[PATCH v3 0/2] usb: gpio-sbu-mux: add FUSB340 and enable option for orientation

[PATCH v3 0/2] usb: gpio-sbu-mux: add FUSB340 and enable option for orientation

[Fabrice Gasnier]

Add a new compatible for FUSB340. Also manage the enable GPIO, when used as
orientation-switch only.
It is used on STM32MP25 DK boards, as orientation-switch only for
USB SuperSpeed lines on the Type-C connector, the enable GPIO being
connected to the SoC.

- - - - SoC - - - - - - - - - - board - - - - -
                        |                 USB-C
+------+  +----------+  |                   +-+
|      |--|  USB2PHY |<-----------------HS->|*|
|      |--|    HS    |<-----------------HS->|*|
|      |  +----------+  |                   | |
|      |                |    ________       | |
+ dwc3 |  +----------+  |   /        |<-SS->|*|
|      |  |          |<--->/         |<-SS->|*|
|      |--| ComboPHY |<--->  FUSB340 |      | |
|      |  |    SS    |  |  \  __     |<-SS->|*|
+------+  +----------+  |   \_en__sw_|<-SS->|*|
                        |     ^   ^         | |
          +----------+  |     |   |         ...
          [   GPIO   ]--------+   |
          [   GPIO   ]------------+
          +----------+  |
- - - - - - - - - - - - - - - - - - - - - - --

This is a subset of STM32MP25 Type-C support [1].

[1] https://lore.kernel.org/all/20260821-ucpd-host-fusb340-v7-2-rfc-v1-0-c5e27cbc0795@foss.st.com/

---
Changes in v3:
- Fix missed v2 update on probing mode-switch property.
- Link to v2: https://patch.msgid.link/20260826-usb-fusb340-v1-v2-0-994a03c9ae45@foss.st.com

Changes in v2:
- Added Conor's Acked-by
- Fix new driver issues introduced in v1 as reported by Sashiko, on
  a possible race during probe and a possible glitch upon enable.
- Link to v1: https://patch.msgid.link/20260825-usb-fusb340-v1-v1-0-2191179b0661@foss.st.com

To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Rob Herring <robh@kernel.org>
To: Krzysztof Kozlowski <krzk+dt@kernel.org>
To: Conor Dooley <conor+dt@kernel.org>
To: Bjorn Andersson <andersson@kernel.org>
To: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: linux-usb@vger.kernel.org
Cc: devicetree@vger.kernel.org
Cc: linux-kernel@vger.kernel.org

---
Fabrice Gasnier (2):
      dt-bindings: usb: gpio-sbu-mux: Add compatible for FUSB340
      usb: typec: mux: gpio-sbu: enable when only used for orientation

 Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml |  1 +
 drivers/usb/typec/mux/gpio-sbu-mux.c                    | 13 ++++++++++---
 2 files changed, 11 insertions(+), 3 deletions(-)
---
base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
change-id: 20260825-usb-fusb340-v1-f060a5f84d3c

Best regards,
--  
Fabrice Gasnier <fabrice.gasnier@foss.st.com>

[PATCH v3 1/2] dt-bindings: usb: gpio-sbu-mux: Add compatible for FUSB340

[Fabrice Gasnier]

Add a compatible for the FUSB340 GPIO-based 2:1 SuperSpeed switch
with enable-gpios and select-gpios controls. The switch can be used
in Type-C applications where a reversible cable requires a switch.

Suggested-by: Marek Vasut <marex@nabladev.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
---
 Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml b/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
index 793662f6f3bf..c0e60848d8ab 100644
--- a/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
+++ b/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
@@ -22,6 +22,7 @@ properties:
           - nxp,cbdtu02043
           - onnn,fsusb42
           - onnn,fsusb43l10x
+          - onnn,fusb340
           - pericom,pi3usb102
           - ti,tmuxhs4212
       - const: gpio-sbu-mux

-- 
2.43.0

[PATCH v3 2/2] usb: typec: mux: gpio-sbu: enable when only used for orientation

[Fabrice Gasnier]

When used as orientation-switch only (no mode-switch, e.g. no altmode),
the optional enable gpio remains disabled.
Enable it from the switch_set() routine, in this case, when the
orientation is set and the enable-gpios property has been provided.
Move enable GPIO configuration after the swapped configuration has
been done, to avoid possible glitches in case both signals are changed.

Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
---
Changes in v3
- Fix missed v2 update on probing mode-switch property.
Changes in v2
- fix issues reported by Sashiko: probe mode-switch property before
  registering Type-C switch, to avoid possible race. Configure enable
  GPIO after swapp GPIO has been configured, in case both transition.
---
 drivers/usb/typec/mux/gpio-sbu-mux.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/typec/mux/gpio-sbu-mux.c b/drivers/usb/typec/mux/gpio-sbu-mux.c
index 1834f1a2dd9d..b1aa976aca24 100644
--- a/drivers/usb/typec/mux/gpio-sbu-mux.c
+++ b/drivers/usb/typec/mux/gpio-sbu-mux.c
@@ -17,6 +17,7 @@ struct gpio_sbu_mux {
 
 	struct typec_switch_dev *sw;
 	struct typec_mux_dev *mux;
+	bool mode_switch;
 
 	struct mutex lock; /* protect enabled and swapped */
 	bool enabled;
@@ -40,19 +41,24 @@ static int gpio_sbu_switch_set(struct typec_switch_dev *sw,
 		enabled = false;
 		break;
 	case TYPEC_ORIENTATION_NORMAL:
+		if (!sbu_mux->mode_switch)
+			enabled = true;
 		swapped = false;
 		break;
 	case TYPEC_ORIENTATION_REVERSE:
+		if (!sbu_mux->mode_switch)
+			enabled = true;
 		swapped = true;
 		break;
 	}
 
-	if (enabled != sbu_mux->enabled)
-		gpiod_set_value_cansleep(sbu_mux->enable_gpio, enabled);
-
 	if (swapped != sbu_mux->swapped)
 		gpiod_set_value_cansleep(sbu_mux->select_gpio, swapped);
 
+	/* If both enabled and swapped transition, set enable GPIO after to avoid glitches */
+	if (enabled != sbu_mux->enabled)
+		gpiod_set_value_cansleep(sbu_mux->enable_gpio, enabled);
+
 	sbu_mux->enabled = enabled;
 	sbu_mux->swapped = swapped;
 
@@ -120,6 +126,7 @@ static int gpio_sbu_mux_probe(struct platform_device *pdev)
 	sw_desc.fwnode = dev_fwnode(dev);
 	sw_desc.set = gpio_sbu_switch_set;
 
+	sbu_mux->mode_switch = device_property_read_bool(dev, "mode-switch");
 	sbu_mux->sw = typec_switch_register(dev, &sw_desc);
 	if (IS_ERR(sbu_mux->sw))
 		return dev_err_probe(dev, PTR_ERR(sbu_mux->sw),

-- 
2.43.0

Re: [PATCH v3 2/2] usb: typec: mux: gpio-sbu: enable when only used for orientation

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-after-free on driver unbind due to devres-managed objects accessed by registered callbacks.
--

commit ac2f1c36c2a2fd8f5788aba123b30da04e627199
Author: Fabrice Gasnier <fabrice.gasnier@foss.st.com>

usb: typec: mux: gpio-sbu: enable when only used for orientation
    
When used as orientation-switch only (no mode-switch, e.g. no altmode),
the optional enable gpio remains disabled.
Enable it from the switch_set() routine, in this case, when the
orientation is set and the enable-gpios property has been provided.

