linux-kernel - Re: [PATCH v3] usb: typec: ucsi: Fix busy loop on ASUS VivoBooks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZthnbdKig//kPKgF@cae.in-ulm.de>
Date: Wed, 4 Sep 2024 15:58:05 +0200
From: "Christian A. Ehrhardt" <lk@...e.de>
To: Heikki Krogerus <heikki.krogerus@...ux.intel.com>
Cc: linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
	Anurag Bijea <icaliberdev@...il.com>,
	Christian Heusel <christian@...sel.eu>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Dmitry Baryshkov <dmitry.baryshkov@...aro.org>,
	Jameson Thies <jthies@...gle.com>,
	Abhishek Pandit-Subedi <abhishekpandit@...omium.org>
Subject: Re: [PATCH v3] usb: typec: ucsi: Fix busy loop on ASUS VivoBooks


Hi Heikki,

On Wed, Sep 04, 2024 at 03:07:45PM +0300, Heikki Krogerus wrote:
> On Tue, Sep 03, 2024 at 08:19:17PM +0200, Christian A. Ehrhardt wrote:
> > If the busy indicator is set, all other fields in CCI should be
> > clear according to the spec. However, some UCSI implementations do
> > not follow this rule and report bogus data in CCI along with the
> > busy indicator. Ignore the contents of CCI if the busy indicator is
> > set.
> > 
> > If a command timeout is hit it is possible that the EVENT_PENDING
> > bit is cleared while connector work is still scheduled which can
> > cause the EVENT_PENDING bit to go out of sync with scheduled connector
> > work. Check and set the EVENT_PENDING bit on entry to
> > ucsi_handle_connector_change() to fix this.
> > 
> > Reported-by: Anurag Bijea <icaliberdev@...il.com>
> > Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219108
> > Bisected-by: Christian Heusel <christian@...sel.eu>
> > Tested-by: Anurag Bijea <icaliberdev@...il.com>
> > Fixes: de52aca4d9d5 ("usb: typec: ucsi: Never send a lone connector change ack")
> > Cc: stable@...r.kernel.org
> > Signed-off-by: Christian A. Ehrhardt <lk@...e.de>
> > ---
> >  drivers/usb/typec/ucsi/ucsi.c | 8 ++++++++
> >  1 file changed, 8 insertions(+)
> > 
> > diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> > index 4039851551c1..540cb1d2822c 100644
> > --- a/drivers/usb/typec/ucsi/ucsi.c
> > +++ b/drivers/usb/typec/ucsi/ucsi.c
> > @@ -38,6 +38,10 @@
> >  
> >  void ucsi_notify_common(struct ucsi *ucsi, u32 cci)
> >  {
> > +	/* Ignore bogus data in CCI if busy indicator is set. */
> > +	if (cci & UCSI_CCI_BUSY)
> > +		return;
> 
> I started testing this and it looks like the commands never get
> cancelled when the BUSY bit is set. I don't think this patch is the
> problem, though. I think the BUSY handling broke earlier, probable in
> 5e9c1662a89b ("usb: typec: ucsi: rework command execution functions").
> 
> I need to look at this a bit more carefully, but in the meantime, can
> you try this:
> 
> 	if (cci & UCSI_CCI_BUSY) {
> 		complete(&ucsi->complete);
> 		return;
>         }

I really don't think this is the correct thing to do and it will
likely make things worse.

A notification with the UCSI_CCI_BUSY bit does _not_ mean that
the controller is busy doing other things and cannot complete the
command.

Instead it is an indication that the controller _is_ working to
complete our command but will take somewhat longer:

Citing:
| Note: If a command takes longer than MIN_TIME_TO_RESPOND_WITH_BUSY ms
|       for the PPM (excluding PPM to OPM communication latency) to complete,
|       then the PPM shall respond to the command by setting the CCI Busy
|       Indicator and notify the OPM.
|       Subsequently, when the PPM actually completes the command, the
|       PPM shall notify the OPM of the outcome of the command via an
|       asynchronous notification associated with that command.

Unless I misunderstand what you are trying to do your change would
cause us to needlessly abort/cancel every command that takes more than
MIN_TIME_TO_RESPOND_WITH_BUSY to complete.

What am I missing?

Best regards,
Christian