All of lore.kernel.org
 help / color / mirror / Atom feed
* [1/4] usb: dwc3: gadget: clear DWC3_EP_TRANSFER_STARTED on cmd complete
@ 2019-02-13  7:11 Felipe Balbi
  0 siblings, 0 replies; 5+ messages in thread
From: Felipe Balbi @ 2019-02-13  7:11 UTC (permalink / raw)
  To: Thinh Nguyen

Hi,

Thinh Nguyen <thinh.nguyen@synopsys.com> writes:

<snip>

>> Note that start transfer came before End Transfer completion.
>>
>> /me goes look furter
>>
>> I can see what's going on. The problem here is that we issue a Start
>> Transfer to all bulk endpoints when they are enabled. Upon ep_disable,
>> we issue End Transfer. Because you're switching interfaces all the time,
>> then you exposed the race between ep_disable followed by ep_enable and
>> End Transfer completion.
>>
>> Would it be enough to just skip the completion interrupt from
>> ep_disable?
>>
>>
>
> Your patch resolves this issue. Can you create a formal patch for this?

will do, thanks

^ permalink raw reply	[flat|nested] 5+ messages in thread
* [1/4] usb: dwc3: gadget: clear DWC3_EP_TRANSFER_STARTED on cmd complete
@ 2019-02-13  2:32 Thinh Nguyen
  0 siblings, 0 replies; 5+ messages in thread
From: Thinh Nguyen @ 2019-02-13  2:32 UTC (permalink / raw)
  To: Felipe Balbi, Thinh Nguyen, Linux USB