> diff --git a/drivers/usb/typec/mux/gpio-sbu-mux.c b/drivers/usb/typec/mux/gpio-sbu-mux.c
> index 1834f1a2dd9dd..b1aa976aca240 100644
> --- a/drivers/usb/typec/mux/gpio-sbu-mux.c
> +++ b/drivers/usb/typec/mux/gpio-sbu-mux.c
[ ... ]
> @@ -120,6 +126,7 @@ static int gpio_sbu_mux_probe(struct platform_device *pdev)
>  	sw_desc.fwnode = dev_fwnode(dev);
>  	sw_desc.set = gpio_sbu_switch_set;
>  
> +	sbu_mux->mode_switch = device_property_read_bool(dev, "mode-switch");
>  	sbu_mux->sw = typec_switch_register(dev, &sw_desc);
>  	if (IS_ERR(sbu_mux->sw))
>  		return dev_err_probe(dev, PTR_ERR(sbu_mux->sw),

[Severity: High]
This is a pre-existing issue, but can this lead to a use-after-free during
driver unbind?

The sbu_mux struct is allocated with devres (devm_kzalloc), tying its
lifetime to the platform driver's bind state. However, the driver registers
callbacks with the Type-C subsystem via typec_switch_register().

When the driver unbinds (e.g., via sysfs), typec_switch_unregister() removes
the switch from sysfs but does not wait for active consumers who hold a
reference to the typec_switch_dev to drop their references.

After the driver's remove hook completes, the driver core's devres cleanup
runs and frees sbu_mux and the GPIO descriptors.

If a consumer holding a reference subsequently invokes typec_switch_set(),
it calls into gpio_sbu_switch_set() which blindly dereferences the freed
sbu_mux pointer (e.g., locking its mutex) and accesses freed GPIO structures.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260826-usb-fusb340-v1-v3-0-11927682504d@foss.st.com?part=2

Re: [PATCH v3 2/2] usb: typec: mux: gpio-sbu: enable when only used for orientation

[Heikki Krogerus]

On Wed, Aug 26, 2026 at 02:16:36PM +0200, Fabrice Gasnier wrote:
> When used as orientation-switch only (no mode-switch, e.g. no altmode),
> the optional enable gpio remains disabled.
> Enable it from the switch_set() routine, in this case, when the
> orientation is set and the enable-gpios property has been provided.
> Move enable GPIO configuration after the swapped configuration has
> been done, to avoid possible glitches in case both signals are changed.
> 
> Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>

Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
> Changes in v3
> - Fix missed v2 update on probing mode-switch property.
> Changes in v2
> - fix issues reported by Sashiko: probe mode-switch property before
>   registering Type-C switch, to avoid possible race. Configure enable
>   GPIO after swapp GPIO has been configured, in case both transition.
> ---
>  drivers/usb/typec/mux/gpio-sbu-mux.c | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/usb/typec/mux/gpio-sbu-mux.c b/drivers/usb/typec/mux/gpio-sbu-mux.c
> index 1834f1a2dd9d..b1aa976aca24 100644
> --- a/drivers/usb/typec/mux/gpio-sbu-mux.c
> +++ b/drivers/usb/typec/mux/gpio-sbu-mux.c
> @@ -17,6 +17,7 @@ struct gpio_sbu_mux {
>  
>  	struct typec_switch_dev *sw;
>  	struct typec_mux_dev *mux;
> +	bool mode_switch;
>  
>  	struct mutex lock; /* protect enabled and swapped */
>  	bool enabled;
> @@ -40,19 +41,24 @@ static int gpio_sbu_switch_set(struct typec_switch_dev *sw,
>  		enabled = false;
>  		break;
>  	case TYPEC_ORIENTATION_NORMAL:
> +		if (!sbu_mux->mode_switch)
> +			enabled = true;
>  		swapped = false;
>  		break;
>  	case TYPEC_ORIENTATION_REVERSE:
> +		if (!sbu_mux->mode_switch)
> +			enabled = true;
>  		swapped = true;
>  		break;
>  	}
>  
> -	if (enabled != sbu_mux->enabled)
> -		gpiod_set_value_cansleep(sbu_mux->enable_gpio, enabled);
> -
>  	if (swapped != sbu_mux->swapped)
>  		gpiod_set_value_cansleep(sbu_mux->select_gpio, swapped);
>  
> +	/* If both enabled and swapped transition, set enable GPIO after to avoid glitches */
> +	if (enabled != sbu_mux->enabled)
> +		gpiod_set_value_cansleep(sbu_mux->enable_gpio, enabled);
> +
>  	sbu_mux->enabled = enabled;
>  	sbu_mux->swapped = swapped;
>  
> @@ -120,6 +126,7 @@ static int gpio_sbu_mux_probe(struct platform_device *pdev)
>  	sw_desc.fwnode = dev_fwnode(dev);
>  	sw_desc.set = gpio_sbu_switch_set;
>  
> +	sbu_mux->mode_switch = device_property_read_bool(dev, "mode-switch");
>  	sbu_mux->sw = typec_switch_register(dev, &sw_desc);
>  	if (IS_ERR(sbu_mux->sw))
>  		return dev_err_probe(dev, PTR_ERR(sbu_mux->sw),
> 
> -- 
> 2.43.0

