[PATCH v3 0/2] usb: gpio-sbu-mux: add FUSB340 and enable option for orientation

[PATCH v3 0/2] usb: gpio-sbu-mux: add FUSB340 and enable option for orientation

[Fabrice Gasnier]

Add a new compatible for FUSB340. Also manage the enable GPIO, when used as
orientation-switch only.
It is used on STM32MP25 DK boards, as orientation-switch only for
USB SuperSpeed lines on the Type-C connector, the enable GPIO being
connected to the SoC.

- - - - SoC - - - - - - - - - - board - - - - -
                        |                 USB-C
+------+  +----------+  |                   +-+
|      |--|  USB2PHY |<-----------------HS->|*|
|      |--|    HS    |<-----------------HS->|*|
|      |  +----------+  |                   | |
|      |                |    ________       | |
+ dwc3 |  +----------+  |   /        |<-SS->|*|
|      |  |          |<--->/         |<-SS->|*|
|      |--| ComboPHY |<--->  FUSB340 |      | |
|      |  |    SS    |  |  \  __     |<-SS->|*|
+------+  +----------+  |   \_en__sw_|<-SS->|*|
                        |     ^   ^         | |
          +----------+  |     |   |         ...
          [   GPIO   ]--------+   |
          [   GPIO   ]------------+
          +----------+  |
- - - - - - - - - - - - - - - - - - - - - - --

This is a subset of STM32MP25 Type-C support [1].

[1] https://lore.kernel.org/all/20260821-ucpd-host-fusb340-v7-2-rfc-v1-0-c5e27cbc0795@foss.st.com/

---
Changes in v3:
- Fix missed v2 update on probing mode-switch property.
- Link to v2: https://patch.msgid.link/20260826-usb-fusb340-v1-v2-0-994a03c9ae45@foss.st.com

Changes in v2:
- Added Conor's Acked-by
- Fix new driver issues introduced in v1 as reported by Sashiko, on
  a possible race during probe and a possible glitch upon enable.
- Link to v1: https://patch.msgid.link/20260825-usb-fusb340-v1-v1-0-2191179b0661@foss.st.com

To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Rob Herring <robh@kernel.org>
To: Krzysztof Kozlowski <krzk+dt@kernel.org>
To: Conor Dooley <conor+dt@kernel.org>
To: Bjorn Andersson <andersson@kernel.org>
To: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: linux-usb@vger.kernel.org
Cc: devicetree@vger.kernel.org
Cc: linux-kernel@vger.kernel.org

---
Fabrice Gasnier (2):
      dt-bindings: usb: gpio-sbu-mux: Add compatible for FUSB340
      usb: typec: mux: gpio-sbu: enable when only used for orientation

 Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml |  1 +
 drivers/usb/typec/mux/gpio-sbu-mux.c                    | 13 ++++++++++---
 2 files changed, 11 insertions(+), 3 deletions(-)
---
base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
change-id: 20260825-usb-fusb340-v1-f060a5f84d3c

Best regards,
--  
Fabrice Gasnier <fabrice.gasnier@foss.st.com>

[PATCH v3 1/2] dt-bindings: usb: gpio-sbu-mux: Add compatible for FUSB340

[Fabrice Gasnier]

Add a compatible for the FUSB340 GPIO-based 2:1 SuperSpeed switch
with enable-gpios and select-gpios controls. The switch can be used
in Type-C applications where a reversible cable requires a switch.

Suggested-by: Marek Vasut <marex@nabladev.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
---
 Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml b/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
index 793662f6f3bf..c0e60848d8ab 100644
--- a/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
+++ b/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
@@ -22,6 +22,7 @@ properties:
           - nxp,cbdtu02043
           - onnn,fsusb42
           - onnn,fsusb43l10x
+          - onnn,fusb340
           - pericom,pi3usb102
           - ti,tmuxhs4212
       - const: gpio-sbu-mux

-- 
2.43.0

[PATCH v3 2/2] usb: typec: mux: gpio-sbu: enable when only used for orientation

[Fabrice Gasnier]

When used as orientation-switch only (no mode-switch, e.g. no altmode),
the optional enable gpio remains disabled.
Enable it from the switch_set() routine, in this case, when the
orientation is set and the enable-gpios property has been provided.
Move enable GPIO configuration after the swapped configuration has
been done, to avoid possible glitches in case both signals are changed.

Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
---
Changes in v3
- Fix missed v2 update on probing mode-switch property.
Changes in v2
- fix issues reported by Sashiko: probe mode-switch property before
  registering Type-C switch, to avoid possible race. Configure enable
  GPIO after swapp GPIO has been configured, in case both transition.
---
 drivers/usb/typec/mux/gpio-sbu-mux.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/typec/mux/gpio-sbu-mux.c b/drivers/usb/typec/mux/gpio-sbu-mux.c
index 1834f1a2dd9d..b1aa976aca24 100644
--- a/drivers/usb/typec/mux/gpio-sbu-mux.c
+++ b/drivers/usb/typec/mux/gpio-sbu-mux.c
@@ -17,6 +17,7 @@ struct gpio_sbu_mux {
 
 	struct typec_switch_dev *sw;
 	struct typec_mux_dev *mux;
+	bool mode_switch;
 
 	struct mutex lock; /* protect enabled and swapped */
 	bool enabled;
@@ -40,19 +41,24 @@ static int gpio_sbu_switch_set(struct typec_switch_dev *sw,
 		enabled = false;
 		break;
 	case TYPEC_ORIENTATION_NORMAL:
+		if (!sbu_mux->mode_switch)
+			enabled = true;
 		swapped = false;
 		break;
 	case TYPEC_ORIENTATION_REVERSE:
+		if (!sbu_mux->mode_switch)
+			enabled = true;
 		swapped = true;
 		break;
 	}
 
-	if (enabled != sbu_mux->enabled)
-		gpiod_set_value_cansleep(sbu_mux->enable_gpio, enabled);
-
 	if (swapped != sbu_mux->swapped)
 		gpiod_set_value_cansleep(sbu_mux->select_gpio, swapped);
 
+	/* If both enabled and swapped transition, set enable GPIO after to avoid glitches */
+	if (enabled != sbu_mux->enabled)
+		gpiod_set_value_cansleep(sbu_mux->enable_gpio, enabled);
+
 	sbu_mux->enabled = enabled;
 	sbu_mux->swapped = swapped;
 
@@ -120,6 +126,7 @@ static int gpio_sbu_mux_probe(struct platform_device *pdev)
 	sw_desc.fwnode = dev_fwnode(dev);
 	sw_desc.set = gpio_sbu_switch_set;
 
+	sbu_mux->mode_switch = device_property_read_bool(dev, "mode-switch");
 	sbu_mux->sw = typec_switch_register(dev, &sw_desc);
 	if (IS_ERR(sbu_mux->sw))
 		return dev_err_probe(dev, PTR_ERR(sbu_mux->sw),

-- 
2.43.0

Re: [PATCH v3 2/2] usb: typec: mux: gpio-sbu: enable when only used for orientation

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-after-free on driver unbind due to devres-managed objects accessed by registered callbacks.
--

commit ac2f1c36c2a2fd8f5788aba123b30da04e627199
Author: Fabrice Gasnier <fabrice.gasnier@foss.st.com>

usb: typec: mux: gpio-sbu: enable when only used for orientation
    
When used as orientation-switch only (no mode-switch, e.g. no altmode),
the optional enable gpio remains disabled.
Enable it from the switch_set() routine, in this case, when the
orientation is set and the enable-gpios property has been provided.

> diff --git a/drivers/usb/typec/mux/gpio-sbu-mux.c b/drivers/usb/typec/mux/gpio-sbu-mux.c
> index 1834f1a2dd9dd..b1aa976aca240 100644
> --- a/drivers/usb/typec/mux/gpio-sbu-mux.c
> +++ b/drivers/usb/typec/mux/gpio-sbu-mux.c
[ ... ]
> @@ -120,6 +126,7 @@ static int gpio_sbu_mux_probe(struct platform_device *pdev)
>  	sw_desc.fwnode = dev_fwnode(dev);
>  	sw_desc.set = gpio_sbu_switch_set;
>  
> +	sbu_mux->mode_switch = device_property_read_bool(dev, "mode-switch");
>  	sbu_mux->sw = typec_switch_register(dev, &sw_desc);
>  	if (IS_ERR(sbu_mux->sw))
>  		return dev_err_probe(dev, PTR_ERR(sbu_mux->sw),

[Severity: High]
This is a pre-existing issue, but can this lead to a use-after-free during
driver unbind?

The sbu_mux struct is allocated with devres (devm_kzalloc), tying its
lifetime to the platform driver's bind state. However, the driver registers
callbacks with the Type-C subsystem via typec_switch_register().

When the driver unbinds (e.g., via sysfs), typec_switch_unregister() removes
the switch from sysfs but does not wait for active consumers who hold a
reference to the typec_switch_dev to drop their references.

After the driver's remove hook completes, the driver core's devres cleanup
runs and frees sbu_mux and the GPIO descriptors.

If a consumer holding a reference subsequently invokes typec_switch_set(),
it calls into gpio_sbu_switch_set() which blindly dereferences the freed
sbu_mux pointer (e.g., locking its mutex) and accesses freed GPIO structures.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260826-usb-fusb340-v1-v3-0-11927682504d@foss.st.com?part=2