summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-12-23phy: apple: Add Apple Type-C PHYSven Peter
The Apple Type-C PHY (ATCPHY) is a PHY for USB 2.0, USB 3.x, USB4/Thunderbolt, and DisplayPort connectivity found in Apple Silicon SoCs. The PHY handles muxing between these different protocols and also provides the reset controller for the attached dwc3 USB controller. There is no documentation available for this PHY and the entire sequence of MMIO pokes has been figured out by tracing all MMIO access of Apple's driver under a thin hypervisor and correlating the register reads/writes to their kernel's debug output to find their names. Deviations from this sequence generally results in the port not working or, especially when the mode is switched to USB4 or Thunderbolt, to some watchdog resetting the entire SoC. This initial commit already introduces support for Display Port and USB4/Thunderbolt but the drivers for these are not ready. We cannot control the alternate mode negotiation and are stuck with whatever Apple's firmware decides such that any DisplayPort or USB4/Thunderbolt device will result in a correctly setup PHY but not be usable until the other drivers are upstreamed as well. Co-developed-by: Janne Grunau <j@jannau.net> Signed-off-by: Janne Grunau <j@jannau.net> Co-developed-by: Hector Martin <marcan@marcan.st> Signed-off-by: Hector Martin <marcan@marcan.st> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> # for reset controller Reviewed-by: Neal Gompa <neal@gompa.dev> Signed-off-by: Sven Peter <sven@kernel.org> Link: https://patch.msgid.link/20251214-b4-atcphy-v3-3-ba82b20e9459@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23soc: apple: Add hardware tunable supportSven Peter
Various hardware, like the Type-C PHY or the Thunderbolt/USB4 NHI, present on Apple SoCs need machine-specific tunables passed from our bootloader m1n1 to the device tree. Add generic helpers so that we don't have to duplicate this across multiple drivers. Reviewed-by: Alyssa Rosenzweig <alyssa@rosenzweig.io> Reviewed-by: Neal Gompa <neal@gompa.dev> Reviewed-by: Janne Grunau <j@jannau.net> Signed-off-by: Sven Peter <sven@kernel.org> Link: https://patch.msgid.link/20251214-b4-atcphy-v3-1-ba82b20e9459@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom: qmp-usbc: Add QCS615 USB/DP PHY config and DP mode supportXiangxu Yin
Add QCS615-specific configuration for USB/DP PHY, including DP init routines, voltage swing tables, and platform data. Add compatible "qcs615-qmp-usb3-dp-phy". Note: SW_PORTSELECT handling for orientation flip is not implemented due to QCS615 fixed-orientation design and non-standard lane mapping. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Xiangxu Yin <xiangxu.yin@oss.qualcomm.com> Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-12-cbc72c88a44e@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom: qmp: Add DP v2 PHY register definitionsXiangxu Yin
Add dedicated headers for DP v2 PHY, including QSERDES COM and TX/RX register definitions. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Xiangxu Yin <xiangxu.yin@oss.qualcomm.com> Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-11-cbc72c88a44e@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom: qmp-usbc: Add USB/DP exclude handlingXiangxu Yin
When both USB and DP PHY modes are enabled simultaneously on the same QMP USBC PHY, it can lead to hardware misconfiguration and undefined behavior. This happens because the PHY resources are not designed to operate in both modes at the same time. To prevent this, introduce a mutual exclusion check between USB and DP PHY modes. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Xiangxu Yin <xiangxu.yin@oss.qualcomm.com> Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-10-cbc72c88a44e@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom: qmp-usbc: Add DP PHY ops for USB/DP switchable Type-C PHYsXiangxu Yin
Define qmp_usbc_dp_phy_ops struct to support DP mode on USB/DP switchable PHYs. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Xiangxu Yin <xiangxu.yin@oss.qualcomm.com> Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-9-cbc72c88a44e@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom: qmp-usbc: Add TCSR parsing and PHY mode settingXiangxu Yin
Extend TCSR parsing to read optional dp_phy_mode_reg and add qmp_usbc_set_phy_mode() to switch between USB and DP modes when supported. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Xiangxu Yin <xiangxu.yin@oss.qualcomm.com> Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-8-cbc72c88a44e@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom: qmp-usbc: Move USB-only init to usb_power_onXiangxu Yin
The current implementation programs USB-specific registers in qmp_usbc_com_init(), which is shared by both USB and DP modes. This causes unnecessary configuration when the PHY is used for DP. Move USB-only register setup from com_init to qmp_usbc_usb_power_on, so it runs only for USB mode. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Xiangxu Yin <xiangxu.yin@oss.qualcomm.com> Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-7-cbc72c88a44e@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom: qmp-usbc: add DP link and vco_div clocks for DP PHYXiangxu Yin
