linux-kernel - [PATCH -next] usb: ehci: Read CMD_RUN instead of STS_HALT in ehci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220723073805.23491-1-xy521521@gmail.com>
Date:   Sat, 23 Jul 2022 15:38:05 +0800
From:   xy521521 <xy521521@...il.com>
To:     stern@...land.harvard.edu, gregkh@...uxfoundation.org
Cc:     linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        EdisonZhang@...oxin.com, PeterWu@...oxin.com, cobechen@...oxin.com,
        wugaoquan@...inos.cn, Hongyu Xie <xiehongyu1@...inos.cn>
Subject: [PATCH -next] usb: ehci: Read CMD_RUN instead of STS_HALT in ehci_halt with ZX-200

From: Hongyu Xie <xiehongyu1@...inos.cn>

Forcing HC to halt state is ensured by reading STS_HALT field in USBSTS
register every microsecond(2ms in total) after clearing CMD_RUN filed in
USBCMD register during initialization.

But sometimes the STS_HALT field in USBSTS is not set during that 2ms, i.e
ehci_handshake returns -ETIMEDOUT. And host controller won't work after
that, so does the device attached on it. This was first found on a system
with ZX-200 HC on it.

The interesting part is that if you ignore -ETIMEOUT returned from
ehci_handshak or read CMD_RUN instead and continue the initialization, the
HC works just fine.

So read CMD_RUN instead.

Signed-off-by: Hongyu Xie <xiehongyu1@...inos.cn>
---
 drivers/usb/host/ehci-hcd.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 684164fa9716..a935cfb79bcc 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -181,6 +181,7 @@ static int tdi_in_host_mode (struct ehci_hcd *ehci)
 static int ehci_halt (struct ehci_hcd *ehci)
 {
 	u32	temp;
+	struct pci_dev  *pci_dev = to_pci_dev(ehci_to_hcd(ehci)->self.controller);
 
 	spin_lock_irq(&ehci->lock);
 
@@ -204,8 +205,14 @@ static int ehci_halt (struct ehci_hcd *ehci)
 	spin_unlock_irq(&ehci->lock);
 	synchronize_irq(ehci_to_hcd(ehci)->irq);
 
-	return ehci_handshake(ehci, &ehci->regs->status,
-			  STS_HALT, STS_HALT, 16 * 125);
+	if (((pci_dev->vendor == PCI_VENDOR_ID_ZHAOXIN) &&
+		(pci_dev->device == 0x3104) &&
+		((pci_dev->revision & 0xf0) == 0x90)))
+		return ehci_handshake(ehci, &ehci->regs->command, CMD_RUN,
+				0, 16 * 125);
+	else
+		return ehci_handshake(ehci, &ehci->regs->status, STS_HALT,
+				STS_HALT, 16 * 125);
 }
 
 /* put TDI/ARC silicon into EHCI mode */
-- 
2.25.1