From nobody Tue Dec 2 02:32:14 2025 Received: from mail-ej1-f48.google.com (mail-ej1-f48.google.com [209.85.218.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0139D34F476 for ; Wed, 19 Nov 2025 11:03:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763550237; cv=none; b=TyCZYclBAzUKlpFLPXo+A7hpefBvMrHTDvO4zpl8vXphXZNWLbrNhsN4b2gixHbgc/yI3kt+V6RbCLQKK9vhoFtqCmJa9yY0m9C0r3IlXgEw9I0JyfZxFQRIs26l8Yezv78Jz7X8tQ3TaOTfyzvCzE+F93P0byC0lhkBRyxvj7U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763550237; c=relaxed/simple; bh=4mSerw4vYazyDfgyl8j1CLDy2pYsgGbR8tF9bgVF6JA=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=OflfQRkFPQp9o9CCQw0Pa0PYxQOUrJrjkTalko/VWs88zy7pKaoTpY0kxvYmHmfLVn+ZBEjUmiwKCnrzX+D86F0R3KaMBT0IflZxKQqHYW8eA4UPC+nCChkP87ZWfloUBsxCfxkgCAt2Fk2Wh0zJOUFQvcD1n5uT1VxXsL3I46k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Pz3s5KyD; arc=none smtp.client-ip=209.85.218.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Pz3s5KyD" Received: by mail-ej1-f48.google.com with SMTP id a640c23a62f3a-b728a43e410so1079840066b.1 for ; Wed, 19 Nov 2025 03:03:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1763550230; x=1764155030; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=EdPiRm4LzogiWqW/lnu08ToTWmpvxJj4XqcowJynZMA=; b=Pz3s5KyDCiqAc6CmRV1sN6+hWcfnmA6cIwXzPUD+BKO83rwiZs1t/92Q1i1q3XBI8K ZvGT6kRHEW8p4Zmzg9IXIPczj51PMZqiRa5ums3FzJSmQe+SOHMvdZxMoyNoOrP7njFX V4PTlPiQqEpU5S26P0izNsPEhLanqfmuCvu0cn0zxHQIJYX8O+lygKZZeO3jUhwLIlHS ddhz8GXprusbXnLVUn8sNTI/E8qAPt/ZYxBwAXkuyRwQ0YYRBdibTOts6Mzf8xUYEwoA vn7RC7536ClWCBUCG6kqbBOkHRcfBLsCQP6JNB5ileUk6XyYL1zIN4spx1O1C7B9L5e0 v63g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763550230; x=1764155030; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=EdPiRm4LzogiWqW/lnu08ToTWmpvxJj4XqcowJynZMA=; b=Jv/z0mjiJjmkz0vcD7+iWSr9mMvff1PnjkNS1e87Hmdm/mru/vITBDKGpfNVEOJd6Y QI+quo1H6UVOeW++5LLYY0JyOtLxhqx9j09cNNHxA5VqGr+6r6Ic/Yyf3ixvr8uoeSUs woqSIbyxUyev2OPim4Vvg0gbkWcrnl1DplGqA4lXM7Sui1bn5kVjELPbn9uo3RdoQT/Q gd1g9zLJBUGKYNMIbcSHG1MN4Jlxx63ZR76qOi2E5HN/SAhxLJm0UZXSyXJOzrvLf0tk wmooPZ8JCa4V8z1408JMeNphIooyJRY4OutI03XgIJp1LAzgtaI3Jb7qYkd2Q3uogjjZ ew9Q== X-Forwarded-Encrypted: i=1; AJvYcCVIfnjZekHd/oYqDG7NhPgEgdbeiKQduDJOpo4OhcLaQqjNV7/QuTtn1Z61xWAJdSxsLckCp7C+xyQsPuc=@vger.kernel.org X-Gm-Message-State: AOJu0Yx4eweSFh3c5la21XQFMPUCmvrQTe0n1aF+vfmVB092oeUHB5BS 2ldeSLVHDkQa8rsROzhOswTInUJVqaDpMHjPVGhlcC/MiN8ife3BumS9nqASYg== X-Gm-Gg: ASbGnctjHfXjeuhadOgJGXgDd/nvkSgfXTOMtF1Pbvfl4rLjf82TrokYDwQguHXrHu5 JfJFpk4aTc+V1ZypiKS1ZLWCgOy7CjaJHrzWQkHzzXkpjA0G/SghmjxqkcCG9axmaV6VTJx/Ed4 61BWlpApC3YRJkihZgwr4oDaBAMUHRGu/kBHFosRHfbxY0uYVtNYMBObGzpc++8l4wgZTj3bkIj HOML/Ygtax9i17GArcbF6Buin+oWjYfwmc/GFn43fRItiLdjKmjcKytHu+Qt0RDCa+Y0xy1AYGF pq9WGu5Cd7sKPopGY/Tc/Iu6wqQms5fNoyzybMpYNhV4FMlLD91ubq9L9jouO38FzqEY6KGwvFy OMUJAwjhHxHfHfgBS67coQlhlqhqyFs1kUnNelKUrrwM90+KVqGYJ1877m1dx3tKdkW4ruIlJEQ /g99K8n2ex73E/oy55NcYQ+S4= X-Google-Smtp-Source: AGHT+IFgyVTFepwmJ2y3kGahtWZuiVh3MxIYfoCeuZo+rnD6QUmtcBuWMQiB2ayc/7YdDXfEDMrrbg== X-Received: by 2002:a17:906:b205:b0:b73:7a44:b4d5 with SMTP id a640c23a62f3a-b737a44b692mr1432516766b.41.1763550230496; Wed, 19 Nov 2025 03:03:50 -0800 (PST) Received: from foxbook (bhd138.neoplus.adsl.tpnet.pl. [83.28.93.138]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b734fa81296sm1617324866b.6.2025.11.19.03.03.49 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Wed, 19 Nov 2025 03:03:50 -0800 (PST) Date: Wed, 19 Nov 2025 12:03:47 +0100 From: Michal Pecio To: Mathias Nyman , Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/5] usb: xhci: Find transfer TRB early in handle_tx_event() Message-ID: <20251119120347.70a02fde.michal.pecio@gmail.com> In-Reply-To: <20251119120208.6a025eb0.michal.pecio@gmail.com> References: <20251119120208.6a025eb0.michal.pecio@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" As soon as we find the transfer ring to which an event belongs, we can proceed to locate the exact TRB referenced by the event. This enables better event handling and diagnostics, even if no TD matches the event. Also set 'ep_seg' and remove its secondary use as a temporary boolean. Bail out if event TRB pointer is not NULL and not a transfer TRB on the endpoint's ring. This indicates that either the HC executes TRBs from a wrong ring (bad Set TR Dequeue command, Link TRB damaged or ignored by the HC) or its internal state is corrupted and the event is bogus. No such event is going to match any TD on td_list and trying to handle it would generally do nothing. On an isochronous endpoint we might skip all pending TDs and create more chaos. Just log this error and get out. Suggested-by: Mathias Nyman Signed-off-by: Michal Pecio --- drivers/usb/host/xhci-ring.c | 35 +++++++++++++++++++++++++++++++---- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 3d5124912a09..531e2f207b17 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -82,6 +82,27 @@ dma_addr_t xhci_trb_virt_to_dma(struct xhci_segment *seg, return seg->dma + (segment_offset * sizeof(*trb)); } =20 +/* + * Look up a TRB by its DMA address, return NULL if not found on the ring. + * Search from start_seg to let callers optimize starting point selection. + * Write actual segment containing returned TRB to seg_out, if provided. + */ +static union xhci_trb *xhci_dma_to_trb(struct xhci_segment *start_seg, dma= _addr_t dma, + struct xhci_segment **seg_out) +{ + struct xhci_segment *seg; + + xhci_for_each_ring_seg(start_seg, seg) { + if (in_range(dma, seg->dma, TRB_SEGMENT_SIZE)) { + if (seg_out) + *seg_out =3D seg; + return seg->trbs + (dma - seg->dma) / sizeof(seg->trbs[0]); + } + } + + return NULL; +} + static bool trb_is_noop(union xhci_trb *trb) { return TRB_TYPE_NOOP_LE32(trb->generic.field[3]); @@ -2672,6 +2693,15 @@ static int handle_tx_event(struct xhci_hcd *xhci, if (!ep_ring) return handle_transferless_tx_event(xhci, ep, trb_comp_code); =20 + /* get the corresponding transfer TRB pointer */ + ep_trb =3D xhci_dma_to_trb(ep_ring->deq_seg, ep_trb_dma, &ep_seg); + if (!ep_trb && ep_trb_dma) { + xhci_warn(xhci, "Ignoring '%s' event out of ring on slot %d ep %d\n", + xhci_trb_comp_code_string(trb_comp_code), slot_id, ep_index); + /* XXX: other ring's TDs may be executing on this EP, should we kill it?= */ + return 0; + } + /* Look for common error cases */ switch (trb_comp_code) { /* Skip codes that require special handling depending on @@ -2846,9 +2876,7 @@ static int handle_tx_event(struct xhci_hcd *xhci, td_list); =20 /* Is this a TRB in the currently executing TD? */ - ep_seg =3D trb_in_td(td, ep_trb_dma); - - if (!ep_seg) { + if (!trb_in_td(td, ep_trb_dma)) { =20 if (ep->skip && usb_endpoint_xfer_isoc(&td->urb->ep->desc)) { /* this event is unlikely to match any TD, don't skip them all */ @@ -2931,7 +2959,6 @@ static int handle_tx_event(struct xhci_hcd *xhci, if (ring_xrun_event) return 0; =20 - ep_trb =3D &ep_seg->trbs[(ep_trb_dma - ep_seg->dma) / sizeof(*ep_trb)]; trace_xhci_handle_transfer(ep_ring, (struct xhci_generic_trb *) ep_trb, e= p_trb_dma); =20 /* --=20 2.48.1