USB3DP PHY requires link and vco_div clocks when operating in DP mode. Extend qmp_usbc_register_clocks and the clock provider logic to register these clocks along with the existing pipe clock, to support both USB and DP configurations. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Xiangxu Yin <xiangxu.yin@oss.qualcomm.com> Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-6-cbc72c88a44e@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom: qmp-usbc: Move reset config into PHY cfgXiangxu Yin
The original reset list only works for USB-only PHYs. USB3DP PHYs require different reset names such as "dp_phy", so they need a separate list. Moving reset configuration into qmp_phy_cfg allows per-PHY customization without adding special-case logic in DT parsing. The legacy DT path keeps using the old hardcoded list, while non-legacy paths use cfg->reset_list. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Xiangxu Yin <xiangxu.yin@oss.qualcomm.com> Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-5-cbc72c88a44e@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom: qmp-usbc: Add regulator init_load supportXiangxu Yin
QMP USBC PHY drivers previously did not set init_load_uA for regulators, which could result in incorrect vote levels. This patch introduces regulator definitions with proper init_load_uA values based on each chip's power grid design. QCS615 USB3 PHY was previously reusing qcm2290_usb3phy_cfg, but its regulator requirements differ. A new qcs615_usb3phy_cfg is added to reflect the correct settings. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Xiangxu Yin <xiangxu.yin@oss.qualcomm.com> Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-4-cbc72c88a44e@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom: qmp-usbc: Add DP-related fields for USB/DP switchable PHYXiangxu Yin
Extend qmp_usbc_offsets and qmp_phy_cfg with DP-specific fields, including register offsets, init tables, and callback hooks. Also update qmp_usbc struct to track DP-related resources and state. This enables support for USB/DP switchable Type-C PHYs that operate in either mode. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Xiangxu Yin <xiangxu.yin@oss.qualcomm.com> Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-3-cbc72c88a44e@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom: qmp-usbc: Rename USB-specific ops to prepare for DP supportXiangxu Yin
To support following DisplayPort (DP) mode over the Type-C PHY, rename USB-specific functions and ops to clearly separate them from common or DP-related logic. This is a preparatory cleanup to enable USB + DP dual mode. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Xiangxu Yin <xiangxu.yin@oss.qualcomm.com> Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-2-cbc72c88a44e@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: cadence-torrent: restore parent clock for refclk during resumeThomas Richard (TI.com)
While suspend and resume, parent clock config for refclk was getting lost. So save and restore it in suspend and resume operations. Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Thomas Richard (TI.com) <thomas.richard@bootlin.com> Link: https://patch.msgid.link/20251216-phy-cadence-torrent-resume-restore-refclk-parent-v3-1-8a7ed84b47e3@bootlin.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: ti: phy-j721e-wiz: restore mux selection during resumeThomas Richard (TI.com)
While suspend and resume mux selection was getting lost. So save and restore these values in suspend and resume operations. Signed-off-by: Thomas Richard (TI.com) <thomas.richard@bootlin.com> Link: https://patch.msgid.link/20251216-phy-ti-phy-j721e-wiz-resume-restore-mux-sel-v1-1-771d564db966@bootlin.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom-qmp-usb: Set regulator load before enablingFaisal Hassan
Set the regulator load before enabling the regulators to ensure stable operation and proper power management on platforms where regulators are shared between the QMP USB PHY and other IP blocks. Introduce a regulator data structure with explicit enable load values and use the regulator framework's `init_load_uA` field along with `devm_regulator_bulk_get_const()` to ensure that `regulator_set_load()` is applied automatically before the first enable, providing consistent power management behavior across platforms. Signed-off-by: Faisal Hassan <faisal.hassan@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://patch.msgid.link/20250905101243.14815-1-faisal.hassan@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom: qmp-pcie: add QMP PCIe PHY tables for KaanapaliQiang Yu
Add QMP PCIe PHY support for the Kaanapali platform. Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com> Reviewed-by: Abel Vesa <abel.vesa@linaro.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Qiang Yu <qiang.yu@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://patch.msgid.link/20251124-kaanapali-pcie-phy-v4-5-d04ee9cca83b@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom-qmp: qserdes-com: Add some more v8 register offsetsQiang Yu
Some qserdes-com register offsets for the v8 PHY were previously omitted, as they were not needed by earlier v8 PHY initialization sequences. Add these missing v8 register offsets now required to support PCIe QMP PHY on Kaanapali platform. Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Qiang Yu <qiang.yu@oss.qualcomm.com> Link: https://patch.msgid.link/20251124-kaanapali-pcie-phy-v4-4-d04ee9cca83b@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom-qmp: pcs-pcie: Add v8 register offsetsQiang Yu
