linux-kernel - [LINUX PATCH] usb: xhci: Add toggle cycle bit for the last seg trb when cached ring is used

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 31 May 2017 19:11:50 +0530
From:   Anurag Kumar Vulisha <anurag.kumar.vulisha@...inx.com>
To:     <mathias.nyman@...el.com>, <gregkh@...uxfoundation.org>
CC:     <linux-usb@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <anirudh@...inx.com>, Anurag Kumar Vulisha <anuragku@...inx.com>
Subject: [LINUX PATCH] usb: xhci: Add toggle cycle bit for the last seg trb when cached ring is used

At present USB 2.0 cameras fail to play when run for 2nd time or greater.
This issue occurs only when previous endpoint cached ring is used instead
of allocating a new endpoint ring. The root cause of the problem narrows
down to the Toggle bit, which is not getting set on the last trb of the
cached ring last segment. When the controller fetches the last link trb
with no toggle bit set, abnormal behaviour is generated.
This patch solves that problem by adding the TOGGLE bit for the last trb
of the last segment of the cached ring.

Signed-off-by: Anurag Kumar Vulisha <anuragku@...inx.com>
---
 drivers/usb/host/xhci-mem.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 1f1687e..3e59ba9 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -455,6 +455,14 @@ static void xhci_reinit_cached_ring(struct xhci_hcd *xhci,
 	} while (seg != ring->first_seg);
 	ring->type = type;
 	xhci_initialize_ring_info(ring, cycle_state);
+
+	/* Only event ring does not use link TRB */
+	if (type != TYPE_EVENT) {
+		/* See xhci spec section 4.9.2.1 and 6.4.4.1 */
+		ring->last_seg->trbs[TRBS_PER_SEGMENT - 1].link.control |=
+			cpu_to_le32(LINK_TOGGLE);
+	}
+
 	/* td list should be empty since all URBs have been cancelled,
 	 * but just in case...
 	 */
-- 
2.1.1