queue-4.19/xhci-update-bounce-buffer-with-correct-sg-num.patch

   1 From 597c56e372dab2c7f79b8d700aad3a5deebf9d1b Mon Sep 17 00:00:00 2001
   2 From: Henry Lin <henryl@nvidia.com>
   3 Date: Wed, 22 May 2019 14:33:57 +0300
   4 Subject: xhci: update bounce buffer with correct sg num
   5
   6 From: Henry Lin <henryl@nvidia.com>
   7
   8 commit 597c56e372dab2c7f79b8d700aad3a5deebf9d1b upstream.
   9
  10 This change fixes a data corruption issue occurred on USB hard disk for
  11 the case that bounce buffer is used during transferring data.
  12
  13 While updating data between sg list and bounce buffer, current
  14 implementation passes mapped sg number (urb->num_mapped_sgs) to
  15 sg_pcopy_from_buffer() and sg_pcopy_to_buffer(). This causes data
  16 not get copied if target buffer is located in the elements after
  17 mapped sg elements. This change passes sg number for full list to
  18 fix issue.
  19
  20 Besides, for copying data from bounce buffer, calling dma_unmap_single()
  21 on the bounce buffer before copying data to sg list can avoid cache issue.
  22
  23 Fixes: f9c589e142d0 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer")
  24 Cc: <stable@vger.kernel.org> # v4.8+
  25 Signed-off-by: Henry Lin <henryl@nvidia.com>
  26 Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
  27 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  28
  29 ---
  30  drivers/usb/host/xhci-ring.c |   17 +++++++++++++----
  31  1 file changed, 13 insertions(+), 4 deletions(-)
  32
  33 --- a/drivers/usb/host/xhci-ring.c
  34 +++ b/drivers/usb/host/xhci-ring.c
  35 @@ -656,6 +656,7 @@ static void xhci_unmap_td_bounce_buffer(
  36         struct device *dev = xhci_to_hcd(xhci)->self.controller;
  37         struct xhci_segment *seg = td->bounce_seg;
  38         struct urb *urb = td->urb;
  39 +       size_t len;
  40
  41         if (!ring || !seg || !urb)
  42                 return;
  43 @@ -666,11 +667,14 @@ static void xhci_unmap_td_bounce_buffer(
  44                 return;
  45         }
  46
  47 -       /* for in tranfers we need to copy the data from bounce to sg */
  48 -       sg_pcopy_from_buffer(urb->sg, urb->num_mapped_sgs, seg->bounce_buf,
  49 -                            seg->bounce_len, seg->bounce_offs);
  50         dma_unmap_single(dev, seg->bounce_dma, ring->bounce_buf_len,
  51                          DMA_FROM_DEVICE);
  52 +       /* for in tranfers we need to copy the data from bounce to sg */
  53 +       len = sg_pcopy_from_buffer(urb->sg, urb->num_sgs, seg->bounce_buf,
  54 +                            seg->bounce_len, seg->bounce_offs);
  55 +       if (len != seg->bounce_len)
  56 +               xhci_warn(xhci, "WARN Wrong bounce buffer read length: %ld != %d\n",
  57 +                               len, seg->bounce_len);
  58         seg->bounce_len = 0;
  59         seg->bounce_offs = 0;
  60  }
  61 @@ -3104,6 +3108,7 @@ static int xhci_align_td(struct xhci_hcd
  62         unsigned int unalign;
  63         unsigned int max_pkt;
  64         u32 new_buff_len;
  65 +       size_t len;
  66
  67         max_pkt = usb_endpoint_maxp(&urb->ep->desc);
  68         unalign = (enqd_len + *trb_buff_len) % max_pkt;
  69 @@ -3134,8 +3139,12 @@ static int xhci_align_td(struct xhci_hcd
  70
  71         /* create a max max_pkt sized bounce buffer pointed to by last trb */
  72         if (usb_urb_dir_out(urb)) {
  73 -               sg_pcopy_to_buffer(urb->sg, urb->num_mapped_sgs,
  74 +               len = sg_pcopy_to_buffer(urb->sg, urb->num_sgs,
  75                                    seg->bounce_buf, new_buff_len, enqd_len);
  76 +               if (len != seg->bounce_len)
  77 +                       xhci_warn(xhci,
  78 +                               "WARN Wrong bounce buffer write length: %ld != %d\n",
  79 +                               len, seg->bounce_len);
  80                 seg->bounce_dma = dma_map_single(dev, seg->bounce_buf,
  81                                                  max_pkt, DMA_TO_DEVICE);
  82         } else {