| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <t3hfr33t76ckecatro5gheycb2phnch57m6zzdpm44ibykbubd@e6nffasyetib>
Date: Fri, 26 Sep 2025 00:43:51 +0300
From: Dmitry Baryshkov <dmitry.baryshkov@....qualcomm.com>
To: Anjelique Melendez <anjelique.melendez@....qualcomm.com>
Cc: heikki.krogerus@...ux.intel.com, gregkh@...uxfoundation.org,
lumag@...nel.org, neil.armstrong@...aro.org, johan+linaro@...nel.org,
quic_bjorande@...cinc.com, linux-usb@...r.kernel.org,
linux-kernel@...r.kernel.org, linux-arm-msm@...r.kernel.org
Subject: Re: [PATCH v4 2/2] usb: typec: ucsi_glink: Increase buffer size to
support UCSI v2
On Wed, Sep 24, 2025 at 04:26:31PM -0700, Anjelique Melendez wrote:
> UCSI v2 specification has increased the MSG_IN and MSG_OUT size from
> 16 bytes to 256 bytes each for the message exchange between OPM and PPM
> This makes the total buffer size increase from 48 bytes to 528 bytes.
> Update the buffer size to support this increase.
>
> Signed-off-by: Anjelique Melendez <anjelique.melendez@....qualcomm.com>
> ---
> drivers/usb/typec/ucsi/ucsi_glink.c | 81 ++++++++++++++++++++++++-----
> 1 file changed, 68 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/usb/typec/ucsi/ucsi_glink.c b/drivers/usb/typec/ucsi/ucsi_glink.c
> index 1f9f0d942c1a..7f19b4d23fed 100644
> --- a/drivers/usb/typec/ucsi/ucsi_glink.c
> +++ b/drivers/usb/typec/ucsi/ucsi_glink.c
> @@ -16,10 +16,10 @@
>
> #define PMIC_GLINK_MAX_PORTS 3
>
> -#define UCSI_BUF_SIZE 48
> +#define UCSI_BUF_V1_SIZE (UCSI_MESSAGE_OUT + (UCSI_MESSAGE_OUT - UCSI_MESSAGE_IN))
> +#define UCSI_BUF_V2_SIZE (UCSIv2_MESSAGE_OUT + (UCSIv2_MESSAGE_OUT - UCSI_MESSAGE_IN))
>
> #define MSG_TYPE_REQ_RESP 1
> -#define UCSI_BUF_SIZE 48
>
> #define UC_NOTIFY_RECEIVER_UCSI 0x0
> #define UC_UCSI_READ_BUF_REQ 0x11
> @@ -30,15 +30,27 @@ struct ucsi_read_buf_req_msg {
> struct pmic_glink_hdr hdr;
> };
>
> -struct __packed ucsi_read_buf_resp_msg {
> +struct __packed ucsi_v1_read_buf_resp_msg {
> struct pmic_glink_hdr hdr;
> - u8 buf[UCSI_BUF_SIZE];
> + u8 buf[UCSI_BUF_V1_SIZE];
> u32 ret_code;
> };
>
> -struct __packed ucsi_write_buf_req_msg {
> +struct __packed ucsi_v2_read_buf_resp_msg {
> struct pmic_glink_hdr hdr;
> - u8 buf[UCSI_BUF_SIZE];
> + u8 buf[UCSI_BUF_V2_SIZE];
> + u32 ret_code;
> +};
> +
> +struct __packed ucsi_v1_write_buf_req_msg {
> + struct pmic_glink_hdr hdr;
> + u8 buf[UCSI_BUF_V1_SIZE];
> + u32 reserved;
> +};
> +
> +struct __packed ucsi_v2_write_buf_req_msg {
> + struct pmic_glink_hdr hdr;
> + u8 buf[UCSI_BUF_V2_SIZE];
> u32 reserved;
> };
>
> @@ -72,7 +84,7 @@ struct pmic_glink_ucsi {
> bool ucsi_registered;
> bool pd_running;
>
> - u8 read_buf[UCSI_BUF_SIZE];
> + u8 read_buf[UCSI_BUF_V2_SIZE];
> };
>
> static int pmic_glink_ucsi_read(struct ucsi *__ucsi, unsigned int offset,
> @@ -131,18 +143,34 @@ static int pmic_glink_ucsi_read_message_in(struct ucsi *ucsi, void *val, size_t
> static int pmic_glink_ucsi_locked_write(struct pmic_glink_ucsi *ucsi, unsigned int offset,
> const void *val, size_t val_len)
> {
> - struct ucsi_write_buf_req_msg req = {};
> - unsigned long left;
> + struct ucsi_v2_write_buf_req_msg req = {};
> + unsigned long left, max_buf_len;
> + size_t req_len;
> int ret;
>
> + memset(&req, 0, sizeof(req));
> req.hdr.owner = PMIC_GLINK_OWNER_USBC;
> req.hdr.type = MSG_TYPE_REQ_RESP;
> req.hdr.opcode = UC_UCSI_WRITE_BUF_REQ;
> +
> + if (ucsi->ucsi->version >= UCSI_VERSION_2_0) {
> + req_len = sizeof(struct ucsi_v2_write_buf_req_msg);
> + max_buf_len = UCSI_BUF_V2_SIZE;
I'd prefer it to be more explicit. Define an union of v1 and v2, fill
common parts and version-specific parts separately.
> + } else if (ucsi->ucsi->version) {
> + req_len = sizeof(struct ucsi_v1_write_buf_req_msg);
> + max_buf_len = UCSI_BUF_V1_SIZE;
> + } else {
> + return -EINVAL;
> + }
> +
> + if (offset + val_len > max_buf_len)
> + return -EINVAL;
> +
> memcpy(&req.buf[offset], val, val_len);
>
> reinit_completion(&ucsi->write_ack);
>
> - ret = pmic_glink_send(ucsi->client, &req, sizeof(req));
> + ret = pmic_glink_send(ucsi->client, &req, req_len);
> if (ret < 0) {
> dev_err(ucsi->dev, "failed to send UCSI write request: %d\n", ret);
> return ret;
> @@ -216,12 +244,39 @@ static const struct ucsi_operations pmic_glink_ucsi_ops = {
>
> static void pmic_glink_ucsi_read_ack(struct pmic_glink_ucsi *ucsi, const void *data, int len)
> {
> - const struct ucsi_read_buf_resp_msg *resp = data;
> + u8 *buf = ((struct ucsi_v2_read_buf_resp_msg *)data)->buf;
> + u32 ret_code, max_len;
> + u32 buf_len = 0;
> +
> + if (ucsi->ucsi->version) {
> + if (ucsi->ucsi->version >= UCSI_VERSION_2_0)
> + buf_len = UCSI_BUF_V2_SIZE;
> + else
> + buf_len = UCSI_BUF_V1_SIZE;
> + } else if (!ucsi->ucsi_registered) {
> + /*
> + * If UCSI version is not known yet because device is not registered,
> + * choose buffer size which best fits incoming data
> + */
> + if (len > sizeof(struct pmic_glink_hdr) + UCSI_BUF_V2_SIZE)
> + buf_len = UCSI_BUF_V2_SIZE;
> + else
> + buf_len = UCSI_BUF_V1_SIZE;
> + }
>
> - if (resp->ret_code)
> + max_len = sizeof(struct pmic_glink_hdr) + buf_len + sizeof(u32);
> +
> + if (len > max_len)
> + return;
> +
> + if (buf_len > len - sizeof(struct pmic_glink_hdr) - sizeof(u32))
> + buf_len = len - sizeof(struct pmic_glink_hdr) - sizeof(u32);
Comment?
> +
> + memcpy(&ret_code, buf + buf_len, sizeof(u32));
> + if (ret_code)
> return;
>
> - memcpy(ucsi->read_buf, resp->buf, UCSI_BUF_SIZE);
> + memcpy(ucsi->read_buf, buf, buf_len);
> complete(&ucsi->read_ack);
> }
>
> --
> 2.34.1
>
--
With best wishes
Dmitry
Powered by blists - more mailing lists