Move PWM activation from the legacy request() callback into the pwm_ops apply() path. Activation is now performed when the PWM transitions from disabled to enabled (state.enabled = true), so request() is no longer required. This aligns the driver with modern PWM core expectations: activation happens when the channel is actually enabled, and the device free path still performs deactivation.

Signed-off-by: Ayaan Mirza Baig ayaanmirzabaig85@gmail.com --- drivers/staging/greybus/pwm.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/drivers/staging/greybus/pwm.c b/drivers/staging/greybus/pwm.c index 1cb7b9089ead..c80f42100e3b 100644 --- a/drivers/staging/greybus/pwm.c +++ b/drivers/staging/greybus/pwm.c @@ -174,10 +174,6 @@ static int gb_pwm_disable_operation(struct pwm_chip *chip, u8 which) return ret; }

-static int gb_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm) -{ - return gb_pwm_activate_operation(chip, pwm->hwpwm); -};

static void gb_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) { @@ -206,6 +202,7 @@ static int gb_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, return err; }

+ /* Disable if requested */ if (!state->enabled) { if (enabled) gb_pwm_disable_operation(chip, pwm->hwpwm); @@ -228,15 +225,21 @@ static int gb_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, if (err) return err;

- /* enable/disable */ - if (!enabled) - return gb_pwm_enable_operation(chip, pwm->hwpwm); + /* Activate and enable on transition from disabled to enabled */ + if (state->enabled && !enabled) { + err = gb_pwm_activate_operation(chip, pwm->hwpwm); + if (err) + return err; + + /* Activate hardware channel before enabling input */ + err = gb_pwm_enable_operation(chip, pwm->hwpwm); + return err; + }

return 0; }

static const struct pwm_ops gb_pwm_ops = { - .request = gb_pwm_request, .free = gb_pwm_free, .apply = gb_pwm_apply, };

The commented-out code attempted to set INPUT_PROP_NO_DUMMY_RELEASE on the jack's input device, but this input property does not exist in the kernel and struct snd_jack does not expose an input_dev field. The FIXME is obsolete and the commented code is invalid, remove it.

Signed-off-by: Ayaan Mirza Baig ayaanmirzabaig85@gmail.com --- drivers/staging/greybus/audio_codec.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c index 2f05e761fb9a..cafce125d5d4 100644 --- a/drivers/staging/greybus/audio_codec.c +++ b/drivers/staging/greybus/audio_codec.c @@ -785,12 +785,7 @@ static int gbaudio_init_jack(struct gbaudio_module_info *module, goto free_jacks; } } - - /* FIXME - * verify if this is really required - set_bit(INPUT_PROP_NO_DUMMY_RELEASE, - module->button.jack.jack->input_dev->propbit); - */ +

return 0;

The MODE_SWITCH_TIMEOUT_MS constant included a FIXME suggesting the timeout could be reduced once the SVC core supported parallel event processing. Greybus SVC logic is stable today and no such change is planned, and the existing timeout has been used reliably for years. Remove the obsolete FIXME and replace it with a descriptive comment.

Signed-off-by: Ayaan Mirza Baig ayaanmirzabaig85@gmail.com --- drivers/staging/greybus/bootrom.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c index d4d86b3898de..156212301d58 100644 --- a/drivers/staging/greybus/bootrom.c +++ b/drivers/staging/greybus/bootrom.c @@ -17,10 +17,7 @@ /* Timeout, in jiffies, within which the next request must be received */ #define NEXT_REQ_TIMEOUT_MS 1000

-/* - * FIXME: Reduce this timeout once svc core handles parallel processing of - * events from the SVC, which are handled sequentially today. - */ +/* Timeout for mode switching operations, based on current SVC behaviour */ #define MODE_SWITCH_TIMEOUT_MS 10000

enum next_request_type {

A historical FIXME suggested converting a dev_info() message to dev_dbg() after all Greybus modules reported valid IDs. Greybus hardware is stable today and the firmware filename is still useful to log at info level, so remove the obsolete FIXME and keep the existing behaviour. Replace it with a concise descriptive comment.

Signed-off-by: Ayaan Mirza Baig ayaanmirzabaig85@gmail.com --- drivers/staging/greybus/bootrom.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c index 156212301d58..8665be86dae6 100644 --- a/drivers/staging/greybus/bootrom.c +++ b/drivers/staging/greybus/bootrom.c @@ -165,10 +165,7 @@ static int find_firmware(struct gb_bootrom *bootrom, u8 stage) intf->ddbl1_manufacturer_id, intf->ddbl1_product_id, intf->vendor_id, intf->product_id);

- // FIXME: - // Turn to dev_dbg later after everyone has valid bootloaders with good - // ids, but leave this as dev_info for now to make it easier to track - // down "empty" vid/pid modules. + /* Log the firmware filename being requested */ dev_info(&connection->bundle->dev, "Firmware file '%s' requested\n", firmware_name);

The raw protocol driver destroyed its character device and freed its private data even when userspace still had the device node open. This could cause use-after-free access through active file operations.

Fix this by marking the device as disconnected, returning -ENODEV from all file operations after disconnect, and disabling the Greybus connection before destroying the cdev. This provides safe teardown without redesigning the driver.

