Skip to contentSkip to conversation

Update designware pwm driver

PATCH Superseded [email protected] 2 participants 6 messages Jul 1 – Jul 2

Subsystems (2)

v9 of 14 Superseded Latest is v14 →

lore
Share & tools
lore
#0 lore raw

v9 cover Update designware pwm driver

From: Xuyang Dong <[email protected]>

There is already a patch [1] for the DesignWare PWM driver, which is posted by Ben and still under review. Based on this patch, this series is a continuation of [1] to add support for IP versions 2.11a and later, which includes support for "Pulse Width Modulation with 0% and 100% Duty Cycle".

Supported chips:
ESWIN EIC7700 series SoC.

Test:
Tested this patch on the Sifive HiFive Premier P550 (which uses the EIC7700 SoC).

[1] https://lore.kernel.org/lkml/[email protected]/

Updates:
Changes in v9:
- YAML:
- Add 'Acked-by: Conor Dooley <[email protected]>' for patch 1 and 2.
- Driver:
- __dwc_pwm_configure_timer():
reads state->polarity and swaps registers:
NORMAL (active-high): duty_cycle to DWC_TIM_LD_CNT2 (HIGH), remainder to DWC_TIM_LD_CNT (LOW)
INVERSED (active-low): duty_cycle to DWC_TIM_LD_CNT (LOW), remainder to DWC_TIM_LD_CNT2 (HIGH)
Applies to both 0N100 and classic paths.
dwc_pwm_apply():
removed -EINVAL polarity guard; both polarities accepted. dwc_pwm_get_state():
reconstructs polarity from pwm->state.polarity (last apply() value); initial read zero-initialized to PWM_POLARITY_NORMAL; decode mirrors apply() swap logic for consistent round-trip.
Update this in the commit message (Sashiko review of v8).
- Replace pm_runtime_get_sync() with pm_runtime_resume_and_get() in dwc_pwm_apply() and add error checking (Sashiko review of v8).
- Add a non-zero check for clk_rate in dwc_pwm_get_state(). Add a non-zero check for dwc->clk_rate in probe (Sashiko review of v8).
- When pwm_en is true, adding 'goto disable_clk;'. When pwm_en is false, return early from pm_disable without falling through to disable_clk. (Sashiko review of v8).
- Replace pm_runtime_get_sync() with pm_runtime_resume_and_get() in dwc_pwm_plat_remove() and add error checking.
On failure, skip register reads and pm_runtime_put_sync() (Sashiko review of v8).
- Remove the -EBUSY check in dwc_pwm_suspend() and save all contexts (Sashiko review of v8).
- Replace pm_runtime_get_sync() with pm_runtime_resume_and_get() in dwc_pwm_resume() (Sashiko review of v8).

- Link to v8: https://lore.kernel.org/all/[email protected]/

Changes in v8:
- YAML:
- Split the v7 binding into two patches.
Patch 1 explains why to add the resets property.
Patch 2 adds the eswin compatible string and specified reset.
- Driver:
- Use mul_u64_u64_div_u64() to safely scale the values and avoid 64-bit multiplication overflow in __dwc_pwm_configure_timer() and dwc_pwm_get_state().
Add the include for linux/math64.h (Sashiko review of v7).
- Keep the current usage of pwm->args.polarity until a better solution is available.
- Use pm_runtime_resume_and_get() in dwc_pwm_get_state() instead of pm_runtime_get_sync(), so that register access is skipped if the device fails to resume (Sashiko review of v7).
- Replace devm_pwmchip_add() with pwmchip_add() and move it after pm_runtime_enable(), so that the PWM chip is registered only after runtime PM has been fully initialized (Sashiko review of v7).
- Remove the reset_assert label and reset_control_assert() (Sashiko review of v7).
- Remove the pm_runtime_status_suspended() check and unconditionally use pm_runtime_get_sync() instead (Sashiko review of v7).
- Remove the pwm_en flag, but keep the pm_runtime_put_noidle() call (Sashiko review of v7; see email for explanation)
- Use pm_runtime_status_suspended() to check the runtime PM status. If the device is not suspended (i.e., active), call clk_disable_unprepare(). If it is suspended, skip this block (Sashiko review of v7).
- Use an explicit pwmchip_remove() as the first step of .remove(), instead of relying on devm_pwmchip_add() to unregister the chip after .remove() returns. This prevents the hardware teardown that follows from racing against a still-registered chip (Sashiko review of v7).
- Add a check for dwc->rst before asserting reset in the remove path (Sashiko review of v7).
- Drop the return value check from pm_runtime_put_sync() (Sashiko review of v7).

