vhci_hcd: USB port can get stuck in the disabled state

When a remote usb device is attached to the local Virtual USB Host Controller Root Hub port, the bound device driver may send a port reset command. For example to initialize firmware (eg. btusb does this). This port reset command can be sent at any time, however the VHCI hcd root hub is only expecting reset to occur before the device receives SET_ADDRESS. The USB port should always be enabled after a reset (because the port is virtual and there is no possibility of hardware errors)

Signed-off-by Michael Broadfoot <[email protected]>

---
  drivers/usb/usbip/vhci_hcd.c | 13 ++++---------
  1 file changed, 4 insertions(+), 9 deletions(-)

drivers/usb/usbip/vhci_hcd.c +0 -0

index 4ba6bcdaa8e9..d3cda1b2c15a 100644
@@ -455,15 +455,10 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
  			vhci_hcd->port_status[rhport] &= ~(1 << USB_PORT_FEAT_RESET);
  			vhci_hcd->re_timeout = 0;

Quoted 22 lines · Michael Broadfoot

When a remote usb device is attached to the local Virtual USB Host Controller Root Hub port, the bound device driver may send a port reset command. For example to initialize firmware (eg. btusb does this). This port reset command can be sent at any time, however the VHCI hcd root hub is only expecting reset to occur before the device receives SET_ADDRESS. The USB port should always be enabled after a reset (because the port is virtual and there is no possibility of hardware errors)

Signed-off-by Michael Broadfoot <[email protected]>

---
  drivers/usb/usbip/vhci_hcd.c | 13 ++++---------
  1 file changed, 4 insertions(+), 9 deletions(-)

drivers/usb/usbip/vhci_hcd.c +0 -0

index 4ba6bcdaa8e9..d3cda1b2c15a 100644
@@ -455,15 +455,10 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                      vhci_hcd->port_status[rhport] &= ~(1 << USB_PORT_FEAT_RESET);
                      vhci_hcd->re_timeout = 0;

drivers/usb/usbip/vhci_hcd.c static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, · line 466

Quoted 10 lines

drivers/usb/usbip/vhci_hcd.c +0 -9

 
-                     if (vhci_hcd->vdev[rhport].ud.status ==
-                         VDEV_ST_NOTASSIGNED) {
-                             usbip_dbg_vhci_rh(
-                                     " enable rhport %d (status %u)\n",
-                                     rhport,
-                                     vhci_hcd->vdev[rhport].ud.status);
-                             vhci_hcd->port_status[rhport] |=
-                                     USB_PORT_STAT_ENABLE;
-                     }

VDEV_ST_NOTASSIGNED status indicates that the vdev is in use without address assigned - in other words port is initializing.

This is part of the attach request handling when user requests to attach to a remote device. attach_store() will change the status to VDEV_ST_NOTASSIGNED and then initiate port_connect sequence.

We don't want to touch the vdev when it is in other states.

drivers/usb/usbip/vhci_hcd.c static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, · line 464

Quoted 8 lines

drivers/usb/usbip/vhci_hcd.c +4 -0

+                     usbip_dbg_vhci_rh(" enable rhport %d (status %u)\n",
+                                       rhport,
+                                       vhci_hcd->vdev[rhport].ud.status);
+                     vhci_hcd->port_status[rhport] |= USB_PORT_STAT_ENABLE;
 
                      if (hcd->speed < HCD_USB3) {
                              switch (vhci_hcd->vdev[rhport].speed) {

How did you find this problem? Does the port get into stuck state while attaching to a remote usbip device on the host?

thanks,
-- Shuah

You can pass through any bluetooth dongle (or xbox wireless dongle) through usbip and it will cause this issue.

For example, here is one of my customers https://www.virtualhere.com/comment/9432#comment-9432 <https://www.virtualhere.com/comment/9432#comment-9432> with the issue.

The device is in the VDEV_ST_USED state when a reset occurs and so its never re-enabled

Furthermore there is a bug in the line pr_err("vhci_device speed not set\n"); (L479) because resetting a full-speed device is not an error.

Quoted 9 lines · Michael

You can pass through any bluetooth dongle (or xbox wireless dongle) through usbip and it will cause this issue.

For example, here is one of my customers https://www.virtualhere.com/comment/9432#comment-9432 <https://www.virtualhere.com/comment/9432#comment-9432> with the issue.

The device is in the VDEV_ST_USED state when a reset occurs and so its never re-enabled

Furthermore there is a bug in the line pr_err("vhci_device speed not set\n"); (L479) because resetting a full-speed device is not an error.

Can you provide me the full demsg from host and client including the part where device is attached? I assume usbip tools from Linux sources are used?

