linux-kernel - RE: [PATCH] usb: cdnsp: fix issue with ZLP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 24 Oct 2022 14:10:30 +0000
From:   Pawel Laszczak <pawell@...ence.com>
To:     Peter Chen <peter.chen@...nel.org>
CC:     "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: RE: [PATCH] usb: cdnsp: fix issue with ZLP - added TD_SIZE = 1

>> >
>> >On 22-10-19 02:07:17, Pawel Laszczak wrote:
>> >> Patch modifies the TD_SIZE in TRB before ZLP TRB.
>> >> The TD_SIZE in TRB before ZLP TRB must be set to 1 to force
>> >> processing ZLP TRB by controller.
>> >>
>> >> Cc: <stable@...r.kernel.org>
>> >> Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence
>> >> USBSSP DRD Driver")
>> >> Signed-off-by: Pawel Laszczak <pawell@...ence.com>
>> >> ---
>> >>  drivers/usb/cdns3/cdnsp-ring.c | 15 ++++++++-------
>> >>  1 file changed, 8 insertions(+), 7 deletions(-)
>> >>
>> >> diff --git a/drivers/usb/cdns3/cdnsp-ring.c
>> >> b/drivers/usb/cdns3/cdnsp-ring.c index 794e413800ae..4809d0e894bb
>> >> 100644
>> >> --- a/drivers/usb/cdns3/cdnsp-ring.c
>> >> +++ b/drivers/usb/cdns3/cdnsp-ring.c
>> >> @@ -1765,18 +1765,19 @@ static u32 cdnsp_td_remainder(struct
>> >cdnsp_device *pdev,
>> >>  			      struct cdnsp_request *preq,
>> >>  			      bool more_trbs_coming)
>> >>  {
>> >> -	u32 maxp, total_packet_count;
>> >> -
>> >> -	/* One TRB with a zero-length data packet. */
>> >> -	if (!more_trbs_coming || (transferred == 0 && trb_buff_len == 0) ||
>> >> -	    trb_buff_len == td_total_len)
>> >> -		return 0;
>> >> +	u32 maxp, total_packet_count, remainder;
>> >>
>> >>  	maxp = usb_endpoint_maxp(preq->pep->endpoint.desc);
>> >>  	total_packet_count = DIV_ROUND_UP(td_total_len, maxp);
>> >>
>> >>  	/* Queuing functions don't count the current TRB into transferred. */
>> >> -	return (total_packet_count - ((transferred + trb_buff_len) / maxp));
>> >> +	remainder = (total_packet_count - ((transferred + trb_buff_len) /
>> >> +maxp));
>> >> +
>> >> +	/* Before ZLP driver needs set TD_SIZE=1. */
>> >> +	if (!remainder && more_trbs_coming)
>> >> +		remainder = 1;
>> >
>> >Without ZLP, TD_SIZE = 0 for the last TRB.
>> >With ZLP, TD_SIZE = 1 for current TRB, and TD_SIZE = 0 for the next
>> >TRB (the last zero-length packet) right?
>>
>> Yes, you have right.
>>
>
>Pawel, With your changes, the return value is 1 for function
>cdnsp_queue_ctrl_tx. Without your changes, it is 0, something wrong?
>
Yes you have right. 
It does not cause a problem, but it's not according with controller specification. 

I posted the fixed version of this patch.

Thanks,
Pawel