Remove the obsolete FIXME

Signed-off-by: Ayaan Mirza Baig ayaanmirzabaig85@gmail.com --- drivers/staging/greybus/raw.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/greybus/raw.c b/drivers/staging/greybus/raw.c index 71de6776739c..74818ca829c2 100644 --- a/drivers/staging/greybus/raw.c +++ b/drivers/staging/greybus/raw.c @@ -24,6 +24,7 @@ struct gb_raw { dev_t dev; struct cdev cdev; struct device *device; + bool disconnected; };

struct raw_data { @@ -231,10 +232,14 @@ static void gb_raw_disconnect(struct gb_bundle *bundle) struct raw_data *raw_data; struct raw_data *temp;

- // FIXME - handle removing a connection when the char device node is open. + /* Mark device as disconnected so file operations fail gracefully */ + raw->disconnected = true; + + /* Disable Greybus connection before destroying the chardev */ + gb_connection_disable(connection); + device_destroy(&raw_class, raw->dev); cdev_del(&raw->cdev); - gb_connection_disable(connection); ida_free(&minors, MINOR(raw->dev)); gb_connection_destroy(connection);

@@ -262,6 +267,9 @@ static int raw_open(struct inode *inode, struct file *file) struct cdev *cdev = inode->i_cdev; struct gb_raw *raw = container_of(cdev, struct gb_raw, cdev);

+ if (raw->disconnected) + return -ENODEV; + file->private_data = raw; return 0; } @@ -272,6 +280,9 @@ static ssize_t raw_write(struct file *file, const char __user *buf, struct gb_raw *raw = file->private_data; int retval;

+ if (raw->disconnected) + return -ENODEV; + if (!count) return 0;

@@ -292,6 +303,9 @@ static ssize_t raw_read(struct file *file, char __user *buf, size_t count, int retval = 0; struct raw_data *raw_data;

+ if (raw->disconnected) + return -ENODEV; + mutex_lock(&raw->list_lock); if (list_empty(&raw->list)) goto exit;

The Greybus UART protocol supports only 8 data bits, no parity, one stop bit, and no hardware flow control. Mask out unsupported termios flags before applying settings and force the supported configuration. This removes the old FIXME and aligns the driver with TTY subsystem expectations.

Signed-off-by: Ayaan Mirza Baig ayaanmirzabaig85@gmail.com --- drivers/staging/greybus/uart.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c index 10df5c37c83e..cc7337bf5088 100644 --- a/drivers/staging/greybus/uart.c +++ b/drivers/staging/greybus/uart.c @@ -495,8 +495,14 @@ static void gb_tty_set_termios(struct tty_struct *tty,

newline.data_bits = tty_get_char_size(termios->c_cflag);

- /* FIXME: needs to clear unsupported bits in the termios */ - gb_tty->clocal = ((termios->c_cflag & CLOCAL) != 0); + /* Mask out unsupported termios flags for Greybus UART */ + termios->c_cflag &= ~(CSIZE | CSTOPB | PARENB | PARODD | + CRTSCTS | CMSPAR | CBAUD | CBAUDEX); + termios->c_cflag |= CS8; /* Force 8 data bits */ + termios->c_cflag &= ~PARENB; /* No parity */ + termios->c_cflag &= ~CSTOPB; /* One stop bit */ + + gb_tty->clocal = (termios->c_cflag & CLOCAL);

if (C_BAUD(tty) == B0) { newline.rate = gb_tty->line_coding.rate;

Clamp hub control wLength to a reasonable maximum before allocating the response buffer to avoid oversized allocations and remove the FIXME about unspecified lengths.

Signed-off-by: Ayaan Mirza Baig ayaanmirzabaig85@gmail.com --- drivers/staging/greybus/usb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/greybus/usb.c b/drivers/staging/greybus/usb.c index 475f24f20cd4..1502641f5dbb 100644 --- a/drivers/staging/greybus/usb.c +++ b/drivers/staging/greybus/usb.c @@ -105,7 +105,13 @@ static int hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex, size_t response_size; int ret;

- /* FIXME: handle unspecified lengths */ + /* + * Clamp wLength to a reasonable maximum to avoid oversized allocations. + * USB control responses are expected to be small, use 2K as a safe + * upper bound for the response payload. + */ + if (wLength > 2048) + wLength = 2048; response_size = sizeof(*response) + wLength;

operation = gb_operation_create(dev->connection,

The USB bridged-PHY protocol has never been supported by the upstream USB core and cannot function. Remove the obsolete FIXME and keep the protocol disabled with a straightforward explanatory comment.

Signed-off-by: Ayaan Mirza Baig ayaanmirzabaig85@gmail.com --- drivers/staging/greybus/usb.c | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/drivers/staging/greybus/usb.c b/drivers/staging/greybus/usb.c index 1502641f5dbb..e1c9966ab678 100644 --- a/drivers/staging/greybus/usb.c +++ b/drivers/staging/greybus/usb.c @@ -194,23 +194,10 @@ static int gb_usb_probe(struct gbphy_device *gbphy_dev, if (retval) goto exit_connection_destroy;

- /* - * FIXME: The USB bridged-PHY protocol driver depends on changes to - * USB core which are not yet upstream. - * - * Disable for now. - */ - if (1) { + /* The USB bridged-PHY protocol is not supported by upstream USB core */ dev_warn(dev, "USB protocol disabled\n"); retval = -EPROTONOSUPPORT; goto exit_connection_disable; - } - - retval = usb_add_hcd(hcd, 0, 0); - if (retval) - goto exit_connection_disable; - - return 0;

exit_connection_disable: gb_connection_disable(connection);