linux-kernel - Re: [PATCH v2] usb: cdns3: gadget: Fix g_audio use case when connected to Super-Speed host

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 31 Oct 2019 13:08:16 +0200
From:   Felipe Balbi <balbi@...nel.org>
To:     Roger Quadros <rogerq@...com>, gregkh@...uxfoundation.org,
        pawell@...ence.com
Cc:     peter.chen@....com, nsekhar@...com, kurahul@...ence.com,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] usb: cdns3: gadget: Fix g_audio use case when connected to Super-Speed host


Hi,

Roger Quadros <rogerq@...com> writes:
>>>>> Take into account gadget driver's speed limit when programming
>>>>> controller speed.
>>>>>
>>>>> Fixes: commit 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
>>>>> Signed-off-by: Roger Quadros <rogerq@...com>
>>>>> Acked-by: Peter Chen <peter.chen@....com>
>>>>> ---
>>>>>
>>>>> Changelog:
>>>>> v2
>>>>> - Add Fixes line
>>>>>
>>>>>    drivers/usb/cdns3/gadget.c | 31 ++++++++++++++++++++++++++-----
>>>>>    1 file changed, 26 insertions(+), 5 deletions(-)
>>>>>
>>>>> diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c
>>>>> index 40dad4e8d0dc..1c724c20d468 100644
>>>>> --- a/drivers/usb/cdns3/gadget.c
>>>>> +++ b/drivers/usb/cdns3/gadget.c
>>>>> @@ -2338,9 +2338,35 @@ static int cdns3_gadget_udc_start(struct usb_gadget *gadget,
>>>>>    {
>>>>>    	struct cdns3_device *priv_dev = gadget_to_cdns3_device(gadget);
>>>>>    	unsigned long flags;
>>>>> +	enum usb_device_speed max_speed = driver->max_speed;
>>>>>    
>>>>>    	spin_lock_irqsave(&priv_dev->lock, flags);
>>>>>    	priv_dev->gadget_driver = driver;
>>>>> +
>>>>> +	/* limit speed if necessary */
>>>>> +	max_speed = min(driver->max_speed, gadget->max_speed);
>>>>> +
>>>>> +	switch (max_speed) {
>>>>> +	case USB_SPEED_FULL:
>>>>> +		writel(USB_CONF_SFORCE_FS, &priv_dev->regs->usb_conf);
>> 
>> so this forces the controller to FS
>
> Right.
>
>> 
>>>>> +		writel(USB_CONF_USB3DIS, &priv_dev->regs->usb_conf);
>> 
>> and this disconnects in superspeed? What is this supposed to do?
>> 
>
> It says "Disconnect USB device in SuperSpeed".
>
> We were asked to set that bit to limit it to HS.

I wonder if by "Disconnect USB device in SuperSpeed" means tristating
the PIPE3 interface, therefore forcing RX.Detect to fail.

>>>>> +		break;
>>>>> +	case USB_SPEED_HIGH:
>>>>> +		writel(USB_CONF_USB3DIS, &priv_dev->regs->usb_conf);
>>>>> +		break;
>>>>> +	case USB_SPEED_SUPER:
>>>>> +		break;
>>>>> +	default:
>>>>> +		dev_err(priv_dev->dev,
>>>>> +			"invalid maximum_speed parameter %d\n",
>>>>> +			max_speed);
>>>>> +		/* fall through */
>>>>> +	case USB_SPEED_UNKNOWN:
>>>>> +		/* default to superspeed */
>>>>> +		max_speed = USB_SPEED_SUPER;
>>>>> +		break;
>>>>> +	}
>>>>
>>>> I had suggested some simplification for this case statement.
>>>>
>>>
>>> oops, looks like Greg picked this already.
>>>
>>> During more tests today I just observed that this patch causes
>>> the following regression.
>>>
>>> Connect EVM to Super-Speed host
>>> Load g_audio. (this enumerates as HS which is fine)
>>> unload g_audio
>>> load g_zero (this enumerates at HS instead of SS).
>>>
>>> This is because the speed limit that we set doesn't get cleared.
>>>
>>> Now the bits are write only and there is a way to undo USB_CONF_SFORCE_FS
>>> by writing USB_CONF_CFORCE_FS, however there is no corresponding bit
>>> to clear USB_CONF_USB3DIS. Only way seems to be USB_CFG_SWRST which
>>> is a bit harsh IMO.
>> 
>> Isn't bit 0 enough?
>> 
>> /* Reset USB device configuration. */
>> #define USB_CONF_CFGRST		BIT(0)
>
> Probably not, as explanation of USB3DIS bit says,
> "To connect disconnected device, CPU performs
> software reset (CFG.SWRST)." which is bit 7. "Device software reset.

ouch

> But I'll let Pawel comment on this.

ok

>> Also, now that I look at this more carefully, you should move that code
>> to udc_set_speed().
>> 
>
> Agreed. I'll revise the implementation to move it to udc_set_speed()
> once I know how to undo the USB3DIS.

Sure

-- 
balbi