From 4eae0978e2ae21f020e6665e09e5d10567e15099 Mon Sep 17 00:00:00 2001 From: Loic Poulain Date: Wed, 22 Jul 2026 15:45:14 +0200 Subject: [PATCH 1/7] phy: qcom: qmp-combo: Prevent unnecessary PM runtime suspend at boot Runtime PM has to be enabled before creating the PHYs, since phy_create() only enables runtime PM on the PHY devices if it is already enabled on this parent device. This opens a small window where the device can be runtime suspended after pm_runtime_enable() and before the later pm_runtime_forbid(), causing an unnecessary suspend/resume cycle while the PHYs are not yet registered. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHYs have been created to prevent the device from being runtime suspended during that window. This also makes the probe path safe independently of pm_runtime_forbid(), which is a good preparation for potentially dropping the forbid() call in the future and letting runtime PM be enabled by default. Reviewed-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Reviewed-by: Konrad Dybcio Signed-off-by: Loic Poulain --- drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 26 +++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c index cdcfad2e86b1d..2cbe1d90662ee 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c @@ -4934,10 +4934,16 @@ static int qmp_combo_probe(struct platform_device *pdev) if (ret) goto err_node_put; + /* + * Enable runtime PM before creating the PHYs, phy_create() only enables + * it on the PHY devices if already enabled on the parent. Hold a usage + * reference so callbacks cannot run until the PHY is ready. + */ + pm_runtime_get_noresume(dev); pm_runtime_set_active(dev); ret = devm_pm_runtime_enable(dev); if (ret) - goto err_node_put; + goto err_pm_put; /* * Prevent runtime pm from being ON by default. Users can enable * it using power/control in sysfs. @@ -4946,14 +4952,13 @@ static int qmp_combo_probe(struct platform_device *pdev) ret = qmp_combo_register_clocks(qmp, usb_np, dp_np); if (ret) - goto err_node_put; - + goto err_pm_put; qmp->usb_phy = devm_phy_create(dev, usb_np, &qmp_combo_usb_phy_ops); if (IS_ERR(qmp->usb_phy)) { ret = PTR_ERR(qmp->usb_phy); dev_err(dev, "failed to create USB PHY: %d\n", ret); - goto err_node_put; + goto err_pm_put; } phy_set_drvdata(qmp->usb_phy, qmp); @@ -4962,7 +4967,7 @@ static int qmp_combo_probe(struct platform_device *pdev) if (IS_ERR(qmp->dp_phy)) { ret = PTR_ERR(qmp->dp_phy); dev_err(dev, "failed to create DP PHY: %d\n", ret); - goto err_node_put; + goto err_pm_put; } phy_set_drvdata(qmp->dp_phy, qmp); @@ -4972,11 +4977,20 @@ static int qmp_combo_probe(struct platform_device *pdev) else phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate); + if (IS_ERR(phy_provider)) { + ret = PTR_ERR(phy_provider); + goto err_pm_put; + } + of_node_put(usb_np); of_node_put(dp_np); - return PTR_ERR_OR_ZERO(phy_provider); + pm_runtime_put(dev); + + return 0; +err_pm_put: + pm_runtime_put_noidle(dev); err_node_put: of_node_put(usb_np); of_node_put(dp_np); From 44cd7c4b98e42b6d94921f5a6855a1c2196a1411 Mon Sep 17 00:00:00 2001 From: Loic Poulain Date: Wed, 22 Jul 2026 15:45:15 +0200 Subject: [PATCH 2/7] phy: qcom: qmp-usbc: Prevent unnecessary PM runtime suspend at boot Runtime PM has to be enabled before creating the PHYs, since phy_create() only enables runtime PM on the PHY devices if it is already enabled on this parent device. This opens a small window where the device can be runtime suspended after pm_runtime_enable() and before the later pm_runtime_forbid(), causing an unnecessary suspend/resume cycle while the PHYs are not yet registered. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHYs have been created to prevent the device from being runtime suspended during that window. This also makes the probe path safe independently of pm_runtime_forbid(), which is a good preparation for potentially dropping the forbid() call in the future and letting runtime PM be enabled by default. Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Signed-off-by: Loic Poulain --- drivers/phy/qualcomm/phy-qcom-qmp-usbc.c | 26 ++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c b/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c index ab3055bb5b0c1..780a6b4f71eb4 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c @@ -1959,10 +1959,16 @@ static int qmp_usbc_probe(struct platform_device *pdev) if (ret) goto err_node_put; + /* + * Enable runtime PM before creating the PHYs, phy_create() only enables + * it on the PHY devices if already enabled on the parent. Hold a usage + * reference so callbacks cannot run until the PHY is ready. + */ + pm_runtime_get_noresume(dev); pm_runtime_set_active(dev); ret = devm_pm_runtime_enable(dev); if (ret) - goto err_node_put; + goto err_pm_put; /* * Prevent runtime pm from being ON by default. Users can enable * it using power/control in sysfs. @@ -1971,13 +1977,13 @@ static int qmp_usbc_probe(struct platform_device *pdev) ret = qmp_usbc_register_clocks(qmp, np); if (ret) - goto err_node_put; + goto err_pm_put; qmp->usb_phy = devm_phy_create(dev, np, &qmp_usbc_usb_phy_ops); if (IS_ERR(qmp->usb_phy)) { ret = PTR_ERR(qmp->usb_phy); dev_err(dev, "failed to create PHY: %d\n", ret); - goto err_node_put; + goto err_pm_put; } phy_set_drvdata(qmp->usb_phy, qmp); @@ -1987,17 +1993,25 @@ static int qmp_usbc_probe(struct platform_device *pdev) if (IS_ERR(qmp->dp_phy)) { ret = PTR_ERR(qmp->dp_phy); dev_err(dev, "failed to create PHY: %d\n", ret); - goto err_node_put; + goto err_pm_put; } phy_set_drvdata(qmp->dp_phy, qmp); } + phy_provider = devm_of_phy_provider_register(dev, qmp_usbc_phy_xlate); + if (IS_ERR(phy_provider)) { + ret = PTR_ERR(phy_provider); + goto err_pm_put; + } + of_node_put(np); - phy_provider = devm_of_phy_provider_register(dev, qmp_usbc_phy_xlate); + pm_runtime_put(dev); - return PTR_ERR_OR_ZERO(phy_provider); + return 0; +err_pm_put: + pm_runtime_put_noidle(dev); err_node_put: of_node_put(np); return ret; From 9d44076c4fb0c78b1fd3342b85eeab8e52c5a0d8 Mon Sep 17 00:00:00 2001 From: Loic Poulain Date: Wed, 22 Jul 2026 15:45:16 +0200 Subject: [PATCH 3/7] phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pm_runtime_enable() and before pm_runtime_forbid(). In this case, a crash occurs because runtime suspend/resume dereferences qmp->phy pointer, which is not yet initialized: `if (!qmp->phy->init_count) {` This can also happen if user re-enables runtime-pm via the sysfs attribute before qmp phy is initialized. Similarly to other qcom phy drivers, introduce a qmp->phy_initialized variable that can be used to avoid relying on the possibly uninitialized phy pointer. Fixes: e464a3180a43 ("phy: qcom-qmp-usb: split off the legacy USB+dp_com support") Reviewed-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Signed-off-by: Loic Poulain --- drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c b/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c index 8bf951b0490cf..fc490589c8e48 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c @@ -542,6 +542,8 @@ struct qmp_usb { enum phy_mode mode; + bool phy_initialized; + struct phy *phy; struct clk_fixed_rate pipe_clk_fixed; @@ -895,6 +897,7 @@ static int qmp_usb_legacy_power_off(struct phy *phy) static int qmp_usb_legacy_enable(struct phy *phy) { + struct qmp_usb *qmp = phy_get_drvdata(phy); int ret; ret = qmp_usb_legacy_init(phy); @@ -904,14 +907,19 @@ static int