Kaanapali SoC uses QMP phy with version v8 for PCIe Gen3 x2. Add the new PCS PCIE specific offsets in a dedicated header file. Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Qiang Yu <qiang.yu@oss.qualcomm.com> Link: https://patch.msgid.link/20251124-kaanapali-pcie-phy-v4-3-d04ee9cca83b@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: qcom-qmp: qserdes-txrx: Add complete QMP PCIe PHY v8 register offsetsQiang Yu
Kaanapali SoC uses QMP PHY with version v8 for PCIe Gen3 x2, but requires a completely unique qserdes-txrx register offsets compared to existing v8 offsets. Hence, add a dedicated header file containing the FULL SET of qserdes-txrx register definitions required for Kaanapali's PCIe PHY operation. Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Qiang Yu <qiang.yu@oss.qualcomm.com> Link: https://patch.msgid.link/20251124-kaanapali-pcie-phy-v4-2-d04ee9cca83b@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: spacemit: Introduce PCIe/combo PHYAlex Elder
Introduce a driver that supports three PHYs found on the SpacemiT K1 SoC. The first PHY is a combo PHY that can be configured for use for either USB 3 or PCIe. The other two PHYs support PCIe only. All three PHYs must be programmed with an 8 bit receiver termination value, which must be determined dynamically. Only the combo PHY is able to determine this value. The combo PHY performs a special calibration step at probe time to discover this, and that value is used to program each PHY that operates in PCIe mode. The combo PHY must therefore be probed before either of the PCIe-only PHYs will be used. Each PHY has an internal PLL driven from an external oscillator. This PLL started when the PHY is first initialized, and stays on thereafter. During normal operation, the USB or PCIe driver using the PHY must ensure (other) clocks and resets are set up properly. However PCIe mode clocks are enabled and resets are de-asserted temporarily by this driver to perform the calibration step on the combo PHY. Tested-by: Junzhong Pan <panjunzhong@linux.spacemit.com> Signed-off-by: Alex Elder <elder@riscstar.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/all/ba532f8d-a452-40e5-af46-b58b89f70a92@linaro.org/ [1] Tested-by: Yixun Lan <dlan@gentoo.org> Link: https://patch.msgid.link/20251218151235.454997-4-elder@riscstar.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: rockchip: samsung-hdptx: Cleanup TMDS PLL config tableCristian Ciocaltea
Drop a bunch of unused members from struct ropll_config and make the static ropll_tmds_cfg table more readable: * add a table header * sort rows by rate * convert hex values to decimal (for consistency) Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://patch.msgid.link/20251221-phy-hdptx-pll-fix-v2-2-ae4abf7f75a1@collabora.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: rockchip: samsung-hdptx: Pre-compute HDMI PLL config for 461.10125 MHz ↵Cristian Ciocaltea
output Attempting to make use of a 1080p@120Hz display mode with 10 bpc RGB on my Acer XV275K P3 monitor results in a blank image. A similar behavior has been reported on Philips 279M1RV. The faulty modeline is created by drm_gtf_mode_complex() based on the following EDID entry from the Standard Timings block: GTF: 1920x1080 119.999987 Hz 16:9 138.840 kHz 368.759000 MHz It's worth noting the computed pixel clock ends up being slightly higher at 368.881000 MHz. Nevertheless, this seems to work consistently fine with 8 bpc RGB. After switching to 10 bpc, the TMDS character rate expected for the mode increases to 461.101250 MHz, as per drm_hdmi_compute_mode_clock(). Since there is no entry for this rate in the ropll_tmds_cfg table, the necessary HDMI PLL configuration parameters are calculated dynamically by rk_hdptx_phy_clk_pll_calc(). However, the resulting output rate is not quite a perfect match, i.e. 461.100000 MHz. That proved to be the actual root cause of the problem. Add a new entry to the TMDS configuration table and provide the necessary frequency division coefficients for the PHY PLL to generate the expected 461.101250 MHz output. Fixes: 9d0ec51d7c22 ("phy: rockchip: samsung-hdptx: Add high color depth management") Tested-by: Derek Foreman <derek.foreman@collabora.com> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://patch.msgid.link/20251221-phy-hdptx-pll-fix-v2-1-ae4abf7f75a1@collabora.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: fsl-imx8mq-usb: change ssc_range value for i.MX8MQXu Yang
According to IC engineer suggestion, set ssc_range as -4003 ppm will have more tolerance for EMI, and suitable for more boards. Besides, it's confirmed that with this setting the TX SSC test will pass on one customer board. Signed-off-by: Li Jun <jun.li@nxp.com> Signed-off-by: Xu Yang <xu.yang_2@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251219081354.3806806-1-xu.yang_2@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: core: Discard pm_runtime_put() return valuesRafael J. Wysocki
