usb: xhci: Enable the TRB overfetch quirk on VIA VL805

commit c133ec0e5717868c9967fa3df92a55e537b1aead upstream.

Raspberry Pi is a major user of those chips and they discovered a bug -
when the end of a transfer ring segment is reached, up to four TRBs can
be prefetched from the next page even if the segment ends with link TRB
and on page boundary (the chip claims to support standard 4KB pages).

It also appears that if the prefetched TRBs belong to a different ring
whose doorbell is later rung, they may be used without refreshing from
system RAM and the endpoint will stay idle if their cycle bit is stale.

Other users complain about IOMMU faults on x86 systems, unsurprisingly.

Deal with it by using existing quirk which allocates a dummy page after
each transfer ring segment. This was seen to resolve both problems. RPi
came up with a more efficient solution, shortening each segment by four
TRBs, but it complicated the driver and they ditched it for this quirk.

Also rename the quirk and add VL805 device ID macro.

Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
Link: https://github.com/raspberrypi/linux/issues/4685
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=215906
CC: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20250225095927.2512358-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index d2900197a49e7474843efff3f8c43d9505346119..32c8693b438b073b70ad6e56b35bfceed7d8cc5f 100644 (file)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2443,7 +2443,8 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
         * and our use of dma addresses in the trb_address_map radix tree needs
         * TRB_SEGMENT_SIZE alignment, so we pick the greater alignment need.
         */
-       if (xhci->quirks & XHCI_ZHAOXIN_TRB_FETCH)
+       if (xhci->quirks & XHCI_TRB_OVERFETCH)
+               /* Buggy HC prefetches beyond segment bounds - allocate dummy space at the end */
                xhci->segment_pool = dma_pool_create("xHCI ring segments", dev,
                                TRB_SEGMENT_SIZE * 2, TRB_SEGMENT_SIZE * 2, xhci->page_size * 2);
        else

diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 4697756b2f3caa5f34f5ea227375fe60c58118b8..1b033c8ce188eff7a897d3f6bcca2fc78df724f2 100644 (file)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -38,6 +38,8 @@
 #define PCI_DEVICE_ID_EJ168            0x7023
 #define PCI_DEVICE_ID_EJ188            0x7052
 
+#define PCI_DEVICE_ID_VIA_VL805                        0x3483
+
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI             0x8c31
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI          0x9c31
 #define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI       0x9cb1
@@ -424,8 +426,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                        pdev->device == 0x3432)
                xhci->quirks |= XHCI_BROKEN_STREAMS;
 
-       if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483)
+       if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == PCI_DEVICE_ID_VIA_VL805) {
                xhci->quirks |= XHCI_LPM_SUPPORT;
+               xhci->quirks |= XHCI_TRB_OVERFETCH;
+       }
 
        if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
                pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) {
@@ -473,11 +477,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
 
                if (pdev->device == 0x9202) {
                        xhci->quirks |= XHCI_RESET_ON_RESUME;
-                       xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
+                       xhci->quirks |= XHCI_TRB_OVERFETCH;
                }
 
                if (pdev->device == 0x9203)
-                       xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
+                       xhci->quirks |= XHCI_TRB_OVERFETCH;
        }
 
        if (pdev->vendor == PCI_DEVICE_ID_CADENCE &&

diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 673179047eb82e0c8e70bc33672a1312f38a3549..439767d242fa9c96f7e4b31abfe19adebcfc5bae 100644 (file)
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1621,7 +1621,7 @@ struct xhci_hcd {
 #define XHCI_EP_CTX_BROKEN_DCS BIT_ULL(42)
 #define XHCI_SUSPEND_RESUME_CLKS       BIT_ULL(43)
 #define XHCI_RESET_TO_DEFAULT  BIT_ULL(44)
-#define XHCI_ZHAOXIN_TRB_FETCH BIT_ULL(45)
+#define XHCI_TRB_OVERFETCH     BIT_ULL(45)
 #define XHCI_ZHAOXIN_HOST      BIT_ULL(46)
 #define XHCI_WRITE_64_HI_LO    BIT_ULL(47)
 #define XHCI_CDNS_SCTX_QUIRK   BIT_ULL(48)