redonkable/alistair23-linux
redonkable/alistair23-linux
1
0
Fork 0
Code Releases Activity
alistair23-linux/drivers/usb/typec/tps6598x.c
Kees Cook 8d361fa2c2 usb: typec: tps6598x: Remove VLA usage 
In the quest to remove all stack VLA usage from the kernel[1], this
uses the maximum buffer size and adds a sanity check. While 25 bytes
is the size of the largest current things coming through, Heikki
Krogerus pointed out that the actual max in 64 bytes, as per ch 1.3.2
http://www.ti.com/lit/ug/slvuan1a/slvuan1a.pdf

[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com

Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-28 19:49:46 +09:00

523 lines
12 KiB
C
Raw Blame History

// SPDX-License-Identifier: GPL-2.0
/*
* Driver for TI TPS6598x USB Power Delivery controller family
*
* Copyright (C) 2017, Intel Corporation
* Author: Heikki Krogerus <heikki.krogerus@linux.intel.com>
*/
#include <linux/i2c.h>
#include <linux/acpi.h>
#include <linux/module.h>
#include <linux/regmap.h>
#include <linux/interrupt.h>
#include <linux/usb/typec.h>
/* Register offsets */
#define TPS_REG_CMD1 0x08
#define TPS_REG_DATA1 0x09
#define TPS_REG_INT_EVENT1 0x14
#define TPS_REG_INT_EVENT2 0x15
#define TPS_REG_INT_MASK1 0x16
#define TPS_REG_INT_MASK2 0x17
#define TPS_REG_INT_CLEAR1 0x18
#define TPS_REG_INT_CLEAR2 0x19
#define TPS_REG_STATUS 0x1a
#define TPS_REG_SYSTEM_CONF 0x28
#define TPS_REG_CTRL_CONF 0x29
#define TPS_REG_POWER_STATUS 0x3f
#define TPS_REG_RX_IDENTITY_SOP 0x48
/* TPS_REG_INT_* bits */
#define TPS_REG_INT_PLUG_EVENT BIT(3)
/* TPS_REG_STATUS bits */
#define TPS_STATUS_PLUG_PRESENT BIT(0)
#define TPS_STATUS_ORIENTATION BIT(4)
#define TPS_STATUS_PORTROLE(s) (!!((s) & BIT(5)))
#define TPS_STATUS_DATAROLE(s) (!!((s) & BIT(6)))
#define TPS_STATUS_VCONN(s) (!!((s) & BIT(7)))
/* TPS_REG_SYSTEM_CONF bits */
#define TPS_SYSCONF_PORTINFO(c) ((c) & 3)
enum {
TPS_PORTINFO_SINK,
TPS_PORTINFO_SINK_ACCESSORY,
TPS_PORTINFO_DRP_UFP,
TPS_PORTINFO_DRP_UFP_DRD,
TPS_PORTINFO_DRP_DFP,
TPS_PORTINFO_DRP_DFP_DRD,
TPS_PORTINFO_SOURCE,
};
/* TPS_REG_POWER_STATUS bits */
#define TPS_POWER_STATUS_SOURCESINK BIT(1)
#define TPS_POWER_STATUS_PWROPMODE(p) (((p) & GENMASK(3, 2)) >> 2)
/* TPS_REG_RX_IDENTITY_SOP */
struct tps6598x_rx_identity_reg {
u8 status;
struct usb_pd_identity identity;
u32 vdo[3];
} __packed;
/* Standard Task return codes */
#define TPS_TASK_TIMEOUT 1
#define TPS_TASK_REJECTED 3
/* Unrecognized commands will be replaced with "!CMD" */
#define INVALID_CMD(_cmd_) (_cmd_ == 0x444d4321)
struct tps6598x {
struct device *dev;
struct regmap *regmap;
struct mutex lock; /* device lock */
u8 i2c_protocol:1;
struct typec_port *port;
struct typec_partner *partner;
struct usb_pd_identity partner_identity;
struct typec_capability typec_cap;
};
/*
* Max data bytes for Data1, Data2, and other registers. See ch 1.3.2:
* http://www.ti.com/lit/ug/slvuan1a/slvuan1a.pdf
*/
#define TPS_MAX_LEN 64
static int
tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len)
{
u8 data[TPS_MAX_LEN + 1];
int ret;
if (WARN_ON(len + 1 > sizeof(data)))
return -EINVAL;
if (!tps->i2c_protocol)
return regmap_raw_read(tps->regmap, reg, val, len);
ret = regmap_raw_read(tps->regmap, reg, data, sizeof(data));
if (ret)
return ret;
if (data[0] < len)
return -EIO;
memcpy(val, &data[1], len);
