From 83aba6aba986e2ead8d4165d93b62329d7d8f047 Mon Sep 17 00:00:00 2001 From: Krishna Kurapati Date: Wed, 9 Sep 2026 15:19:10 +0530 Subject: [PATCH 1/2] UPSTREAM: Revert "usb: dwc3: qcom: Add support to skip phy management by USB core" This reverts commit be7b1c68cd3e4fc0f5a4e1b85696de1052f21f2f. Commit be7b1c68cd3e ("usb: dwc3: qcom: Add support to skip phy management by USB core") is causing a regression on qualcomm platforms. During role switch it tends to cause the following crash: [ 5.620951] refcount_t: underflow; use-after-free. [ 5.621114] Call trace: [ 5.621115] refcount_warn_saturate+0xd8/0x140 (P) [ 5.621117] kobject_put+0x11c/0x230 [ 5.621121] software_node_notify_remove+0xdc/0xf8 [ 5.621124] device_del+0x1dc/0x328 [ 5.621126] usb_disconnect+0x1d8/0x348 [ 5.621129] usb_remove_hcd+0x100/0x2a8 [ 5.621131] xhci_plat_remove+0x8c/0x170 [ 5.621134] platform_remove+0x28/0x40 [ 5.621135] device_release_driver_internal+0x174/0x290 [ 5.621138] device_release_driver+0x20/0x38 [ 5.621140] bus_remove_device+0x19c/0x1f8 [ 5.621142] device_del+0x1c4/0x328 [ 5.621143] platform_device_unregister+0x34/0xc0 [ 5.621145] dwc3_host_exit+0x50/0x70 [ 5.621146] __dwc3_set_mode+0xa4/0x378 [ 5.644535] Unable to handle kernel paging request at virtual address [ 5.644657] Workqueue: events_freezable __dwc3_set_mode [ 5.644664] pc : __pi_strcmp+0x9c/0x140 [ 5.644668] lr : software_node_property_present+0x60/0x98 [ 5.644697] Call trace: [ 5.644698] __pi_strcmp+0x9c/0x140 (P) [ 5.644700] device_property_present+0x9c/0xc0 [ 5.644703] dwc3_gadget_init+0x230/0x7b0 [ 5.644704] __dwc3_set_mode+0x314/0x378 [ 5.644707] process_scheduled_works+0x1b8/0x538 [ 5.644710] worker_thread+0x1fc/0x2f8 [ 5.644711] kthread+0x114/0x148 [ 5.644713] ret_from_fork+0x10/0x20 Revert skipping of usb core phy management for Qualcomm platforms to avoid the above issues. Reported-by: Val Packett Closes: https://lore.kernel.org/all/f9926203-ee69-4e18-b6c7-95261ba10807@packett.cool/ Signed-off-by: Krishna Kurapati Acked-by: Thinh Nguyen Tested-by: Shawn Guo Link: https://patch.msgid.link/20260909-xhci-fixes-revert-v1-1-7cc97fa0f307@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/dwc3/dwc3-qcom.c | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c index 1b026c3eba879..dc830f5aa25bc 100644 --- a/drivers/usb/dwc3/dwc3-qcom.c +++ b/drivers/usb/dwc3/dwc3-qcom.c @@ -21,7 +21,6 @@ #include #include #include -#include #include #include "core.h" #include "glue.h" @@ -448,16 +447,6 @@ static irqreturn_t qcom_dwc3_resume_irq(int irq, void *data) return IRQ_HANDLED; } -static int dwc3_qcom_set_swnode(struct device *dev) -{ - const struct property_entry props[] = { - PROPERTY_ENTRY_BOOL("xhci-skip-phy-init-quirk"), - {} - }; - - return device_create_managed_software_node(dev, props, NULL); -} - static void dwc3_qcom_select_utmi_clk(struct dwc3_qcom *qcom) { /* Configure dwc3 to use UTMI clock as PIPE clock not present */ @@ -735,10 +724,6 @@ static int dwc3_qcom_probe(struct platform_device *pdev) if (ignore_pipe_clk) dwc3_qcom_select_utmi_clk(qcom); - ret = dwc3_qcom_set_swnode(dev); - if (ret) - goto clk_disable; - qcom->mode = usb_get_dr_mode(dev); if (qcom->mode == USB_DR_MODE_HOST) { From 32fc1bdf85a4e9bdc335b0d3f1f847782253f619 Mon Sep 17 00:00:00 2001 From: Krishna Kurapati Date: Mon, 14 Sep 2026 20:05:58 +0530 Subject: [PATCH 2/2] FROMLIST: usb: dwc3: qcom: Add support to skip phy management by USB core DWC3 driver does manage phys itself