linux-kernel - RE: [PATCH] usb: dwc3: usb/dwc3: fake dissconnect event when turn off pullup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 27 Apr 2016 11:27:08 +0000
From:	"Du, Changbin" <changbin.du@...el.com>
To:	Felipe Balbi <balbi@...nel.org>
CC:	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] usb: dwc3: usb/dwc3: fake dissconnect event when turn
 off pullup

Hi, Balbi,

The step to reproduce this issue is:
1) connect device to a host and wait its enumeration.
2) trigger software disconnect by calling function
    usb_gadget_disconnect(), which finally call
   dwc3_gadget_pullup(false). Do not reconnect device
  (I mean no enumeration go on, keep bit Run/Stop 0.).

At here, gadget driver's disconnect callback should be
Called, right? We has been disconnected. But no, as
You said " not generating disconnect IRQ after you
drop Run/Stop is expected".

And I am testing on an Android device, Android only
use dwc3_gadget_pullup(false) to issue a soft disconnection.
This confused user that the UI still show usb as connected
State, caused by missing a disconnect event.

> Hi,
> 
> changbin.du@...el.com writes:
> > From: "Du, Changbin" <changbin.du@...el.com>
> >
> > The dwc3 controller can't generate a disconnect event after it is
> > stopped. Thus gadget dissconnect callback is not invoked when do
> 
> not generating disconnect IRQ after you drop Run/Stop is expected.
> 
> > soft dissconnect. Call dissconnect here to workaround this issue.
> 
> I'm rather sure this is a bug elsewhere. How do you trigger this ?
> 
> > Note, most time we still see disconnect be called that because
> > it is invoked by dwc3_gadget_reset_interrupt(). But if we
> > disconnect cable once pullup disabled quickly, issue can be
> > observed.
> 
> I can't understand what you're trying to say with this.
> 
> > Signed-off-by: Du, Changbin <changbin.du@...el.com>
> > ---
> >  drivers/usb/dwc3/gadget.c | 33 ++++++++++++++++++++++++---------
> >  1 file changed, 24 insertions(+), 9 deletions(-)
> >
> > diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> > index 8e4a1b1..cd73187 100644
> > --- a/drivers/usb/dwc3/gadget.c
> > +++ b/drivers/usb/dwc3/gadget.c
> > @@ -1566,6 +1566,15 @@ static int dwc3_gadget_run_stop(struct dwc3
> *dwc, int is_on, int suspend)
> >  	return 0;
> >  }
> >
> > +static void dwc3_disconnect_gadget(struct dwc3 *dwc)
> > +{
> > +	if (dwc->gadget_driver && dwc->gadget_driver->disconnect) {
> > +		spin_unlock(&dwc->lock);
> > +		dwc->gadget_driver->disconnect(&dwc->gadget);
> > +		spin_lock(&dwc->lock);
> > +	}
> > +}
> > +
> >  static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
> >  {
> >  	struct dwc3		*dwc = gadget_to_dwc(g);
> > @@ -1575,6 +1584,21 @@ static int dwc3_gadget_pullup(struct usb_gadget
> *g, int is_on)
> >  	is_on = !!is_on;
> >
> >  	spin_lock_irqsave(&dwc->lock, flags);
> > +	/**
> > +	 * WORKAROUND: The dwc3 controller can't generate a disconnect
> > +	 * event after it is stopped. Thus gadget dissconnect callback
> > +	 * is not invoked when do soft dissconnect. Call dissconnect
> > +	 * here to workaround this issue.
> > +	 * Note, most time we still see disconnect be called that because
> > +	 * it is invoked by dwc3_gadget_reset_interrupt(). But if we
> > +	 * disconnect cable once pullup disabled quickly, issue can be
> > +	 * observed.
> > +	 */
> > +	if (!is_on && (dwc->gadget.speed != USB_SPEED_UNKNOWN)) {
> > +		dev_dbg(dwc->dev, "fake dissconnect event on pullup
> off\n");
> > +		dwc3_disconnect_gadget(dwc);
> > +		dwc->gadget.speed = USB_SPEED_UNKNOWN;
> > +	}
> 
> this is *really* wrong. You shouldn't be calling pullup directly. This
> patch looks wrong and you didn't even explain how to trigger this
> problem; when does the problem happen ?
> 
> Gadget load/unload does the right thing here, so that can't be the
> case. We also do the right thing on soft_connect sysfs file:
> 
> static ssize_t usb_udc_softconn_store(struct device *dev,
> 		struct device_attribute *attr, const char *buf, size_t n)
> {
> 	struct usb_udc		*udc = container_of(dev, struct usb_udc,
> dev);
> 
> 	if (!udc->driver) {
> 		dev_err(dev, "soft-connect without a gadget driver\n");
> 		return -EOPNOTSUPP;
> 	}
> 
> 	if (sysfs_streq(buf, "connect")) {
> 		usb_gadget_udc_start(udc);
> 		usb_gadget_connect(udc->gadget);
> 	} else if (sysfs_streq(buf, "disconnect")) {
> 		usb_gadget_disconnect(udc->gadget);
> 		udc->driver->disconnect(udc->gadget);
> 		usb_gadget_udc_stop(udc);
> 	} else {
> 		dev_err(dev, "unsupported command '%s'\n", buf);
> 		return -EINVAL;
> 	}
> 
> 	return n;
> }
> static DEVICE_ATTR(soft_connect, S_IWUSR, NULL,
> usb_udc_softconn_store);
> 
> So really, what _is_ the problem ?
> 
> --
> balbi