From patchwork Mon Feb 10 07:38:27 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Pecio X-Patchwork-Id: 13967415 Received: from mail-ej1-f48.google.com (mail-ej1-f48.google.com [209.85.218.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 753F71A4F22; Mon, 10 Feb 2025 07:38:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739173115; cv=none; b=QUVm5Tnh2mUtKG5DDKIIusCFq5nqmN3WAXDG54FttBOYLZW6IRLTER0M2VoeAdclK0MaIN9LVH2V8pSB/2JCatUYOpvkT1Wq1QNxnQjxDqlyoDVTH58UvqhZDHlpgLnSfkbKpcHJZp9bGIhCRwrT36+U2uSK04Ukii4xnLuWh6Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739173115; c=relaxed/simple; bh=rzLIcW6Uwg2iq/oUVo2eRQXjftKxEPX7IwkRPXp5qHg=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=i57/SreI5AXCGdLHLv5TfXSRRlBxgubrEq0Nu+Qh4Tcv8BJ1i+NtN7JQ9/OvtCeXRjjI45l5IXOjQt29EIY7xM7RDVs+FSwKrS1VaQOF1t+o3eNXOaaaAoH1hGtiCyjjSqzU1jIpyTJloCqdM+p9R3J89UxXb7AqNlV2B3ejbTs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YoebXdHy; arc=none smtp.client-ip=209.85.218.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YoebXdHy" Received: by mail-ej1-f48.google.com with SMTP id a640c23a62f3a-ab7c501bbecso80690566b.2; Sun, 09 Feb 2025 23:38:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1739173112; x=1739777912; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=hDIUrVZk2er48UMv50fmo3VWNeX5XafyYFDhgvhEonQ=; b=YoebXdHyeu936voebMRgXrfKTV+rtsStHYBwyikfpKufJlUQ0/5WN748F3dtE3P1zN fLisPCNhbq25Fo3AZIy9277SgNpTMAtO2QTjJoXPNNwrURyvlOI8FZHm8x/DZMu1PScE z4NxW6SNBbQy37+rEbmeOUy9/OwGQehO7Oq/sPBgi/Dgb4I2dbbL1cK/4ZeKmp3b6jO9 usNvQp6qU5zusACn8UxaM+rEWweXxNagIGhgp2KOm8RWrklcIDADxclgvq7xxFmX6s3S K6JOP8i1r5gqgGNU18qZXL/QKKhUpXZ0KBJ32mZsvxTcypNuAbF22pEy/QKQ1tn+M9u3 XH7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1739173112; x=1739777912; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=hDIUrVZk2er48UMv50fmo3VWNeX5XafyYFDhgvhEonQ=; b=rs4PkQlbFXmKkSRJo6VkU7f5M92sZIPFe8cR86LzDrY+fRhGMnXKZOyhyy+7NgD/Nz ryMBycZhEbTBYimzjqg86iRVl3OOs8Z5C5pDBZlR+1cuRBw96ntndCXGQShyJ9rlUerN U6iWwyOR9HLM5CTdSd7wa8LL+HYCYQqzREmMSrnBNjyewGmegovC8Yk1ODdNcV1GgESW J6H87DhvVk/D75DmLGaInxJoY81kspWVw+BJlStzblxL5+11nS3g8orCzAHyJIJsBnFD IjP9SUxZF2umv6tsFYJTFCELVtgk1Xxbv3PO88Fje4vQ/MGSy5CFweG5I+pbzJeokB0e 9v+A== X-Forwarded-Encrypted: i=1; AJvYcCWWeBnHHYV1uIKUdrN2dWKJvTJxxQFHQv3/gfQZUVvH9tZVVLcPnRMu9M1noS/VrW2U9hkkMzCE9R17@vger.kernel.org, AJvYcCWiF11ko1/LnmepNiyvzF0f7ynCL3S5CIx6XrA55dBB+UCrE48YyV/rIjFHEZik8cNlX+QyRWMBZbcTSnQ=@vger.kernel.org X-Gm-Message-State: AOJu0YyDXOs16v98DMx4vm+OiCsPbvbLXxwraItuZKFNK/iZi9zR4Xde Rkokr+pFmKa476hPNwGnbJVEwULKwaJ+I0GC7UY0jyrDQW/ysmca X-Gm-Gg: ASbGncvsUdcJxR86t9aq2i0NeDn0hfo5CbsVF2NVnGihxfDMjvSGuQZQmCe7oxXCZO+ +pzbvW2JF3Xe9nxJF186pJvnPlyo86pvGpVQd7VhRQqd84qBZhoV4wEmdQnYalRoYcQvHVZbjlX URFwgBQG7lL494Dg2goupYhbQkay04Q/J+q2HwCwQjokiNy0FIMl33gkkGptolbSM38Woz0SoT8 Br8aY8oyZCC9/fSL9HjyEr5Ayp1QpAsHP6wpBeLp5SOAfNEfehD6G6A+IOG4y+NsR0/D/LpEqAH Pr7qQzHDvaOI+KZncWTEGveelXOjJ3CO X-Google-Smtp-Source: AGHT+IG1xp7UAiVEChw5JbzI1UtuChPcdyi/g+FxQX1BvtBENBaFaPlJ4WcJOREOP9WIjsZ+qOjo4Q== X-Received: by 2002:a17:907:980c:b0:ab7:758c:b398 with SMTP id a640c23a62f3a-ab789ac0dacmr1317854066b.20.1739173111427; Sun, 09 Feb 2025 23:38:31 -0800 (PST) Received: from foxbook (adtq181.neoplus.adsl.tpnet.pl. [79.185.228.181]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-ab79792121dsm543968966b.124.2025.02.09.23.38.30 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Sun, 09 Feb 2025 23:38:31 -0800 (PST) Date: Mon, 10 Feb 2025 08:38:27 +0100 From: Michal Pecio To: Mathias Nyman , Greg Kroah-Hartman Cc: Niklas Neronin , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/5] usb: xhci: Complete 'error mid TD' transfers when handling Missed Service Message-ID: <20250210083827.2de46507@foxbook> In-Reply-To: <20250210083718.2dd337c3@foxbook> References: <20250210083718.2dd337c3@foxbook> Precedence: bulk X-Mailing-List: linux-usb@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Missed Service Error after an error mid TD means that the failed TD has already been passed by the xHC without acknowledgment of the final TRB, a known hardware bug. So don't wait any more and give back the TD. Reproduced on NEC uPD720200 under conditions of ludicrously bad USB link quality, confirmed to behave as expected using dynamic debug. Signed-off-by: Michal Pecio --- drivers/usb/host/xhci-ring.