xhci: Prevent early endpoint restart when handling STALL errors.

Ensure that an endpoint halted due to device STALL is not
restarted before a Clear_Feature(ENDPOINT_HALT) request is sent to
the device.

The host side of the endpoint may otherwise be started early by the
'Set TR Deq' command completion handler which is called if dequeue
is moved past a cancelled or halted TD.

Prevent this with a new flag set for bulk and interrupt endpoints
when a Stall Error is received. Clear it in hcd->endpoint_reset()
which is called after Clear_Feature(ENDPOINT_HALT) is sent.

Also add a debug message if a class driver queues a new URB after the
STALL. Note that class driver might not be aware of the STALL
yet when it submits the URB as URBs are given back in BH.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20250306144954.3507700-13-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index c2e15a27338ba5f7a9fb67bd3a4dbe9b88681509..7643ab9ec3b492d1b4692c13163a101f300f5323 100644 (file)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -556,8 +556,8 @@ void xhci_ring_ep_doorbell(struct xhci_hcd *xhci,
         * pointer command pending because the device can choose to start any
         * stream once the endpoint is on the HW schedule.
         */
-       if ((ep_state & EP_STOP_CMD_PENDING) || (ep_state & SET_DEQ_PENDING) ||
-           (ep_state & EP_HALTED) || (ep_state & EP_CLEARING_TT))
+       if (ep_state & (EP_STOP_CMD_PENDING | SET_DEQ_PENDING | EP_HALTED |
+                       EP_CLEARING_TT | EP_STALLED))
                return;
 
        trace_xhci_ring_ep_doorbell(slot_id, DB_VALUE(ep_index, stream_id));
@@ -2555,6 +2555,9 @@ static void process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_virt_ep *ep,
 
                xhci_handle_halted_endpoint(xhci, ep, td, EP_SOFT_RESET);
                return;
+       case COMP_STALL_ERROR:
+               ep->ep_state |= EP_STALLED;
+               break;
        default:
                /* do nothing */
                break;

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 3f2cd546a7a26ba1646be9540905d29dbbb7262f..0c22b78358b9265ba48164fae409492a97988045 100644 (file)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1604,6 +1604,11 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
                goto free_priv;
        }
 
+       /* Class driver might not be aware ep halted due to async URB giveback */
+       if (*ep_state & EP_STALLED)
+               dev_dbg(&urb->dev->dev, "URB %p queued before clearing halt\n",
+                       urb);
+
        switch (usb_endpoint_type(&urb->ep->desc)) {
 
        case USB_ENDPOINT_XFER_CONTROL:
@@ -3202,6 +3207,7 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
                return;
 
        ep = &vdev->eps[ep_index];
+       ep->ep_state &= ~EP_STALLED;
 
        /* Bail out if toggle is already being cleared by a endpoint reset */
        spin_lock_irqsave(&xhci->lock, flags);

diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index cd96e0a8c593a95bd1872e5c325abffb5fe00292..4ee14f651d36c9d34a68926093fa6f9ad030a135 100644 (file)
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -664,7 +664,7 @@ struct xhci_virt_ep {
        unsigned int                    err_count;
        unsigned int                    ep_state;
 #define SET_DEQ_PENDING                (1 << 0)
-#define EP_HALTED              (1 << 1)        /* For stall handling */
+#define EP_HALTED              (1 << 1)        /* Halted host ep handling */
 #define EP_STOP_CMD_PENDING    (1 << 2)        /* For URB cancellation */
 /* Transitioning the endpoint to using streams, don't enqueue URBs */
 #define EP_GETTING_STREAMS     (1 << 3)
@@ -675,6 +675,7 @@ struct xhci_virt_ep {
 #define EP_SOFT_CLEAR_TOGGLE   (1 << 7)
 /* usb_hub_clear_tt_buffer is in progress */
 #define EP_CLEARING_TT         (1 << 8)
+#define EP_STALLED             (1 << 9)        /* For stall handling */
        /* ----  Related to URB cancellation ---- */
        struct list_head        cancelled_td_list;
        struct xhci_hcd         *xhci;