linux-kernel - Re: [PATCH v2] usb: gadget: musb: fix short isoc packets with inventra dma

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190109150215.GJ25910@uda0271908>
Date:   Wed, 9 Jan 2019 09:02:15 -0600
From:   Bin Liu <b-liu@...com>
To:     Paul Elder <paul.elder@...asonboard.com>
CC:     <laurent.pinchart@...asonboard.com>,
        <kieran.bingham@...asonboard.com>, <drinkcat@...omium.org>,
        <balbi@...nel.org>, <gregkh@...uxfoundation.org>,
        <linux-usb@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] usb: gadget: musb: fix short isoc packets with
 inventra dma

Hi Paul,

On Wed, Jan 09, 2019 at 02:10:09AM -0500, Paul Elder wrote:
> Handling short packets (length < max packet size) in the Inventra DMA
> engine in the MUSB driver causes the MUSB DMA controller to hang. An
> example of a problem that is caused by this problem is when streaming
> video out of a UVC gadget, only the first video frame is transferred.
> 
> For short packets (mode-0 or mode-1 DMA), MUSB_TXCSR_TXPKTRDY must be
> set manually by the driver. This was previously done in musb_g_tx
> (musb_gadget.c), but incorrectly (all csr flags were cleared, and only
> MUSB_TXCSR_MODE and MUSB_TXCSR_TXPKTRDY were set). Fixing that problem
> allows some requests to be transferred correctly, but multiple requests
> were often put together in one USB packet, and caused problems if the
> packet size was not a multiple of 4. Instead, set MUSB_TXCSR_TXPKTRDY
> in dma_controller_irq (musbhsdma.c), just like host mode transfers.
> 
> This topic was originally tackled by Nicolas Boichat [0] [1] and is
> discussed further at [2] as part of his GSoC project [3].
> 
> [0] https://groups.google.com/forum/?hl=en#!topic/beagleboard-gsoc/k8Azwfp75CU
> [1] https://gitorious.org/beagleboard-usbsniffer/beagleboard-usbsniffer-kernel/commit/b0be3b6cc195ba732189b04f1d43ec843c3e54c9?p=beagleboard-usbsniffer:beagleboard-usbsniffer-kernel.git;a=patch;h=b0be3b6cc195ba732189b04f1d43ec843c3e54c9
> [2] http://beagleboard-usbsniffer.blogspot.com/2010/07/musb-isochronous-transfers-fixed.html
> [3] http://elinux.org/BeagleBoard/GSoC/USBSniffer
> 
> Signed-off-by: Paul Elder <paul.elder@...asonboard.com>
> ---
> Changes in v2:
> 
> - no more flushing FIFO
> - greatly simplified short packet if guard in musb_g_tx, and removed
>   unnecessary variables
> - minor indentation and wording changes
> 
>  drivers/usb/musb/musb_gadget.c | 19 +++++--------------
>  drivers/usb/musb/musbhsdma.c   | 21 +++++++++++----------
>  2 files changed, 16 insertions(+), 24 deletions(-)
> 
> diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
> index eae8b1b1b45b..496643f54faa 100644
> --- a/drivers/usb/musb/musb_gadget.c
> +++ b/drivers/usb/musb/musb_gadget.c
> @@ -452,13 +452,10 @@ void musb_g_tx(struct musb *musb, u8 epnum)
>  	}
>  
>  	if (request) {
> -		u8	is_dma = 0;
> -		bool	short_packet = false;
>  
>  		trace_musb_req_tx(req);
>  
>  		if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
> -			is_dma = 1;
>  			csr |= MUSB_TXCSR_P_WZC_BITS;
>  			csr &= ~(MUSB_TXCSR_DMAENAB | MUSB_TXCSR_P_UNDERRUN |
>  				 MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_AUTOSET);
> @@ -476,16 +473,8 @@ void musb_g_tx(struct musb *musb, u8 epnum)
>  		 */
>  		if ((request->zero && request->length)
>  			&& (request->length % musb_ep->packet_sz == 0)
> -			&& (request->actual == request->length))
> -				short_packet = true;
> +			&& (request->actual == request->length)) {
>  
> -		if ((musb_dma_inventra(musb) || musb_dma_ux500(musb)) &&
> -			(is_dma && (!dma->desired_mode ||
> -				(request->actual &
> -					(musb_ep->packet_sz - 1)))))
> -				short_packet = true;
> -
> -		if (short_packet) {
>  			/*
>  			 * On DMA completion, FIFO may not be
>  			 * available yet...
> @@ -493,8 +482,10 @@ void musb_g_tx(struct musb *musb, u8 epnum)
>  			if (csr & MUSB_TXCSR_TXPKTRDY)
>  				return;
>  
> -			musb_writew(epio, MUSB_TXCSR, MUSB_TXCSR_MODE
> -					| MUSB_TXCSR_TXPKTRDY);
> +			musb_dbg(musb, "sending short pkt (zero=%d, length=%d, actual=%d, dma->desired_mode=%d)\n",
> +				 request->zero, request->length, request->actual,
> +				 dma->desired_mode);
> +			musb_writew(epio, MUSB_TXCSR, csr | MUSB_TXCSR_TXPKTRDY);

Sorry I didn't catch this in the last review, but this change seems not
required, isn't it? In the first version of the patch, the code is
'returned' in the 'if (musb_dma_inventra())' branch above, doesn't reach
here.

Regards,
-Bin.