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 965bffce301e..af6c4c4cbe1c 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2789,7 +2789,7 @@ static int handle_tx_event(struct xhci_hcd *xhci, xhci_dbg(xhci, "Miss service interval error for slot %u ep %u, set skip flag\n", slot_id, ep_index); - return 0; + break; case COMP_NO_PING_RESPONSE_ERROR: ep->skip = true; xhci_dbg(xhci, @@ -2837,6 +2837,10 @@ static int handle_tx_event(struct xhci_hcd *xhci, xhci_dequeue_td(xhci, td, ep_ring, td->status); } + /* Missed TDs will be skipped on the next event */ + if (trb_comp_code == COMP_MISSED_SERVICE_ERROR) + return 0; + if (list_empty(&ep_ring->td_list)) { /* * Don't print wanings if ring is empty due to a stopped endpoint generating an From patchwork Mon Feb 10 07:39:40 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Pecio X-Patchwork-Id: 13967419 Received: from mail-ed1-f52.google.com (mail-ed1-f52.google.com [209.85.208.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 74BD01A3159; Mon, 10 Feb 2025 07:39:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739173188; cv=none; b=JKLsxHosUKnxZUVsNh1nUvl2EKJTdYtBjBDyFxkN5YXAQRErahk0JH1myrjAF+9GnRYaPm0crF5hOc02HpiTXlk46s7tpKVoCHeKJBWAWXeR6NaiRvL2Ny5yudHYC74vp+T20qBKnj6YN6aU4aGsSf1E7K4uCjxkfZM/wpCGAFM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739173188; c=relaxed/simple; bh=/MhUaxMiXFtrw1l+HuClnUI74j6x65PHqprv76q92dw=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=e7Vhh/FwwSuo1umEfEHQfZNpRXeNRbcXAEE89Qruuv6qycAFMRjKHxcoa3ahLPGGFWqUOXflsYuekzkT7vs4xiE3ytOtnFKUR9D/7KZvNnAYkgrTGbxrt70JDTLdy4RxMpT5SSC4tuDWS1hxrsAG0uguTvDNOkHLqwTnovycW8Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Jawnz0TL; arc=none smtp.client-ip=209.85.208.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Jawnz0TL" Received: by mail-ed1-f52.google.com with SMTP id 4fb4d7f45d1cf-5dca468c5e4so5210331a12.1; Sun, 09 Feb 2025 23:39:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1739173184; x=1739777984; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=ElG9QHShsG3QPSus8iOZDuN/TU1JSfnKVnU9TxLdqKg=; b=Jawnz0TL8Adllc+231bO/CgaJGF/duZdLquKE5sTS+YEm0VuI12tbju+jCCQ763mbf 9LcP7rAh0wmvc80NPQH6RGCTUHX5u64KrH5ndtoVxgpEb1QPEaCYCrXc/dcrCdhYNVUR B2gODvmRwDwNVWMHR+8aPNRcZe4RgHjLt3wnO1a86HcUkPOY+i+SPQ82bFtpN+SVEtXb KPKoQB2LmmRa1HxFMFcgLBKL2IphjwHsEs0rSIy/oGYH0egnXffYu5BOz88xnPjDKAA9 DAHe5hMl4WbnFM9vqsDp2tw745LUU2lYbDdX5TORYgC/a8KAeDGKEdSECBfkU20NZeZP m1+g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1739173184; x=1739777984; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ElG9QHShsG3QPSus8iOZDuN/TU1JSfnKVnU9TxLdqKg=; b=PrX7ze2BLOUNypLyO3cExxSVwFSYneysXU1pkVvstFSAECs2uui4oxqKBbEkmvr1Z+ VL6eeC3OGD8JfX2h5+MU6cC6yGjKF2sGdAc1sIm9f75L6w5z2Gycic8FlUu5c9pWE1xL MhxX3Ms/LIvydEdWUSAUdxvmWj6Y/Rjom/X2Mx1ZznEZVAidcKr0lie+SPOvVacupS5Y mIiyDtgraBUC2o1y9GXcx6Ias1F9Dty1OjEVIHruZecIct0NoBV5mhi9CkviBBFdD0fM AChJcTKSiCBZdfQw+EtOolgTF+EMDB5fzvKNo2GcsVAmZsy4JJyL55uJudABVjuxZaoD jIyg== X-Forwarded-Encrypted: i=1; AJvYcCWjsg2jRoOBS7l4VHW1lEHTlbDV1fYkL0MvRHfKA4nxN5sCRTVrCybynrSmBuxGJtBr1OjSbR+XSCFdsrE=@vger.kernel.org, AJvYcCXQtv36Flg9aX3IQxwFOzaEs2GEKKaUMhPz39FbUw6c300tPfkxbXH6A+9iUwRUe9f2mVDS1t4yDemO@vger.kernel.org