Also send me lsusb output on host and client

thanks,
-- Shuah

Quoted 9 lines · Michael

You can pass through any bluetooth dongle (or xbox wireless dongle) through usbip and it will cause this issue.

For example, here is one of my customers https://www.virtualhere.com/comment/9432#comment-9432 <https://www.virtualhere.com/comment/9432#comment-9432> with the issue.

The device is in the VDEV_ST_USED state when a reset occurs and so its never re-enabled

Furthermore there is a bug in the line pr_err("vhci_device speed not set\n"); (L479) because resetting a full-speed device is not an error.

Can you provide me the full demsg from host and client including the part where device is attached? I assume usbip tools from Linux sources are used?

Also send me lsusb output on host and client

thanks,
-- Shuah

Here is the lsusb on the client when the device fails to attach
---------------------------------------

michael@ubuntu:~$ lsusb
Bus 006 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 005 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

Here is the lsusb on the host before use
-----------------------------------------------------
pi@raspberrypi:~ $ lsusb
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 003: ID 045e:02e6 Microsoft Corp. Wireless XBox Controller Dongle Bus 001 Device 002: ID 2109:3431 VIA Labs, Inc. Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Quoted 11 lines · Michael

Here is the lsusb on the client when the device fails to attach
---------------------------------------

michael@ubuntu:~$ lsusb
Bus 006 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 005 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

Quoted 8 lines

Here is the lsusb on the host before use
-----------------------------------------------------
pi@raspberrypi:~ $ lsusb
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 003: ID 045e:02e6 Microsoft Corp. Wireless XBox Controller Dongle Bus 001 Device 002: ID 2109:3431 VIA Labs, Inc. Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Sorry for the delay on this. I had to make time to do some research on usb_reset_device() calls from probe routines.

From what you said in another email:

"The device is in the VDEV_ST_USED state when a reset occurs and so its never re-enabled"

Right if device is in VDEV_ST_USED state, vhci treats reset as invalid.

Your commit log says:

"When a remote usb device is attached to the local Virtual USB Host Controller Root Hub port, the bound device driver may send a port reset command. For example to initialize firmware (eg. btusb does this). This port reset command can be sent at any time, however the VHCI hcd root hub is only expecting reset to occur before the device receives SET_ADDRESS. The USB port should always be enabled after a reset (because the port is virtual and there is no possibility of hardware errors)"

It appears btusb driver issues reset as a workaround: btusb_setup_intel()

/* The controller has a bug with the first HCI command sent to it
* returning number of completed commands as zero. This would stall the
* command processing in the Bluetooth core.
*
* As a workaround, send HCI Reset command first which will reset the
* number of completed commands and allow normal command processing
* from now on.
*/

Another "Toggle the hard reset line" workaround for Realtek devices:
See btusb_rtl_cmd_timeout()

Both of these cases are workarounds. Is this what you are referring to about btusb doing reset?

Specific to this bug report and mt76, other network/wireless usb drivers call usb_reset_device() from their probe routines unconditionally. These are the calls from normal paths and not fw load/error paths.

rtl8152_probe(), carl9170_usb_probe(), mt7663u_probe() and so on. Looking at these probe routines, it appears some of them do that to avoid problems in disconnect path.

I have two questions:
- Is it necessary to do usb_reset_device() in net/wireless usb driver probe routines?
- Are these legit calls according to protocol?

If yes, we can look into changing vhci to handle this case for net/wireless usb drivers. I would not delete the check though. I would add VDEV_ST_USED check in addition to VDEV_ST_NOTASSIGNED with some comments on why this is necessary.

Furthermore there is a bug in the line pr_err("vhci_device speed not set\n"); (L479) because resetting a full-speed device is not an error.

This is a separate issue is separate. vhci is missing USB_SPEED_FULL checks at various places. This has to be done as a separate work.

thanks,
-- Shuah

Yes i think just adding the VDEV_ST_USED check in addition to the VDEV_ST_NOT_ASSIGNED state is fine and would fix the issue.

After many years of writing virtualhere (a similar system to usb/ip but cross-platform and different non-kernel way of doing it server side) I've seen many drivers that issue reset at any time. Loading firmware is usually the reason. Also sometimes switching configurations requires a reset also, for example some gaming wheels do this. I don't think you should make this VDEV_ST_USED check specific to Wifi devices, as a lot of devices don't follow too closely to the USB protocol to begin with from my experience. They primarily base their USB interactions assuming the windows platform and its quirks.

Quoted 3 lines · Michael

Yes i think just adding the VDEV_ST_USED check in addition to the VDEV_ST_NOT_ASSIGNED state is fine and would fix the issue.

Can you please confirm if this works?