- Link to v7: https://lore.kernel.org/all/[email protected]/

Changes in v7:
- YAML:
- Dropped Conor's Acked-by due to significant schema changes.
- Rename patch 1 from "dt-bindings: pwm: dwc: add optional reset" to "dt-bindings: pwm: dwc: Add eswin compatible and resets property".
- Update the commit message to explain why the EIC7700 supports only one reset.
- Add constraints 'minItems: 1' and 'maxItems: 1' for the 'resets' property of eswin,eic7700-pwm.
- Add an example for eswin,eic7700-pwm.

- Link to v6: https://lore.kernel.org/all/[email protected]/

Changes in v6:
- YAML:
- Drop properties resets and its items description for eswin,eic7700-pwm.

- Link to v5: https://lore.kernel.org/all/[email protected]/

Changes in v5:
- YAML:
- Add 'eswin,eic7700-pwm' compatible string.
- Add the items description for the resets property and set minItems to 1.
- Require resets property with exactly 1 reset for eswin,eic7700-pwm compatible.
- Driver:
- Add support for 'eswin,eic7700-pwm' compatible.
- Add structure dwc_pwm_plat_data to manage the API for obtaining resets.

- Link to v4: https://lore.kernel.org/all/[email protected]/

Changes in v4:
- YAML:
- Change maxItems from 1 to 2. As there is a corresponding reset signal for each clock domain, the effective maxItems of the resets property is set to 2.
- Update the YAML commit message to describe the hardware.
- Driver:
- Replace devm_reset_control_get_optional_exclusive() with devm_reset_control_array_get_optional_exclusive(). Since the number of reset signals has increased from one to two, we need to use the array API to acquire them.

- Link to v3: https://lore.kernel.org/all/[email protected]/

Changes in v3:
- YAML:
- Added a clear justification for the optional resets property. It is required to support proper controller initialization when no PWM channel is active at boot time, while allowing the driver to skip reset deassertion if any channel is already enabled.
- Driver:
- Update the boundary value check of tmp in __dwc_pwm_configure_timer() for DWC_TIM_CTRL_0N100PWM_EN.
- Replace 'sizeof(struct dwc_pwm_drvdata)' with 'struct_size(data, chips, 1)'.
- Drop devm_clk_get_enabled() in favor of devm_clk_get() with explicit clk_prepare_enable() and clk_disable_unprepare() allowing runtime PM to manage clock state.
- Replace devm_reset_control_get_optional_exclusive_deasserted() with devm_reset_control_get_optional_exclusive() and issue a full reset via reset_control_reset() only when no PWM channel is active at probe time.
- Detect bootloader-enabled PWM channels by reading the enable bit, and initialize runtime PM as active for those channels by calling pm_runtime_set_active() and pm_runtime_get_noresume().
- Remove autosuspend as it is not required for this driver.
- Use explicit pm_runtime_enable() and pm_runtime_disable() instead of the managed devm_pm_runtime_enable() variant to ensure correct cleanup.
- On device removal, recheck the channel enable status. If any channel remains active, call pm_runtime_put_noidle() before disabling clocks via clk_disable_unprepare().
Resume device before register access during removal if it is runtime suspended, and re-suspend it afterward.
- If device is suspended, resume it before register access during system resume/suspend.
- Use pm_ptr() instead of pm_sleep_ptr() for correct PM operation.

- Link to v2: https://lore.kernel.org/all/[email protected]/

Changes in v2:
- YAML:
- Remove eswin,eic7700-pwm.yaml. Use snps,dw-apb-timers-pwm2.yaml. The description in snps,dw-apb-timers-pwm2.yaml is better.
- Add the resets property as optional, as defined in the databook.
- Remove snps,pwm-full-range-enable as no additional property is needed.
- Driver:
- Change the file from pwm-dwc-eic7700.c to pwm-dwc-of.c from [1].
- Define DWC_TIM_VERSION_ID_2_11A 2.11a as the baseline version.
- Enable the 0% and 100% duty cycle mode by setting dwc->feature if the version read from the TIMERS_COMP_VERSION register is later than or equal to DWC_TIM_VERSION_ID_2_11A.
- Use the DIV_ROUND_UP_ULL() to calculate width in the .apply and .get_state.
- Additionally, Power Management (PM) support has been added to the pwm-dwc-of.c driver.
- Drop the headers that are not used.
- Use devm_clk_get_enabled() instead of devm_clk_get().
- Drop of_match_ptr.
- Fix build error with 1ULL << 32.