-- 
heikki

Re: [PATCH v3 1/2] dt-bindings: usb: gpio-sbu-mux: Add compatible for FUSB340

[Xu Yang]

Hi Fabrice,

On Wed, Aug 26, 2026 at 02:16:35PM +0200, Fabrice Gasnier wrote:
> Add a compatible for the FUSB340 GPIO-based 2:1 SuperSpeed switch
> with enable-gpios and select-gpios controls. The switch can be used
> in Type-C applications where a reversible cable requires a switch.
> 
> Suggested-by: Marek Vasut <marex@nabladev.com>
> Acked-by: Conor Dooley <conor.dooley@microchip.com>
> Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
> ---
>  Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml b/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
> index 793662f6f3bf..c0e60848d8ab 100644
> --- a/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
> +++ b/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
> @@ -22,6 +22,7 @@ properties:
>            - nxp,cbdtu02043
>            - onnn,fsusb42
>            - onnn,fsusb43l10x
> +          - onnn,fusb340
>            - pericom,pi3usb102
>            - ti,tmuxhs4212
>        - const: gpio-sbu-mux

To be honest, the added one is SuperSpeed Line switch. The gpio-sbu-mux.yaml
describes SBU line here. They are different. Should another compatible name
be created? Such as gpio-ss-mux or similar?

Thanks,
Xu Yang

> 
> -- 
> 2.43.0
> 

Re: [PATCH v3 1/2] dt-bindings: usb: gpio-sbu-mux: Add compatible for FUSB340

[Fabrice Gasnier]

On 9/1/26 08:31, Xu Yang wrote:
> Hi Fabrice,
> 
> On Wed, Aug 26, 2026 at 02:16:35PM +0200, Fabrice Gasnier wrote:
>> Add a compatible for the FUSB340 GPIO-based 2:1 SuperSpeed switch
>> with enable-gpios and select-gpios controls. The switch can be used
>> in Type-C applications where a reversible cable requires a switch.
>>
>> Suggested-by: Marek Vasut <marex@nabladev.com>
>> Acked-by: Conor Dooley <conor.dooley@microchip.com>
>> Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
>> ---
>>  Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml | 1 +
>>  1 file changed, 1 insertion(+)
>>
>> diff --git a/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml b/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
>> index 793662f6f3bf..c0e60848d8ab 100644
>> --- a/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
>> +++ b/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
>> @@ -22,6 +22,7 @@ properties:
>>            - nxp,cbdtu02043
>>            - onnn,fsusb42
>>            - onnn,fsusb43l10x
>> +          - onnn,fusb340
>>            - pericom,pi3usb102
>>            - ti,tmuxhs4212
>>        - const: gpio-sbu-mux
> 
> To be honest, the added one is SuperSpeed Line switch. The gpio-sbu-mux.yaml
> describes SBU line here. They are different. Should another compatible name
> be created? Such as gpio-ss-mux or similar?

Hi Xu,

It is very similar to other parts supported here already (see tmuxhs4212
datasheet). I don't understand why another compatible would be created ?
And other properties in the bindings indicate the purpose, e.g.
mode-switch, orientation-switch.

