github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
3eb40771c0
linux/drivers/usb
History
Lachlan Hodges 3d26cd1f3f usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask 
xhci is unusable on some systems after driver switched to BIT() macro.
Upper 32bits of 64bit CRCR command register are unintentionally cleared.

Seen on a raspberry pi 4B compiled for arm32.
The main symptoms were the following log message:

[    0.549897] raspberrypi-firmware soc:firmware: Attached to firmware from 2021-02-25T12:11:39
[    0.626859] xhci_hcd 0000:01:00.0: xHCI Host Controller
[    0.626889] xhci_hcd 0000:01:00.0: new USB bus registered, assigned bus number 1
[    0.812619] xhci_hcd 0000:01:00.0: hcc params 0x002841eb hci version 0x100 quirks 0x0000200000000890
[    0.813188] xhci_hcd 0000:01:00.0: xHCI Host Controller
[    0.813203] xhci_hcd 0000:01:00.0: new USB bus registered, assigned bus number 2
[    0.813219] xhci_hcd 0000:01:00.0: Host supports USB 3.0 SuperSpeed
[    0.813602] hub 1-0:1.0: USB hub found
[    0.814052] hub 2-0:1.0: USB hub found
[    0.952714] xhci_hcd 0000:01:00.0: ERROR mismatched command completion event

Additionally running lsusb just hangs. Running the same kernel compiled
for aarch64 worked fine. Bisected to the commit in the Fixes line.
Additionally a USB device plugged in to the USB3.0 (or 2.0) did not
enumerate. Once this patch is applied the USB device enumerates properly.

The CRCR register is 64 bits wide - commit abe93f27cd
("xhci: use BIT macro") changed the flag definitions from (1 << n),
a signed int, to BIT(n), an unsigned long. Within
xhci_set_cmd_ring_deq(), the following operation is performed on the
CRCR register:

...
	crcr &= ~CMD_RING_PTR_MASK;
	crcr |= deq_dma;
	crcr &= ~CMD_RING_CYCLE;
	crcr |= xhci->cmd_ring->cycle_state;
...

Previously, ~CMD_RING_CYCLE was ~(int)1, a negative signed value
(0xFFFFFFFE with the sign bit set). Widening a negative signed int to
u64 sign-extends it to 0xFFFFFFFFFFFFFFFE, correctly clearing only bit
0 and preserving the 64-bit pointer written two lines above.

After the change when running on 32 bit kernels, ~CMD_RING_CYCLE is
~(unsigned long)1UL. On a 32-bit host this is an unsigned 32-bit
value (0xFFFFFFFE, no sign bit). Widening an unsigned value to u64
zero-extends it instead (0x00000000FFFFFFFE), so the subsequent AND
silently clears bits 63:32 of crcr, truncating the command ring
pointer that was just written before the value reaches hardware.

To fix, similar to how CMD_RING_PTR_MASK is defined, make sure we
use the BIT_ULL variant when defining the CRCR bits.

[Mathias: use BIT_ULL() for ERST_EHB and EP_CTX_CYCLE_MASK as suggested
by Michal Pecio, also include raspberry case in commit message]

Fixes: abe93f27cd ("xhci: use BIT macro")
Cc: stable <stable@kernel.org>
Assisted-by: Claude:claude-sonnet-5
cc: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20260804083639.2148950-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-04 10:54:57 +02:00
..
atm usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() 2026-08-03 17:23:58 +02:00
c67x00 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cdns3 usb: cdnsp: fix incorrect endian conversions for APB timeout register 2026-08-03 17:23:47 +02:00
chipidea usb: chipidea: fix usage_count leak when autosuspend_delay is negative 2026-07-16 17:12:21 +02:00
class usb: cdc_acm: Add quirk for Uniden BC125AT scanner 2026-06-25 15:10:09 +01:00
common USB: ulpi: fix memory leak on registration failure 2026-06-25 15:11:27 +01:00
core usb: quirks: Add ShanWan gamepad to quirk list 2026-08-03 17:25:44 +02:00
dwc2 usb: dwc2: Add include defining struct pci_device_id 2026-07-03 07:38:15 +02:00
dwc3 usb: dwc3: run gadget disconnect from sleepable suspend context 2026-07-08 13:35:22 +02:00
early usb: early: xhci-dbc: Fix early_ioremap leak 2025-07-07 11:04:46 +02:00
fotg210 usb: free iso schedules on failed submit 2026-07-08 13:30:38 +02:00
gadget usb: gadget: f_ncm: Use unsigned int for ndp_index 2026-08-03 17:23:51 +02:00
host usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask 2026-08-04 10:54:57 +02:00
image Merge 7.0-rc4 into usb-next 2026-03-16 11:50:48 +01:00
isp1760 Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
misc usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg 2026-08-03 17:23:54 +02:00
mon Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
mtu3 usb: mtu3: unmap request DMA on queue failure 2026-06-25 16:04:26 +01:00
musb usb: musb: omap2430: Do not put borrowed of_node in probe 2026-07-16 17:11:35 +02:00
phy usb: phy: isp1301: Use named initializers for struct i2c_device_id 2026-05-21 16:52:36 +02:00
renesas_usbhs usb: renesas_usbhs: use kzalloc_flex 2026-03-18 15:51:48 +01:00
roles usb: roles: get usb role switch from parent only for usb-b-connector 2026-03-11 16:22:22 +01:00
serial USB: serial: io_edgeport: cap received transmit credits 2026-07-22 11:23:54 +02:00
storage USB: storage: add NO_ATA_1X quirk for Longmai USB Key 2026-07-16 17:11:02 +02:00
typec usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path 2026-07-23 10:38:19 +02:00
usbip usbip: vudc: fix NULL deref in vep_dequeue() 2026-07-08 13:29:31 +02:00
Kconfig usb: pci-quirks: handle HAS_IOPORT dependency for AMD quirk 2023-10-02 16:19:12 +02:00
Makefile usb: cdns3: Add USBSSP platform driver support 2026-04-27 05:14:18 -06:00
usb-skeleton.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00