The PHY core defines phy_pm_runtime_put() to return an int, but that return value is never used. It also passes the return value of pm_runtime_put() to the caller which is not very useful. Returning an error code from pm_runtime_put() merely means that it has not queued up a work item to check whether or not the device can be suspended and there are many perfectly valid situations in which that can happen, like after writing "on" to the devices' runtime PM "control" attribute in sysfs for one example. Modify phy_pm_runtime_put() to discard the pm_runtime_put() return value and change its return type to void. Also drop the redundant pm_runtime_enabled() call from there. No intentional functional impact. This will facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2556645.jE0xQCEvom@rafael.j.wysocki Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: rockchip-samsung-dcphy: Discard pm_runtime_put() return valueRafael J. Wysocki
Passing pm_runtime_put() return value to the callers is not particularly useful. Returning an error code from pm_runtime_put() merely means that it has not queued up a work item to check whether or not the device can be suspended and there are many perfectly valid situations in which that can happen, like after writing "on" to the devices' runtime PM "control" attribute in sysfs for one example. It also happens when the kernel is configured with CONFIG_PM unset. Accordingly, update samsung_mipi_dcphy_exit() to simply discard the return value of pm_runtime_put() and always return success to the caller. This will facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2281919.Icojqenx9y@rafael.j.wysocki Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: freescale: Discard pm_runtime_put() return valueRafael J. Wysocki
Printing error messages on pm_runtime_put() returning negative values is not particularly useful. Returning an error code from pm_runtime_put() merely means that it has not queued up a work item to check whether or not the device can be suspended and there are many perfectly valid situations in which that can happen, like after writing "on" to the devices' runtime PM "control" attribute in sysfs for one example. Accordingly, update mixel_lvds_phy_reset() to simply discard the return value of pm_runtime_put(). This will facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2012926.taCxCBeP46@rafael.j.wysocki Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: rockchip: inno-usb2: fix communication disruption in gadget modeLuca Ceresoli
When the OTG USB port is used to power to SoC, configured as peripheral and used in gadget mode, communication stops without notice about 6 seconds after the gadget is configured and enumerated. The problem was observed on a Radxa Rock Pi S board, which can only be powered by the only USB-C connector. That connector is the only one usable in gadget mode. This implies the USB cable is connected from before boot and never disconnects while the kernel runs. The related code flow in the PHY driver code can be summarized as: * the first time chg_detect_work starts (6 seconds after gadget is configured and enumerated) -> rockchip_chg_detect_work(): if chg_state is UNDEFINED: property_enable(base, &rphy->phy_cfg->chg_det.opmode, false); [Y] * rockchip_chg_detect_work() changes state and re-triggers itself a few times until it reaches the DETECTED state: -> rockchip_chg_detect_work(): if chg_state is DETECTED: property_enable(base, &rphy->phy_cfg->chg_det.opmode, true); [Z] At [Y] all existing communications stop. E.g. using a CDC serial gadget, the /dev/tty* devices are still present on both host and device, but no data is transferred anymore. The later call with a 'true' argument at [Z] does not restore it. Due to the lack of documentation, what chg_det.opmode does exactly is not clear, however by code inspection it seems reasonable that is disables something needed to keep the communication working, and testing proves that disabling these lines lets gadget mode keep working. So prevent changes to chg_det.opmode when there is a cable connected (VBUS present). Fixes: 98898f3bc83c ("phy: rockchip-inno-usb2: support otg-port for rk3399") Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/lkml/20250414185458.7767aabc@booty/ Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com> Link: https://patch.msgid.link/20251127-rk3308-fix-usb-gadget-phy-disconnect-v2-2-dac8a02cd2ca@bootlin.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: rockchip: inno-usb2: fix disconnection in gadget modeLouis Chauvet
When the OTG USB port is used to power the SoC, configured as peripheral and used in gadget mode, there is a disconnection about 6 seconds after the gadget is configured and enumerated. The problem was observed on a Radxa Rock Pi S board, which can only be powered by the only USB-C connector. That connector is the only one usable in gadget mode. This implies the USB cable is connected from before boot and never disconnects while the kernel runs. The problem happens because of the PHY driver code flow, summarized as: * UDC start code (triggered via configfs at any time after boot) -> phy_init -> rockchip_usb2phy_init -> schedule_delayed_work(otg_sm_work [A], 6 sec) -> phy_power_on -> rockchip_usb2phy_power_on -> enable clock -> rockchip_usb2phy_reset * Now the gadget interface is up and running. * 6 seconds later otg_sm_work starts [A] -> rockchip_usb2phy_otg_sm_work(): if (B_IDLE state && VBUS present && ...): schedule_delayed_work(&rport->chg_work [B], 0); * immediately the chg_detect_work starts [B] -> rockchip_chg_detect_work(): if chg_state is UNDEFINED: if (!rport->suspended): rockchip_usb2phy_power_off() <--- [X] At [X], the PHY is powered off, causing a disconnection. This quickly triggers a new connection and following re-enumeration, but any connection that had been established during the 6 seconds is broken. The code already checks for !rport->suspended (which, somewhat counter-intuitively, means the PHY is powered on), so add a guard for VBUS as well to avoid a disconnection when a cable is connected. Fixes: 98898f3bc83c ("phy: rockchip-inno-usb2: support otg-port for rk3399") Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/lkml/20250414185458.7767aabc@booty/ Signed-off-by: Louis Chauvet <louis.chauvet@bootlin.com> Co-developed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com> Link: https://patch.msgid.link/20251127-rk3308-fix-usb-gadget-phy-disconnect-v2-1-dac8a02cd2ca@bootlin.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: ti: gmii-sel: fix regmap leak on probe failureJohan Hovold
The mmio regmap that may be allocated during probe is never freed. Switch to using the device managed allocator so that the regmap is released on probe failures (e.g. probe deferral) and on driver unbind. Fixes: 5ab90f40121a ("phy: ti: gmii-sel: Do not use syscon helper to build regmap") Cc: stable@vger.kernel.org # 6.14 Cc: Andrew Davis <afd@ti.com> Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Andrew Davis <afd@ti.com> Link: https://patch.msgid.link/20251127134834.2030-1-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: sparx5-serdes: make it selectable for ARCH_LAN969XRobert Marko
LAN969x uses the SparX-5 SERDES driver, so make it selectable for ARCH_LAN969X. Reviewed-by: Daniel Machon <daniel.machon@microchip.com> Signed-off-by: Robert Marko <robert.marko@sartura.hr> Tested-by: Gabor Juhos <j4g8y7@gmail.com> Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com> Link: https://patch.msgid.link/20251031121834.665987-1-robert.marko@sartura.hr Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errorsHaotian Zhang
devm_pm_runtime_enable() can fail due to memory allocation. The current code ignores its return value after calling pm_runtime_set_active(), leaving the device in an inconsistent state if runtime PM initialization fails. Check the return value of devm_pm_runtime_enable() and return on failure. Also move the declaration of 'ret' to the function scope to support this check. Fixes: ee8e41b5044f ("phy: ti: phy-da8xx-usb: Add runtime PM support") Suggested-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20251124105734.1027-1-vulab@iscas.ac.cn Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: stm32-usphyc: Fix off by one in probe()Dan Carpenter
The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one element out of bounds. The "index" comes from the device tree so it's data that we trust and it's unlikely to be wrong, however it's obviously still worth fixing the bug. Change the > to >=. Fixes: 94c358da3a05 ("phy: stm32: add support for STM32 USB PHY Controller (USBPHYC)") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com> Link: https://patch.msgid.link/aTfHcMJK1wFVnvEe@stanley.mountain Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23ACPI: bus: Rework the handling of \_SB._OSC USB4 featuresRafael J. Wysocki
Use acpi_osc_handshake() introduced previously for implementing the \_SB._OSC USB4 features control negotiation. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Link: https://patch.msgid.link/3879947.MHq7AAxBmi@rafael.j.wysocki
2025-12-23ACPI: bus: Adjust feature mask creation for \_SB._OSCRafael J. Wysocki
The feature mask creation for \_SB._OSC is messy and hard to follow, so clean it up and make all of the CPPC-related features depend on CONFIG_ACPI_CPPC_LIB as they will not work if it is not set anyway. Also make acpi_bus_osc_negotiate_platform_control() print a message including a bit mask representig the features for which control has been granted. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Link: https://patch.msgid.link/4495088.ejJDZkT8p0@rafael.j.wysocki
2025-12-23ACPI: bus: Rework the handling of \_SB._OSC platform featuresRafael J. Wysocki
Both acpi_bus_osc_negotiate_platform_control() and acpi_bus_osc_negotiate_usb_control() first call acpi_run_osc() to evaluate _OSC in "query mode", with OSC_QUERY_ENABLE set in the capabilities buffer, and then use the resultant feature mask as the input buffer for requesting control of those features by calling acpi_run_osc() to evaluate _OSC with OSC_QUERY_ENABLE clear. This involves some code duplication and unnecessary memory allocations, so introduce a new helper function carrying out an _OSC handshake along the lines of the above description in a simpler way and update acpi_bus_osc_negotiate_platform_control() to use it. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Link: https://patch.msgid.link/1966378.CQOukoFCf9@rafael.j.wysocki
2025-12-23ACPI: bus: Rename label and use ACPI_FREE() in acpi_run_osc()Rafael J. Wysocki
Use ACPI_FREE() for freeing an object coming from acpi_eval_osc() and rename the "out_free" to "out" because it does not involve kfree() any more. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Link: https://patch.msgid.link/8682086.NyiUUSuA9g@rafael.j.wysocki
2025-12-23ACPI: bus: Split _OSC error processing out of acpi_run_osc()Rafael J. Wysocki
Split a function for processing _OSC errors called acpi_osc_error_check() out of acpi_run_osc() to facilitate subsequent changes. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Link: https://patch.msgid.link/6135328.MhkbZ0Pkbq@rafael.j.wysocki
2025-12-23ACPI: bus: Split _OSC evaluation out of acpi_run_osc()Rafael J. Wysocki
Split a function for evaluating _OSC called acpi_eval_osc() out of acpi_run_osc() to facilitate subsequent changes and add some more parameters sanity checks to the latter. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Link: https://patch.msgid.link/22963770.EfDdHjke4D@rafael.j.wysocki
2025-12-23ACPI: bus: Rework printing debug messages on _OSC errorsRafael J. Wysocki
Instead of using one function, acpi_print_osc_error(), for printing a debug message and dumping the _OSC request data in one go, use acpi_handle_debug() directly for printing messages and a separate function called acpi_dump_osc_data() for dumping the _OSC request data before printing one or more of them. This avoids * dumping _OSC request data multiple times when there are multiple error bits set in the return buffer, * wrapping message lines on terminals with 80 character line width, * mixing up unrelated messages by printing full lines only, and generally helps to make the messages easier to parse. Also, use %pUL for UUID printing instead of printing UUIDs as strings and include the revision number into the dumped _OSC request data. This is how the debug printout looks like when the OSC_REQUEST_ERROR and OSC_INVALID_REVISION_ERROR bits are set in the return buffer before the change: ACPI: \_SB_: ACPI: (0811B06E-4A27-44F9-8D60-3CBBC22E7B48): _OSC request failed ACPI: _OSC request data: ACPI: 1 ACPI: 2e7eff ACPI: ACPI: \_SB_: ACPI: (0811B06E-4A27-44F9-8D60-3CBBC22E7B48): _OSC invalid revision ACPI: _OSC request data: ACPI: 1 ACPI: 2e7eff ACPI: and this is how it is going to look like afterward: ACPI: \_SB_: ACPI: _OSC: UUID: 0811B06E-4A27-44F9-8D60-3CBBC22E7B48, rev: 1 ACPI: \_SB_: ACPI: _OSC: capabilities DWORD 0: [00000001] ACPI: \_SB_: ACPI: _OSC: capabilities DWORD 1: [002e7eff] ACPI: \_SB_: ACPI: _OSC: request failed ACPI: \_SB_: ACPI: _OSC: invalid revision Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Link: https://patch.msgid.link/10794028.nUPlyArG6x@rafael.j.wysocki
2025-12-23ACPI: bus: Fix handling of _OSC errors in acpi_run_osc()Rafael J. Wysocki
The handling of _OSC errors in acpi_run_osc() is inconsistent and arguably not compliant with the _OSC definition (cf. Section 6.2.12 of ACPI 6.6 [1]). Namely, if OSC_QUERY_ENABLE is not set in the capabilities buffer and any of the error bits are set in the _OSC return buffer, acpi_run_osc() returns an error code and the _OSC return buffer is discarded. However, in that case, depending on what error bits are set, the return buffer may contain acknowledged bits for features that need to be controlled by the kernel going forward. If the OSC_INVALID_UUID_ERROR bit is set, the request could not be processed at all and so in that particular case discarding the _OSC return buffer and returning an error is the right thing to do regardless of whether or not OSC_QUERY_ENABLE is set in the capabilities buffer. If OSC_QUERY_ENABLE is set in the capabilities buffer and the OSC_REQUEST_ERROR or OSC_INVALID_REVISION_ERROR bits are set in the return buffer, acpi_run_osc() may return an error and discard the _OSC return buffer because in that case the platform configuration does not change. However, if any of them is set in the return buffer when OSC_QUERY_ENABLE is not set in the capabilities buffer, the feature mask in the _OSC return buffer still represents a set of acknowleded features as per the _OSC definition: The platform acknowledges the Capabilities Buffer by returning a buffer of DWORDs of the same length. Set bits indicate acknowledgment that OSPM may take control of the capability and cleared bits indicate that the platform either does not support the capability or that OSPM may not assume control. which is not conditional on the error bits being clear, so in that case, discarding the _OSC return buffer is questionable. There is also no reason to return an error and discard the _OSC return buffer if the OSC_CAPABILITIES_MASK_ERROR bit is set in it, but printing diagnostic messages is appropriate when that happens with OSC_QUERY_ENABLE clear in the capabilities buffer. Adress this issue by making acpi_run_osc() follow the rules outlined above. Moreover, make acpi_run_osc() only take the defined _OSC error bits into account when checking _OSC errors. Link: https://uefi.org/specs/ACPI/6.6/06_Device_Configuration.html#osc-operating-system-capabilities [1] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> [ rjw: Corrected typo in the changelog ] Link: https://patch.msgid.link/3042649.e9J7NaK4W3@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-12-23PCI: aspeed: Add ASPEED PCIe RC driverJacky Chou
Introduce PCIe Root Complex driver for ASPEED SoCs. Support RC initialization, reset, clock, IRQ domain, and MSI domain setup. Implement platform-specific setup and register configuration for ASPEED. And provide PCI config space read/write and INTx/MSI interrupt handling. Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20251216-upstream_pcie_rc-v7-6-4aeb0f53c4ce@aspeedtech.com
2025-12-23PCI: Add FMT, TYPE and CPL status definition for TLP headerJacky Chou
According to PCIe specification, add FMT, TYPE and CPL status definition for TLP header. Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Acked-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20251216-upstream_pcie_rc-v7-5-4aeb0f53c4ce@aspeedtech.com