- Link to v1: https://lore.kernel.org/all/[email protected]/
- Link to v9: https://lore.kernel.org/lkml/[email protected]/

Xuyang Dong (3):
dt-bindings: pwm: dwc: Document optional resets property
dt-bindings: pwm: dwc: Add eswin compatible
pwm: dwc: add of/platform support

 .../bindings/pwm/snps,dw-apb-timers-pwm2.yaml |  37 +-
 drivers/pwm/Kconfig                           |  10 +
 drivers/pwm/Makefile                          |   1 +
 drivers/pwm/pwm-dwc-core.c                    | 161 ++++++--
 drivers/pwm/pwm-dwc-of.c                      | 356 ++++++++++++++++++
 drivers/pwm/pwm-dwc.h                         |  25 +-
 6 files changed, 548 insertions(+), 42 deletions(-)
 create mode 100644 drivers/pwm/pwm-dwc-of.c

--
2.34.1

#1 lore raw

PATCH v9 1/3 dt-bindings: pwm: dwc: Document optional resets property

From: Xuyang Dong <[email protected]>

The DesignWare PWM IP has two active-low reset inputs: presetn resets the register interface logic in the pclk (bus) domain, and timer_N_resetn resets the counter/timer logic in the timer_N_clk domain. The existing snps,dw-apb-timers-pwm2 binding does not describe either of these lines.

Add the resets property and describe the function of each reset to support future use of resets.

---
 .../devicetree/bindings/pwm/snps,dw-apb-timers-pwm2.yaml     | 5 +++++
 1 file changed, 5 insertions(+)
Documentation/devicetree/bindings/pwm/snps,dw-apb-timers-pwm2.yaml +5 -0
index 7523a89a1773..213fdaef25d9 100644
@@ -43,6 +43,11 @@ properties:
       - const: bus
       - const: timer
 
+  resets:
+    items:
+      - description: Interface bus (presetn) reset
+      - description: PWM timer logic (timer_N_resetn) reset
+
   snps,pwm-number:
     $ref: /schemas/types.yaml#/definitions/uint32
     description: The number of PWM channels configured for this instance
Signature · 1 line
2.34.1
#2 lore raw

PATCH v9 2/3 dt-bindings: pwm: dwc: Add eswin compatible

In reply to [email protected]

From: Xuyang Dong <[email protected]>

EIC7700 integrates the DesignWare PWM IP described by the generic snps,dw-apb-timers-pwm2 binding. On this SoC, the presetn and timer_N_resetn inputs are physically tied together to a single reset line, so exactly one reset is both required and sufficient, unlike the generic binding where up to two independent lines are optional.

Add the eswin,eic7700-pwm compatible string and constrain its resets property to exactly one entry.

---
 .../bindings/pwm/snps,dw-apb-timers-pwm2.yaml | 32 ++++++++++++++++---
 1 file changed, 28 insertions(+), 4 deletions(-)
Documentation/devicetree/bindings/pwm/snps,dw-apb-timers-pwm2.yaml +28 -4
index 213fdaef25d9..9a9a24ddc61b 100644
@@ -20,12 +20,11 @@ description:
   instead of having to encode the IP version number in the device tree
   compatible.
 
-allOf:
-  - $ref: pwm.yaml#
-
 properties:
   compatible:
-    const: snps,dw-apb-timers-pwm2
+    enum:
+      - snps,dw-apb-timers-pwm2
+      - eswin,eic7700-pwm
 
   reg:
     maxItems: 1
@@ -44,6 +43,7 @@ properties:
       - const: timer
 
   resets:
+    minItems: 1
     items:
       - description: Interface bus (presetn) reset
       - description: PWM timer logic (timer_N_resetn) reset
@@ -59,6 +59,21 @@ required:
   - clocks
   - clock-names
 
+allOf:
+  - $ref: pwm.yaml#
+
+  - if:
+      properties:
+        compatible:
+          contains:
+            const: eswin,eic7700-pwm
+    then:
+      properties:
+        resets:
+          maxItems: 1
+      required:
+        - resets
+
 additionalProperties: false
 
 examples:
@@ -70,3 +85,12 @@ examples:
       clocks = <&bus>, <&timer>;
       clock-names = "bus", "timer";
     };
+  - |
+    pwm@50818000 {
+      compatible = "eswin,eic7700-pwm";
+      reg = <0x50818000 0x4000>;
+      #pwm-cells = <3>;
+      clocks = <&bus>, <&timer>;
+      clock-names = "bus", "timer";
+      resets = <&reset>;
+    };
Signature · 1 line
2.34.1
#3 lore raw

PATCH v9 3/3 pwm: dwc: add of/platform support

In reply to [email protected]

From: Xuyang Dong <[email protected]>

The dwc pwm controller can be used in non-PCI systems, so allow either platform or OF based probing.

The controller is reset only when no PWM channel is enabled. Otherwise, clocks are enabled and the runtime PM state is updated to reflect the active hardware configuration.

