefinite RS485 post-send delayFan Wu1-2/+6
The RS485 stop hrtimer is used both to drain the transmitter and to wait out delay_rts_after_send. The callback cannot tell the two apart, so it restarts the post-send delay on every expiry and the timer never stops. Add a WAIT_AFTER_SEND_DELAY state so its expiry ends the stop sequence instead of restarting the delay. Fixes: 2c1fd53af21b ("serial: amba-pl011: Fix RTS handling in RS485 mode") Cc: stable <stable@kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-2-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03vt: add permission check for KDSKBMETA ioctlJoshua Rogers1-0/+2
KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vt_k_ioctl() enforce, allowing a process to change meta mode on a non-controlling console without authorization. Assisted-by: AISLE:Snapshot Cc: stable <stable@kernel.org> Signed-off-by: Joshua Rogers <linux@joshua.hu> Link: https://patch.msgid.link/20260731-tty-vt-stuff-v1-2-be99b9da8e30@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03vt: stabilize tty reference in kbd_keycode with tty_port_tty_getJoshua Rogers1-1/+4
kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under a different lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference for the duration the tty pointer is needed. Assisted-by: AISLE:Snapshot Signed-off-by: Joshua Rogers <linux@joshua.hu> Cc: stable <stable@kernel.org> Link: https://patch.msgid.link/20260731-tty-vt-stuff-v1-1-be99b9da8e30@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xxRyan Wilbur1-0/+38
The NXP LPC32xx UART (PORT_LPC3220) can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UART_IIR_RX_TIMEOUT (0x0c) but LSR.DR is clear. A character timeout is only cleared by reading RHR, but serial8250_rx_chars() reads RHR only when LSR.DR is set, so nothing ever clears the condition. The interrupt is level-triggered and re-fires immediately, so on a single-core ARM926 the resulting interrupt storm livelocks the CPU. It is reproducible when userspace repeatedly opens the front-panel port (ttyS1): serial8250_do_set_termios() re-enables interrupts on unlock and the handler then spins forever with iir=0xcc lsr=0x60 ier=0x05, tripping the soft-lockup detector in serial8250_handle_irq_locked(). LPC32xx has no dedicated 8250 glue driver, it's driven by the generic 8250_of. Add a hardware specific handle_irq for PORT_LPC3220, wired up in of_platform_serial_setup() the same way fsl8250_handle_irq is installed. The handler follows dw8250_handle_irq(): on an RX timeout with an empty FIFO (LSR.DR and LSR.BI clear) it does one throwaway RHR read to clear the condition, then calls serial8250_handle_irq_locked(). No real received data is ever discarded, and it is a no-op on healthy UARTs which never report a timeout with DR clear. This is the same class of bug already worked around in other 8250 drivers; see commit 424d79183af0 ("serial: 8250_dw: Avoid "too much work" from bogus rx timeout interrupt") which reports the identical iir=0xcc/lsr=0x60. See also UART_RX_TIMEOUT_QUIRK in 8250_omap, and the note in 8250_bcm7271. Cc: stable <stable@kernel.org> Assisted-by: Claude:Opus4.8 Signed-off-by: Ryan Wilbur <rwilbur633@gmail.com> Link: https://patch.msgid.link/20260730193920.28954-1-rwilbur633@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-03Xen/gnttab: adjust two uses of sizeof()Jan Beulich1-2/+2
The use in gnttab_map() is latently buggy, as "frames" there is xen_pfn_t *, not unsigned long *. Adjust the correct use in gnttab_map_frames_v2() as well, just to avoid the problematic pattern of sizeof(<type>). Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <0ddff6c4-7ec7-41a9-9417-687ca16aaafd@suse.com>
2026-08-03Merge tag 'thunderbolt-for-v7.2-rc7' of ↵Greg Kroah-Hartman5-6/+13
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fixes for v7.2-rc7 This includes following USB4/Thunderbolt fixes: - Correct DMA unmapping of USB4STREAM driver. - Fix indexing of bandwidth groups. - More bounds checking for DROM parsing. - Fix ICM USB4 router operation messaging. - Fix crash on ICM error path. All these have been in linux-next with no reported issues. * tag 'thunderbolt-for-v7.2-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Initialize ->domain_released completion before it is being used thunderbolt: icm: Preserve USB4 proxy data-valid bit thunderbolt: Bound the DROM dual link port number before indexing sw->ports thunderbolt: Fix bandwidth group reservation indexing thunderbolt: stream: Unmap buffers with mapped size
2026-08-03ACPI: PAD: xen: Stop setting acpi_device_name/class()Rafael J. Wysocki1-5/+0