Hi Felipe,

Felipe Balbi wrote:
> Hi,
>
> Thinh Nguyen <thinh.nguyen@synopsys.com> writes:
>> Hi Felipe,
>>
>> Felipe Balbi wrote:
>>> We must wait until End Transfer completes in order to clear
>>> DWC3_EP_TRANSFER_STARTED, otherwise we may confuse the driver.
>>>
>>> This patch is in preparation to fix a rare race condition that happens
>>> upon Disconnect Interrupt.
>>>
>>> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
>>> ---
>>>  drivers/usb/dwc3/gadget.c | 19 +++++--------------
>>>  1 file changed, 5 insertions(+), 14 deletions(-)
>>>
>>> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
>>> index bed2ff42780b..a3903b8dc11e 100644
>>> --- a/drivers/usb/dwc3/gadget.c
>>> +++ b/drivers/usb/dwc3/gadget.c
>>> @@ -384,19 +384,9 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd,
>>>  
>>>  	trace_dwc3_gadget_ep_cmd(dep, cmd, params, cmd_status);
>>>  
>>> -	if (ret == 0) {
>>> -		switch (DWC3_DEPCMD_CMD(cmd)) {
>>> -		case DWC3_DEPCMD_STARTTRANSFER:
>>> -			dep->flags |= DWC3_EP_TRANSFER_STARTED;
>>> -			dwc3_gadget_ep_get_transfer_index(dep);
>>> -			break;
>>> -		case DWC3_DEPCMD_ENDTRANSFER:
>>> -			dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
>>> -			break;
>>> -		default:
>>> -			/* nothing */
>>> -			break;
>>> -		}
>>> +	if (ret == 0 && DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_STARTTRANSFER) {
>>> +		dep->flags |= DWC3_EP_TRANSFER_STARTED;
>>> +		dwc3_gadget_ep_get_transfer_index(dep);
>>>  	}
>>>  
>>>  	if (saved_config) {
>>> @@ -2571,7 +2561,8 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc,
>>>  		cmd = DEPEVT_PARAMETER_CMD(event->parameters);
>>>  
>>>  		if (cmd == DWC3_DEPCMD_ENDTRANSFER) {
>>> -			dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING;
>>> +			dep->flags &= ~(DWC3_EP_END_TRANSFER_PENDING |
>>> +					DWC3_EP_TRANSFER_STARTED);
>>>  			dwc3_gadget_ep_cleanup_cancelled_requests(dep);
>>>  		}
>>>  		break;
>> I missed this in my previous test, but my test setup found a race
>> condition with this patch. The flag DWC3_EP_TRANSFER_STARTED doesn't get
>> cleared until the END_TRANSFER command completion. If a START_TRANSFER
>> comes before the command completion, then DWC3 may send multiple
> We shouldn't issue Start Transfer unless that flag is cleared:
>
> static int __dwc3_gadget_kick_transfer(struct dwc3_ep *dep)
> {
> [...]
>
> 	starting = !(dep->flags & DWC3_EP_TRANSFER_STARTED);
>
> [...]
>
> 	if (starting) {
> 		params.param0 = upper_32_bits(req->trb_dma);
> 		params.param1 = lower_32_bits(req->trb_dma);
> 		cmd = DWC3_DEPCMD_STARTTRANSFER;
>
> 		if (dep->stream_capable)
> 			cmd |= DWC3_DEPCMD_PARAM(req->request.stream_id);
>
> 		if (usb_endpoint_xfer_isoc(dep->endpoint.desc))
> 			cmd |= DWC3_DEPCMD_PARAM(dep->frame_number);
> 	} else {
> 		cmd = DWC3_DEPCMD_UPDATETRANSFER |
> 			DWC3_DEPCMD_PARAM(dep->resource_index);
> 	}
> [...]
> }
>
> This seems to be the case from the tracepoints though:
>
>     file-storage-20541 [001] d...  2552.847057: dwc3_gadget_ep_cmd: ep1in: cmd 'End Transfer' [30d08] params 00000000 00000000 00000000 --> status: Successful
>     file-storage-20541 [001] d...  2552.847060: dwc3_gadget_ep_disable: ep1out: mps 1024/1024 streams 15 burst 16 ring 1/1 flags E:swbp:>
>     file-storage-20541 [001] d...  2552.847070: dwc3_gadget_ep_cmd: ep1in: cmd 'Set Endpoint Configuration' [401] params 03c22004 06000200 00000000 --> status: Successful
>     file-storage-20541 [001] d...  2552.847079: dwc3_gadget_ep_cmd: ep1in: cmd 'Start Transfer' [406] params 00000000 36c82000 00000000 --> status: Successful
>     file-storage-20541 [001] d...  2552.847081: dwc3_gadget_ep_enable: ep1in: mps 1024/1024 streams 15 burst 16 ring 0/0 flags E:swBp:<
>     file-storage-20541 [001] d...  2552.847088: dwc3_gadget_ep_cmd: ep1out: cmd 'Set Endpoint Configuration' [401] params 03c02004 04000200 00000000 --> status: Successful
>     file-storage-20541 [001] d...  2552.847097: dwc3_gadget_ep_cmd: ep1out: cmd 'Start Transfer' [406] params 00000000 36c81000 00000000 --> status: Successful
>     file-storage-20541 [001] d...  2552.847099: dwc3_gadget_ep_enable: ep1out: mps 1024/1024 streams 15 burst 16 ring 0/0 flags E:swBp:>
>     file-storage-20541 [001] ....  2552.847101: dwc3_alloc_request: ep1in: req 00000000af96ad11 length 0/0 zsI ==> 0
>     file-storage-20541 [001] ....  2552.847101: dwc3_alloc_request: ep1out: req 000000008d5106f9 length 0/0 zsI ==> 0
>     file-storage-20541 [001] ....  2552.847102: dwc3_alloc_request: ep1in: req 00000000c7da02d0 length 0/0 zsI ==> 0
>     file-storage-20541 [001] ....  2552.847103: dwc3_alloc_request: ep1out: req 00000000a270ad2c length 0/0 zsI ==> 0
>     file-storage-20541 [001] dN..  2552.847112: dwc3_prepare_trb: ep0in: trb 00000000fc6bece2 buf 0000000036c7f000 size 0 ctrl 00000c33 (HLcs:SC:status2)
>     file-storage-20541 [001] dN..  2552.847119: dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 36c7f000 00000000 --> status: Successful
>     file-storage-20541 [001] d...  2552.847134: dwc3_ep_queue: ep1out: req 000000008d5106f9 length 0/1024 zsI ==> -115
>     file-storage-20541 [001] d...  2552.847137: dwc3_prepare_trb: ep1out: trb 00000000abc35b59 buf 00000000bcb56800 size 1024 ctrl 00000819 (HlcS:sC:normal)
>     file-storage-20541 [001] d...  2552.847142: dwc3_gadget_ep_cmd: ep1out: cmd 'Update Transfer' [20007] params 00000000 00000000 00000000 --> status: Successful
>      irq/16-dwc3-20542 [004] d...  2552.847144: dwc3_event: event (080301c6): ep1in: Endpoint Command Complete
>
> Note that start transfer came before End Transfer completion.
>
> /me goes look furter
>
> I can see what's going on. The problem here is that we issue a Start
> Transfer to all bulk endpoints when they are enabled. Upon ep_disable,
> we issue End Transfer. Because you're switching interfaces all the time,
> then you exposed the race between ep_disable followed by ep_enable and
> End Transfer completion.
>
> Would it be enough to just skip the completion interrupt from
> ep_disable?
>
>

Your patch resolves this issue. Can you create a formal patch for this?