qmp_usb_legacy_enable(struct phy *phy) ret = qmp_usb_legacy_power_on(phy); if (ret) qmp_usb_legacy_exit(phy); + else + qmp->phy_initialized = true; return ret; } static int qmp_usb_legacy_disable(struct phy *phy) { + struct qmp_usb *qmp = phy_get_drvdata(phy); int ret; + qmp->phy_initialized = false; + ret = qmp_usb_legacy_power_off(phy); if (ret) return ret; @@ -988,7 +996,7 @@ static int __maybe_unused qmp_usb_legacy_runtime_suspend(struct device *dev) dev_vdbg(dev, "Suspending QMP phy, mode:%d\n", qmp->mode); - if (!qmp->phy->init_count) { + if (!qmp->phy_initialized) { dev_vdbg(dev, "PHY not initialized, bailing out\n"); return 0; } @@ -1009,7 +1017,7 @@ static int __maybe_unused qmp_usb_legacy_runtime_resume(struct device *dev) dev_vdbg(dev, "Resuming QMP phy, mode:%d\n", qmp->mode); - if (!qmp->phy->init_count) { + if (!qmp->phy_initialized) { dev_vdbg(dev, "PHY not initialized, bailing out\n"); return 0; } From ae951ab1291dfb95070783c889794c3a2f761d84 Mon Sep 17 00:00:00 2001 From: Loic Poulain Date: Wed, 22 Jul 2026 15:45:17 +0200 Subject: [PATCH 4/7] phy: qcom: qmp-usb-legacy: Prevent unnecessary PM runtime suspend at boot Runtime PM has to be enabled before creating the PHY, since phy_create() only enables runtime PM on the PHY device if it is already enabled on this parent device. This opens a small window where the device can be runtime suspended after pm_runtime_enable() and before the later pm_runtime_forbid(), causing an unnecessary suspend/resume cycle while the PHY is not yet registered. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHY has been created to prevent the device from being runtime suspended during that window. This also makes the probe path safe independently of pm_runtime_forbid(), which is a good preparation for potentially dropping the forbid() call in the future and letting runtime PM be enabled by default. Reviewed-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Signed-off-by: Loic Poulain --- .../phy/qualcomm/phy-qcom-qmp-usb-legacy.c | 24 +++++++++++++++---- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c b/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c index fc490589c8e48..c5160cb892079 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c @@ -1285,10 +1285,16 @@ static int qmp_usb_legacy_probe(struct platform_device *pdev) if (ret) goto err_node_put; + /* + * Enable runtime PM before creating the PHY, phy_create() only enables + * it on the PHY device if already enabled on the parent. Hold a usage + * reference so callbacks cannot run before qmp->phy is assigned. + */ + pm_runtime_get_noresume(dev); pm_runtime_set_active(dev); ret = devm_pm_runtime_enable(dev); if (ret) - goto err_node_put; + goto err_pm_put; /* * Prevent runtime pm from being ON by default. Users can enable * it using power/control in sysfs. @@ -1297,23 +1303,31 @@ static int qmp_usb_legacy_probe(struct platform_device *pdev) ret = phy_pipe_clk_register(qmp, np); if (ret) - goto err_node_put; + goto err_pm_put; qmp->phy = devm_phy_create(dev, np, &qmp_usb_legacy_phy_ops); if (IS_ERR(qmp->phy)) { ret = PTR_ERR(qmp->phy); dev_err(dev, "failed to create PHY: %d\n", ret); - goto err_node_put; + goto err_pm_put; } phy_set_drvdata(qmp->phy, qmp); + phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate); + if (IS_ERR(phy_provider)) { + ret = PTR_ERR(phy_provider); + goto err_pm_put; + } + of_node_put(np); - phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate); + pm_runtime_put(dev); - return PTR_ERR_OR_ZERO(phy_provider); + return 0; +err_pm_put: + pm_runtime_put_noidle(dev); err_node_put: of_node_put(np); return ret; From 3b8a9a6613e72858c612d173df3702b896e5b55a Mon Sep 17 00:00:00 2001 From: Loic Poulain Date: Wed, 22 Jul 2026 15:45:18 +0200 Subject: [PATCH 5/7] phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Runtime PM must be enabled before creating the PHY, since phy_create() only enables runtime PM on the PHY device if it is already enabled on this parent device. However, the runtime PM callbacks dereference the hsphy instance, which is not yet ready, leaving a window where a suspend callback may trigger a NULL pointer dereference. