From: Arkadiusz Miskiewicz <a.miskiewicz@gmail.com>
Reply-To: arekm@maven.pl
To: Mathias Nyman <mathias.nyman@linux.intel.com>
Subject: Re: xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 1
Date: Fri, 24 Jul 2015 17:33:18 +0200
User-Agent: KMail/1.13.7 (Linux/4.2.0-rc3-00136-g45b4b78-dirty; KDE/4.14.9; x86_64; ; )
Cc: linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org
References: <201507181649.37745.a.miskiewicz@gmail.com> <55B228A4.2020604@linux.intel.com> <55B24006.7020300@linux.intel.com>
In-Reply-To: <55B24006.7020300@linux.intel.com>
Organization: Do not reply to gmail address. Write to arekm@maven.pl instead.
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="utf-8"
Content-Transfer-Encoding: 8BIT
Message-Id: <201507241733.18308.a.miskiewicz@gmail.com>
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 2944
Lines: 76

On Friday 24 of July 2015, Mathias Nyman wrote:
> On 24.07.2015 14:59, Mathias Nyman wrote:
> > On 22.07.2015 17:12, Arkadiusz Miskiewicz wrote:
> >> On Tuesday 21 of July 2015, Mathias Nyman wrote:
> >>> On 20.07.2015 23:13, Arkadiusz Miskiewicz wrote:
> >>>> On Saturday 18 of July 2015, Arkadiusz Miskiewicz wrote:
> >>>>> Hi.
> >>>>> 
> >>>>> I'm on 4.2.0-rc2-00077-gf760b87 kernel and while trying to copy some
> >>>>> file from usb storage (sata disk behind sata-usb bridge or pendrive;
> >>>>> hapens in
> >>>> 
> >>>>> both cases) copying process hangs just early after start with:
> >>>> Looks like suspend & resume is enough. Reloading bluetooth firmware
> >>>> done by kernel triggers problem:
> >>>> 
> >>>> [  106.302783] rtc_cmos 00:02: System wakeup disabled by ACPI
> >>>> [  106.313280] PM: resume of devices complete after 3003.032 msecs
> >>>> [  106.314079] Restarting tasks ... done.
> >>>> [  106.326434] Bluetooth: hci0: read Intel version: 370710018002030d00
> >>>> [  106.330422] Bluetooth: hci0: Intel Bluetooth firmware file:
> >>>> intel/ibt-hw-37.7.10-fw-1.80.2.3.d.bseq [  106.398223] xhci_hcd
> >>>> 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD
> >>>> ep_index 0 comp_code 1
> > 
> > Thanks for the logs, They show that the error is related to transfer
> > descriptors that wrap around on the endpoint ring buffer by exactly one
> > transfer block.
> > 
> > I don't know yet why this happens, and I might need some help running
> > additional debug patches to solve this. I'll take a more in depth look
> > at the code one more time first.
> 
> I think I found something, The recent ring segment size increase exposed an
> off by one error that has been in the driver for a long time. But you need
> to be unlucky and have your memory pages allocated in a specific order to
> trigger it.
> 
> small fix, looks like this:
> 
> diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
> index 94416ff..77da8fe 100644
> --- a/drivers/usb/host/xhci-ring.c
> +++ b/drivers/usb/host/xhci-ring.c
> @@ -82,7 +82,7 @@ dma_addr_t xhci_trb_virt_to_dma(struct xhci_segment *seg,
>                 return 0;
>         /* offset in TRBs */
>         segment_offset = trb - seg->trbs;
> -       if (segment_offset > TRBS_PER_SEGMENT)
> +       if (segment_offset > TRBS_PER_SEGMENT - 1)
>                 return 0;
>         return seg->dma + (segment_offset * sizeof(*trb));
>  }
> 
> 
> Patch attached, could you try it out?

Works fine with this patch, so:

Tested-by: Arkadiusz Miśkiewicz <arekm@maven.pl>

Thanks!

ps. please push to stable@, too

> 
> Thanks
> -Mathias

-- 
Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/