Thanks,
Thinh

^ permalink raw reply	[flat|nested] 5+ messages in thread
* [1/4] usb: dwc3: gadget: clear DWC3_EP_TRANSFER_STARTED on cmd complete
@ 2019-02-01  6:32 Felipe Balbi
  0 siblings, 0 replies; 5+ messages in thread
From: Felipe Balbi @ 2019-02-01  6:32 UTC (permalink / raw)
  To: Thinh Nguyen, Linux USB

Thinh Nguyen <thinh.nguyen@synopsys.com> writes:

> Hi Felipe,
>
> Felipe Balbi wrote:
>> We must wait until End Transfer completes in order to clear
>> DWC3_EP_TRANSFER_STARTED, otherwise we may confuse the driver.
>>
>> This patch is in preparation to fix a rare race condition that happens
>> upon Disconnect Interrupt.
>>
>> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
>> ---
>>  drivers/usb/dwc3/gadget.c | 19 +++++--------------
>>  1 file changed, 5 insertions(+), 14 deletions(-)
>>
>> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
>> index bed2ff42780b..a3903b8dc11e 100644
>> --- a/drivers/usb/dwc3/gadget.c
>> break;
>
> This patch series has been running fine on my testing setup.
>
> Tested-by: Thinh Nguyen <thinhn@synopsys.com>

Thank you, I've merged this into my testing/next with your Tested-by.

^ permalink raw reply	[flat|nested] 5+ messages in thread
* [1/4] usb: dwc3: gadget: clear DWC3_EP_TRANSFER_STARTED on cmd complete
@ 2019-02-01  2:30 Thinh Nguyen
  0 siblings, 0 replies; 5+ messages in thread
From: Thinh Nguyen @ 2019-02-01  2:30 UTC (permalink / raw)
  To: Felipe Balbi, Linux USB

Hi Felipe,

Felipe Balbi wrote:
> We must wait until End Transfer completes in order to clear
> DWC3_EP_TRANSFER_STARTED, otherwise we may confuse the driver.
>
> This patch is in preparation to fix a rare race condition that happens
> upon Disconnect Interrupt.
>
> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
> ---
>  drivers/usb/dwc3/gadget.c | 19 +++++--------------
>  1 file changed, 5 insertions(+), 14 deletions(-)
>
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index bed2ff42780b..a3903b8dc11e 100644
> --- a/drivers/usb/dwc3/gadget.c
> break;

This patch series has been running fine on my testing setup.

Tested-by: Thinh Nguyen <thinhn@synopsys.com>

Thanks,
Thinh

^ permalink raw reply	[flat|nested] 5+ messages in thread
* [1/4] usb: dwc3: gadget: clear DWC3_EP_TRANSFER_STARTED on cmd complete
@ 2019-01-24  7:24 Felipe Balbi
  0 siblings, 0 replies; 5+ messages in thread
From: Felipe Balbi @ 2019-01-24  7:24 UTC (permalink / raw)
  To: Linux USB; +Cc: Felipe Balbi

We must wait until End Transfer completes in order to clear
DWC3_EP_TRANSFER_STARTED, otherwise we may confuse the driver.

This patch is in preparation to fix a rare race condition that happens
upon Disconnect Interrupt.

Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
---
 drivers/usb/dwc3/gadget.c | 19 +++++--------------
 1 file changed, 5 insertions(+), 14 deletions(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index bed2ff42780b..a3903b8dc11e 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -384,19 +384,9 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd,
 
 	trace_dwc3_gadget_ep_cmd(dep, cmd, params, cmd_status);
 
-	if (ret == 0) {
-		switch (DWC3_DEPCMD_CMD(cmd)) {
-		case DWC3_DEPCMD_STARTTRANSFER:
-			dep->flags |= DWC3_EP_TRANSFER_STARTED;
-			dwc3_gadget_ep_get_transfer_index(dep);
-			break;
-		case DWC3_DEPCMD_ENDTRANSFER:
-			dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
-			break;
-		default:
-			/* nothing */
-			break;
-		}
+	if (ret == 0 && DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_STARTTRANSFER) {
+		dep->flags |= DWC3_EP_TRANSFER_STARTED;
+		dwc3_gadget_ep_get_transfer_index(dep);
 	}
 
 	if (saved_config) {
@@ -2571,7 +2561,8 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc,
 		cmd = DEPEVT_PARAMETER_CMD(event->parameters);
 
 		if (cmd == DWC3_DEPCMD_ENDTRANSFER) {
-			dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING;
+			dep->flags &= ~(DWC3_EP_END_TRANSFER_PENDING |
+					DWC3_EP_TRANSFER_STARTED);
 			dwc3_gadget_ep_cleanup_cancelled_requests(dep);
 		}
 		break;

^ permalink raw reply related	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2019-02-13  7:11 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-02-13  7:11 [1/4] usb: dwc3: gadget: clear DWC3_EP_TRANSFER_STARTED on cmd complete Felipe Balbi
  -- strict thread matches above, loose matches on Subject: below --
2019-02-13  2:32 Thinh Nguyen
2019-02-01  6:32 Felipe Balbi
2019-02-01  2:30 Thinh Nguyen
2019-01-24  7:24 Felipe Balbi

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.