linux.git/drivers/phy/apple, branch v7.1-rc5

phy: apple: atc: Fix typec switch/mux leak on unbind

2026-05-14T15:47:54+00:00

atcphy_probe_switch() and atcphy_probe_mux() discard the pointers
returned by typec_switch_register() and typec_mux_register(). The
platform driver has no .remove callback, so when the driver unbinds
(e.g. via sysfs unbind) neither typec_switch_unregister() nor
typec_mux_unregister() is called. The framework reference taken in
typec_switch_register() (device_initialize() + device_add() in
drivers/usb/typec/mux.c) is therefore never dropped and the
typec_switch_dev / typec_mux_dev objects stay live forever, with
their sysfs entries under the typec_mux class also left behind. A
subsequent rebind cannot recreate them with the same fwnode-derived
name.

Save the registered handles and unregister them through
devm_add_action_or_reset() so framework registration is torn down
in step with the driver's other devm-managed state. While here,
drop struct apple_atcphy::sw and ::mux: they were declared with the
consumer-side types (typec_switch *, typec_mux *) instead of the
provider-side types and were never assigned.

Scope of the fix
================
This patch fixes the registration leak only. It does not close the
use-after-free window that arises when a consumer that obtained a
reference via fwnode_typec_switch_get() / fwnode_typec_mux_get()
outlives the provider unbind: such consumers keep the underlying
typec_switch_dev / typec_mux_dev alive past device_unregister(),
and a later typec_switch_set() / typec_mux_set() still invokes the
registered atcphy_sw_set() / atcphy_mux_set(), which dereferences
the freed apple_atcphy through typec_{switch,mux}_get_drvdata().

On Apple Silicon the relevant consumers are the typec port and the
cd321x controller registered by drivers/usb/typec/tipd/core.c.
Cable plug / orientation events and alt-mode transitions trigger
the .set callbacks via:

  tps6598x_interrupt()                 drivers/usb/typec/tipd/core.c
    tps6598x_handle_plug_event()
      tps6598x_connect()/_disconnect()
        typec_set_orientation()        drivers/usb/typec/class.c
          typec_switch_set(port->sw)   drivers/usb/typec/mux.c
            atcphy_sw_set()            drivers/phy/apple/atc.c

  cd321x_update_work()                 drivers/usb/typec/tipd/core.c
    cd321x_typec_update_mode()
      typec_mux_set(cd321x->mux)       drivers/usb/typec/mux.c
        atcphy_mux_set()               drivers/phy/apple/atc.c

Closing that window requires framework support for invalidating
consumer-held references on provider unbind. The same
consumer-survives-provider pattern has been discussed for the PHY
framework [1] and is out of scope here.

[1] https://lore.kernel.org/linux-phy/aZejMSJ9qqRWb2pX@google.com/

Fixes: 8e98ca1e74db ("phy: apple: Add Apple Type-C PHY")
Signed-off-by: David Carlier 
Reviewed-by: Vladimir Oltean 
Tested-by: Joshua Peisach 
Link: https://lkml.kernel.org/r/6ec1ed08328340db42655287afd5fa4067316b11.camel@perches.com
Link: https://patch.msgid.link/20260508201958.30060-1-devnexen@gmail.com
Signed-off-by: Vinod Koul

phy: apple: apple: Use local variable for ioremap return value

2026-02-27T15:02:39+00:00

The indirection through the resources array is unnecessarily complicated
and resuling in using IS_ERR() and PTR_ERR() on a valid address. A local
variable for the devm_ioremap_resource() return value is both easier to
read and matches expectations when reading code.

Reported-by: Dan Carpenter 
Closes: https://lore.kernel.org/asahi/aYXvX1bYOXtYCgfC@stanley.mountain/
Suggested-by: Vladimir Oltean 
Fixes: 8e98ca1e74db ("phy: apple: Add Apple Type-C PHY")
Signed-off-by: Janne Grunau 
Reviewed-by: Sven Peter 
Reviewed-by: Vladimir Oltean 
Link: https://patch.msgid.link/20260215-phy-apple-resource-err-ptr-v2-1-e43c22453682@jannau.net
Signed-off-by: Vinod Koul

phy: apple: atc: Make atcphy_dwc3_reset_ops variable static

2026-02-27T14:33:38+00:00

File-scope 'atcphy_dwc3_reset_ops' is not used outside of this unit, so
make it static to silence sparse warning:

  atc.c:2026:32: warning: symbol 'atcphy_dwc3_reset_ops' was not declared. Should it be static?

Signed-off-by: Krzysztof Kozlowski 
Reviewed-by: Janne Grunau 
Link: https://patch.msgid.link/20260216110413.159994-4-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Vinod Koul

phy: apple: atc: Reset USB2 PHY during probe as well

2026-01-14T14:15:07+00:00

Now that the upstream Type-C PHY code is getting broader test coverage we
got reports of USB devices plugged in during boot or those plugged in for
the first time after boot occasionally not working correctly.
This is partially caused by the USB2 parts of the PHY being left in an
unknown state by the previous boot stages. We reset all other parts during
probe but forgot about the USB2 PHY so let's fix that and actually reset
and power off the USB2 PHY as well.

