From patchwork Mon Jan 25 18:39:42 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 371411 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EB531C433E0 for ; Tue, 26 Jan 2021 04:45:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BFAA422B3B for ; Tue, 26 Jan 2021 04:45:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727162AbhAZEol (ORCPT ); Mon, 25 Jan 2021 23:44:41 -0500 Received: from mail.kernel.org ([198.145.29.99]:58354 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727652AbhAYSmt (ORCPT ); Mon, 25 Jan 2021 13:42:49 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8E10923102; Mon, 25 Jan 2021 18:42:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1611600125; bh=goLjPfICnWXpopqQAkGijrPKFoYfCVXCx6RJrB2lbA4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TGkoMheE2+ImBlLmDk5JJevNBdRklbJztzeLR9HMZzkqjzMTKjHz95XAZ4ruEucGH /Ptjlzw8Sm6Pjbcj80sAwV1e2wacQ3ELJ2mgMbT3oMwjM9CdcvA7JKy23bkVNcxu2H AeK6a7kcoDO8j0tVZ9jo8mQ2OcK6gtMBwXqKtmwE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ross Zwisler , Mathias Nyman Subject: [PATCH 4.19 41/58] xhci: make sure TRB is fully written before giving it to the controller Date: Mon, 25 Jan 2021 19:39:42 +0100 Message-Id: <20210125183158.483820186@linuxfoundation.org> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210125183156.702907356@linuxfoundation.org> References: <20210125183156.702907356@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mathias Nyman commit 576667bad341516edc4e18eb85acb0a2b4c9c9d9 upstream. Once the command ring doorbell is rung the xHC controller will parse all command TRBs on the command ring that have the cycle bit set properly. If the driver just started writing the next command TRB to the ring when hardware finished the previous TRB, then HW might fetch an incomplete TRB as long as its cycle bit set correctly. A command TRB is 16 bytes (128 bits) long. Driver writes the command TRB in four 32 bit chunks, with the chunk containing the cycle bit last. This does however not guarantee that chunks actually get written in that order. This was detected in stress testing when canceling URBs with several connected USB devices. Two consecutive "Set TR Dequeue pointer" commands got queued right after each other, and the second one was only partially written when the controller parsed it, causing the dequeue pointer to be set to bogus values. This was seen as error messages: "Mismatch between completed Set TR Deq Ptr command & xHCI internal state" Solution is to add a write memory barrier before writing the cycle bit. Cc: Tested-by: Ross Zwisler Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20210115161907.2875631-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/host/xhci-ring.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2835,6 +2835,8 @@ static void queue_trb(struct xhci_hcd *x trb->field[0] = cpu_to_le32(field1); trb->field[1] = cpu_to_le32(field2); trb->field[2] = cpu_to_le32(field3); + /* make sure TRB is fully written before giving it to the controller */ + wmb(); trb->field[3] = cpu_to_le32(field4); trace_xhci_queue_trb(ring, trb);