BR,
Fabrice

> 
> Thanks,
> Xu Yang
> 
>>
>> -- 
>> 2.43.0
>>

Re: [PATCH v3 1/2] dt-bindings: usb: gpio-sbu-mux: Add compatible for FUSB340

[Xu Yang]

Hi Fabrice,

On Tue, Sep 01, 2026 at 10:02:50AM +0200, Fabrice Gasnier wrote:
> On 9/1/26 08:31, Xu Yang wrote:
> > Hi Fabrice,
> > 
> > On Wed, Aug 26, 2026 at 02:16:35PM +0200, Fabrice Gasnier wrote:
> >> Add a compatible for the FUSB340 GPIO-based 2:1 SuperSpeed switch
> >> with enable-gpios and select-gpios controls. The switch can be used
> >> in Type-C applications where a reversible cable requires a switch.
> >>
> >> Suggested-by: Marek Vasut <marex@nabladev.com>
> >> Acked-by: Conor Dooley <conor.dooley@microchip.com>
> >> Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
> >> ---
> >>  Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml | 1 +
> >>  1 file changed, 1 insertion(+)
> >>
> >> diff --git a/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml b/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
> >> index 793662f6f3bf..c0e60848d8ab 100644
> >> --- a/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
> >> +++ b/Documentation/devicetree/bindings/usb/gpio-sbu-mux.yaml
> >> @@ -22,6 +22,7 @@ properties:
> >>            - nxp,cbdtu02043
> >>            - onnn,fsusb42
> >>            - onnn,fsusb43l10x
> >> +          - onnn,fusb340
> >>            - pericom,pi3usb102
> >>            - ti,tmuxhs4212
> >>        - const: gpio-sbu-mux
> > 
> > To be honest, the added one is SuperSpeed Line switch. The gpio-sbu-mux.yaml
> > describes SBU line here. They are different. Should another compatible name
> > be created? Such as gpio-ss-mux or similar?
> 
> Hi Xu,
> 
> It is very similar to other parts supported here already (see tmuxhs4212
> datasheet). I don't understand why another compatible would be created ?
> And other properties in the bindings indicate the purpose, e.g.
> mode-switch, orientation-switch.

I suspect tmuxhs4212 intentionally misused "gpio-sbu-mux" as SuperSpeed switch.
Commit 06f49cc255b3 said it's used for SBU lines switching, but actually their
DTBs use it for SuperSpeed lines switching. It's not correct and would confuse
users.

Thanks,
Xu Yang

> 
> BR,
> Fabrice
> 
> > 
> > Thanks,
> > Xu Yang
> > 
> >>
> >> -- 
> >> 2.43.0
> >>
> 

Re: [PATCH v3 0/2] usb: gpio-sbu-mux: add FUSB340 and enable option for orientation

[Greg Kroah-Hartman]

On Wed, Aug 26, 2026 at 02:16:34PM +0200, Fabrice Gasnier wrote:
> Add a new compatible for FUSB340. Also manage the enable GPIO, when used as
> orientation-switch only.
> It is used on STM32MP25 DK boards, as orientation-switch only for
> USB SuperSpeed lines on the Type-C connector, the enable GPIO being
> connected to the SoC.
> 
> - - - - SoC - - - - - - - - - - board - - - - -
>                         |                 USB-C
> +------+  +----------+  |                   +-+
> |      |--|  USB2PHY |<-----------------HS->|*|
> |      |--|    HS    |<-----------------HS->|*|
> |      |  +----------+  |                   | |
> |      |                |    ________       | |
> + dwc3 |  +----------+  |   /        |<-SS->|*|
> |      |  |          |<--->/         |<-SS->|*|
> |      |--| ComboPHY |<--->  FUSB340 |      | |
> |      |  |    SS    |  |  \  __     |<-SS->|*|
> +------+  +----------+  |   \_en__sw_|<-SS->|*|
>                         |     ^   ^         | |
>           +----------+  |     |   |         ...
>           [   GPIO   ]--------+   |
>           [   GPIO   ]------------+
>           +----------+  |
> - - - - - - - - - - - - - - - - - - - - - - --

Gotta love the ascii art.  Loved it so much, I forced it into the
changelog, can't let that go to waste!

thanks,

greg k-h