X-Gm-Message-State: AOJu0YxjS6NmsRE7QnB20ffmuT0f5LWKNQKt3V5SWqsoyXlvSvB3nykq r3UMuU3D+DvGo1FIWqVSvcnkKSHfnV/kPI1Z8umDAsDGL2agv+Wx X-Gm-Gg: ASbGncti2G3R4kITyJIKSYamblzcIkVpITAW4AR6/zkNTCniVhPBsv5OfxwAfkpxPj+ RHZsu/dsDoUAE8OMmUhwWJEItqqzOkamtXx6MDWsvqx2it6vJWP0TfE486S6TZlJC2bx0wFxHiz NBa8YfpgbO06/ZaJnR56ZvQDA6jDY5+sC4VWBxpPHZRqhGaiPaOFPuzCyxuB+7qhCzvw7M23AAn pwsBIa3k55U2A6L0jkUs3OnlImyvMwx+iJUNymxsmZipMzHmVXgYG45/r2s/SucR/byrsPygjmu FfoD8gvhdQ8Fvm2riQWn8sKhZeNxcr2o X-Google-Smtp-Source: AGHT+IEkEAyX/0W9vuSkw16lXtvFgCGrx/a3k3X9899oxde55ynWWq5pMfdYJjB9Vl34bnPB2ut3LQ== X-Received: by 2002:a05:6402:2106:b0:5d0:bdc1:75df with SMTP id 4fb4d7f45d1cf-5de4508dc71mr13640776a12.24.1739173183444; Sun, 09 Feb 2025 23:39:43 -0800 (PST) Received: from foxbook (adtq181.neoplus.adsl.tpnet.pl. [79.185.228.181]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-5de4bd92f60sm5693293a12.71.2025.02.09.23.39.42 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Sun, 09 Feb 2025 23:39:43 -0800 (PST) Date: Mon, 10 Feb 2025 08:39:40 +0100 From: Michal Pecio To: Mathias Nyman , Greg Kroah-Hartman Cc: Niklas Neronin , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/5] usb: xhci: Clean up the TD skipping loop Message-ID: <20250210083940.626c02d9@foxbook> In-Reply-To: <20250210083718.2dd337c3@foxbook> References: <20250210083718.2dd337c3@foxbook> Precedence: bulk X-Mailing-List: linux-usb@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Half of this loop is code which only executes once to deal with cases where no TD matches the event and then immediately returns. This code has no need to be in any kind of loop, so get it out. Shuffle the remaining conditionals a little to improve readability. No functional change. Signed-off-by: Michal Pecio --- drivers/usb/host/xhci-ring.c | 68 ++++++++++++++++++------------------ 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index af6c4c4cbe1c..9b06a911a16e 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2866,9 +2866,9 @@ static int handle_tx_event(struct xhci_hcd *xhci, /* Is this a TRB in the currently executing TD? */ ep_seg = trb_in_td(xhci, td, ep_trb_dma, false); - if (!ep_seg) { + if (ep->skip) { - if (ep->skip && usb_endpoint_xfer_isoc(&td->urb->ep->desc)) { + if (!ep_seg && usb_endpoint_xfer_isoc(&td->urb->ep->desc)) { skip_isoc_td(xhci, td, ep, status); if (!list_empty(&ep_ring->td_list)) continue; @@ -2880,38 +2880,6 @@ static int handle_tx_event(struct xhci_hcd *xhci, goto check_endpoint_halted; } - /* - * Skip the Force Stopped Event. The 'ep_trb' of FSE is not in the current - * TD pointed by 'ep_ring->dequeue' because that the hardware dequeue - * pointer still at the previous TRB of the current TD. The previous TRB - * maybe a Link TD or the last TRB of the previous TD. The command - * completion handle will take care the rest. - */ - if (trb_comp_code == COMP_STOPPED || - trb_comp_code == COMP_STOPPED_LENGTH_INVALID) { - return 0; - } - - /* - * Some hosts give a spurious success event after a short - * transfer. Ignore it. - */ - if ((xhci->quirks & XHCI_SPURIOUS_SUCCESS) && - ep_ring->last_td_was_short) { - ep_ring->last_td_was_short = false; - return 0; - } - - /* HC is busted, give up! */ - xhci_err(xhci, - "ERROR Transfer event TRB DMA ptr not part of current TD ep_index %d comp_code %u\n", - ep_index, trb_comp_code); - trb_in_td(xhci, td, ep_trb_dma, true); - - return -ESHUTDOWN; - } - - if (ep->skip) { xhci_dbg(xhci, "Found td. Clear skip flag for slot %u ep %u.