linux-kernel - [PATCH 1/2] usb: host: Implement workaround for Erratum A-009611

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 11 Sep 2017 17:41:32 +0800
From:   <yinbo.zhu@....com>
To:     <yinbo.zhu@....com>
CC:     Mathias Nyman <mathias.nyman@...el.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "open list:USB XHCI DRIVER" <linux-usb@...r.kernel.org>,
        open list <linux-kernel@...r.kernel.org>
Subject: [PATCH 1/2] usb: host: Implement workaround for Erratum A-009611

From: "yinbo.zhu" <yinbo.zhu@....com>

Description: This is a occasional problem where the software
issues an End Transfer command while a USB transfer is in progress,
resulting in the TxFIFO  being flushed when the lower layer is waiting
for data,causing the super speed (SS) transmit to get blocked.
If the End Transfer command is issued on an IN endpoint to
flush out the pending transfers when the same IN endpoint
is doing transfers on the USB, then depending upon the timing
of the End Transfer (and the resulting internal FIFO flush),the
lower layer (U3PTL/U3MAC) could get stuck waiting for data
indefinitely. This blocks the transmission path on the SS, and no
DP/ACK/ERDY/DEVNOTIF packets can be sent from the device.
Impact: If this issue happens and the transmission gets blocked,
then the USB host aborts and resets/re-enumerates the device.
This unblocks the transmitt engine and the device functions normally.

Workaround: Software must wait for all existing TRBs to complete before
issuing End transfer command.

Signed-off-by: yinbo.zhu <yinbo.zhu@....com>
---
 drivers/usb/host/xhci.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2d6a98c1dc12..35f7821bc8b2 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1501,13 +1501,22 @@ static int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 			ret = -ENOMEM;
 			goto done;
 		}
-		ep->ep_state |= EP_STOP_CMD_PENDING;
-		ep->stop_cmd_timer.expires = jiffies +
-			XHCI_STOP_EP_CMD_TIMEOUT * HZ;
-		add_timer(&ep->stop_cmd_timer);
-		xhci_queue_stop_endpoint(xhci, command, urb->dev->slot_id,
-					 ep_index, 0);
-		xhci_ring_cmd_db(xhci);
+
+		/*
+		 *A-009611: Issuing an End Transfer command on an IN endpoint.
+		 *when a transfer is in progress on USB blocks the transmission
+		 *Workaround: Software must wait for all existing TRBs to
+		 *complete before issuing End transfer command.
+		 */
+		if (ep_ring->enqueue == ep_ring->dequeue) {
+			ep->ep_state |= EP_STOP_CMD_PENDING;
+			ep->stop_cmd_timer.expires = jiffies +
+				XHCI_STOP_EP_CMD_TIMEOUT * HZ;
+			add_timer(&ep->stop_cmd_timer);
+			xhci_queue_stop_endpoint(xhci, command,
+			urb->dev->slot_id, ep_index, 0);
+			xhci_ring_cmd_db(xhci);
+		}
 	}
 done:
 	spin_unlock_irqrestore(&xhci->lock, flags);
-- 
2.14.1