sufficiently for Qualcomm platforms. If xhci-skip-phy-init is not set, the HCD core does a phy_init and phy_ exit is done only when roothub is being destroyed. Due to this, during system suspend in host mode, although phy_exit is done by DWC3 core, the init_count on phy is never down to zero since HCD core also did an init. consequently causing phy's exit routine to not be called. Hence, add support to skip phy management by USB core. Some Exynos platforms still do rely on USB core for phy_calibrate calls, hence disable USB core management for Qualcomm platforms only. Signed-off-by: Krishna Kurapati Acked-by: Thinh Nguyen --- drivers/usb/dwc3/core.c | 3 +++ drivers/usb/dwc3/core.h | 1 + drivers/usb/dwc3/dwc3-qcom.c | 1 + drivers/usb/dwc3/glue.h | 2 ++ drivers/usb/dwc3/host.c | 5 ++++- 5 files changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c index ceb49f2f80041..01f31113aec77 100644 --- a/drivers/usb/dwc3/core.c +++ b/drivers/usb/dwc3/core.c @@ -1694,6 +1694,9 @@ static void dwc3_get_software_properties(struct dwc3 *dwc, if (properties->needs_full_reinit) dwc->needs_full_reinit = true; + if (properties->skip_phy_init) + dwc->skip_phy_init = true; + dwc->gsbuscfg0_reqinfo = DWC3_GSBUSCFG0_REQINFO_UNSPECIFIED; if (properties->gsbuscfg0_reqinfo != diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h index e0dee9d287401..86c407973241a 100644 --- a/drivers/usb/dwc3/core.h +++ b/drivers/usb/dwc3/core.h @@ -1415,6 +1415,7 @@ struct dwc3 { unsigned wakeup_configured:1; unsigned suspended:1; unsigned susphy_state:1; + unsigned skip_phy_init:1; u16 imod_interval; diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c index dc830f5aa25bc..592e4b37f5028 100644 --- a/drivers/usb/dwc3/dwc3-qcom.c +++ b/drivers/usb/dwc3/dwc3-qcom.c @@ -746,6 +746,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev) probe_data.res = &res; probe_data.ignore_clocks_and_resets = true; probe_data.properties = DWC3_DEFAULT_PROPERTIES; + probe_data.properties.skip_phy_init = true; ret = dwc3_core_probe(&probe_data); if (ret) { ret = dev_err_probe(dev, ret, "failed to register DWC3 Core\n"); diff --git a/drivers/usb/dwc3/glue.h b/drivers/usb/dwc3/glue.h index d738e1739ae01..72c5593e657a9 100644 --- a/drivers/usb/dwc3/glue.h +++ b/drivers/usb/dwc3/glue.h @@ -14,10 +14,12 @@ * @gsbuscfg0_reqinfo: Value to be programmed in the GSBUSCFG0.REQINFO field * @needs_full_reinit: indicate the controller may not remain power during system * pm and need full initialization + * @skip_phy_init: skip xHCI PHY initialization on host init */ struct dwc3_properties { u32 gsbuscfg0_reqinfo; unsigned needs_full_reinit:1; + unsigned skip_phy_init:1; }; #define DWC3_DEFAULT_PROPERTIES ((struct dwc3_properties){ \ diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c index 96b588bd08cdc..97bdd09abf271 100644 --- a/drivers/usb/dwc3/host.c +++ b/drivers/usb/dwc3/host.c @@ -129,7 +129,7 @@ static int dwc3_host_get_irq(struct dwc3 *dwc) int dwc3_host_init(struct dwc3 *dwc) { - struct property_entry props[6]; + struct property_entry props[7]; struct platform_device *xhci; int ret, irq; int prop_idx = 0; @@ -173,6 +173,9 @@ int dwc3_host_init(struct dwc3 *dwc) if (dwc->usb2_lpm_disable) props[prop_idx++] = PROPERTY_ENTRY_BOOL("usb2-lpm-disable"); + if (dwc->skip_phy_init) + props[prop_idx++] = PROPERTY_ENTRY_BOOL("xhci-skip-phy-init-quirk"); + /** * WORKAROUND: dwc3 revisions <=3.00a have a limitation * where Port Disable command doesn't work.