linux-kernel - Re: [PATCH] USB: Fix xhci ERDP update issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 16 Mar 2022 20:47:14 +0800
From:   "WeitaoWang-oc@...oxin.com" <WeitaoWang-oc@...oxin.com>
To:     Peter Chen <hzpeterchen@...il.com>,
        Greg KH <gregkh@...uxfoundation.org>
CC:     <mathias.nyman@...el.com>, Alan Stern <stern@...land.harvard.edu>,
        "USB list" <linux-usb@...r.kernel.org>,
        lkml <linux-kernel@...r.kernel.org>, <CobeChen@...oxin.com>,
        <TimGuo@...oxin.com>, <tonywwang@...oxin.com>,
        <weitaowang@...oxin.com>
Subject: Re: [PATCH] USB: Fix xhci ERDP update issue

On 2022/3/16 19:57, Peter Chen wrote:
> On Mon, Mar 14, 2022 at 10:34 PM Greg KH <gregkh@...uxfoundation.org> wrote:
>>
>> On Mon, Mar 14, 2022 at 03:25:23PM +0800, WeitaoWang-oc@...oxin.com wrote:
>>> On some situations, software handles TRB events slower than adding TRBs,
>>> xhci_irq will not exit until all events are handled. If xhci_irq just
>>> handles 256 TRBs and exit, the temp variable(event_ring_deq) driver records
>>> in xhci irq is equal to driver current dequeue pointer. It will cause driver
>>> not update ERDP and software dequeue pointer lost sync with ERDP. On the
>>> next xhci_irq, the event ring is full but driver will not update ERDP as
>>> software dequeue pointer is equal to ERDP.
> 
> At the current driver, the ERDP is updated at most 128 TRBs, how is
> the above condition
> triggered?
> 
> Peter

If the number of TRB events to be processed in a given interrupt is 256.
ERDP is updated after only the first 128 TRB evnets are processed.
It will not be updated when another 128 TRB evnets are processed as 
event_ring_deq= "xhci->event_ring->dequeue", which will cause the 
software-recorded dequeue pointer is out of sync with ERDP on interrupt 
exit.

Weitao Wang
> 
> 
>>>
>>> [  536.377115] xhci_hcd 0000:00:12.0: ERROR unknown event type 37
>>> [  566.933173] sd 8:0:0:0: [sdb] tag#27 uas_eh_abort_handler 0 uas-tag 7
>>> inflight: CMD OUT
>>> [  566.933181] sd 8:0:0:0: [sdb] tag#27 CDB: Write(10) 2a 00 17 71 e6 78 00
>>> 00 08 00
>>> [  572.041186] xhci_hcd On some situataions,the0000:00:12.0: xHCI host not
>>> responding to stop endpoint command.
>>> [  572.057193] xhci_hcd 0000:00:12.0: Host halt failed, -110
>>> [  572.057196] xhci_hcd 0000:00:12.0: xHCI host controller not responding,
>>> assume dead
>>> [  572.057236] sd 8:0:0:0: [sdb] tag#26 uas_eh_abort_handler 0 uas-tag 6
>>> inflight: CMD
>>> [  572.057240] sd 8:0:0:0: [sdb] tag#26 CDB: Write(10) 2a 00 38 eb cc d8 00
>>> 00 08 00
>>> [  572.057244] sd 8:0:0:0: [sdb] tag#25 uas_eh_abort_handler 0 uas-tag 5
>>> inflight: CMD
>>>
>>> Fixed this issue by update software record temp variable when handles 128
>>> TRB events.
>>>
>>> Signed-off-by: Weitao Wang <WeitaoWang-oc@...oxin.com>
>>> ---
>>>   drivers/usb/host/xhci-ring.c | 1 +
>>>   1 file changed, 1 insertion(+)
>>>
>>> diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
>>> index d0b6806..f970799 100644
>>> --- a/drivers/usb/host/xhci-ring.c
>>> +++ b/drivers/usb/host/xhci-ring.c
>>> @@ -3141,6 +3141,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
>>>                  if (event_loop++ < TRBS_PER_SEGMENT / 2)
>>>                          continue;
>>>                  xhci_update_erst_dequeue(xhci, event_ring_deq);
>>> +               event_ring_deq = xhci->event_ring->dequeue;
>>>
>>>                  /* ring is half-full, force isoc trbs to interrupt more
>>> often */
>>>                  if (xhci->isoc_bei_interval > AVOID_BEI_INTERVAL_MIN)
>>> --
>>> 2.7.4
>>
>> Hi,
>>
>> This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
>> a patch that has triggered this response.  He used to manually respond
>> to these common problems, but in order to save his sanity (he kept
>> writing the same thing over and over, yet to different people), I was
>> created.  Hopefully you will not take offence and will fix the problem
>> in your patch and resubmit it so that it can be accepted into the Linux
>> kernel tree.
>>
>> You are receiving this message because of the following common error(s)
>> as indicated below:
>>
>> - Your patch is malformed (tabs converted to spaces, linewrapped, etc.)
>>    and can not be applied.  Please read the file,
>>    Documentation/email-clients.txt in order to fix this.
>>
>>
>> If you wish to discuss this problem further, or you have questions about
>> how to resolve this issue, please feel free to respond to this email and
>> Greg will reply once he has dug out from the pending patches received
>> from other developers.
>>
>> thanks,
>>
>> greg k-h's patch email bot
> .