linux-kernel - Re: [PATCH v2] usb: dwc3: gadget: Check for IOC/LST bit in TRB->ctrl fields

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 28 Jan 2020 18:23:53 +0000
From:   Thinh Nguyen <Thinh.Nguyen@...opsys.com>
To:     Felipe Balbi <balbi@...nel.org>,
        John Stultz <john.stultz@...aro.org>,
        lkml <linux-kernel@...r.kernel.org>
CC:     Anurag Kumar Vulisha <anurag.kumar.vulisha@...inx.com>,
        Yang Fei <fei.yang@...el.com>,
        Tejas Joglekar <Tejas.Joglekar@...opsys.com>,
        "Andrzej Pietrasiewicz" <andrzej.p@...labora.com>,
        Jack Pham <jackp@...eaurora.org>, Todd Kjos <tkjos@...gle.com>,
        Greg KH <gregkh@...uxfoundation.org>,
        "Linux USB List" <linux-usb@...r.kernel.org>,
        stable <stable@...r.kernel.org>
Subject: Re: [PATCH v2] usb: dwc3: gadget: Check for IOC/LST bit in TRB->ctrl
 fields

Hi,

Felipe Balbi wrote:
> Hi,
>
> John Stultz <john.stultz@...aro.org> writes:
>
>> From: Anurag Kumar Vulisha <anurag.kumar.vulisha@...inx.com>
>>
>> The current code in dwc3_gadget_ep_reclaim_completed_trb() will
>> check for IOC/LST bit in the event->status and returns if
>> IOC/LST bit is set. This logic doesn't work if multiple TRBs
>> are queued per request and the IOC/LST bit is set on the last
>> TRB of that request.
>>
>> Consider an example where a queued request has multiple queued
>> TRBs and IOC/LST bit is set only for the last TRB. In this case,
>> the core generates XferComplete/XferInProgress events only for
>> the last TRB (since IOC/LST are set only for the last TRB). As
>> per the logic in dwc3_gadget_ep_reclaim_completed_trb()
>> event->status is checked for IOC/LST bit and returns on the
>> first TRB. This leaves the remaining TRBs left unhandled.
>>
>> Similarly, if the gadget function enqueues an unaligned request
>> with sglist already in it, it should fail the same way, since we
>> will append another TRB to something that already uses more than
>> one TRB.
>>
>> To aviod this, this patch changes the code to check for IOC/LST
>> bits in TRB->ctrl instead.
>>
>> At a practical level, this patch resolves USB transfer stalls seen
>> with adb on dwc3 based HiKey960 after functionfs gadget added
>> scatter-gather support around v4.20.
>>
>> Cc: Felipe Balbi <balbi@...nel.org>
>> Cc: Yang Fei <fei.yang@...el.com>
>> Cc: Thinh Nguyen <thinhn@...opsys.com>
>> Cc: Tejas Joglekar <tejas.joglekar@...opsys.com>
>> Cc: Andrzej Pietrasiewicz <andrzej.p@...labora.com>
>> Cc: Jack Pham <jackp@...eaurora.org>
>> Cc: Todd Kjos <tkjos@...gle.com>
>> Cc: Greg KH <gregkh@...uxfoundation.org>
>> Cc: Linux USB List <linux-usb@...r.kernel.org>
>> Cc: stable <stable@...r.kernel.org>
>> Tested-by: Tejas Joglekar <tejas.joglekar@...opsys.com>
>> Reviewed-by: Thinh Nguyen <thinhn@...opsys.com>
>> Signed-off-by: Anurag Kumar Vulisha <anurag.kumar.vulisha@...inx.com>
>> [jstultz: forward ported to mainline, reworded commit log, reworked
>>   to only check trb->ctrl as suggested by Felipe]
>> Signed-off-by: John Stultz <john.stultz@...aro.org>
>> ---
>> v2:
>> * Rework to only check trb->ctrl as suggested by Felipe
>> * Reword the commit message to include more of Felipe's assessment
>> ---
>>   drivers/usb/dwc3/gadget.c | 3 ++-
>>   1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
>> index 154f3f3e8cff..9a085eee1ae3 100644
>> --- a/drivers/usb/dwc3/gadget.c
>> +++ b/drivers/usb/dwc3/gadget.c
>> @@ -2420,7 +2420,8 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
>>   	if (event->status & DEPEVT_STATUS_SHORT && !chain)
>>   		return 1;
>>   
>> -	if (event->status & DEPEVT_STATUS_IOC)
>> +	if ((trb->ctrl & DWC3_TRB_CTRL_IOC) ||
>> +	    (trb->ctrl & DWC3_TRB_CTRL_LST))
> why the LST bit here? It wasn't there before. In fact, we never set LST
> in dwc3 anymore :-)
>

Just a note: right now, it may be fine for non-stream endpoints to not 
set the LST bit in the TRBs. For streams, we need to set this bit so the 
controller know to allocate resource for different transfers of 
different streams. It may be fine now if you think that it should be 
added later when more fixes for streams are added, but I think it 
doesn't hurt checking it now either.

BR,
Thinh