The DWC PWM controller does not provide a hardware polarity bit. Currently, the driver only supports active-low output, which is incompatible with devices requiring active-high waveforms (e.g., backlight controllers, fan speed regulators).

Implement polarity control by exploiting the timer's dual load registers. The hardware uses:
- LD_CNT: LOW period count
- LD_CNT2: HIGH period count

The total period is defined as (LD_CNT + LD_CNT2). By swapping the duty cycle between these registers, we invert the polarity while keeping the period unchanged:
- PWM_POLARITY_NORMAL: write duty_cycle to LD_CNT2 (HIGH period)
- PWM_POLARITY_INVERSED: write duty_cycle to LD_CNT (LOW period)

Implementation:
Update both apply() and get_state() to handle state->polarity consistently. Since the hardware does not store polarity, get_state() returns the last successfully applied software state, ensuring that read-back matches what was originally set.

---
 drivers/pwm/Kconfig        |  10 ++
 drivers/pwm/Makefile       |   1 +
 drivers/pwm/pwm-dwc-core.c | 161 +++++++++++++----
 drivers/pwm/pwm-dwc-of.c   | 356 +++++++++++++++++++++++++++++++++++++
 drivers/pwm/pwm-dwc.h      |  25 ++-
 5 files changed, 515 insertions(+), 38 deletions(-)
 create mode 100644 drivers/pwm/pwm-dwc-of.c
drivers/pwm/Kconfig +10 -0
index e8886a9b64d9..fd1d68beab67 100644
@@ -249,6 +249,16 @@ config PWM_DWC
 	  To compile this driver as a module, choose M here: the module
 	  will be called pwm-dwc.
 
+config PWM_DWC_OF
+	tristate "DesignWare PWM Controller (OF bus)"
+	depends on HAS_IOMEM && (OF || COMPILE_TEST)
+	select PWM_DWC_CORE
+	help
+	  PWM driver for Synopsys DWC PWM Controller on an OF bus or
+	  a platform bus.
+	  To compile this driver as a module, choose M here: the module
+	  will be called pwm-dwc-of.
+
 config PWM_EP93XX
 	tristate "Cirrus Logic EP93xx PWM support"
 	depends on ARCH_EP93XX || COMPILE_TEST
drivers/pwm/Makefile +1 -0
index 5630a521a7cf..acd7dfe98dff 100644
@@ -20,6 +20,7 @@ obj-$(CONFIG_PWM_CRC)		+= pwm-crc.o
 obj-$(CONFIG_PWM_CROS_EC)	+= pwm-cros-ec.o
 obj-$(CONFIG_PWM_DWC_CORE)	+= pwm-dwc-core.o
 obj-$(CONFIG_PWM_DWC)		+= pwm-dwc.o
+obj-$(CONFIG_PWM_DWC_OF)	+= pwm-dwc-of.o
 obj-$(CONFIG_PWM_EP93XX)	+= pwm-ep93xx.o
 obj-$(CONFIG_PWM_FSL_FTM)	+= pwm-fsl-ftm.o
 obj-$(CONFIG_PWM_GPIO)		+= pwm-gpio.o
drivers/pwm/pwm-dwc-core.c +130 -31

224 lines not on this page · raw message

drivers/pwm/pwm-dwc-of.c new file +356 -0

356 lines not on this page · raw message

drivers/pwm/pwm-dwc.h +18 -7
index 1562594e7f85..75f7c2d031c4 100644
@@ -26,12 +26,19 @@ MODULE_IMPORT_NS("dwc_pwm");
 #define DWC_TIMERS_TOTAL	8
 
 /* Timer Control Register */
-#define DWC_TIM_CTRL_EN		BIT(0)
-#define DWC_TIM_CTRL_MODE	BIT(1)
-#define DWC_TIM_CTRL_MODE_FREE	(0 << 1)
-#define DWC_TIM_CTRL_MODE_USER	(1 << 1)
-#define DWC_TIM_CTRL_INT_MASK	BIT(2)
-#define DWC_TIM_CTRL_PWM	BIT(3)
+#define DWC_TIM_CTRL_EN			BIT(0)
+#define DWC_TIM_CTRL_MODE		BIT(1)
+#define DWC_TIM_CTRL_MODE_FREE		(0 << 1)
+#define DWC_TIM_CTRL_MODE_USER		BIT(1)
+#define DWC_TIM_CTRL_INT_MASK		BIT(2)
+#define DWC_TIM_CTRL_PWM		BIT(3)
+#define DWC_TIM_CTRL_0N100PWM_EN	BIT(4)
+
+/*
+ * The version 2.11a and later add "Pulse Width Modulation with
+ * 0% and 100% Duty Cycle".
+ */
+#define DWC_TIM_VERSION_ID_2_11A	0x3231312a
 
