From 3157603c3925a30c6b26dc8f7a1f2c23f7b7bb55 Mon Sep 17 00:00:00 2001 From: Jonathan Bell Date: Thu, 8 Sep 2022 15:50:15 +0100 Subject: [PATCH] usb: xhci: expand mitigations for VLI_SS_BULK_OUT_BUG quirk The VL805 can cause data corruption if a SS Bulk OUT endpoint enters a flow-control condition and there are TRBs in the transfer ring that are not an integral size of wMaxPacket and the endpoint is behind one or more hubs. This is frequently the case encountered when FAT32 filesystems are present on mass-storage devices with cluster sizes of 1 sector, and the filesystem is being written to with an aggregate of small files. The initial implementation of this quirk separated TRBs that didn't adhere to this limitation into two - the first a multiple of wMaxPacket and the second the 512-byte remainder - in an attempt to force TD fragments to align with packet boundaries. This reduced the incidence rate of data corruption but did not resolve it. The fix as recommended by VIA is to disable bursts if this sequence of TRBs can occur. Limit turning off bursts to just USB mass-storage devices by searching the device's configuration for an interface with a class type of USB_CLASS_MASS_STORAGE. Signed-off-by: Jonathan Bell --- drivers/usb/host/xhci-mem.c | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c index 6df995c..bbd5608 100644 --- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -1437,6 +1437,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, unsigned int ep_index; struct xhci_ep_ctx *ep_ctx; struct xhci_ring *ep_ring; + struct usb_interface_cache *intfc; unsigned int max_packet; enum xhci_ring_type ring_type; u32 max_esit_payload; @@ -1446,6 +1447,8 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, unsigned int mult; unsigned int avg_trb_len; unsigned int err_count = 0; + unsigned int is_ums_dev = 0; + unsigned int i; ep_index = xhci_get_endpoint_index(&ep->desc); ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index); @@ -1477,9 +1480,35 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, mult = xhci_get_endpoint_mult(udev, ep); max_packet = usb_endpoint_maxp(&ep->desc); - max_burst = xhci_get_endpoint_max_burst(udev, ep); avg_trb_len = max_esit_payload; + /* + * VL805 errata - Bulk OUT bursts to superspeed mass-storage + * devices behind hub ports can cause data corruption with + * non-wMaxPacket-multiple transfers. + */ + for (i = 0; i < udev->config->desc.bNumInterfaces; i++) { + intfc = udev->config->intf_cache[i]; + /* + * Slight hack - look at interface altsetting 0, which + * should be the UMS bulk-only interface. If the class + * matches, then we disable out bursts for all OUT + * endpoints because endpoint assignments may change + * between alternate settings. + */ + if (intfc->altsetting[0].desc.bInterfaceClass == + USB_CLASS_MASS_STORAGE) { + is_ums_dev = 1; + break; + } + } + if (xhci->quirks & XHCI_VLI_SS_BULK_OUT_BUG && + usb_endpoint_is_bulk_out(&ep->desc) && is_ums_dev && + udev->route) + max_burst = 0; + else + max_burst = xhci_get_endpoint_max_burst(udev, ep); + /* FIXME dig Mult and streams info out of ep companion desc */ /* Allow 3 retries for everything but isoc, set CErr = 3 */ -- 2.7.4