\n", slot_id, ep_index); @@ -2926,6 +2894,38 @@ static int handle_tx_event(struct xhci_hcd *xhci, */ } while (ep->skip); + if (!ep_seg) { + /* + * Skip the Force Stopped Event. The 'ep_trb' of FSE is not in the current + * TD pointed by 'ep_ring->dequeue' because that the hardware dequeue + * pointer still at the previous TRB of the current TD. The previous TRB + * maybe a Link TD or the last TRB of the previous TD. The command + * completion handle will take care the rest. + */ + if (trb_comp_code == COMP_STOPPED || + trb_comp_code == COMP_STOPPED_LENGTH_INVALID) { + return 0; + } + + /* + * Some hosts give a spurious success event after a short + * transfer. Ignore it. + */ + if ((xhci->quirks & XHCI_SPURIOUS_SUCCESS) && + ep_ring->last_td_was_short) { + ep_ring->last_td_was_short = false; + return 0; + } + + /* HC is busted, give up! */ + xhci_err(xhci, + "ERROR Transfer event TRB DMA ptr not part of current TD ep_index %d comp_code %u\n", + ep_index, trb_comp_code); + trb_in_td(xhci, td, ep_trb_dma, true); + + return -ESHUTDOWN; + } + if (trb_comp_code == COMP_SHORT_PACKET) ep_ring->last_td_was_short = true; else From patchwork Mon Feb 10 07:40:39 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Pecio X-Patchwork-Id: 13967420 Received: from mail-ed1-f46.google.com (mail-ed1-f46.google.com [209.85.208.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 173EF1B4149; Mon, 10 Feb 2025 07:40:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739173246; cv=none; b=DbJOSmi/tcSiro/737pc+Esx8kMX8PF+v5IOQ/LX8yWlkSdBmzYIMzBACwGJIYvj+60nuFbLhITmPYZ5x730U0/RH2a+79C3zTe5yN1DUcBycLVD3MwL/gIpfgw7cF4rHhKscIA16IwDiyzZWCdIrnFednRaCsQ1RjPyScgLrGE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739173246; c=relaxed/simple; bh=eTEG+gAtpDdSPJl6g8hkkdjOZgaHcJljzPV6r1bGj0g=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=PFF67ePI/6kFX9ULHxPwMX7HJPnY18CNG6IMAaw33lzxV/KgXaLFGfe75mvGXd9+Yfj1FKwP+u8MAmxJzGlIwz1hUi3orvNZ7/EX0JE5odBAeczrsZlfPG8KlSg1dew2MRdLwkgJ4iDipxzDWVeTeyH2jJoKdTqFkMF1j1Ec0IE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dEk6dpLT; arc=none smtp.client-ip=209.85.208.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dEk6dpLT" Received: by mail-ed1-f46.google.com with SMTP id 4fb4d7f45d1cf-5dccaaca646so7899799a12.0; Sun, 09 Feb 2025 23:40:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1739173243; x=1739778043; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=++ovUUwJH/E3x9o9N2lcwDw3LK6MWwTzZJkWbZlRbW0=; b=dEk6dpLTPp1xnzYa5B/b4hbzmwFRmWyNErUkB5hizzy/OfNDUezJ1hXE8SDO+sCFO2 uCu+W5g4jo62mG8a/n9UXijXXl89Ge/OciVxmkSNH2UjziIyhTozkN0be7hXUeNTBOm9 yct4X9eda62VROUl/3Ty+l7ZSmEDOwOSmKw6jopR3VO49cUF2LcdZiGFy43jJgtiudkl mj7XhtRM9c4peebMEoP5cKUVLbSeHET8baR3rw3MxXyK1xOB9+1+QHR4SS3Y8MncMgfw SK9HeEvEO5OgxmeE3R39b1PtGlP8pmlr3R6z25ykT4ClTzbtV/XUXBDxGspV5yNmBY0R MrhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1739173243; x=1739778043; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=++ovUUwJH/E3x9o9N2lcwDw3LK6MWwTzZJkWbZlRbW0=; b=RA48W/jL+oHJW92oADSjxBz6cm2tHPZpqUQNmKj4wHz+nYbUlkU+YOgHN3Gl2+2MRK Vpx9b+NESCmcLRXrT+ptTxCT0jB8MwaeggGwMeDTiRc4/ZkGTTM4LFMOqRMqKEkHMoKn mTgcvNDLDSM3b6tYYSo3dbmt4yxWXSCY/Jg+b/8MKEeZzHCkehcBUZq+BBa+dibaP+1L xpu7OVjRWYCu1BQodH9aUSOZSChfdnXPYx5CSdhSiB4lFxo3KVRnOXuq0z6iOWVM0LAk TIikK5K7w5u6ZIVm5ma3bvkzTvKqJFLcVXbG4RxSFGuWON6dl0kHZfGs9l5Zhmii/+1L svCA== X-Forwarded-Encrypted: i=1; AJvYcCUEinqA1JVpf677iMIKOYsuAc9our9D5EAHLTxu3u6apfeu3Aa2Slc4TJh4yjPTdo7kbpNoTEh0nfWQB3k=@vger.kernel.org, AJvYcCVClqYNFkU1dtNRgibZsPyEpQVmOufMCLzHw9KhHa+k/LLrkwpAbPxKk3fcl/4Xge9P5Jz02rM4GWl/@vger.kernel.org X-Gm-Message-State: AOJu0YznlwXS8s/AiL30b9eyVURJPPEjy+jpfzNTvI9KNSZjwiD6XIEQ EMPhTYDkklvUalFxgh3p+U2fmfDhoM/aECHBFg4hEKExlg0JWK0u X-Gm-Gg: ASbGncu0Llf+EeSaVxSS6YkEr4ZhQvzLxolX3LwVkCDG6zX73jHIwgVi/jNrO+17+0O LeQiHxzTM/KO+2rZ6Qo4kbo3GRqV0iaGYuDRVcy284daXt66PaaW24az01VLvLBnZYQHe8PvXPk nAH8mwz1eCpA9A4Nvtg0JyTWYTXEQFJI5d42Poi0HCHxf25QekiOwPtlTowM4HE0k558VqAqCaN jvbzqrN3BUZivZl5ZkJLD/HejDfTJaYKKhLhyIg+cCSXTMWhXatQ1MeyekB783eGfziJpr9FFyS anGbiiiEWD/euXzp0HzOsTWV+E2UhzxP X-Google-Smtp-Source: AGHT+IFBJvUjWR/XSylcEftefCtQZBr2hODlucBtDqhpbK84II0TbhllwxJTleUn7E2m6zyXX80oTA== X-Received: by 2002:a05:6402:430c:b0:5db:68bd:ab78 with SMTP id 4fb4d7f45d1cf-5de46a1c14bmr14072221a12.10.1739173243118; Sun, 09 Feb 2025 23:40:43 -0800 (PST) Received: from foxbook (adtq181.neoplus.adsl.tpnet.pl. [79.185.228.181]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-5de45a92fa7sm6489176a12.23.2025.02.09.23.40.42 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Sun, 09 Feb 2025 23:40:42 -0800 (PST) Date: Mon, 10 Feb 2025 08:40:39 +0100 From: Michal Pecio To: Mathias Nyman , Greg Kroah-Hartman Cc: Niklas Neronin , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 3/5] usb: xhci: Fix isochronous Ring Underrun/Overrun event handling Message-ID: <20250210084039.734666bd@foxbook> In-Reply-To: <20250210083718.2dd337c3@foxbook> References: <20250210083718.2dd337c3@foxbook> Precedence: bulk X-Mailing-List: linux-usb@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 The TRB pointer of these events points at enqueue at the time of error occurrence on xHCI 1.1+ HCs or it's NULL on older ones. By the time we are handling the event, a new TD may be queued at this ring position. I can trigger this race by rising interrupt moderation to increase IRQ handling delay. Similar delay may occur naturally due to system load. If this ever happens after a Missed Service Error, missed TDs will be skipped and the new TD processed as if it matched the event. It could be given back prematurely, risking data loss or buffer UAF by the xHC. Don't complete TDs on xrun events and don't warn if queued TDs don't match the event's TRB pointer, which can be NULL or a link/no-op TRB. Now that it's safe, also handle xrun events if the skip flag is clear. This ensures completion of any TD stuck in 'error mid TD' state right before the xrun event, which could happen if a driver submits a finite number of URBs to a buggy HC and then an error occurs on the last TD. Signed-off-by: Michal Pecio --- drivers/usb/host/xhci-ring.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 9b06a911a16e..11a53e310826 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2664,6 +2664,7 @@ static int handle_tx_event(struct xhci_hcd *xhci, int status = -EINPROGRESS; struct xhci_ep_ctx *ep_ctx; u32 trb_comp_code; + bool ring_xrun_event = false; slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags)); ep_index = TRB_TO_EP_ID(le32_to_cpu(event->flags)) - 1; @@ -2770,14 +2771,12 @@ static int handle_tx_event(struct xhci_hcd *xhci, * Underrun Event for OUT Isoch endpoint. */ xhci_dbg(xhci, "Underrun event on slot %u ep %u\n", slot_id, ep_index); - if (ep->skip) - break; - return 0; + ring_xrun_event = true; + break; case COMP_RING_OVERRUN: xhci_dbg(xhci, "Overrun event on slot %u ep %u\n", slot_id, ep_index); - if (ep->skip) - break; - return 0; + ring_xrun_event = true; + break; case COMP_MISSED_SERVICE_ERROR: /* * When encounter missed service error, one or more isoc tds @@ -2894,6 +2893,9 @@ static int handle_tx_event(struct xhci_hcd *xhci, */ } while (ep->skip); + if (ring_xrun_event) + return 0; /* don't warn or complete any TDs */ + if (!ep_seg) { /* * Skip the Force Stopped Event. The 'ep_trb' of FSE is not in the current From patchwork Mon Feb 10 07:41:37 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Pecio X-Patchwork-Id: 13967421 Received: from mail-ed1-f50.google.com (mail-ed1-f50.google.com [209.85.208.