 struct dwc_pwm_info {
 	unsigned int nr;
@@ -52,8 +59,12 @@ struct dwc_pwm_ctx {
 
 struct dwc_pwm {
 	void __iomem *base;
-	unsigned int clk_ns;
+	struct clk *bus_clk;
+	struct clk *clk;
+	unsigned long clk_rate;
+	struct reset_control *rst;
 	struct dwc_pwm_ctx ctx[DWC_TIMERS_TOTAL];
+	u32 features;
 };
 
 static inline struct dwc_pwm *to_dwc_pwm(struct pwm_chip *chip)
Signature · 1 line
2.34.1
#4 lore raw

Re: [PATCH v9 3/3] pwm: dwc: add of/platform support

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider: - [High] Missing CONFIG_PM dependency leads to unclocked MMIO accesses and kernel panics. - [High]…

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [High] Missing CONFIG_PM dependency leads to unclocked MMIO accesses and kernel panics.
- [High] Bypassing the PM framework during system suspend causes bus faults on devices attached to a PM domain.
- [High] Reading MMIO registers while the device is in reset causes a bus stall and kernel panic.
- [Medium] Data race on the shared dwc->clk_rate variable.
--

commit f417f1c0148d8abb6dc7081bbc13d8a85dcc173e
Author: Xuyang Dong <[email protected]>

pwm: dwc: add of/platform support

This patch adds platform and OF device tree support for the DesignWare PWM controller. It introduces runtime PM support, manages clock enabling and disabling based on PWM channel usage, and implements polarity control by swapping load count registers.

Quoted 4 lines
drivers/pwm/Kconfig +0 -0
@@ -249,6 +249,16 @@ config PWM_DWC

[ ... ]

drivers/pwm/Kconfig config PWM_DWC · line 254

Quoted 3 lines
drivers/pwm/Kconfig +3 -0
+config PWM_DWC_OF
+	tristate "DesignWare PWM Controller (OF bus)"
+	depends on HAS_IOMEM && (OF || COMPILE_TEST)

[Severity: High]
Should this include a dependency on PM?

If the kernel is compiled without CONFIG_PM, Kconfig allows building PWM_DWC_OF. During probe(), if no PWMs are enabled, the driver explicitly disables dwc->clk and dwc->bus_clk and relies on PM runtime to re-enable them. Because CONFIG_PM is disabled, pm_runtime_resume_and_get() evaluates to a stub that returns 1 (success) without calling the runtime resume callback. This leads to unclocked register accesses and kernel panics.

Quoted 4 lines
drivers/pwm/pwm-dwc-core.c +0 -0
@@ -44,21 +46,73 @@ static int __dwc_pwm_configure_timer(struct dwc_pwm *dwc,

[ ... ]

drivers/pwm/pwm-dwc-core.c static int __dwc_pwm_configure_timer(struct dwc_pwm *dwc, · line 50

Quoted 3 lines
drivers/pwm/pwm-dwc-core.c +2 -1
-	high = tmp - 1;
+	if (dwc->clk)
+		dwc->clk_rate = clk_get_rate(dwc->clk);

[Severity: Medium]
Can this write to dwc->clk_rate cause a data race?

The PWM framework serializes operations on a per-channel basis, but not across the entire controller. If multiple threads concurrently request state changes (apply) or state reads (get_state) on different PWM channels of the same controller, they might simultaneously write to this shared variable.

Quoted 1 line
drivers/pwm/pwm-dwc-core.c +0 -0
@@ -121,10 +183,23 @@ static int dwc_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm,

[ ... ]

drivers/pwm/pwm-dwc-core.c

Quoted 2 lines
drivers/pwm/pwm-dwc-core.c +2 -0
+	if (dwc->clk)
+		dwc->clk_rate = clk_get_rate(dwc->clk);

[Severity: Medium]
Does this introduce a similar data race on dwc->clk_rate as the one mentioned above in __dwc_pwm_configure_timer()?

