From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 24E2915FCE3; Wed, 3 Apr 2024 17:19:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712164762; cv=none; b=RYwe3aakjp1/EIFHAzZLYzT4ZX9PMNidRwc0MsCE6E9JXAiMYy5YQxgS1FHQD3usClJNYhki2c7B8tKpugY8DjD82X77EC1mgGu6OygAbqURD6sDcrWmbW1xjDNCsGiuNiIGO149ssaGBXRx/MBc6ncOIdkzXFCJLTPsqXAIYNo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712164762; c=relaxed/simple; bh=GV/QxceMDpKd3Dxll4jqgxB//sdf5/98x2xoNhBaPLY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LxLhPJ5E3bvkf8Mslos49FJ1A1w6HnuC3X9N9V3c/b+tFO1CjZBb1ch6uMgrrA/4DsINdPfRwc75vEF96cqna6SKLKmU5mws2x7BE6vbUlVAheA1PeRmqCIzdhesZqcmB7q5xpOthGyrPuT2opiQj/t5q8mUUVcJT0vWH5KfAvs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=s4ipyB47; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="s4ipyB47" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 433FFC43390; Wed, 3 Apr 2024 17:19:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1712164761; bh=GV/QxceMDpKd3Dxll4jqgxB//sdf5/98x2xoNhBaPLY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=s4ipyB47032QhvkOl/gebd9i5vqnwKFOCIoOoRtf6wE93BC/LxvSsH+yHAXgszLQE 8P0nibw00yblO0LN266NE9Ou6QiJI+KMRfTh6PRKS6209oZZfJusYeYU1QxmKsx8VC b5WnuNTqB7kqHdCJykZuN4CZwnJibrq5+OzhKLpc7THtFISO/x3gByiuwT5eiEFXq3 4BDZuy14HHXSzy8xfRziOdE0IfXkv+itN7UqYYX9gSp7qx+JI8gnVBQRTR6s/EooXv COi1VW6+D5O5NUMCLOPzqe65viwjh7v/aGjdPMh1lBiMfUytFKW0TkR5f0Wa9aHG41 i8pLaZpQ6SwQQ== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Abhishek Pandit-Subedi , Neil Armstrong , Prashant Malani , Heikki Krogerus , Greg Kroah-Hartman , Sasha Levin , lk@c--e.de, jthies@google.com, bleung@chromium.org, saranya.gopal@intel.com, dmitry.baryshkov@linaro.org, linux-usb@vger.kernel.org Subject: [PATCH AUTOSEL 6.1 05/15] usb: typec: ucsi: Limit read size on v1.2 Date: Wed, 3 Apr 2024 13:18:49 -0400 Message-ID: <20240403171909.345570-5-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240403171909.345570-1-sashal@kernel.org> References: <20240403171909.345570-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.1.84 Content-Transfer-Encoding: 8bit From: Abhishek Pandit-Subedi [ Upstream commit b3db266fb031fba88c423d4bb8983a73a3db6527 ] Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was increased from 16 to 256. In order to avoid overflowing reads for older systems, add a mechanism to use the read UCSI version to truncate read sizes on UCSI v1.2. Tested-by: Neil Armstrong Reviewed-by: Prashant Malani Reviewed-by: Heikki Krogerus Signed-off-by: Abhishek Pandit-Subedi Link: https://lore.kernel.org/r/20240209143723.v5.1.Iacf5570a66b82b73ef03daa6557e2fc0db10266a@changeid Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/usb/typec/ucsi/ucsi.c | 26 ++++++++++++++++++++++++-- drivers/usb/typec/ucsi/ucsi.h | 11 +++++++++++ 2 files changed, 35 insertions(+), 2 deletions(-) diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c index 0695ee54ff781..9d4b30bb744cc 100644 --- a/drivers/usb/typec/ucsi/ucsi.c +++ b/drivers/usb/typec/ucsi/ucsi.c @@ -36,6 +36,19 @@ */ #define UCSI_SWAP_TIMEOUT_MS 5000 +static int ucsi_read_message_in(struct ucsi *ucsi, void *buf, + size_t buf_size) +{ + /* + * Below UCSI 2.0, MESSAGE_IN was limited to 16 bytes. Truncate the + * reads here. + */ + if (ucsi->version <= UCSI_VERSION_1_2) + buf_size = clamp(buf_size, 0, 16); + + return ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, buf, buf_size); +} + static int ucsi_acknowledge_command(struct ucsi *ucsi) { u64 ctrl; @@ -72,7 +85,7 @@ static int ucsi_read_error(struct ucsi *ucsi) if (ret < 0) return ret; - ret = ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, &error, sizeof(error)); + ret = ucsi_read_message_in(ucsi, &error, sizeof(error)); if (ret) return ret; @@ -170,7 +183,7 @@ int ucsi_send_command(struct ucsi *ucsi, u64 command, length = ret; if (data) { - ret = ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, data, size); + ret = ucsi_read_message_in(ucsi, data, size); if (ret) goto out; } @@ -1403,6 +1416,15 @@ int ucsi_register(struct ucsi *ucsi) if (!ucsi->version) return -ENODEV; + /* + * Version format is JJ.M.N (JJ = Major version, M = Minor version, + * N = sub-minor version). + */ + dev_dbg(ucsi->dev, "Registered UCSI interface with version %x.%x.%x", + UCSI_BCD_GET_MAJOR(ucsi->version), + UCSI_BCD_GET_MINOR(ucsi->version), + UCSI_BCD_GET_SUBMINOR(ucsi->version)); + queue_delayed_work(system_long_wq, &ucsi->work, 0); return 0; diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h index 60ce9fb6e7450..559cec46e906a 100644 --- a/drivers/usb/typec/ucsi/ucsi.h +++ b/drivers/usb/typec/ucsi/ucsi.h @@ -22,6 +22,17 @@ struct ucsi_altmode; #define UCSI_CONTROL 8 #define UCSI_MESSAGE_IN 16 #define UCSI_MESSAGE_OUT 32 +#define UCSIv2_MESSAGE_OUT 272 + +/* UCSI versions */ +#define UCSI_VERSION_1_2 0x0120 +#define UCSI_VERSION_2_0 0x0200 +#define UCSI_VERSION_2_1 0x0210 +#define UCSI_VERSION_3_0 0x0300 + +#define UCSI_BCD_GET_MAJOR(_v_) (((_v_) >> 8) & 0xFF) +#define UCSI_BCD_GET_MINOR(_v_) (((_v_) >> 4) & 0x0F) +#define UCSI_BCD_GET_SUBMINOR(_v_) ((_v_) & 0x0F) /* Command Status and Connector Change Indication (CCI) bits */ #define UCSI_CCI_CONNECTOR(_c_) (((_c_) & GENMASK(7, 1)) >> 1) -- 2.43.0