Reported-by: James Calligeros 
Reported-by: Janne Grunau 
Fixes: 8e98ca1e74db ("phy: apple: Add Apple Type-C PHY")
Signed-off-by: Sven Peter 
Reviewed-by: Janne Grunau 
Tested-by: Janne Grunau 
Link: https://patch.msgid.link/20260108-atcphy-coldboot-fix-v1-1-01c41c6e84f2@kernel.org
Signed-off-by: Vinod Koul

phy: apple: atc: Actually check return value of devm_apple_tunable_parse

2026-01-14T14:12:53+00:00

Let's actually check the return value of devm_apple_tunable_parse
instead of trying to check IS_ERR on a pointer to the return value which
is always going to be valid. This prevent a oops when the tunables are
invalid or when they don't exist:

[   57.664567] Unable to handle kernel paging request at virtual address fffffffffffffffe
[   57.664584] Mem abort info:
[   57.664589]   ESR = 0x0000000096000007
[   57.664595]   EC = 0x25: DABT (current EL), IL = 32 bits
[   57.664602]   SET = 0, FnV = 0
[   57.664607]   EA = 0, S1PTW = 0
[   57.664611]   FSC = 0x07: level 3 translation fault
[   57.664617] Data abort info:
[   57.664621]   ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
[   57.664626]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[   57.664631]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[   57.664640] swapper pgtable: 16k pages, 47-bit VAs, pgdp=0000000b4391c000
[   57.664647] [fffffffffffffffe] pgd=0000000000000000, p4d=0000000000000000, pud=0000000b44188403, pmd=0000000b4418c403, pte=0000000000000000
[   57.664670] Internal error: Oops: 0000000096000007 [#1]  SMP
[   57.665047] CPU: 1 UID: 0 PID: 23 Comm: kworker/1:0 Tainted: G S                  6.18.2+ #2 PREEMPTLAZY
[   57.665061] Tainted: [S]=CPU_OUT_OF_SPEC
[   57.665066] Hardware name: Apple Mac mini (M1, 2020) (DT)
[   57.665072] Workqueue: events cd321x_update_work [tps6598x]
[   57.665100] pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[   57.665111] pc : apple_tunable_apply+0x8/0x80 [apple_tunable]
[   57.665121] lr : atcphy_mux_set+0x3e0/0x1138 [phy_apple_atc]
[   57.665133] sp : ffffc000802a7c00
[   57.665138] x29: ffffc000802a7c00 x28: 0000000000000003 x27: ffff800016c84080
[   57.665151] x26: 0000000000000002 x25: ffff800016c84090 x24: ffff800016c8408f
[   57.665163] x23: 0000000000020004 x22: 0000000000000001 x21: 0000000000000006
[   57.665175] x20: ffff80000d6da9b0 x19: ffff80000d6da880 x18: 0000000000000002
[   57.665188] x17: 0000000000000000 x16: ffffe22de59e0e38 x15: 0000000000000002
[   57.665199] x14: ffffe22de76ecff8 x13: 0000000000000001 x12: ffff9dd5f90bc000
[   57.665211] x11: 00000000000000c0 x10: 048abc15ceba0919 x9 : ffffe22dbc5fde10
[   57.665223] x8 : ffff80000175e0d8 x7 : 0000000000000004 x6 : 0000000000000000
[   57.665234] x5 : 0000000000000001 x4 : 0000000d6d132db7 x3 : 00000000000155db
[   57.665246] x2 : 0000000000000000 x1 : fffffffffffffffe x0 : ffffc00082b80000
[   57.665258] Call trace:
[   57.665265]  apple_tunable_apply+0x8/0x80 [apple_tunable] (P)
[   57.665276]  typec_mux_set+0x74/0xe0 [typec]
[   57.665315]  cd321x_update_work+0x440/0x8c0 [tps6598x]
[   57.665332]  process_one_work+0x178/0x3d0
[   57.665346]  worker_thread+0x260/0x390
[   57.665354]  kthread+0x150/0x250
[   57.665369]  ret_from_fork+0x10/0x20
[   57.665386] Code: e69a0ae8 ffffe22d aa1e03e9 d503201f (f9400022)
[   57.665394] ---[ end trace 0000000000000000 ]---

Reported-by: Thomas Glanzmann 
Fixes: 8e98ca1e74db ("phy: apple: Add Apple Type-C PHY")
Signed-off-by: Sven Peter 
Reviewed-by: Neil Armstrong 
Link: https://patch.msgid.link/20260104-atcphy-tunable-fix-v2-1-84e5c2a57aaa@kernel.org
Signed-off-by: Vinod Koul

phy: apple: Add Apple Type-C PHY

2025-12-23T17:41:05+00:00

The Apple Type-C PHY (ATCPHY) is a PHY for USB 2.0, USB 3.x,
USB4/Thunderbolt, and DisplayPort connectivity found in Apple Silicon SoCs.
The PHY handles muxing between these different protocols and also provides
the reset controller for the attached dwc3 USB controller.

There is no documentation available for this PHY and the entire sequence
of MMIO pokes has been figured out by tracing all MMIO access of Apple's
driver under a thin hypervisor and correlating the register reads/writes
to their kernel's debug output to find their names. Deviations from this
sequence generally results in the port not working or, especially when
the mode is switched to USB4 or Thunderbolt, to some watchdog resetting
the entire SoC.

This initial commit already introduces support for Display Port and
USB4/Thunderbolt but the drivers for these are not ready. We cannot
control the alternate mode negotiation and are stuck with whatever Apple's
firmware decides such that any DisplayPort or USB4/Thunderbolt device will
result in a correctly setup PHY but not be usable until the other drivers
are upstreamed as well.

Co-developed-by: Janne Grunau 
Signed-off-by: Janne Grunau 
Co-developed-by: Hector Martin 
Signed-off-by: Hector Martin 
Reviewed-by: Philipp Zabel  # for reset controller
Reviewed-by: Neal Gompa 
Signed-off-by: Sven Peter 
Link: https://patch.msgid.link/20251214-b4-atcphy-v3-3-ba82b20e9459@kernel.org
Signed-off-by: Vinod Koul