Re: 6.5.0 broke XHCI URB submissions for count >512

[Mathias Nyman <mathias.nyman@linux.intel.com>]

On 2.3.2024 17.55, Chris Yokum wrote:
> 
> The submission of >512 URBs is via usbfs, yes. This worked forever, and still works on EHCI, it's just been failing on xHCI once the indicated change was applied.
> 

>>> We have found a regression bug, where more than 512 URBs cannot be
>>> reliably submitted to XHCI. URBs beyond that return 0x00 instead of
>>> valid data in the buffer.
> 
>>
>> FWIW, that's f5af638f0609af ("xhci: Fix transfer ring expansion size
>> calculation") [v6.5-rc1] from Mathias.
>>
>>> Attached is a test program that demonstrates the problem. We used a few
>>> different USB-to-Serial adapters with no driver installed as a
>>> convenient way to reproduce. We check the TRB debug information before
>>> and after to verify the actual number of allocated TRBs.
> 

Could you send me that test program as well?

> Ah, so this is just through usbfs?
> 
>>> With some adapters on unaffected kernels, the TRB map gets expanded
>>> correctly. This directly corresponds to correct functional behavior. On
>>> affected kernels, the TRB ring does not expand, and our functional tests
>>> also will fail.
>>>
>>> We don't know exactly why this happens. Some adapters do work correctly,
>>> so there seems to also be some subtle problem that was being masked by
>>> the liberal expansion of the TRB ring in older kernels. We also saw on
>>> one system that the TRB expansion did work correctly with one particular
>>> adapter. However, on all systems at least two adapters did exhibit the
>>> problem and fail.

Ok, I see, this could be the empty ring exception check in xhci-ring.c:

It could falsely assume ring is empty when it in fact is filled up in one
go by queuing several small urbs.

static unsigned int xhci_ring_expansion_needed(struct xhci_hcd *xhci, struct xhci_ring *ring,
                                                unsigned int num_trbs)
{
  ...
         /* Empty ring special case, enqueue stuck on link trb while dequeue advanced */
         if (trb_is_link(ring->enqueue) && ring->enq_seg->next->trbs == ring->dequeue)
                 return 0;
...
}

https://elixir.bootlin.com/linux/v6.7/source/drivers/usb/host/xhci-ring.c#L333

Can you help me test some patches on your setup?

Thanks
Mathias