[PATCH] usb: xhci: Fix HCS_ERST_MAX conversion

[PATCH] usb: xhci: Fix HCS_ERST_MAX conversion

[Chen-Yu Tsai]

This partially reverts commit 6d45e9556d4a11b726e897d86e095b96db4550d8.

HCS_ERST_MAX holds power of 2 value for maximum number of segments.
In the culprit commit, this was incorrectly converted to "shift up 2".
On hardware where this field is zero, this results in xhci_alloc_erst()
calling dma_alloc_coherent() with size = 0, leading to a horrible splat
and non-usable XHCI.

Revert the shift-up-2 to the BIT() macro.

Fixes: 6d45e9556d4a ("usb: xhci: standardize multi bit-field macros")
Cc: Niklas Neronin <niklas.neronin@linux.intel.com>
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
---
This immediately fixes XHCI for me. This was observed on next-20260818
and next-20260819.
---
 drivers/usb/host/xhci-mem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 7a21ac81f9c8..af8d4b74c4ba 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2301,7 +2301,7 @@ xhci_alloc_interrupter(struct xhci_hcd *xhci, unsigned int segs, gfp_t flags)
 	if (!segs)
 		segs = ERST_DEFAULT_SEGS;
 
-	max_segs = FIELD_GET(HCS_ERST_MAX, xhci->hcs_params2) << 2;
+	max_segs = BIT(FIELD_GET(HCS_ERST_MAX, xhci->hcs_params2));
 	segs = min(segs, max_segs);
 
 	ir = kzalloc_node(sizeof(*ir), flags, dev_to_node(dev));
-- 
2.55.0.860.g4b6b3295ed-goog

Re: [PATCH] usb: xhci: Fix HCS_ERST_MAX conversion

[Mathias Nyman]

On 8/20/26 12:57, Chen-Yu Tsai wrote:
> This partially reverts commit 6d45e9556d4a11b726e897d86e095b96db4550d8.
> 
> HCS_ERST_MAX holds power of 2 value for maximum number of segments.
> In the culprit commit, this was incorrectly converted to "shift up 2".
> On hardware where this field is zero, this results in xhci_alloc_erst()
> calling dma_alloc_coherent() with size = 0, leading to a horrible splat
> and non-usable XHCI.
> 
> Revert the shift-up-2 to the BIT() macro.
> 
> Fixes: 6d45e9556d4a ("usb: xhci: standardize multi bit-field macros")
> Cc: Niklas Neronin <niklas.neronin@linux.intel.com>
> Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
> ---

Thanks

Adding to queue, will submit after rc1

-Mathias