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHY has been created, so that no runtime suspend can run before the PHY is ready. This also prevents a short window where an unnecessary runtime suspend can occur. Use the devres-managed version to ensure PM runtime is symmetrically disabled during driver removal for proper cleanup. Fixes: 0d75f508a9d5 ("phy: qcom-snps: Add runtime suspend and resume handlers") Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Signed-off-by: Loic Poulain --- drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 26 ++++++++++++++----- 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c index eb0b0f61d98e0..980ad1fb1e2e3 100644 --- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c @@ -599,8 +599,18 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev) return dev_err_probe(dev, ret, "failed to get regulator supplies\n"); + /* + * Enable runtime PM before creating the PHY, phy_create() only enables + * it on the PHY device if already enabled on the parent. Hold a usage + * reference so callbacks cannot run before the PHY is ready. + */ + pm_runtime_get_noresume(dev); pm_runtime_set_active(dev); - pm_runtime_enable(dev); + ret = devm_pm_runtime_enable(dev); + if (ret) { + pm_runtime_put_noidle(dev); + return ret; + } /* * Prevent runtime pm from being ON by default. Users can enable * it using power/control in sysfs. @@ -611,6 +621,7 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev) if (IS_ERR(generic_phy)) { ret = PTR_ERR(generic_phy); dev_err(dev, "failed to create phy, %d\n", ret); + pm_runtime_put_noidle(dev); return ret; } hsphy->phy = generic_phy; @@ -620,12 +631,15 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev) qcom_snps_hsphy_read_override_param_seq(dev); phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate); - if (!IS_ERR(phy_provider)) - dev_dbg(dev, "Registered Qcom-SNPS HS phy\n"); - else - pm_runtime_disable(dev); + if (IS_ERR(phy_provider)) { + pm_runtime_put_noidle(dev); + return PTR_ERR(phy_provider); + } - return PTR_ERR_OR_ZERO(phy_provider); + dev_dbg(dev, "Registered Qcom-SNPS HS phy\n"); + pm_runtime_put(dev); + + return 0; } static struct platform_driver qcom_snps_hsphy_driver = { From 96d5ee3b321e4ff567dac3e3f5a2c383bbd221de Mon Sep 17 00:00:00 2001 From: Loic Poulain Date: Wed, 22 Jul 2026 15:45:19 +0200 Subject: [PATCH 6/7] phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pm_runtime_enable() and before pm_runtime_forbid(). In this case, a crash occurs because runtime suspend/resume dereferences qmp->phy pointer, which is not yet initialized: `if (!qmp->phy->init_count) {` This can also happen if user re-enables runtime-pm via the sysfs attribute before qmp phy is initialized. Similarly to other qcom phy drivers, introduce a qmp->phy_initialized variable that can be used to avoid relying on the possibly uninitialized phy pointer. Fixes: e464a3180a43 ("phy: qcom-qmp-usb: split off the legacy USB+dp_com support") Signed-off-by: Loic Poulain --- drivers/phy/qualcomm/phy-qcom-qmp-usb.