Quoted 11 lines

After many years of writing virtualhere (a similar system to usb/ip but cross-platform and different non-kernel way of doing it server side) I've seen many drivers that issue reset at any time. Loading firmware is usually the reason. Also sometimes switching configurations requires a reset also, for example some gaming wheels do this. I don't think you should make this VDEV_ST_USED check specific to Wifi devices, as a lot of devices don't follow too closely to the USB protocol to begin with from my experience. They primarily base their USB interactions assuming the windows platform and its quirks.

When sending responses to Linux kernel mailing lists, please use bottom post. This check will be used for all drivers. We don't add checks for specific cases in the code.

thanks,
-- Shuah

Quoted 24 lines · Shuah Khan

Quoted 3 lines · Michael

Yes i think just adding the VDEV_ST_USED check in addition to the VDEV_ST_NOT_ASSIGNED state is fine and would fix the issue.

Can you please confirm if this works?

Quoted 11 lines

After many years of writing virtualhere (a similar system to usb/ip but cross-platform and different non-kernel way of doing it server side) I've seen many drivers that issue reset at any time. Loading firmware is usually the reason. Also sometimes switching configurations requires a reset also, for example some gaming wheels do this. I don't think you should make this VDEV_ST_USED check specific to Wifi devices, as a lot of devices don't follow too closely to the USB protocol to begin with from my experience. They primarily base their USB interactions assuming the windows platform and its quirks.

When sending responses to Linux kernel mailing lists, please use bottom post. This check will be used for all drivers. We don't add checks for specific cases in the code.

Quoted 3 lines

thanks,
-- Shuah

Yes it works with that change.

Quoted 29 lines · Michael

Quoted 27 lines · Shuah Khan

Quoted 3 lines · Michael

Yes i think just adding the VDEV_ST_USED check in addition to the VDEV_ST_NOT_ASSIGNED state is fine and would fix the issue.

Can you please confirm if this works?

Quoted 11 lines

After many years of writing virtualhere (a similar system to usb/ip but cross-platform and different non-kernel way of doing it server side) I've seen many drivers that issue reset at any time. Loading firmware is usually the reason. Also sometimes switching configurations requires a reset also, for example some gaming wheels do this. I don't think you should make this VDEV_ST_USED check specific to Wifi devices, as a lot of devices don't follow too closely to the USB protocol to begin with from my experience. They primarily base their USB interactions assuming the windows platform and its quirks.

When sending responses to Linux kernel mailing lists, please use bottom post. This check will be used for all drivers. We don't add checks for specific cases in the code.

thanks,
-- Shuah

Quoted 2 lines

Yes it works with that change.

Would you like to send me a patch for this?

thanks,
-- Shuah

Quoted 31 lines · Shuah Khan

Quoted 29 lines · Michael

Quoted 27 lines · Shuah Khan

Quoted 3 lines · Michael

Yes i think just adding the VDEV_ST_USED check in addition to the VDEV_ST_NOT_ASSIGNED state is fine and would fix the issue.

Can you please confirm if this works?

Quoted 11 lines

After many years of writing virtualhere (a similar system to usb/ip but cross-platform and different non-kernel way of doing it server side) I've seen many drivers that issue reset at any time. Loading firmware is usually the reason. Also sometimes switching configurations requires a reset also, for example some gaming wheels do this. I don't think you should make this VDEV_ST_USED check specific to Wifi devices, as a lot of devices don't follow too closely to the USB protocol to begin with from my experience. They primarily base their USB interactions assuming the windows platform and its quirks.

When sending responses to Linux kernel mailing lists, please use bottom post. This check will be used for all drivers. We don't add checks for specific cases in the code.

thanks,
-- Shuah

Quoted 7 lines

Quoted 2 lines

Yes it works with that change.

Would you like to send me a patch for this?

thanks,
-- Shuah

usbip: Allow port reset to occur when the port is also in the ST_USED state

Signed-off-by Michael <[email protected]>

---
  drivers/usb/usbip/vhci_hcd.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)

drivers/usb/usbip/vhci_hcd.c +3 -1

index 4ba6bcdaa8e9..300131ae5897 100644
@@ -456,7 +456,9 @@ static int vhci_hub_control(struct usb_hcd *hcd,
 u16 typeReq, u16 wValue,
                         vhci_hcd->re_timeout = 0;
 
                         if (vhci_hcd->vdev[rhport].ud.status ==
-                           VDEV_ST_NOTASSIGNED) {
+                           VDEV_ST_NOTASSIGNED ||
+                               vhci_hcd->vdev[rhport].ud.status ==
+                               VDEV_ST_USED) {
                                 usbip_dbg_vhci_rh(
                                         " enable rhport %d (status %u)\n",

rhport,
--
2.30.2