2025-12-23phy: qcom-qusb2: Fix NULL pointer dereference on early suspendLoic Poulain
Enabling runtime PM before attaching the QPHY instance as driver data can lead to a NULL pointer dereference in runtime PM callbacks that expect valid driver data. There is a small window where the suspend callback may run after PM runtime enabling and before runtime forbid. This causes a sporadic crash during boot: ``` Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a1 [...] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.7+ #116 PREEMPT Workqueue: pm pm_runtime_work pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : qusb2_phy_runtime_suspend+0x14/0x1e0 [phy_qcom_qusb2] lr : pm_generic_runtime_suspend+0x2c/0x44 [...] ``` Attach the QPHY instance as driver data before enabling runtime PM to prevent NULL pointer dereference in runtime PM callbacks. Reorder pm_runtime_enable() and pm_runtime_forbid() to prevent a short window where an unnecessary runtime suspend can occur. Use the devres-managed version to ensure PM runtime is symmetrically disabled during driver removal for proper cleanup. Fixes: 891a96f65ac3 ("phy: qcom-qusb2: Add support for runtime PM") Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Link: https://patch.msgid.link/20251219085640.114473-1-loic.poulain@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using itStefano Radaelli
Clear the PCS_TX_SWING_FULL field mask before setting the new value in PHY_CTRL5 register. Without clearing the mask first, the OR operation could leave previously set bits, resulting in incorrect register configuration. Fixes: 63c85ad0cd81 ("phy: fsl-imx8mp-usb: add support for phy tuning") Suggested-by: Leonid Segal <leonids@variscite.com> Acked-by: Pierluigi Passaro <pierluigi.p@variscite.com> Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Reviewed-by: Xu Yang <xu.yang_2@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Fabio Estevam <festevam@gmail.com> Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Link: https://patch.msgid.link/20251219160912.561431-1-stefano.r@variscite.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-12-23spi: cadence-quadspi: Prevent indirect readMark Brown
Merge series from Mateusz Litwin <mateusz.litwin@nokia.com>: On the Stratix10 platform, indirect reads can become very slow due to lost interrupts and/or missed `complete()` calls, causing `wait_for_completion_timeout()` to expire. Three issues were identified: 1) A race condition exists between the read loop and IRQ `complete()` call: An IRQ can call `complete()` after the inner loop ends, but before `reinit_completion()`, losing the completion event and leading to `wait_for_completion_timeout()` expire. This function will not return an error because `bytes_to_read` > 0 (indicating data is already in the FIFO) and the final `ret` value is overwritten by `cqspi_wait_for_bit()` return value (indicating request completion), masking the timeout. For test purpose, logging was added to print the count of timeouts and the outer loop count. $ dd if=/dev/mtd0 of=/dev/null bs=64M count=1 [ 2232.925219] cadence-qspi ff8d2000.spi: Indirect read error timeout (1) loop (12472) [ 2236.200391] cadence-qspi ff8d2000.spi: Indirect read error timeout (1) loop (12460) [ 2239.482836] cadence-qspi ff8d2000.spi: Indirect read error timeout (5) loop (12450) This indicates that such an event is rare, but possible. Tested on the Stratix10 platform. 2) The quirk assumes the indirect read path never leaves the inner loop on SoCFPGA. This assumption is incorrect when using slow flash. Disabling IRQs in the inner loop can cause lost interrupts. 3) The `CQSPI_SLOW_SRAM` quirk disables `CQSPI_REG_IRQ_IND_COMP` (indirect completion) interrupt, relying solely on the `CQSPI_REG_IRQ_WATERMARK` (FIFO watermark) interrupt. For small transfers sizes, the final data read might not fill the FIFO sufficiently to trigger the watermark, preventing completion and leading to wait_for_completion_timeout() expiration. Two patches have been prepared to resolve these issues. - [1/2] spi: cadence-quadspi: Prevent lost complete() call during indirect read Moving `reinit_completion()` before the inner loop prevents a race condition. This might cause a premature IRQ complete() call to occur; however, in the worst case, this will result in a spurious wakeup and another wait cycle, which is preferable to waiting for a timeout. - [2/2] spi: cadence-quadspi: Improve CQSPI_SLOW_SRAM quirk if flash is slow Re-enabling `CQSPI_REG_IRQ_IND_COMP` interrupt resolves the problem for small reads and removes the disabling of interrupts, addressing the issue with lost interrupts. This marginally increases the IRQ count. Test: $ dd if=/dev/mtd0 of=/dev/null bs=1M count=64 Results from the Stratix10 platform with mt25qu02g flash. FIFO size in all tests: 128 Serviced interrupt call counts: Without `CQSPI_SLOW_SRAM` quirk: 16 668 850 With `CQSPI_SLOW_SRAM` quirk: 204 176 With `CQSPI_SLOW_SRAM` and this patch: 224 528 Patch 2/2: Delivers a substantial read‑performance improvement for the Cadence QSPI controller on the Stratix10 platform. Patch 1/2: Applies to all platforms and should yield a modest performance gain, most noticeable with large `CQSPI_READ_TIMEOUT_MS` values and workloads dominated by many small reads.