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c index c5507168e1354..bb905c437a01e 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c @@ -1434,6 +1434,8 @@ struct qmp_usb { enum phy_mode mode; + bool phy_initialized; + struct phy *phy; struct clk_fixed_rate pipe_clk_fixed; @@ -2009,6 +2011,7 @@ static int qmp_usb_power_off(struct phy *phy) static int qmp_usb_enable(struct phy *phy) { + struct qmp_usb *qmp = phy_get_drvdata(phy); int ret; ret = qmp_usb_init(phy); @@ -2018,14 +2021,19 @@ static int qmp_usb_enable(struct phy *phy) ret = qmp_usb_power_on(phy); if (ret) qmp_usb_exit(phy); + else + qmp->phy_initialized = true; return ret; } static int qmp_usb_disable(struct phy *phy) { + struct qmp_usb *qmp = phy_get_drvdata(phy); int ret; + qmp->phy_initialized = false; + ret = qmp_usb_power_off(phy); if (ret) return ret; @@ -2101,7 +2109,7 @@ static int __maybe_unused qmp_usb_runtime_suspend(struct device *dev) dev_vdbg(dev, "Suspending QMP phy, mode:%d\n", qmp->mode); - if (!qmp->phy->init_count) { + if (!qmp->phy_initialized) { dev_vdbg(dev, "PHY not initialized, bailing out\n"); return 0; } @@ -2121,7 +2129,7 @@ static int __maybe_unused qmp_usb_runtime_resume(struct device *dev) dev_vdbg(dev, "Resuming QMP phy, mode:%d\n", qmp->mode); - if (!qmp->phy->init_count) { + if (!qmp->phy_initialized) { dev_vdbg(dev, "PHY not initialized, bailing out\n"); return 0; } From f549ac95524169bef01e0a3233991f5d11c06eb8 Mon Sep 17 00:00:00 2001 From: Loic Poulain Date: Wed, 22 Jul 2026 15:45:20 +0200 Subject: [PATCH 7/7] phy: qcom: qmp-usb: Prevent unnecessary PM runtime suspend at boot Runtime PM has to be enabled before creating the PHY, since phy_create() only enables runtime PM on the PHY device if it is already enabled on this parent device. This opens a small window where the device can be runtime suspended after pm_runtime_enable() and before the later pm_runtime_forbid(), causing an unnecessary suspend/resume cycle while the PHY is not yet registered. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHY has been created to prevent the device from being runtime suspended during that window. This also makes the probe path safe independently of pm_runtime_forbid(), which is a good preparation for potentially dropping the forbid() call in the future and letting runtime PM be enabled by default. Signed-off-by: Loic Poulain --- drivers/phy/qualcomm/phy-qcom-qmp-usb.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c index bb905c437a01e..b0790bcf0bc86 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c @@ -2419,10 +2419,16 @@ static int qmp_usb_probe(struct platform_device *pdev) if (ret) goto err_node_put; + /* + * Enable runtime PM before creating the PHY, phy_create() only enables + * it on the PHY device if already enabled on the parent. Hold a usage + * reference so callbacks cannot run before qmp->phy is assigned. + */ + pm_runtime_get_noresume(dev); pm_runtime_set_active(dev); ret = devm_pm_runtime_enable(dev); if (ret) - goto err_node_put; + goto err_pm_put; /* * Prevent runtime pm from being ON by default. Users can enable * it using power/control in sysfs. @@ -2431,23 +2437,31 @@ static int qmp_usb_probe(struct platform_device *pdev) ret = phy_pipe_clk_register(qmp, np); if (ret) - goto err_node_put; + goto err_pm_put; qmp->phy = devm_phy_create(dev, np, &qmp_usb_phy_ops); if (IS_ERR(qmp->phy)) { ret = PTR_ERR(qmp->phy); dev_err(dev, "failed to create PHY: %d\n", ret); - goto err_node_put; + goto err_pm_put; } phy_set_drvdata(qmp->phy, qmp); + phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate); + if (IS_ERR(phy_provider)) { + ret = PTR_ERR(phy_provider); + goto err_pm_put; + } + of_node_put(np); - phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate); + pm_runtime_put(dev); - return PTR_ERR_OR_ZERO(phy_provider); + return 0; +err_pm_put: + pm_runtime_put_noidle(dev); err_node_put: of_node_put(np); return ret;