8:25 a.m.
tree: https://git.kernel.org/pub/scm/linux/kernel/git/mnyman/xhci.git clear_tt_fix
head: f0c60c326a996022b065eb6ed919d4a1953ca0f8
commit: 407ed31dc0b999ff33a602731b37ba011f0fdf4b [1/2] xhci: HACK: fake ep halt on FS/LS
device behind HS hub
reproduce:
# apt-get install sparse
# sparse version: v0.6.1-rc1-42-g38eda53-dirty
git checkout 407ed31dc0b999ff33a602731b37ba011f0fdf4b
make ARCH=x86_64 allmodconfig
make C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__'
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp(a)intel.com>
sparse warnings: (new ones prefixed by >>)
> drivers/usb/host/xhci-ring.c:2118:33: sparse: sparse: incorrect
type in assignment (different base types) @@ expected unsigned int [usertype] field0 @@
got d int [usertype] field0 @@
> drivers/usb/host/xhci-ring.c:2118:33: sparse: expected unsigned int [usertype]
field0
> drivers/usb/host/xhci-ring.c:2118:33: sparse: got restricted __le32
> drivers/usb/host/xhci-ring.c:2121:35: sparse: sparse: cast to restricted __le16
drivers/usb/host/xhci-ring.c:652:9: sparse: sparse: context imbalance in
'xhci_giveback_urb_in_irq' - unexpected unlock
vim +2118 drivers/usb/host/xhci-ring.c
2004
2005 /*
2006 * Process control tds, update urb status and actual_length.
2007 */
2008 static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
2009 union xhci_trb *ep_trb, struct xhci_transfer_event *event,
2010 struct xhci_virt_ep *ep, int *status)
2011 {
2012 struct xhci_virt_device *xdev;
2013 unsigned int slot_id;
2014 int ep_index;
2015 struct xhci_ep_ctx *ep_ctx;
2016 u32 trb_comp_code;
2017 u32 remaining, requested;
2018 u32 trb_type;
2019 bool fake_epipe = false;
2020
2021 trb_type = TRB_FIELD_TO_TYPE(le32_to_cpu(ep_trb->generic.field[3]));
2022 slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags));
2023 xdev = xhci->devs[slot_id];
2024 ep_index = TRB_TO_EP_ID(le32_to_cpu(event->flags)) - 1;
2025 ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
2026 trb_comp_code = GET_COMP_CODE(le32_to_cpu(event->transfer_len));
2027 requested = td->urb->transfer_buffer_length;
2028 remaining = EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
2029
2030 switch (trb_comp_code) {
2031 case COMP_SUCCESS:
2032 if (trb_type != TRB_STATUS) {
2033 xhci_warn(xhci, "WARN: Success on ctrl %s TRB without IOC set?\n",
2034 (trb_type == TRB_DATA) ? "data" : "setup");
2035 *status = -ESHUTDOWN;
2036 break;
2037 }
2038 *status = 0;
2039 break;
2040 case COMP_SHORT_PACKET:
2041 *status = 0;
2042 break;
2043 case COMP_STOPPED_SHORT_PACKET:
2044 if (trb_type == TRB_DATA || trb_type == TRB_NORMAL)
2045 td->urb->actual_length = remaining;
2046 else
2047 xhci_warn(xhci, "WARN: Stopped Short Packet on ctrl setup or status
TRB\n");
2048 goto finish_td;
2049 case COMP_STOPPED:
2050 switch (trb_type) {
2051 case TRB_SETUP:
2052 td->urb->actual_length = 0;
2053 goto finish_td;
2054 case TRB_DATA:
2055 case TRB_NORMAL:
2056 td->urb->actual_length = requested - remaining;
2057 goto finish_td;
2058 case TRB_STATUS:
2059 td->urb->actual_length = requested;
2060 goto finish_td;
2061 default:
2062 xhci_warn(xhci, "WARN: unexpected TRB Type %d\n",
2063 trb_type);
2064 goto finish_td;
2065 }
2066 case COMP_STOPPED_LENGTH_INVALID:
2067 goto finish_td;
2068 default:
2069 if (!xhci_requires_manual_halt_cleanup(xhci,
2070 ep_ctx, trb_comp_code))
2071 break;
2072 xhci_dbg(xhci, "TRB error %u, halted endpoint index = %u\n",
2073 trb_comp_code, ep_index);
2074 /* else fall through */
2075 case COMP_STALL_ERROR:
2076 /* Did we transfer part of the data (middle) phase? */
2077 if (trb_type == TRB_DATA || trb_type == TRB_NORMAL)
2078 td->urb->actual_length = requested - remaining;
2079 else if (!td->urb_length_set)
2080 td->urb->actual_length = 0;
2081 goto finish_td;
2082 }
2083
2084 /* stopped at setup stage, no data transferred */
2085 if (trb_type == TRB_SETUP)
2086 goto finish_td;
2087
2088 /*
2089 * if on data stage then update the actual_length of the URB and flag it
2090 * as set, so it won't be overwritten in the event for the last TRB.
2091 */
2092 if (trb_type == TRB_DATA ||
2093 trb_type == TRB_NORMAL) {
2094 td->urb_length_set = true;
2095 td->urb->actual_length = requested - remaining;
2096 xhci_dbg(xhci, "Waiting for status stage event\n");
2097 return 0;
2098 }
2099
2100 /* at status stage */
2101 if (!td->urb_length_set)
2102 td->urb->actual_length = requested;
2103
2104 /*
2105 * If this a status TRB of a LS/FS device begind a HS hub with a TT
2106 * and we are asked to read the device descriptor -> fake a -EPROTO
2107 */
2108 if (trb_type == TRB_STATUS &&
2109 td->urb->dev->tt &&
2110 td->urb->dev->tt->hub != xhci_to_hcd(xhci)->self.root_hub) {
2111 union xhci_trb *setup_trb;
2112 u32 field0;
2113 u8 bmRequestType;
2114 u8 bRequest;
2115 u16 wValue;
2116
2117 setup_trb = td->first_trb;
2118 field0 = setup_trb->generic.field[0];
2119 bmRequestType = (field0 & 0xff);
2120 bRequest = (field0 & 0xff00) >> 8;
2121 wValue = le16_to_cpu((field0 & 0xffff0000) >> 16);
2122
2123 /*
2124 * bmRequestType, bits 0-7, 0x80 = standard, Device
2125 * bRequest, Get_Descriptor == 6
2126 * wValue:1 is Device Descriptor, messed up byte order -> 0x100,
2127 */
2128 if (bmRequestType == 0x80 &&
2129 bRequest == 0x6 &&
2130 wValue == 0x100) {
2131 xhci_err(xhci, "Fake a -EPIPE on LS/FS dev behind TT hub\n");
2132 fake_epipe = true;
2133 *status = -EPIPE;
2134 }
2135 }
2136 finish_td:
2137 return finish_td(xhci, td, event, ep, status, fake_epipe);
2138 }
2139
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation