xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

UPSTREAM: xhci: Fix failure to give back some cached cancelled URBs.

Browse Source 
(upstream commit 94f339147fc3eb9edef7ee4ef6e39c569c073753)

Only TDs with status TD_CLEARING_CACHE will be given back after
cache is cleared with a set TR deq command.

xhci_invalidate_cached_td() failed to set the TD_CLEARING_CACHE status
for some cancelled TDs as it assumed an endpoint only needs to clear the
TD it stopped on.

This isn't always true. For example with streams enabled an endpoint may
have several stream rings, each stopping on a different TDs.

Note that if an endpoint has several stream rings, the current code
will still only clear the cache of the stream pointed to by the last
cancelled TD in the cancel list.

This patch only focus on making sure all canceled TDs are given back,
avoiding hung task after device removal.
Another fix to solve clearing the caches of all stream rings with
cancelled TDs is needed, but not as urgent.

This issue was simultanously discovered and debugged by
by Tao Wang, with a slightly different fix proposal.

Fixes: 674f8438c121 ("xhci: split handling halted endpoints into two steps")
Cc: <stable@vger.kernel.org> #5.12
Reported-by: Tao Wang <wat@codeaurora.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>

Bug: 202901721
Signed-off-by: Puma Hsu <pumahsu@google.com>
Change-Id: I0ceff10453a99183d27bc53e64c2c193e0ac429a
This commit is contained in:
Mathias Nyman
2021-08-20 15:35:00 +03:00
committed by Todd Kjos
parent 7320fb1abd
commit c23b0e7c47
1 changed files with 25 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
drivers/usb/host/xhci-ring.c
View File

@@ -944,17 +944,21 @@ static int xhci_invalidate_cancelled_tds(struct xhci_virt_ep *ep)
td->urb->stream_id); td->urb->stream_id);
hw_deq &= ~0xf; hw_deq &= ~0xf;
if (td->cancel_status == TD_HALTED) { if (td->cancel_status == TD_HALTED ||
cached_td = td; trb_in_td(xhci, td->start_seg, td->first_trb, td->last_trb, hw_deq, false)) {
} else if (trb_in_td(xhci, td->start_seg, td->first_trb,
td->last_trb, hw_deq, false)) {
switch (td->cancel_status) { switch (td->cancel_status) {
case TD_CLEARED: /* TD is already no-op */ case TD_CLEARED: /* TD is already no-op */
case TD_CLEARING_CACHE: /* set TR deq command already queued */ case TD_CLEARING_CACHE: /* set TR deq command already queued */
break; break;
case TD_DIRTY: /* TD is cached, clear it */ case TD_DIRTY: /* TD is cached, clear it */
case TD_HALTED: case TD_HALTED:
td->cancel_status = TD_CLEARING_CACHE;
if (cached_td)
/* FIXME stream case, several stopped rings */ /* FIXME stream case, several stopped rings */
xhci_dbg(xhci,
"Move dq past stream %u URB %p instead of stream %u URB %p\n",
td->urb->stream_id, td->urb,
cached_td->urb->stream_id, cached_td->urb);
cached_td = td; cached_td = td;
break; break;
} }
@@ -963,18 +967,24 @@ static int xhci_invalidate_cancelled_tds(struct xhci_virt_ep *ep)
td->cancel_status = TD_CLEARED; td->cancel_status = TD_CLEARED;
} }
} }
if (cached_td) {
cached_td->cancel_status = TD_CLEARING_CACHE; /* If there's no need to move the dequeue pointer then we're done */
if (!cached_td)
return 0;
err = xhci_move_dequeue_past_td(xhci, slot_id, ep->ep_index, err = xhci_move_dequeue_past_td(xhci, slot_id, ep->ep_index,
cached_td->urb->stream_id, cached_td->urb->stream_id,
cached_td); cached_td);
/* Failed to move past cached td, try just setting it noop */
if (err) { if (err) {
td_to_noop(xhci, ring, cached_td, false); /* Failed to move past cached td, just set cached TDs to no-op */
cached_td->cancel_status = TD_CLEARED; list_for_each_entry_safe(td, tmp_td, &ep->cancelled_td_list, cancelled_td_list) {
if (td->cancel_status != TD_CLEARING_CACHE)
continue;
xhci_dbg(xhci, "Failed to clear cancelled cached URB %p, mark clear anyway\n",
td->urb);
td_to_noop(xhci, ring, td, false);
td->cancel_status = TD_CLEARED;
} }
cached_td = NULL;
} }
return 0; return 0;
} }