linux-kernel - Re: [PATCH v4] usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2025052143-uptake-grudge-6e5f@gregkh>
Date: Wed, 21 May 2025 13:16:02 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Jay Chen <shawn2000100@...il.com>
Cc: mathias.nyman@...el.com, linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org, jay.chen@...mens.com
Subject: Re: [PATCH v4] usb: xhci: Set avg_trb_len = 8 for EP0 during Address
 Device Command

On Wed, May 21, 2025 at 06:48:34PM +0800, Jay Chen wrote:
> There is a subtle contradiction between sections of the xHCI 1.2 spec
> regarding the initialization of Input Endpoint Context fields. Section
> 4.8.2 ("Endpoint Context Initialization") states that all fields should
> be initialized to 0. However, Section 6.2.3 ("Endpoint Context", p.453)
> specifies that the Average TRB Length (avg_trb_len) field shall be
> greater than 0, and explicitly notes (p.454): "Software shall set
> Average TRB Length to '8' for control endpoints."
> 
> Strictly setting all fields to 0 during initialization conflicts with
> the specific recommendation for control endpoints. In practice, setting
> avg_trb_len = 0 is not meaningful for the hardware/firmware, as the
> value is used for bandwidth calculation.
> 
> Motivation: Our company is developing a custom Virtual xHC hardware
> platform that strictly follows the xHCI spec and its recommendations.
> During validation, we observed that enumeration fails and a parameter
> error (TRB Completion Code = 5) is reported if avg_trb_len for EP0 is
> not set to 8 as recommended by Section 6.2.3. This demonstrates the
> importance of assigning a meaningful, non-zero value to avg_trb_len,
> even in virtualized or emulated environments.
> 
> This patch explicitly sets avg_trb_len to 8 for EP0 in
> xhci_setup_addressable_virt_dev(), as recommended in Section 6.2.3, to
> prevent potential issues with xHCI host controllers that enforce the
> spec strictly.
> 
> v4:
> - Clarify relevant spec sections and document their conflict.
> - Remove language about "ensuring compliance with the spec" per reviewer
>   suggestion.
> - Update assignment to use '=' instead of '|='.
> 
> v3:
> - Corrected author name in commit metadata and added changelog.
> 
> v2:
> - Fixed malformed patch formatting issue.
> 
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=220033
> Signed-off-by: Jay Chen <shawn2000100@...il.com>
> ---
>  drivers/usb/host/xhci-mem.c | 2 ++
>  1 file changed, 2 insertions(+)

The "changes" go below the --- line, as is documented in our
documentation.

thanks,

greg k-h