The driver sets acpi_device_name() and acpi_device_class() which are never read afterward, so make it stop doing that and drop the symbols defined specifically for this purpose. No intentional functional impact. This will facilitate the removal of device_name and device_class from struct acpi_device_pnp in the future. Signed-off-by: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Juergen Gross <jgross@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <2384190.iZASKD2KPV@rafael.j.wysocki>
2026-08-03Merge branch 'for-linus' into for-nextTakashi Iwai260-1222/+3192
Pull 7.2 devel branch for put_device auto-clean fixes. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-03soc: fsl: qe: Rename irq variable to parent_irqPaul Louvel1-6/+6
Rename the local variable holding the platform IRQ to parent_irq, which better describes its role as the upstream/chained interrupt in the hierarchy. Signed-off-by: Paul Louvel <paul.louvel@bootlin.com> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Link: https://lore.kernel.org/r/20260708-qe-pic-gpios-v2-9-1972044cfbd1@bootlin.com Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
2026-08-03soc: fsl: qe: Convert to generic IRQ chipPaul Louvel2-41/+76
The generic IRQ chip framework is available to handle IRQ chips. Using this framework for the QE interrupt controller allows to simplify the driver. Indeed, the framework internally handles operations coded directly in the driver. Signed-off-by: Paul Louvel <paul.louvel@bootlin.com> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Link: https://lore.kernel.org/r/20260708-qe-pic-gpios-v2-8-1972044cfbd1@bootlin.com Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
2026-08-03soc: fsl: qe: Handle spurious interruptsPaul Louvel1-0/+6
When no interrupt bits are set in the event register, call handle_bad_irq() to account for the spurious interrupt before exiting the cascade handler. Signed-off-by: Paul Louvel <paul.louvel@bootlin.com> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Link: https://lore.kernel.org/r/20260708-qe-pic-gpios-v2-7-1972044cfbd1@bootlin.com Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
2026-08-03soc: fsl: qe: Iterate over all pending interrupts in cascade handlerPaul Louvel1-12/+5
Instead of only servicing a single interrupt, the chained handler can handle all IRQs that have their bit set in the event register. This avoid multiple parent IRQ handler being serviced if more than one interrupt are pending on the QE PIC. Remove unused code. Signed-off-by: Paul Louvel <paul.louvel@bootlin.com> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Link: https://lore.kernel.org/r/20260708-qe-pic-gpios-v2-6-1972044cfbd1@bootlin.com Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
2026-08-03soc: fsl: qe: Use generic_handle_domain_irq()Paul Louvel1-2/+3
Replace the irq_find_mapping() + generic_handle_irq() pattern with generic_handle_domain_irq(), which handles the IRQ domain lookup internally. This is less error-prone and more idiomatic. Remove the now-unused irq_find_mapping() call from qepic_get_irq(). Signed-off-by: Paul Louvel <paul.louvel@bootlin.com> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Link: https://lore.kernel.org/r/20260708-qe-pic-gpios-v2-5-1972044cfbd1@bootlin.com Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
2026-08-03soc: fsl: qe: Add chained_irq_{enter,exit}() calls in cascade handlerPaul Louvel1-0/+7
Wrap the cascade handler body with chained_irq_{enter,exit}() to properly inform the parent IRQ chip that a chained interrupt is being serviced. Fixes: f0bcd784e1b76 ("soc: fsl: qe: Add an interrupt controller for QUICC Engine Ports") Signed-off-by: Paul Louvel <paul.louvel@bootlin.com> Cc: stable@kernel.org Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Link: https://lore.kernel.org/r/20260708-qe-pic-gpios-v2-1-1972044cfbd1@bootlin.com Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
2026-08-03soc: fsl: qe: implement get_direction()Christophe Leroy (CS GROUP)1-0/+25
The lack of get_direction() callback in this driver causes GPIOLIB to emit a warning. Implement it. Fixes: e623c4303ed1 ("gpiolib: sanitize the return value of gpio_chip::get_direction()") Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://lore.kernel.org/r/30b3f278a10b46252783458c81dc438df176f86c.1785405882.git.chleroy@kernel.org Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
2026-08-03soc: fsl: dpio: Remove redundant dev_err()Pan Chuang1-5/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Acked-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://lore.kernel.org/r/20260723024748.30105-1-panchuang@vivo.com Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
generated by cgit (git 2.54.0.dirty) at 2026-09-29 18:51:46 +0000