usb: xhci: expand mitigations for VLI_SS_BULK_OUT_BUG quirk

The VL805 can cause data corruption if a SS Bulk OUT endpoint enters a
flow-control condition and there are TRBs in the transfer ring that are
not an integral size of wMaxPacket and the endpoint is behind one or more
hubs.

This is frequently the case encountered when FAT32 filesystems are
present on mass-storage devices with cluster sizes of 1 sector, and the
filesystem is being written to with an aggregate of small files.

The initial implementation of this quirk separated TRBs that didn't
adhere to this limitation into two - the first a multiple of wMaxPacket
and the second the 512-byte remainder - in an attempt to force TD
fragments to align with packet boundaries. This reduced the incidence
rate of data corruption but did not resolve it.

The fix as recommended by VIA is to disable bursts if this sequence of
TRBs can occur.

Limit turning off bursts to just USB mass-storage devices by searching
the device's configuration for an interface with a class type of
USB_CLASS_MASS_STORAGE.

Signed-off-by: Jonathan Bell <[email protected]>

Author: P33M

drivers/usb/host/xhci-mem.c

@@ -1437,6 +1437,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
 	unsigned int ep_index;
 	struct xhci_ep_ctx *ep_ctx;
 	struct xhci_ring *ep_ring;
+	struct usb_interface_cache *intfc;
 	unsigned int max_packet;
 	enum xhci_ring_type ring_type;
 	u32 max_esit_payload;
@@ -1446,6 +1447,8 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
 	unsigned int mult;
 	unsigned int avg_trb_len;
 	unsigned int err_count = 0;
+	unsigned int is_ums_dev = 0;
+	unsigned int i;
 
 	ep_index = xhci_get_endpoint_index(&ep->desc);
 	ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
@@ -1477,9 +1480,35 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
 
 	mult = xhci_get_endpoint_mult(udev, ep);
 	max_packet = usb_endpoint_maxp(&ep->desc);
-	max_burst = xhci_get_endpoint_max_burst(udev, ep);
 	avg_trb_len = max_esit_payload;
 
+	/*
+	 * VL805 errata - Bulk OUT bursts to superspeed mass-storage
+	 * devices behind hub ports can cause data corruption with
+	 * non-wMaxPacket-multiple transfers.
+	 */
+	for (i = 0; i < udev->config->desc.bNumInterfaces; i++) {
+		intfc = udev->config->intf_cache[i];
+		/*
+		 * Slight hack - look at interface altsetting 0, which
+		 * should be the UMS bulk-only interface. If the class
+		 * matches, then we disable out bursts for all OUT
+		 * endpoints because endpoint assignments may change
+		 * between alternate settings.
+		 */
+		if (intfc->altsetting[0].desc.bInterfaceClass ==
+		    USB_CLASS_MASS_STORAGE) {
+			is_ums_dev = 1;
+			break;
+		}
+	}
+	if (xhci->quirks & XHCI_VLI_SS_BULK_OUT_BUG &&
+	    usb_endpoint_is_bulk_out(&ep->desc) && is_ums_dev &&
+	    udev->route)
+		max_burst = 0;
+	else
+		max_burst = xhci_get_endpoint_max_burst(udev, ep);
+
 	/* FIXME dig Mult and streams info out of ep companion desc */
 
 	/* Allow 3 retries for everything but isoc, set CErr = 3 */