linux-kernel - [PATCH 15/31] usb: usbssp: added device controller error, transfer and SETUP completion event.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 12 Jul 2018 06:47:12 +0100
From:   Pawel Laszczak <pawell@...ence.com>
To:     unlisted-recipients:; (no To-header on input)
CC:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        <linux-usb@...r.kernel.org>, Felipe Balbi <balbi@...nel.org>,
        <linux-kernel@...r.kernel.org>, <ltyrala@...ence.com>,
        <adouglas@...ence.com>, <pawell@...ence.com>
Subject: [PATCH 15/31] usb: usbssp: added device controller error, transfer and SETUP completion event.

Patch adds some other completion events used in driver.

The Device Controller Error event is used for detecting
Event Ring Full error.

Transfer event will be implemented in later patches.

SETUP event handles SETUP packet received from host. In interrupt context
driver only preserve the SETUP packet, then postpone handling
it for later. We can't handle all Setup packet in interrupt
context because some of them needs to call command that take some time.

Signed-off-by: Pawel Laszczak <pawell@...ence.com>
---
 drivers/usb/usbssp/gadget-ring.c | 58 ++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/drivers/usb/usbssp/gadget-ring.c b/drivers/usb/usbssp/gadget-ring.c
index 399084963e3b..28b807fbbc64 100644
--- a/drivers/usb/usbssp/gadget-ring.c
+++ b/drivers/usb/usbssp/gadget-ring.c
@@ -1069,6 +1069,18 @@ struct usbssp_segment *usbssp_trb_in_td(struct usbssp_udc *usbssp_data,
 	return NULL;
 }
 
+/*
+ * If this function returns an error condition, it means it got a Transfer
+ * event with a corrupted Slot ID, Endpoint ID, or TRB DMA address.
+ * At this point, the USBSSP controller is probably hosed and should be reset.
+ */
+static int handle_tx_event(struct usbssp_udc *usbssp_data,
+			   struct usbssp_transfer_event *event)
+{
+	/*TODO: implement function handling transfer event*/
+	return 0;
+}
+
 /*
  * This function handles all events on the event ring.
  * Function can defers handling of some events to kernel thread.
@@ -1079,7 +1091,9 @@ int usbssp_handle_event(struct usbssp_udc *usbssp_data)
 {
 	union usbssp_trb *event;
 	int update_ptrs = 1;
+	int ret = 0;
 	__le32 cycle_bit;
+	unsigned int trb_comp_code;
 
 	if (!usbssp_data->event_ring || !usbssp_data->event_ring->dequeue) {
 		usbssp_err(usbssp_data, "ERROR event ring not ready\n");
@@ -1109,6 +1123,50 @@ int usbssp_handle_event(struct usbssp_udc *usbssp_data)
 		handle_port_status(usbssp_data, event);
 		update_ptrs = 0;
 		break;
+	case TRB_TYPE(TRB_TRANSFER):
+		ret = handle_tx_event(usbssp_data, &event->trans_event);
+
+		if (ret >= 0)
+			update_ptrs = 0;
+		break;
+	case TRB_TYPE(TRB_SETUP): {
+		/*handling of SETUP packet are deferred to thread. */
+
+		usbssp_data->ep0state = USBSSP_EP0_SETUP_PHASE;
+		usbssp_data->setupId = TRB_SETUPID_TO_TYPE(event->trans_event.flags);
+		usbssp_data->setup_speed = TRB_SETUP_SPEEDID(event->trans_event.flags);
+
+		/*save current setup packet. It some case it will be used
+		 * latter
+		 */
+		usbssp_data->setup = *((struct usb_ctrlrequest  *)&event->trans_event.buffer);
+
+		usbssp_dbg(usbssp_data,
+			"Setup packet (id: %d) defered to thread\n",
+			usbssp_data->setupId);
+
+		usbssp_data->defered_event |= EVENT_SETUP_PACKET;
+		queue_work(usbssp_data->bottom_irq_wq,
+				&usbssp_data->bottom_irq);
+		break;
+	}
+
+	case TRB_TYPE(TRB_HC_EVENT):
+		trb_comp_code = GET_COMP_CODE(le32_to_cpu(event->generic.field[2]));
+		usbssp_warn(usbssp_data,
+			"Device Controller Error detected with error code 0x%02x\n",
+			trb_comp_code);
+		/* Look for common error cases */
+		switch (trb_comp_code) {
+		case COMP_EVENT_RING_FULL_ERROR:
+			usbssp_dbg(usbssp_data,
+				"Error: Event Ring Full\n");
+			break;
+		default:
+			usbssp_dbg(usbssp_data,
+				"Not supported completion code\n");
+		}
+		break;
 	default:
 		if ((le32_to_cpu(event->event_cmd.flags) & TRB_TYPE_BITMASK) >=
 		    TRB_TYPE(48))
-- 
2.17.1