2025-12-23drm/xe: Don't use absolute path in generated header commentCalvin Owens
Building the XE driver through Yocto throws this QA warning: WARNING: mc:house:linux-stable-6.17-r0 do_package_qa: QA Issue: File /usr/src/debug/linux-stable/6.17/drivers/gpu/drm/xe/generated/xe_device_wa_oob.h in package linux-stable-src contains reference to TMPDIR [buildpaths] WARNING: mc:house:linux-stable-6.17-r0 do_package_qa: QA Issue: File /usr/src/debug/linux-stable/6.17/drivers/gpu/drm/xe/generated/xe_wa_oob.h in package linux-stable-src contains reference to TMPDIR [buildpaths] ...because the comment at the top of the generated header contains the absolute path to the rules file at build time: * This file was generated from rules: /home/calvinow/git/meta-house/build/tmp-house/work-shared/nuc14rvhu7/kernel-source/drivers/gpu/drm/xe/xe_device_wa_oob.rules Fix this minor annoyance by putting the basename of the rules file in the generated comment instead of the absolute path, so the generated header contents no longer depend on the location of the kernel source. Signed-off-by: Calvin Owens <calvin@wbinvd.org> Link: https://patch.msgid.link/20251222165441.516102-2-rodrigo.vivi@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2025-12-23drm/xe/migrate: Configure migration queue as low latencyFrancois Dugast
Commit 5488bec96bcc ("drm/xe/uapi: Use hint for guc to set GT frequency") introduced low latency hint for use by user space when creating an exec queue. This instructs SLPC to ramp the GT frequency aggressively. SVM relies on an internal exec queue to migrate memory upon page faults. This change creates this exec queue with the low latency hint to speed up migration. This should not impact systems where GT frequency is set over sysfs, or with long running workloads which give enough time for the frequency to ramp up. An example of memory access pattern that shows an improvement of SVM performance is running hundreds of times IGT eu-fault-2m-once-device in xe_exec_system_allocator. The copy duration provided by GT stats in svm_2M_device_copy_us shows per GPU page fault: ~ 165 μs without low latency hint ~ 130 μs with low latency hint Suggested-by: Matthew Brost <matthew.brost@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Signed-off-by: Francois Dugast <francois.dugast@intel.com> Link: https://patch.msgid.link/20251223115327.49555-1-francois.dugast@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2025-12-23Merge patch series "usb: typec: ucsi: revert broken buffer management"Greg Kroah-Hartman
Johan Hovold <johan@kernel.org> says: The new buffer management code has not been tested or reviewed properly and breaks boot of machines like the Lenovo ThinkPad X13s. Fixing this will require designing a proper interface for managing these transactions, something which most likely involves reverting most of the offending commit anyway. Revert the broken code to fix the regression and let Intel come up with a properly tested implementation for a later kernel. Link: https://lore.kernel.org/r/20251222152204.2846-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-12-23Revert "usb: typec: ucsi: Update UCSI structure to have message in and ↵Johan Hovold
message out fields" This reverts commit 3e082978c33151d576694deac8abde021ea669a8. The new buffer management code has not been tested or reviewed properly and breaks boot of machines like the Lenovo ThinkPad X13s: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 CPU: 0 UID: 0 PID: 813 Comm: kworker/0:3 Not tainted 6.19.0-rc2 #26 PREEMPT Hardware name: LENOVO 21BYZ9SRUS/21BYZ9SRUS, BIOS N3HET87W (1.59 ) 12/05/2023 Workqueue: events ucsi_handle_connector_change [typec_ucsi] Call trace: ucsi_sync_control_common+0xe4/0x1ec [typec_ucsi] (P) ucsi_run_command+0xcc/0x194 [typec_ucsi] ucsi_send_command_common+0x84/0x2a0 [typec_ucsi] ucsi_get_connector_status+0x48/0x78 [typec_ucsi] ucsi_handle_connector_change+0x5c/0x4f4 [typec_ucsi] process_one_work+0x208/0x60c worker_thread+0x244/0x388 The new code completely ignores concurrency so that the message length can be updated while a transaction is ongoing. In the above case, the length ends up being modified by another thread while processing an ack so that the NULL cci pointer is dereferenced. Fixing this will require designing a proper interface for managing these transactions, something which most likely involves reverting most of the offending commit anyway. Revert the broken code to fix the regression and let Intel come up with a properly tested implementation for a later kernel. Fixes: 3e082978c331 ("usb: typec: ucsi: Update UCSI structure to have message in and message out fields") Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/20251222152204.2846-5-johan@kernel.org