return 0;
}
static inline int tps6598x_read16(struct tps6598x *tps, u8 reg, u16 *val)
{
return tps6598x_block_read(tps, reg, val, sizeof(u16));
}
static inline int tps6598x_read32(struct tps6598x *tps, u8 reg, u32 *val)
{
return tps6598x_block_read(tps, reg, val, sizeof(u32));
}
static inline int tps6598x_read64(struct tps6598x *tps, u8 reg, u64 *val)
{
return tps6598x_block_read(tps, reg, val, sizeof(u64));
}
static inline int tps6598x_write16(struct tps6598x *tps, u8 reg, u16 val)
{
return regmap_raw_write(tps->regmap, reg, &val, sizeof(u16));
}
static inline int tps6598x_write32(struct tps6598x *tps, u8 reg, u32 val)
{
return regmap_raw_write(tps->regmap, reg, &val, sizeof(u32));
}
static inline int tps6598x_write64(struct tps6598x *tps, u8 reg, u64 val)
{
return regmap_raw_write(tps->regmap, reg, &val, sizeof(u64));
}
static inline int
tps6598x_write_4cc(struct tps6598x *tps, u8 reg, const char *val)
{
return regmap_raw_write(tps->regmap, reg, &val, sizeof(u32));
}
static int tps6598x_read_partner_identity(struct tps6598x *tps)
{
struct tps6598x_rx_identity_reg id;
int ret;
ret = tps6598x_block_read(tps, TPS_REG_RX_IDENTITY_SOP,
&id, sizeof(id));
if (ret)
return ret;
tps->partner_identity = id.identity;
return 0;
}
static int tps6598x_connect(struct tps6598x *tps, u32 status)
{
struct typec_partner_desc desc;
enum typec_pwr_opmode mode;
u16 pwr_status;
int ret;
if (tps->partner)
return 0;
ret = tps6598x_read16(tps, TPS_REG_POWER_STATUS, &pwr_status);
if (ret < 0)
return ret;
mode = TPS_POWER_STATUS_PWROPMODE(pwr_status);
desc.usb_pd = mode == TYPEC_PWR_MODE_PD;
desc.accessory = TYPEC_ACCESSORY_NONE; /* XXX: handle accessories */
desc.identity = NULL;
if (desc.usb_pd) {
ret = tps6598x_read_partner_identity(tps);
if (ret)
return ret;
desc.identity = &tps->partner_identity;
}
typec_set_pwr_opmode(tps->port, mode);
typec_set_pwr_role(tps->port, TPS_STATUS_PORTROLE(status));
typec_set_vconn_role(tps->port, TPS_STATUS_VCONN(status));
typec_set_data_role(tps->port, TPS_STATUS_DATAROLE(status));
tps->partner = typec_register_partner(tps->port, &desc);
if (IS_ERR(tps->partner))
return PTR_ERR(tps->partner);
if (desc.identity)
typec_partner_set_identity(tps->partner);
return 0;
}
static void tps6598x_disconnect(struct tps6598x *tps, u32 status)
{
if (!IS_ERR(tps->partner))
typec_unregister_partner(tps->partner);
tps->partner = NULL;
typec_set_pwr_opmode(tps->port, TYPEC_PWR_MODE_USB);
typec_set_pwr_role(tps->port, TPS_STATUS_PORTROLE(status));
typec_set_vconn_role(tps->port, TPS_STATUS_VCONN(status));
typec_set_data_role(tps->port, TPS_STATUS_DATAROLE(status));
}
static int tps6598x_exec_cmd(struct tps6598x *tps, const char *cmd,
size_t in_len, u8 *in_data,
size_t out_len, u8 *out_data)
{
unsigned long timeout;
u32 val;
int ret;
ret = tps6598x_read32(tps, TPS_REG_CMD1, &val);
if (ret)
return ret;
if (val && !INVALID_CMD(val))
return -EBUSY;
if (in_len) {
ret = regmap_raw_write(tps->regmap, TPS_REG_DATA1,
in_data, in_len);
if (ret)
return ret;
}
ret = tps6598x_write_4cc(tps, TPS_REG_CMD1, cmd);
if (ret < 0)
return ret;
/* XXX: Using 1s for now, but it may not be enough for every command. */
timeout = jiffies + msecs_to_jiffies(1000);
do {
ret = tps6598x_read32(tps, TPS_REG_CMD1, &val);
if (ret)
return ret;
if (INVALID_CMD(val))