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9933C1B87EF; Mon, 10 Feb 2025 07:41:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739173304; cv=none; b=TPNo9j2CU8QN3SjFWZ19lmWCWscp7nwmpCsuw9fVkGyYaeiuGrm4QegNudAK67bIhFMRfoFaXKtao9c9A9v8amMY3pZQGtebZyZb+m+ZV+gC3UARDgMEq5uuvggOkAiDU4U/9i5JTA8JMxEPztjnIDZxD3dY/MOI7OEGoJxgm4E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739173304; c=relaxed/simple; bh=4wZ2PXfur8egXNnwBo7N5ubOAev+hvve+Oxty/JG0Vk=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=DvaLlIZedFgsbPZZXPpUXrDEBXkCt/Bn+WPWXFeNKpVN12KY5ESnSW/puMunAk0YPSSaf4py0xMYwXs9nP/tkSAIfKYNXLYsnkDBPKBbpcH8luibU7cJaHq+bPVciePzXJMtdBN8sW+ySq6Py3sHO8Zl3n0HjT3c81TrEC8kOiM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=L3qnT9jl; arc=none smtp.client-ip=209.85.208.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="L3qnT9jl" Received: by mail-ed1-f50.google.com with SMTP id 4fb4d7f45d1cf-5de6e26db8eso1986744a12.2; Sun, 09 Feb 2025 23:41:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1739173301; x=1739778101; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=f2RcdX/GqwE9yRHPGubP2yGFF/DbcGETjEu0NPc+ZSE=; b=L3qnT9jlIDGjf/NIQik6CZ+WpIKDAubpItUdRNKwZiYt9fW+WTFtZwGFHsUZe0dKOA pLvLQ2lPsZjuyt61x+kH6RljoKpteZrSu49TmEf/56FyOlgxtcJAePBSOtN4CnzRGHgT EiaWvTVtWUl6fqkpdZvSl0UGszYdnYRSNwyYhAcSTMuOMXoLpQHK/tv+DZH2hYequdWR W1GFtFqUbARMKksAhe2f0i4Z1GC3YcpvIZeijnmUA8knrSSQjObn+91G8Fmre6YAiuI5 7/TAu0Lc4FDRWy6ifGpA2uvCnOocPxZDYH1vqIB3v5xC1wEyAsGvAhdga9r3cZxsdRGI hBaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1739173301; x=1739778101; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=f2RcdX/GqwE9yRHPGubP2yGFF/DbcGETjEu0NPc+ZSE=; b=bncHvzEBKh4WS2j++ErcKH4EAaywX+dXcHROXdhhtT+RqAcoU0yfzVwXDVDLNBioJ1 XkjNmH1kPoChMbEVoSeNDNod7irnqNKysMETYszcpysw/41a4xwWF5gKA6I+gGaJkGY7 UFe8qvBLTqPSfcExjdB7Lksc+0ezBMg/TslKBavT+IgR/Tj2bRXHZBpvGc4g0e0yIcCg Cd6sc3YtBSdEjlkdcHkoamBzwqGrf5k3gyGB0bib/gaeBnkg1qON0xM0Ae/ZNNMR0KzV AM57cbyVkiQoq4q84YNtdwIGYym6IWd90WVcBIm+v279fUPguyxR9el66AvC2j/41Hsg b8Wg== X-Forwarded-Encrypted: i=1; AJvYcCUsv3cvntFN+QuplO7n3hJ5F7hPHitjmxLcINO513RPDFPs+cgNUVmX0pgVAohfzf9X3c31mqP+3eB0HXE=@vger.kernel.org, AJvYcCWLZ4enBCE+HxyDEtrjmXQujRQXoqFa2w3gyPW6WFvB4eaGYdReNPRJBssDXtqb2lPGYeOHQxa5qKVR@vger.kernel.org X-Gm-Message-State: AOJu0YzuBax13wctG7vAMXeFd/LQJt3yiCuSec5sBEuxs8JqbwNkHJsW Dg6lDzSviZ939Yp5Z32BHQEa3wni18dKrCRoYb8Bv8UQ5K3RHHfMuE6F2A== X-Gm-Gg: ASbGncsjCzH4R7SahBuxUG5yt926GtOZcbBPv84PA+5N4D1Xr5/WCt0YK31r3blS0aU BnZIilJ6XousSTz4rD3K2tlCIK6iyl6dh6XtSXnM/SE7X6332Ywb4UBBC5dxeN0tO0dZ/2LTmKD 8U2TNcts2QzAfSivNJQxnVUKm+gbzoUNryeudPjKTkaAlTE1+LvpAllzsP0menZ6iTOBayLPTxw hxmj/u74uHj2NZHr8SJCh0X9f6Tbf6OzT+o/dcKNl6QMXqjtiNg6noyIkOPu2ALV4mj0MxY9IEP 30SS9TzT1Kaf+Q4qeYjxmT5a3LjE219b X-Google-Smtp-Source: AGHT+IFmHEz01JMwmgTiCyvn2884m6vS3unuxdPrSqOcyaZhFaMbZz9SzHMSUQZjiq8nwJ320QX/GA== X-Received: by 2002:a05:6402:1ec5:b0:5dc:545:40a7 with SMTP id 4fb4d7f45d1cf-5de45005b92mr15481607a12.12.1739173300626; Sun, 09 Feb 2025 23:41:40 -0800 (PST) Received: from foxbook (adtq181.neoplus.adsl.tpnet.pl. [79.185.228.181]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-5de4ba95a32sm6086993a12.40.2025.02.09.23.41.39 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Sun, 09 Feb 2025 23:41:40 -0800 (PST) Date: Mon, 10 Feb 2025 08:41:37 +0100 From: Michal Pecio To: Mathias Nyman , Greg Kroah-Hartman Cc: Niklas Neronin , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 4/5] usb: xhci: Expedite skipping missed isoch TDs on modern HCs Message-ID: <20250210084137.5f4cc906@foxbook> In-Reply-To: <20250210083718.2dd337c3@foxbook> References: <20250210083718.2dd337c3@foxbook> Precedence: bulk X-Mailing-List: linux-usb@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 xHCI spec rev. 1.0 allowed the TRB pointer of Missed Service events to be NULL. Having no idea which of the queued TDs were missed and which are waiting, we can only set a flag to skip missed TDs later. But HCs are also allowed to give us pointer to the last missed TRB, and this became mandatory in spec rev. 1.1 and later. Use this pointer, if available, to immediately