Quoted 4 lines
drivers/pwm/pwm-dwc-of.c new file +0 -0
@@ -0,0 +1,356 @@

[ ... ]

Quoted 2 lines
drivers/pwm/pwm-dwc-of.c new file +2 -0
+static int dwc_pwm_plat_probe(struct platform_device *pdev)
+{

[ ... ]

Quoted 13 lines
drivers/pwm/pwm-dwc-of.c new file +13 -0
+	ret = clk_prepare_enable(dwc->clk);
+	if (ret) {
+		dev_err(dev, "failed to enable timer clock\n");
+		goto disable_busclk;
+	}
+
+	/*
+	 * Check all channels to see if any channel is enabled.
+	 * Read the control register of each channel and extract the enable bit
+	 */
+	for (i = 0; i < chip->npwm; i++) {
+		ctrl[i] = dwc_pwm_readl(dwc, DWC_TIM_CTRL(i)) & DWC_TIM_CTRL_EN;
+		if (ctrl[i])

drivers/pwm/pwm-dwc-of.c line 115

Quoted 10 lines
drivers/pwm/pwm-dwc-of.c new file +10 -0
+			pwm_en = true;
+	}
+
+	/*
+	 * Only issue a reset pulse when all channels are disabled, so a PWM
+	 * channel already running (e.g. configured by firmware before Linux
+	 * took over) is left undisturbed.
+	 */
+	if (!pwm_en) {
+		ret = reset_control_reset(dwc->rst);

[Severity: High]
Could this read from DWC_TIM_CTRL(i) cause a bus stall and kernel panic if the device is currently in reset?

Module removal explicitly asserts the reset line in dwc_pwm_plat_remove(), leaving the device in reset. On a subsequent probe (e.g., reloading the module), this loop attempts to read from the MMIO space before the reset is deasserted.

[ ... ]

drivers/pwm/pwm-dwc-of.c line 148

Quoted 10 lines
drivers/pwm/pwm-dwc-of.c new file +10 -0
+	if (pwm_en) {
+		pm_runtime_set_active(dev);
+		for (i = 0; i < chip->npwm; i++) {
+			if (ctrl[i])
+				pm_runtime_get_noresume(dev);
+		}
+	} else {
+		clk_disable_unprepare(dwc->clk);
+		clk_disable_unprepare(dwc->bus_clk);
+	}

[Severity: High]
If CONFIG_PM is disabled in the kernel, does gating these clocks here cause subsequent unclocked register accesses?

Since pm_runtime_resume_and_get() becomes a stub that returns 1 without re-enabling clocks, subsequent operations like apply() or get_state() would perform unclocked MMIO accesses leading to panics.

[ ... ]

Quoted 2 lines
drivers/pwm/pwm-dwc-of.c new file +2 -0
+static void dwc_pwm_plat_remove(struct platform_device *pdev)
+{

[ ... ]

drivers/pwm/pwm-dwc-of.c line 205

Quoted 4 lines
drivers/pwm/pwm-dwc-of.c new file +4 -0
+	if (!pm_runtime_status_suspended(&pdev->dev)) {
+		clk_disable_unprepare(dwc->clk);
+		clk_disable_unprepare(dwc->bus_clk);
+	}

[Severity: High]
If CONFIG_PM is disabled, pm_runtime_status_suspended() will always return false. Does this cause a double-disable of the clocks if they were already gated in probe?

[ ... ]

Quoted 6 lines
drivers/pwm/pwm-dwc-of.c new file +6 -0
+static int dwc_pwm_suspend(struct device *dev)
+{
+	struct dwc_pwm_drvdata *data = dev_get_drvdata(dev);
+	struct pwm_chip *chip = data->chips[0];
+	struct dwc_pwm *dwc = to_dwc_pwm(chip);
+	unsigned int idx;

drivers/pwm/pwm-dwc-of.c line 266

Quoted 10 lines
drivers/pwm/pwm-dwc-of.c new file +10 -0
+	int ret;
+
+	if (pm_runtime_status_suspended(dev)) {
+		ret = dwc_pwm_runtime_resume(dev);
+		if (ret)
+			return ret;
+	}
+
+	for (idx = 0; idx < chip->npwm; idx++) {
+		dwc->ctx[idx].cnt = dwc_pwm_readl(dwc, DWC_TIM_LD_CNT(idx));

[Severity: High]
Does calling the local dwc_pwm_runtime_resume() directly bypass the PM framework?

If the device is attached to a generic power domain (genpd) and is runtime-suspended, the PM domain itself might be powered off. Bypassing pm_runtime_resume_and_get() means the PM domain is never powered back on, and the subsequent dwc_pwm_readl() calls will access unpowered hardware causing a bus fault.

Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=3
#5 lore raw

Re: Re: [PATCH v9 3/3] pwm: dwc: add of/platform support

Quoted 30 lines

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [High] Missing CONFIG_PM dependency leads to unclocked MMIO accesses and kernel panics.
- [High] Bypassing the PM framework during system suspend causes bus faults on devices attached to a PM domain.
- [High] Reading MMIO registers while the device is in reset causes a bus stall and kernel panic.
- [Medium] Data race on the shared dwc->clk_rate variable.
--

commit f417f1c0148d8abb6dc7081bbc13d8a85dcc173e
Author: Xuyang Dong <[email protected]>

pwm: dwc: add of/platform support

This patch adds platform and OF device tree support for the DesignWare PWM controller. It introduces runtime PM support, manages clock enabling and disabling based on PWM channel usage, and implements polarity control by swapping load count registers.

