[PATCH] usb: xhci: Tear down host on Reset Endpoint and Set TR Dequeue timeout

[Ambareesh Balaji <ambareeshbalaji@gmail.com>]

When a command times out, xhci_handle_command_timeout() aborts the
command ring. The aborted command is turned into a No-Op TRB, so its
completion is handled as a No-Op and the command's own handler never
runs.

A timed out Stop Endpoint command already halts the host and tears it
down. Reset Endpoint and Set TR Dequeue Pointer timeouts are not
handled, so the endpoint stays halted (EP_HALTED or SET_DEQ_PENDING)
and its cancelled TDs are never given back. A driver waiting for those
URBs, such as usb_kill_urb() during unbind, then waits forever.

Reset Endpoint and Set TR Dequeue Pointer change endpoint state in the
host controller only and never talk to the device, so a timeout means
the host controller is not responding, as with Stop Endpoint. Handle
them the same way: halt the host and give back all URBs with
xhci_hc_died(). The endpoint state flags are not cleared here, because
the endpoint handlers and URB dequeue check XHCI_STATE_DYING first.

The timeout was reproduced on an AMD xHCI controller passed through to a
QEMU/KVM guest. An endpoint halt was set on a usbhid interrupt IN endpoint
and the doorbell of the Set TR Dequeue Pointer command queued by the
usbhid unbind was suppressed with a kprobe, to emulate a host that does
not answer the command. Without this change the unbind blocks forever in
usb_kill_urb(). With it the command times out, the host is torn down and
the unbind completes. Normal unbind and rebind of the same device is
unaffected.

Fixes: c311e391a7ef ("xhci: rework command timeout and cancellation,")
Signed-off-by: Ambareesh Balaji <ambareeshbalaji@gmail.com>
---
 drivers/usb/host/xhci-ring.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index c23434001e9c..b03ff184c074 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1755,20 +1755,23 @@ void xhci_handle_command_timeout(struct work_struct *work)
 	usbsts = readl(&xhci->op_regs->status);
 	xhci_dbg(xhci, "Command timeout, USBSTS:%s\n", xhci_decode_usbsts(str, usbsts));
 
-	/* Bail out and tear down xhci if a stop endpoint command failed */
-	if (TRB_FIELD_TO_TYPE(cmd_field3) == TRB_STOP_RING) {
-		struct xhci_virt_ep	*ep;
-
-		xhci_warn(xhci, "xHCI host not responding to stop endpoint command\n");
-
-		ep = xhci_get_virt_ep(xhci, TRB_TO_SLOT_ID(cmd_field3),
-				      TRB_TO_EP_INDEX(cmd_field3));
-		if (ep)
-			ep->ep_state &= ~EP_STOP_CMD_PENDING;
+	/*
+	 * Bail out and tear down xhci if an endpoint command failed. An aborted
+	 * command is turned into a No-Op, so its handler never runs and the
+	 * cancelled TDs of the endpoint are not given back.
+	 */
+	switch (TRB_FIELD_TO_TYPE(cmd_field3)) {
+	case TRB_STOP_RING:
+	case TRB_RESET_EP:
+	case TRB_SET_DEQ:
+		xhci_warn(xhci, "xHCI host not responding to %s\n",
+			  xhci_trb_type_string(TRB_FIELD_TO_TYPE(cmd_field3)));
 
 		xhci_halt(xhci);
 		xhci_hc_died(xhci);
 		goto time_out_completed;
+	default:
+		break;
 	}
 
 	/* mark this command to be cancelled */
-- 
2.56.0