skip all missed TDs. This reduces latency and risk of skipping-related bugs, because we can now leave the skip flag cleared for future events. Handle Missed Service Error events as 'error mid TD', if applicable, because rev. 1.0 spec excplicitly says so in notes to 4.10.3.2 and later revs in 4.10.3.2 and 4.11.2.5.2. Notes to 4.9.1 seem to apply. Tested on ASM1142 and ASM3142 v1.1 xHCs which provide TRB pointers. Tested on AMD, Etron, Renesas v1.0 xHCs which provide TRB pointers. Tested on NEC v0.96 and VIA v1.0 xHCs which send a NULL pointer. Change inspired by a discussion about realtime USB audio. Link: https://lore.kernel.org/linux-usb/76e1a191-020d-4a76-97f6-237f9bd0ede0@gmx.net/T/ Signed-off-by: Michal Pecio --- drivers/usb/host/xhci-ring.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 11a53e310826..878abf5b745d 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2476,6 +2476,12 @@ static void process_isoc_td(struct xhci_hcd *xhci, struct xhci_virt_ep *ep, if (ep_trb != td->end_trb) td->error_mid_td = true; break; + case COMP_MISSED_SERVICE_ERROR: + frame->status = -EXDEV; + sum_trbs_for_length = true; + if (ep_trb != td->end_trb) + td->error_mid_td = true; + break; case COMP_INCOMPATIBLE_DEVICE_ERROR: case COMP_STALL_ERROR: frame->status = -EPROTO; @@ -2786,8 +2792,8 @@ static int handle_tx_event(struct xhci_hcd *xhci, */ ep->skip = true; xhci_dbg(xhci, - "Miss service interval error for slot %u ep %u, set skip flag\n", - slot_id, ep_index); + "Miss service interval error for slot %u ep %u, set skip flag%s\n", + slot_id, ep_index, ep_trb_dma ? ", skip now" : ""); break; case COMP_NO_PING_RESPONSE_ERROR: ep->skip = true; @@ -2836,8 +2842,8 @@ static int handle_tx_event(struct xhci_hcd *xhci, xhci_dequeue_td(xhci, td, ep_ring, td->status); } - /* Missed TDs will be skipped on the next event */ - if (trb_comp_code == COMP_MISSED_SERVICE_ERROR) + /* If the TRB pointer is NULL, missed TDs will be skipped on the next event */ + if (trb_comp_code == COMP_MISSED_SERVICE_ERROR && !ep_trb_dma) return 0; if (list_empty(&ep_ring->td_list)) { From patchwork Mon Feb 10 07:42:20 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Pecio X-Patchwork-Id: 13967422 Received: from mail-ej1-f42.google.com (mail-ej1-f42.google.com [209.85.218.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 345771A3159; Mon, 10 Feb 2025 07:42:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739173347; cv=none; b=nuVrip8FeOAojy9kL2SP3yBBk4EplXgcTM4i1NdB3gmfKEvMAiJjmEhsuKboy628vhM81a09TMMfNPwXNVXWx6Yv/hw4KiNjw8Pm+kbXOFIX41Nz5yGfLzcXMpBREJBi4/YcCOAKoGd+JfNQvDkftbf4Z7uho4fY1JftyjjfoMM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739173347; c=relaxed/simple; bh=QSeVFrS8AlRqMMnu5KVH+XMuflenwRZOO6LZ39/DS28=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=f7F7LODxW5lZi2EaMJa2gneZK+guvlH9JWXjwocJeDuniEdgkugQUtcMsMnAzvRiS35FuVDRYzkongKJxpuBle2EeL/0chz6GxDu6f8g/ZMfSzTDXM11YFeHHDhdnu+EU8guSCL7SQro6kV0vlgRLbL/SKZru9mLDwdP+2l0SNo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Lg463z4c; arc=none smtp.client-ip=209.85.218.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Lg463z4c" Received: by mail-ej1-f42.google.com with SMTP id a640c23a62f3a-ab78d9c5542so470461866b.1; Sun, 09 Feb 2025 23:42:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1739173344; x=1739778144; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=ltfGinCJ7NHfrB+q5DH7Wu/bz6rIJOHJC14+oF7o8aE=; b=Lg463z4cDCXrxvmQic2S6BYhduZNUcioZNbFoIjd98Mf/LZFtO7b9OpJFlbMk9bZSQ lq2E2IQnL+Qb74UlJlYkxe19qRWyNd7fzdQU7yRj5xOnTFfzaiGXnMdHABT4cjDZjAwx 44L9TbFPLImQe7lDS9xBmFpdVaS22K0V6gAgaNv6wglVYZlHfirc7zwN1JbpC2qapUNu u0kNX7dEaOUqKyFYdLINwRNSV66yEKkLT4DiMWl5vx0Qi62X2vNFTaSKCcVp/X0Rbkr/ QjtSaWWTShEG/e3Lv2e5HFXdpiXKzHig4DuuKZ+23ubIeiQvaonL6NmaEbLIMsrRPzBS