linux-kernel - Re: [RFC PATCHv2] usb: USB Type-C Connector Class

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1464769892.4051.2.camel@suse.com>
Date:	Wed, 01 Jun 2016 10:31:32 +0200
From:	Oliver Neukum <oneukum@...e.com>
To:	Heikki Krogerus <heikki.krogerus@...ux.intel.com>
Cc:	Guenter Roeck <linux@...ck-us.net>,
	Andy Shevchenko <andy.shevchenko@...il.com>,
	Rajaram R <rajaram.officemail@...il.com>,
	Felipe Balbi <felipe.balbi@...ux.intel.com>,
	Mathias Nyman <mathias.nyman@...ux.intel.com>,
	Greg KH <gregkh@...uxfoundation.org>,
	linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org
Subject: Re: [RFC PATCHv2] usb: USB Type-C Connector Class

On Wed, 2016-06-01 at 11:23 +0300, Heikki Krogerus wrote:
> On Tue, May 31, 2016 at 10:20:34AM -0700, Guenter Roeck wrote:
> > On Tue, May 31, 2016 at 03:43:56PM +0300, Heikki Krogerus wrote:
> > > On Tue, May 31, 2016 at 03:09:01PM +0300, Heikki Krogerus wrote:
> > > > On Tue, May 31, 2016 at 10:48:29AM +0200, Oliver Neukum wrote:
> > > > > On Tue, 2016-05-31 at 11:31 +0300, Heikki Krogerus wrote:
> > > > > > Hi Oliver,
> > > > > > 
> > > > > > On Mon, May 30, 2016 at 03:59:27PM +0200, Oliver Neukum wrote:
> > > > > > > On Mon, 2016-05-30 at 16:19 +0300, Heikki Krogerus wrote:
> > > > > > > > Hi guys,
> > > > > > > > 
> > > > > > > > I'm attaching a diff instead of full v3. I'm not yet adding attributes
> > > > > > > > for the reset and cable_reset. I still don't understand what is the
> > > > > > > > case where the userspace would need to be able to tricker reset? Why
> > > > > > > > isn't it enough for the userspace to be able to enter/exit modes?
> > > > > > > > Oliver! Can you please comment?
> > > > > > > 
> > > > > > > 1. Because we need error handling.
> > > > > > >    Devices crash. Cables will crash. We will get out of sync.
> > > > > > >    You never put yourself in a place where you cannot handle an
> > > > > > >    IO error.
> > > > > > > 2. Because it is in the spec. We do not second guess the spec.
> > > > > > >    We implement it.
> > > > > > 
> > > > > > Error conditions and crashes are the responsibility of the USB PD
> > > > > > stack, not userspace. In those cases the stack can not wait for a
> > > > > 
> > > > > Those are not exclusive conditions.
> > > > > 
> > > > > > command from the userspace. So for example if a timer like
> > > > > > NoResponseTimer times out, the stack an its state machines will have
> > > > > > to take care of the reset quite independently.
> > > > > 
> > > > > Yes. But somebody needs to handle high level errors.
> > > > > 
> > > > > > If you get out of sync with an alternate mode, you reset that specific
> > > > > > alternate mode by exiting and re-entering it, and you do not reset the
> > > > > > entire PD connection, port, partner or cable.
> > > > > 
> > > > > That would be the first step. If that doesn't work you will at that
> > > > > point either give up or use the next largest hammer.
> > > > > In principle you could do that in kernel space, but that implies
> > > > > that the kernel can detect all failures. That is unlikely.
> > > > 
> > > > Any PD communication failures the kernel has to be able to detect, so
> > > > I guess you mean failures with the alternate modes themselves, right?
> > > > 
> > > > In that case, surely exiting the mode is enough to "reset" it? When it
> > > > is re-entered, it has to be completely re-configured in any case. I
> > > > don't see how resetting the whole port or cable would guarantee that a
> > > > mode would become any more functional in case of failures? It will
> > > > however make also the other active modes to de-activate even if they
> > > > are functioning fine.
> > > 
> > > Forget about it, I'll just add the reset attributes. I'm still not
> > > clear about their usefulness, but instead they will just create a small
> > > risk, but I can live with that.
> > > 
> > 
> > Given my experience over the last few weeks, I think the added risk
> > may not just be small, and I think the added benefit is questionable.
> > Reset handling is not well implemented in all devices, and manually
> > triggered resets in an unexpected state may make the situation worse.
> > 
> > Can you make it optional ? I may choose not to support it to avoid
> > the risk.
> 
> Maybe I gave up on this too hastily... I changing my mind about this,
> I'm not going to add them. Having them optional is not enough. It
> changes nothing when they are implemented. I think there is a change
> that we would actually end up having to remove the attributes, which
> would be really bad.
> 
> I think we can still add them later if they are still seen as
> necessity later on, tough I seriously doubt it. It would not be
> ideal, but adding an attribute should not really break anything,
> right? Removing would.

That is true. So let's leave it out for now. I still think sane
error handling will require it eventually, but that will be in the
future.

	Regards
		Oliver