Quoted 4 lines
drivers/pwm/Kconfig +0 -0
@@ -249,6 +249,16 @@ config PWM_DWC

[ ... ]

drivers/pwm/Kconfig config PWM_DWC · line 254

Quoted 3 lines
drivers/pwm/Kconfig +3 -0
+config PWM_DWC_OF
+	tristate "DesignWare PWM Controller (OF bus)"
+	depends on HAS_IOMEM && (OF || COMPILE_TEST)

[Severity: High]
Should this include a dependency on PM?

Quoted 7 lines

If the kernel is compiled without CONFIG_PM, Kconfig allows building PWM_DWC_OF. During probe(), if no PWMs are enabled, the driver explicitly disables dwc->clk and dwc->bus_clk and relies on PM runtime to re-enable them. Because CONFIG_PM is disabled, pm_runtime_resume_and_get() evaluates to a stub that returns 1 (success) without calling the runtime resume callback. This leads to unclocked register accesses and kernel panics.

Hi Sashiko,

Do not add a dependency on PM. Additionally, the issues below will be fixed to ensure compatibility with and without PM support.

Quoted 12 lines
Quoted 4 lines
drivers/pwm/pwm-dwc-core.c +0 -0
@@ -44,21 +46,73 @@ static int __dwc_pwm_configure_timer(struct dwc_pwm *dwc,

[ ... ]

drivers/pwm/pwm-dwc-core.c static int __dwc_pwm_configure_timer(struct dwc_pwm *dwc, · line 50

Quoted 3 lines
drivers/pwm/pwm-dwc-core.c +2 -1
-	high = tmp - 1;
+	if (dwc->clk)
+		dwc->clk_rate = clk_get_rate(dwc->clk);

[Severity: Medium]
Can this write to dwc->clk_rate cause a data race?

Quoted 5 lines

The PWM framework serializes operations on a per-channel basis, but not across the entire controller. If multiple threads concurrently request state changes (apply) or state reads (get_state) on different PWM channels of the same controller, they might simultaneously write to this shared variable.

The PWM core's chip->nonatomic_lock (per-chip mutex) serializes all apply() and get_state() calls across all channels on the same chip. The apparent write to dwc->clk_rate in both __dwc_pwm_configure_timer() and dwc_pwm_get_state() cannot race because both code paths are reached only under this lock.
No locking concerns.

Quoted 9 lines
Quoted 1 line
drivers/pwm/pwm-dwc-core.c +0 -0
@@ -121,10 +183,23 @@ static int dwc_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm,

[ ... ]

drivers/pwm/pwm-dwc-core.c

Quoted 2 lines
drivers/pwm/pwm-dwc-core.c +2 -0
+	if (dwc->clk)
+		dwc->clk_rate = clk_get_rate(dwc->clk);

[Severity: Medium]
Does this introduce a similar data race on dwc->clk_rate as the one mentioned above in __dwc_pwm_configure_timer()?

It is the same as above.

Quoted 36 lines
Quoted 4 lines
drivers/pwm/pwm-dwc-of.c new file +0 -0
@@ -0,0 +1,356 @@

[ ... ]

Quoted 2 lines
drivers/pwm/pwm-dwc-of.c new file +2 -0
+static int dwc_pwm_plat_probe(struct platform_device *pdev)
+{

[ ... ]

Quoted 13 lines
drivers/pwm/pwm-dwc-of.c new file +13 -0
+	ret = clk_prepare_enable(dwc->clk);
+	if (ret) {
+		dev_err(dev, "failed to enable timer clock\n");
+		goto disable_busclk;
+	}
+
+	/*
+	 * Check all channels to see if any channel is enabled.
+	 * Read the control register of each channel and extract the enable bit
+	 */
+	for (i = 0; i < chip->npwm; i++) {
+		ctrl[i] = dwc_pwm_readl(dwc, DWC_TIM_CTRL(i)) & DWC_TIM_CTRL_EN;
+		if (ctrl[i])

drivers/pwm/pwm-dwc-of.c line 115

Quoted 10 lines
drivers/pwm/pwm-dwc-of.c new file +10 -0
+			pwm_en = true;
+	}
+
+	/*
+	 * Only issue a reset pulse when all channels are disabled, so a PWM
+	 * channel already running (e.g. configured by firmware before Linux
+	 * took over) is left undisturbed.
+	 */
+	if (!pwm_en) {
+		ret = reset_control_reset(dwc->rst);

[Severity: High]
Could this read from DWC_TIM_CTRL(i) cause a bus stall and kernel panic if the device is currently in reset?

