| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1557403395-30877-1-git-send-email-jilin@nvidia.com>
Date: Thu, 9 May 2019 20:03:15 +0800
From: Jim Lin <jilin@...dia.com>
To: <gregkh@...uxfoundation.org>, <mathias.nyman@...el.com>,
<stern@...land.harvard.edu>, <kai.heng.feng@...onical.com>,
<drinkcat@...omium.org>, <keescook@...omium.org>,
<nsaenzjulienne@...e.de>, <jflat@...omium.org>, <malat@...ian.org>
CC: <linux-usb@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
Jim Lin <jilin@...dia.com>
Subject: [PATCH v7 1/1] usb: xhci: Add Clear_TT_Buffer
USB 2.0 specification chapter 11.17.5 says "as part of endpoint halt
processing for full-/low-speed endpoints connected via a TT, the host
software must use the Clear_TT_Buffer request to the TT to ensure
that the buffer is not in the busy state".
In our case, a full-speed speaker (ConferenceCam) is behind a high-
speed hub (ConferenceCam Connect), sometimes once we get STALL on a
request we may continue to get STALL with the folllowing requests,
like Set_Interface.
Solution is to invoke usb_hub_clear_tt_buffer() to send
Clear_TT_Buffer request to the hub of the device for the following
Set_Interface requests to the device to get ACK successfully.
The Clear_TT_Buffer request sent to the hub includes the address of
the LS/FS child device in wValue field. usb_hub_clear_tt_buffer()
uses udev->devnum to set the address wValue. This won't work for
devices connected to xHC.
For other host controllers udev->devnum is the same as the address of
the usb device, chosen and set by usb core. With xHC the controller
hardware assigns the address, and won't be the same as devnum.
In the fix we add devaddr field in "struct usb_device" (usb.h),
update it in the address_device callback function of XHCI driver.
In usb_hub_clear_tt_buffer() we use udev->devaddr in wValue field if
hcd driver has address_device callback function defined.
Signed-off-by: Jim Lin <jilin@...dia.com>
---
v2: xhci_clear_tt_buffer_complete: add static, shorter indentation
, remove its claiming in xhci.h
v3: Add description for clearing_tt (xhci.h)
v4: Remove clearing_tt flag because hub_tt_work has hub->tt.lock
to protect for Clear_TT_Buffer to be run serially.
Remove xhci_clear_tt_buffer_complete as it's not necessary.
Same reason as the above.
Extend usb_hub_clear_tt_buffer parameter
v5: Not extending usb_hub_clear_tt_buffer parameter
Add description.
v6: Remove unused parameter slot_id from xhci_clear_hub_tt_buffer
v7: Add devaddr field in "struct usb_device"
drivers/usb/core/hub.c | 6 +++++-
drivers/usb/host/xhci-ring.c | 12 ++++++++++++
drivers/usb/host/xhci.c | 1 +
include/linux/usb.h | 2 ++
4 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 15a2934dc29d..a6621e151c8c 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -858,6 +858,7 @@ int usb_hub_clear_tt_buffer(struct urb *urb)
struct usb_tt *tt = udev->tt;
unsigned long flags;
struct usb_tt_clear *clear;
+ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
/* we've got to cope with an arbitrary number of pending TT clears,
* since each TT has "at least two" buffers that can need it (and
@@ -873,7 +874,10 @@ int usb_hub_clear_tt_buffer(struct urb *urb)
/* info that CLEAR_TT_BUFFER needs */
clear->tt = tt->multi ? udev->ttport : 1;
clear->devinfo = usb_pipeendpoint (pipe);
- clear->devinfo |= udev->devnum << 4;
+ if (hcd->driver->address_device)
+ clear->devinfo |= udev->devaddr << 4;
+ else
+ clear->devinfo |= udev->devnum << 4;
clear->devinfo |= usb_pipecontrol(pipe)
? (USB_ENDPOINT_XFER_CONTROL << 11)
: (USB_ENDPOINT_XFER_BULK << 11);
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 9215a28dad40..739737faf752 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1786,6 +1786,17 @@ struct xhci_segment *trb_in_td(struct xhci_hcd *xhci,
return NULL;
}
+static void xhci_clear_hub_tt_buffer(struct xhci_hcd *xhci, struct xhci_td *td)
+{
+ /*
+ * As part of low/full-speed endpoint-halt processing
+ * we must clear the TT buffer (USB 2.0 specification 11.17.5).
+ */
+ if (td->urb->dev->tt && !usb_pipeint(td->urb->pipe) &&
+ (td->urb->dev->tt->hub != xhci_to_hcd(xhci)->self.root_hub))
+ usb_hub_clear_tt_buffer(td->urb);
+}
+
static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
unsigned int slot_id, unsigned int ep_index,
unsigned int stream_id, struct xhci_td *td,
@@ -1804,6 +1815,7 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
if (reset_type == EP_HARD_RESET) {
ep->ep_state |= EP_HARD_CLEAR_TOGGLE;
xhci_cleanup_stalled_ring(xhci, ep_index, stream_id, td);
+ xhci_clear_hub_tt_buffer(xhci, td);
}
xhci_ring_cmd_db(xhci);
}
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 7fa58c99f126..7c86c9eeb4d5 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4096,6 +4096,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
/* Zero the input context control for later use */
ctrl_ctx->add_flags = 0;
ctrl_ctx->drop_flags = 0;
+ udev->devaddr = le32_to_cpu(slot_ctx->dev_state) & DEV_ADDR_MASK;
xhci_dbg_trace(xhci, trace_xhci_dbg_address,
"Internal device address = %d",
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 4229eb74bd2c..86d42f42cae4 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -625,6 +625,7 @@ struct usb3_lpm_parameters {
* parent->hub_delay + wHubDelay + tTPTransmissionDelay (40ns)
*
* Will be used as wValue for SetIsochDelay requests.
+ * @devaddr: address on a USB bus, assigned by controller like XHCI
*
* Notes:
* Usbcore drivers should not set usbdev->state directly. Instead use
@@ -709,6 +710,7 @@ struct usb_device {
unsigned lpm_disable_count;
u16 hub_delay;
+ int devaddr;
};
#define to_usb_device(d) container_of(d, struct usb_device, dev)
--
2.1.4
Powered by blists - more mailing lists