return -EINVAL;
if (time_is_before_jiffies(timeout))
return -ETIMEDOUT;
} while (val);
if (out_len) {
ret = tps6598x_block_read(tps, TPS_REG_DATA1,
out_data, out_len);
if (ret)
return ret;
val = out_data[0];
} else {
ret = tps6598x_block_read(tps, TPS_REG_DATA1, &val, sizeof(u8));
if (ret)
return ret;
}
switch (val) {
case TPS_TASK_TIMEOUT:
return -ETIMEDOUT;
case TPS_TASK_REJECTED:
return -EPERM;
default:
break;
}
return 0;
}
static int
tps6598x_dr_set(const struct typec_capability *cap, enum typec_data_role role)
{
struct tps6598x *tps = container_of(cap, struct tps6598x, typec_cap);
const char *cmd = (role == TYPEC_DEVICE) ? "SWUF" : "SWDF";
u32 status;
int ret;
mutex_lock(&tps->lock);
ret = tps6598x_exec_cmd(tps, cmd, 0, NULL, 0, NULL);
if (ret)
goto out_unlock;
ret = tps6598x_read32(tps, TPS_REG_STATUS, &status);
if (ret)
goto out_unlock;
if (role != TPS_STATUS_DATAROLE(status)) {
ret = -EPROTO;
goto out_unlock;
}
typec_set_data_role(tps->port, role);
out_unlock:
mutex_unlock(&tps->lock);
return ret;
}
static int
tps6598x_pr_set(const struct typec_capability *cap, enum typec_role role)
{
struct tps6598x *tps = container_of(cap, struct tps6598x, typec_cap);
const char *cmd = (role == TYPEC_SINK) ? "SWSk" : "SWSr";
u32 status;
int ret;
mutex_lock(&tps->lock);
ret = tps6598x_exec_cmd(tps, cmd, 0, NULL, 0, NULL);
if (ret)
goto out_unlock;
ret = tps6598x_read32(tps, TPS_REG_STATUS, &status);
if (ret)
goto out_unlock;
if (role != TPS_STATUS_PORTROLE(status)) {
ret = -EPROTO;
goto out_unlock;
}
typec_set_pwr_role(tps->port, role);
out_unlock:
mutex_unlock(&tps->lock);
return ret;
}
static irqreturn_t tps6598x_interrupt(int irq, void *data)
{
struct tps6598x *tps = data;
u64 event1;
u64 event2;
u32 status;
int ret;
mutex_lock(&tps->lock);
ret = tps6598x_read64(tps, TPS_REG_INT_EVENT1, &event1);
ret |= tps6598x_read64(tps, TPS_REG_INT_EVENT2, &event2);
if (ret) {
dev_err(tps->dev, "%s: failed to read events\n", __func__);
goto err_unlock;
}
ret = tps6598x_read32(tps, TPS_REG_STATUS, &status);
if (ret) {
dev_err(tps->dev, "%s: failed to read status\n", __func__);
goto err_clear_ints;
}
/* Handle plug insert or removal */
if ((event1 | event2) & TPS_REG_INT_PLUG_EVENT) {
if (status & TPS_STATUS_PLUG_PRESENT) {
ret = tps6598x_connect(tps, status);
if (ret)
dev_err(tps->dev,
"failed to register partner\n");
} else {
tps6598x_disconnect(tps, status);
}
}
err_clear_ints:
tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event1);
tps6598x_write64(tps, TPS_REG_INT_CLEAR2, event2);
err_unlock:
mutex_unlock(&tps->lock);
return IRQ_HANDLED;
}
static const struct regmap_config tps6598x_regmap_config = {
.reg_bits = 8,
.val_bits = 8,
.max_register = 0x7F,
};
static int tps6598x_probe(struct i2c_client *client)
{
struct tps6598x *tps;
u32 status;
u32 conf;
u32 vid;
int ret;
tps = devm_kzalloc(&client->dev, sizeof(*tps), GFP_KERNEL);
if (!tps)
return -ENOMEM;
mutex_init(&tps->lock);
tps->dev = &client->dev;
tps->regmap = devm_regmap_init_i2c(client, &tps6598x_regmap_config);
if (IS_ERR(tps->regmap))
return PTR_ERR(tps->regmap);
ret = tps6598x_read32(tps, 0, &vid);
if (ret < 0)
return ret;
if (!vid)
return -ENODEV;
/*
* Checking can the adapter handle SMBus protocol. If it can not, the
* driver needs to take care of block reads separately.
