linux-kernel - Re: [PATCH] usb: xhci: Enable the TRB overfetch quirk on VIA VL805

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e265a4b8-7bf8-49ff-9073-d150892bb6dd@linux.intel.com>
Date: Fri, 10 Jan 2025 13:56:21 +0200
From: Mathias Nyman <mathias.nyman@...ux.intel.com>
To: Michal Pecio <michal.pecio@...il.com>,
 Mathias Nyman <mathias.nyman@...el.com>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
 Niklas Neronin <niklas.neronin@...ux.intel.com>
Subject: Re: [PATCH] usb: xhci: Enable the TRB overfetch quirk on VIA VL805

On 7.1.2025 16.35, Michal Pecio wrote:
> Raspberry Pi is a major user of those chips and they discovered a bug -
> when the end of a transfer ring segment is reached, up to four TRBs can
> be prefetched from the next page even if the segment ends with link TRB
> and on page boundary (the chip claims to support standard 4KB pages).
> 
> It also appears that if the prefetched TRBs belong to a different ring
> whose doorbell is later rung, they may be used without refreshing from
> system RAM and the endpoint will stay idle if their cycle bit is stale.
> 
> Other users complain about IOMMU faults on x86 systems, unsurprisingly.
> 
> Deal with it by using existing quirk which allocates a dummy page after
> each transfer ring segment. This was seen to resolve both problems. RPi
> came up with a more efficient solution, shortening each segment by four
> TRBs, but it complicated the driver and they ditched it for this quirk.
> 
> Also rename the quirk and add VL805 device ID macro.
> 
> Signed-off-by: Michal Pecio <michal.pecio@...il.com>
> Link: https://github.com/raspberrypi/linux/issues/4685
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=215906
> CC: stable@...r.kernel.org

Thanks, adding to queue

-Mathias