M/6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1739173344; x=1739778144; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ltfGinCJ7NHfrB+q5DH7Wu/bz6rIJOHJC14+oF7o8aE=; b=nM31m4Ho2KieF4CDsT1QshZjKk5lb+OOaOn/qPxKHNFqHLl/TnJso7medmww49Fp7o X5ZVqnhtparwzpaO95IZE7gQhdyhd06fj3pz2Q+1AEnwHzL0KRelfehjh/9hMDC7M6kA rOQiHTDJ6am6jmxRb+Kub4X3k0QRSBeFaR7m3yhsLzyX7rMu6lhNlM98n/nywcxWUSI6 pamY2QSQ/aE4bH2GWXJy1rn/oejlX2dd365j5qjL+EWg+bptMlwuLtuJbh6xHTqtsA9w uiHG2THM+7hheLMxqBUban77lJO8U8cZYZIx2gDVWdKRSkfw+7SnxGGuU8lm4rhq4q3B j0+g== X-Forwarded-Encrypted: i=1; AJvYcCVA89t/Gd0Yi9kPCY9VE6XFiZ0BW8ICKB/tK89FYDuYLgMN+IQ4IMY0NE12KEMoi9hbLkblY64hKD0hp6I=@vger.kernel.org, AJvYcCXmdQRmlPSUpwu9E6+U8taxoShSCmvd1OZ+KUIC5PIpE9j9VNZOHUQla6+tHnFf5BKAZhtGiAvYreHh@vger.kernel.org X-Gm-Message-State: AOJu0YzmUj1jwwlUhfKMgDqdSxuYlKNh9/gjMwoJ0f7BMEaN4FDYoEmI Nj/cnHEz27YRglfn+gDZT8GGlvimpyYiPVvR6CsHv+km85hPXfmS X-Gm-Gg: ASbGncvcEjbvJZoQ67rYgsyNy1pDdWPQmpxJXsbYnAxay+80MgAPmJ/m/VxaIMXl+pW t091NTXhl3c9u8ZNmlB4alGK8BWyuBNbGRr6tU07GrgxeAFAT8V97jABnuRE5AjuUJWWcLHrCYq mUfTDTBJBj1V2KmmNhZsLPYi5APD9KZpMPNFEJ7A+rpukcd9c7to5RfV3TyE1Khx/fylBN3PaDk Ld6Ji+mCw35R78rfL8RXtVnDahr29mNAhaiM3cSbhr+LEq5oXrfQWJzcIn9ZvyTkTf7AHf/5uQh 0IIDCqYWohmpeYJfnOaIbeOqgBn0WZeQ X-Google-Smtp-Source: AGHT+IGSeWpHu/qJEW7zfEADCO3fh7nw3R6ZvVw1kcqO7eQWmoYB4onDA2ciAEdKNsc9ooJau7TgaA== X-Received: by 2002:a17:906:46db:b0:ab7:9f12:6787 with SMTP id a640c23a62f3a-ab79f1286demr749705466b.50.1739173344134; Sun, 09 Feb 2025 23:42:24 -0800 (PST) Received: from foxbook (adtq181.neoplus.adsl.tpnet.pl. [79.185.228.181]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-ab7cf027239sm33229166b.181.2025.02.09.23.42.23 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Sun, 09 Feb 2025 23:42:23 -0800 (PST) Date: Mon, 10 Feb 2025 08:42:20 +0100 From: Michal Pecio To: Mathias Nyman , Greg Kroah-Hartman Cc: Niklas Neronin , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 5/5] usb: xhci: Skip only one TD on Ring Underrun/Overrun Message-ID: <20250210084220.3e5414e9@foxbook> In-Reply-To: <20250210083718.2dd337c3@foxbook> References: <20250210083718.2dd337c3@foxbook> Precedence: bulk X-Mailing-List: linux-usb@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 If skipping is deferred to events other than Missed Service Error itsef, it means we are running on an xHCI 1.0 host and don't know how many TDs were missed until we reach some ordinary transfer completion event. And in case of ring xrun, we can't know where the xrun happened either. If we skip all pending TDs, we may prematurely give back TDs added after the xrun had occurred, risking data loss or buffer UAF by the xHC. If we skip none, a driver may become confused and stop working when all its URBs are missed and appear to be "in flight" forever. Skip exactly one TD on each xrun event - the first one that was missed, as we can now be sure that the HC has finished processing it. Provided that one more TD is queued before any subsequent doorbell ring, it will become safe to skip another TD by the time we get an xrun again. Signed-off-by: Michal Pecio --- drivers/usb/host/xhci-ring.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 878abf5b745d..049206a1db76 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2875,6 +2875,18 @@ static int handle_tx_event(struct xhci_hcd *xhci, if (!ep_seg && usb_endpoint_xfer_isoc(&td->urb->ep->desc)) { skip_isoc_td(xhci, td, ep, status); + + if (ring_xrun_event) { + /* + * If we are here, we are on xHCI 1.0 host with no idea how + * many TDs were missed and where the xrun occurred. Don't + * skip more TDs, they may have been queued after the xrun. + */ + xhci_dbg(xhci, "Skipped one TD for slot %u ep %u", + slot_id, ep_index); + break; + } + if (!list_empty(&ep_ring->td_list)) continue;