*
* FIXME: Testing with I2C_FUNC_I2C. regmap-i2c uses I2C protocol
* unconditionally if the adapter has I2C_FUNC_I2C set.
*/
if (i2c_check_functionality(client->adapter, I2C_FUNC_I2C))
tps->i2c_protocol = true;
ret = tps6598x_read32(tps, TPS_REG_STATUS, &status);
if (ret < 0)
return ret;
ret = tps6598x_read32(tps, TPS_REG_SYSTEM_CONF, &conf);
if (ret < 0)
return ret;
tps->typec_cap.revision = USB_TYPEC_REV_1_2;
tps->typec_cap.pd_revision = 0x200;
tps->typec_cap.prefer_role = TYPEC_NO_PREFERRED_ROLE;
tps->typec_cap.pr_set = tps6598x_pr_set;
tps->typec_cap.dr_set = tps6598x_dr_set;
switch (TPS_SYSCONF_PORTINFO(conf)) {
case TPS_PORTINFO_SINK_ACCESSORY:
case TPS_PORTINFO_SINK:
tps->typec_cap.type = TYPEC_PORT_SNK;
tps->typec_cap.data = TYPEC_PORT_UFP;
break;
case TPS_PORTINFO_DRP_UFP_DRD:
case TPS_PORTINFO_DRP_DFP_DRD:
tps->typec_cap.type = TYPEC_PORT_DRP;
tps->typec_cap.data = TYPEC_PORT_DRD;
break;
case TPS_PORTINFO_DRP_UFP:
tps->typec_cap.type = TYPEC_PORT_DRP;
tps->typec_cap.data = TYPEC_PORT_UFP;
break;
case TPS_PORTINFO_DRP_DFP:
tps->typec_cap.type = TYPEC_PORT_DRP;
tps->typec_cap.data = TYPEC_PORT_DFP;
break;
case TPS_PORTINFO_SOURCE:
tps->typec_cap.type = TYPEC_PORT_SRC;
tps->typec_cap.data = TYPEC_PORT_DFP;
break;
default:
return -ENODEV;
}
tps->port = typec_register_port(&client->dev, &tps->typec_cap);
if (IS_ERR(tps->port))
return PTR_ERR(tps->port);
if (status & TPS_STATUS_PLUG_PRESENT) {
ret = tps6598x_connect(tps, status);
if (ret)
dev_err(&client->dev, "failed to register partner\n");
}
ret = devm_request_threaded_irq(&client->dev, client->irq, NULL,
tps6598x_interrupt,
IRQF_SHARED | IRQF_ONESHOT,
dev_name(&client->dev), tps);
if (ret) {
tps6598x_disconnect(tps, 0);
typec_unregister_port(tps->port);
return ret;
}
i2c_set_clientdata(client, tps);
return 0;
}
static int tps6598x_remove(struct i2c_client *client)
{
struct tps6598x *tps = i2c_get_clientdata(client);
tps6598x_disconnect(tps, 0);
typec_unregister_port(tps->port);
return 0;
}
static const struct acpi_device_id tps6598x_acpi_match[] = {
{ "INT3515", 0 },
{ }
};
MODULE_DEVICE_TABLE(acpi, tps6598x_acpi_match);
static struct i2c_driver tps6598x_i2c_driver = {
.driver = {
.name = "tps6598x",
.acpi_match_table = tps6598x_acpi_match,
},
.probe_new = tps6598x_probe,
.remove = tps6598x_remove,
};
module_i2c_driver(tps6598x_i2c_driver);
MODULE_AUTHOR("Heikki Krogerus <heikki.krogerus@linux.intel.com>");
MODULE_LICENSE("GPL v2");
MODULE_DESCRIPTION("TI TPS6598x USB Power Delivery Controller Driver");
View git blame Copy permalink