queue-6.8/usb-typec-ucsi-limit-read-size-on-v1.2.patch

   1 From 2c385038ee64a37b1f621991c95e09911ff45716 Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Fri, 9 Feb 2024 14:37:30 -0800
   4 Subject: usb: typec: ucsi: Limit read size on v1.2
   5
   6 From: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
   7
   8 [ Upstream commit b3db266fb031fba88c423d4bb8983a73a3db6527 ]
   9
  10 Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was
  11 increased from 16 to 256. In order to avoid overflowing reads for older
  12 systems, add a mechanism to use the read UCSI version to truncate read
  13 sizes on UCSI v1.2.
  14
  15 Tested-by: Neil Armstrong <neil.armstrong@linaro.org>
  16 Reviewed-by: Prashant Malani <pmalani@chromium.org>
  17 Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
  18 Signed-off-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
  19 Link: https://lore.kernel.org/r/20240209143723.v5.1.Iacf5570a66b82b73ef03daa6557e2fc0db10266a@changeid
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21 Signed-off-by: Sasha Levin <sashal@kernel.org>
  22 ---
  23  drivers/usb/typec/ucsi/ucsi.c | 26 ++++++++++++++++++++++++--
  24  drivers/usb/typec/ucsi/ucsi.h | 11 +++++++++++
  25  2 files changed, 35 insertions(+), 2 deletions(-)
  26
  27 diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
  28 index 0bfe5e906e543..cd415565b60a1 100644
  29 --- a/drivers/usb/typec/ucsi/ucsi.c
  30 +++ b/drivers/usb/typec/ucsi/ucsi.c
  31 @@ -36,6 +36,19 @@
  32   */
  33  #define UCSI_SWAP_TIMEOUT_MS   5000
  34
  35 +static int ucsi_read_message_in(struct ucsi *ucsi, void *buf,
  36 +                                         size_t buf_size)
  37 +{
  38 +       /*
  39 +        * Below UCSI 2.0, MESSAGE_IN was limited to 16 bytes. Truncate the
  40 +        * reads here.
  41 +        */
  42 +       if (ucsi->version <= UCSI_VERSION_1_2)
  43 +               buf_size = clamp(buf_size, 0, 16);
  44 +
  45 +       return ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, buf, buf_size);
  46 +}
  47 +
  48  static int ucsi_acknowledge_command(struct ucsi *ucsi)
  49  {
  50         u64 ctrl;
  51 @@ -72,7 +85,7 @@ static int ucsi_read_error(struct ucsi *ucsi)
  52         if (ret < 0)
  53                 return ret;
  54
  55 -       ret = ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, &error, sizeof(error));
  56 +       ret = ucsi_read_message_in(ucsi, &error, sizeof(error));
  57         if (ret)
  58                 return ret;
  59
  60 @@ -174,7 +187,7 @@ int ucsi_send_command(struct ucsi *ucsi, u64 command,
  61         length = ret;
  62
  63         if (data) {
  64 -               ret = ucsi->ops->read(ucsi, UCSI_MESSAGE_IN, data, size);
  65 +               ret = ucsi_read_message_in(ucsi, data, size);
  66                 if (ret)
  67                         goto out;
  68         }
  69 @@ -1596,6 +1609,15 @@ int ucsi_register(struct ucsi *ucsi)
  70         if (!ucsi->version)
  71                 return -ENODEV;
  72
  73 +       /*
  74 +        * Version format is JJ.M.N (JJ = Major version, M = Minor version,
  75 +        * N = sub-minor version).
  76 +        */
  77 +       dev_dbg(ucsi->dev, "Registered UCSI interface with version %x.%x.%x",
  78 +               UCSI_BCD_GET_MAJOR(ucsi->version),
  79 +               UCSI_BCD_GET_MINOR(ucsi->version),
  80 +               UCSI_BCD_GET_SUBMINOR(ucsi->version));
  81 +
  82         queue_delayed_work(system_long_wq, &ucsi->work, 0);
  83
  84         ucsi_debugfs_register(ucsi);
  85 diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h
  86 index 4550f3e8cfe9c..ede9876488564 100644
  87 --- a/drivers/usb/typec/ucsi/ucsi.h
  88 +++ b/drivers/usb/typec/ucsi/ucsi.h
  89 @@ -23,6 +23,17 @@ struct dentry;
  90  #define UCSI_CONTROL                   8
  91  #define UCSI_MESSAGE_IN                        16
  92  #define UCSI_MESSAGE_OUT               32
  93 +#define UCSIv2_MESSAGE_OUT             272
  94 +
  95 +/* UCSI versions */
  96 +#define UCSI_VERSION_1_2       0x0120
  97 +#define UCSI_VERSION_2_0       0x0200
  98 +#define UCSI_VERSION_2_1       0x0210
  99 +#define UCSI_VERSION_3_0       0x0300
 100 +
 101 +#define UCSI_BCD_GET_MAJOR(_v_)                (((_v_) >> 8) & 0xFF)
 102 +#define UCSI_BCD_GET_MINOR(_v_)                (((_v_) >> 4) & 0x0F)
 103 +#define UCSI_BCD_GET_SUBMINOR(_v_)     ((_v_) & 0x0F)
 104
 105  /* Command Status and Connector Change Indication (CCI) bits */
 106  #define UCSI_CCI_CONNECTOR(_c_)                (((_c_) & GENMASK(7, 1)) >> 1)
 107 --
 108 2.43.0
 109