Quoted 5 lines

Module removal explicitly asserts the reset line in dwc_pwm_plat_remove(), leaving the device in reset. On a subsequent probe (e.g., reloading the module), this loop attempts to read from the MMIO space before the reset is deasserted.

Deassert reset before reading MMIO registers. The channel-enable scan reads DWC_TIM_CTRL while the device may still be held in reset after a previous remove(). Reading MMIO while in reset causes a bus stall on many SoCs; call reset_control_deassert() before the scan.

Quoted 16 lines

[ ... ]

drivers/pwm/pwm-dwc-of.c line 148

Quoted 10 lines
drivers/pwm/pwm-dwc-of.c new file +10 -0
+	if (pwm_en) {
+		pm_runtime_set_active(dev);
+		for (i = 0; i < chip->npwm; i++) {
+			if (ctrl[i])
+				pm_runtime_get_noresume(dev);
+		}
+	} else {
+		clk_disable_unprepare(dwc->clk);
+		clk_disable_unprepare(dwc->bus_clk);
+	}

[Severity: High]
If CONFIG_PM is disabled in the kernel, does gating these clocks here cause subsequent unclocked register accesses?

Quoted 4 lines

Since pm_runtime_resume_and_get() becomes a stub that returns 1 without re-enabling clocks, subsequent operations like apply() or get_state() would perform unclocked MMIO accesses leading to panics.

Keep clocks enabled when CONFIG_PM is disabled. When CONFIG_PM=n, pm_runtime callbacks are stubs that never invoke the runtime_resume hook, so clocks gated in probe are never re-enabled before MMIO access in apply() and get_state(). Condition the clock gating on IS_ENABLED(CONFIG_PM), and update the pm_disable error path to disable clocks when CONFIG_PM=n (they were never gated in that case).

Quoted 4 lines

[ ... ]

Quoted 2 lines
drivers/pwm/pwm-dwc-of.c new file +2 -0
+static void dwc_pwm_plat_remove(struct platform_device *pdev)
+{

[ ... ]

Quoted 10 lines

drivers/pwm/pwm-dwc-of.c line 205

Quoted 4 lines
drivers/pwm/pwm-dwc-of.c new file +4 -0
+	if (!pm_runtime_status_suspended(&pdev->dev)) {
+		clk_disable_unprepare(dwc->clk);
+		clk_disable_unprepare(dwc->bus_clk);
+	}

[Severity: High]
If CONFIG_PM is disabled, pm_runtime_status_suspended() will always return false. Does this cause a double-disable of the clocks if they were already gated in probe?

With the above fix, the clocks in probe will not be disabled when CONFIG_PM=n. This prevents the double-disable issue.

Quoted 22 lines

[ ... ]

Quoted 6 lines
drivers/pwm/pwm-dwc-of.c new file +6 -0
+static int dwc_pwm_suspend(struct device *dev)
+{
+	struct dwc_pwm_drvdata *data = dev_get_drvdata(dev);
+	struct pwm_chip *chip = data->chips[0];
+	struct dwc_pwm *dwc = to_dwc_pwm(chip);
+	unsigned int idx;

drivers/pwm/pwm-dwc-of.c line 266

Quoted 10 lines
drivers/pwm/pwm-dwc-of.c new file +10 -0
+	int ret;
+
+	if (pm_runtime_status_suspended(dev)) {
+		ret = dwc_pwm_runtime_resume(dev);
+		if (ret)
+			return ret;
+	}
+
+	for (idx = 0; idx < chip->npwm; idx++) {
+		dwc->ctx[idx].cnt = dwc_pwm_readl(dwc, DWC_TIM_LD_CNT(idx));

[Severity: High]
Does calling the local dwc_pwm_runtime_resume() directly bypass the PM framework?

Quoted 6 lines

If the device is attached to a generic power domain (genpd) and is runtime-suspended, the PM domain itself might be powered off. Bypassing pm_runtime_resume_and_get() means the PM domain is never powered back on, and the subsequent dwc_pwm_readl() calls will access unpowered hardware causing a bus fault.

Use pm_runtime_resume_and_get() instead of calling dwc_pwm_runtime_resume() directly.

Move the register read/write operations from dwc_pwm_suspend/resume() into dwc_pwm_runtime_suspend/resume().
Switch system sleep callbacks to pm_runtime_force_suspend() and pm_runtime_force_resume(), instead of dwc_pwm_suspend() and dwc_pwm_resume().

Would this approach be more suitable?

Best regards,
Xuyang Dong

Quoted 2 lines
Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=3