linux-kernel - Re: [PATCH v2] usb: gadget: musb: fix short isoc packets with inventra dma

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20190115163520.GC18026@uda0271908>
Date:   Tue, 15 Jan 2019 10:35:20 -0600
From:   Bin Liu <b-liu@...com>
To:     Paul Elder <paul.elder@...asonboard.com>
CC:     <laurent.pinchart@...asonboard.com>,
        <kieran.bingham@...asonboard.com>, <drinkcat@...omium.org>,
        <balbi@...nel.org>, <gregkh@...uxfoundation.org>,
        <linux-usb@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] usb: gadget: musb: fix short isoc packets with
 inventra dma

Hi Paul,

On Fri, Jan 11, 2019 at 12:31:59AM -0500, Paul Elder wrote:
> Hi Bin,
> 
> On Wed, Jan 09, 2019 at 09:02:15AM -0600, Bin Liu wrote:
> > Hi Paul,
> > 
> > On Wed, Jan 09, 2019 at 02:10:09AM -0500, Paul Elder wrote:
> > > Handling short packets (length < max packet size) in the Inventra DMA
> > > engine in the MUSB driver causes the MUSB DMA controller to hang. An
> > > example of a problem that is caused by this problem is when streaming
> > > video out of a UVC gadget, only the first video frame is transferred.
> > > 
> > > For short packets (mode-0 or mode-1 DMA), MUSB_TXCSR_TXPKTRDY must be
> > > set manually by the driver. This was previously done in musb_g_tx
> > > (musb_gadget.c), but incorrectly (all csr flags were cleared, and only
> > > MUSB_TXCSR_MODE and MUSB_TXCSR_TXPKTRDY were set). Fixing that problem
> > > allows some requests to be transferred correctly, but multiple requests
> > > were often put together in one USB packet, and caused problems if the
> > > packet size was not a multiple of 4. Instead, set MUSB_TXCSR_TXPKTRDY
> > > in dma_controller_irq (musbhsdma.c), just like host mode transfers.
> > > 
> > > This topic was originally tackled by Nicolas Boichat [0] [1] and is
> > > discussed further at [2] as part of his GSoC project [3].
> > > 
> > > [0] https://groups.google.com/forum/?hl=en#!topic/beagleboard-gsoc/k8Azwfp75CU
> > > [1] https://gitorious.org/beagleboard-usbsniffer/beagleboard-usbsniffer-kernel/commit/b0be3b6cc195ba732189b04f1d43ec843c3e54c9?p=beagleboard-usbsniffer:beagleboard-usbsniffer-kernel.git;a=patch;h=b0be3b6cc195ba732189b04f1d43ec843c3e54c9
> > > [2] http://beagleboard-usbsniffer.blogspot.com/2010/07/musb-isochronous-transfers-fixed.html
> > > [3] http://elinux.org/BeagleBoard/GSoC/USBSniffer
> > > 
> > > Signed-off-by: Paul Elder <paul.elder@...asonboard.com>
> > > ---
> > > Changes in v2:
> > > 
> > > - no more flushing FIFO
> > > - greatly simplified short packet if guard in musb_g_tx, and removed
> > >   unnecessary variables
> > > - minor indentation and wording changes
> > > 
> > >  drivers/usb/musb/musb_gadget.c | 19 +++++--------------
> > >  drivers/usb/musb/musbhsdma.c   | 21 +++++++++++----------
> > >  2 files changed, 16 insertions(+), 24 deletions(-)
> > > 
> > > diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
> > > index eae8b1b1b45b..496643f54faa 100644
> > > --- a/drivers/usb/musb/musb_gadget.c
> > > +++ b/drivers/usb/musb/musb_gadget.c
> > > @@ -452,13 +452,10 @@ void musb_g_tx(struct musb *musb, u8 epnum)
> > >  	}
> > >  
> > >  	if (request) {
> > > -		u8	is_dma = 0;
> > > -		bool	short_packet = false;
> > >  
> > >  		trace_musb_req_tx(req);
> > >  
> > >  		if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
> > > -			is_dma = 1;
> > >  			csr |= MUSB_TXCSR_P_WZC_BITS;
> > >  			csr &= ~(MUSB_TXCSR_DMAENAB | MUSB_TXCSR_P_UNDERRUN |
> > >  				 MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_AUTOSET);
> > > @@ -476,16 +473,8 @@ void musb_g_tx(struct musb *musb, u8 epnum)
> > >  		 */
> > >  		if ((request->zero && request->length)
> > >  			&& (request->length % musb_ep->packet_sz == 0)
> > > -			&& (request->actual == request->length))
> > > -				short_packet = true;
> > > +			&& (request->actual == request->length)) {
> > >  
> > > -		if ((musb_dma_inventra(musb) || musb_dma_ux500(musb)) &&
> > > -			(is_dma && (!dma->desired_mode ||
> > > -				(request->actual &
> > > -					(musb_ep->packet_sz - 1)))))
> > > -				short_packet = true;
> > > -
> > > -		if (short_packet) {
> > >  			/*
> > >  			 * On DMA completion, FIFO may not be
> > >  			 * available yet...
> > > @@ -493,8 +482,10 @@ void musb_g_tx(struct musb *musb, u8 epnum)
> > >  			if (csr & MUSB_TXCSR_TXPKTRDY)
> > >  				return;
> > >  
> > > -			musb_writew(epio, MUSB_TXCSR, MUSB_TXCSR_MODE
> > > -					| MUSB_TXCSR_TXPKTRDY);
> > > +			musb_dbg(musb, "sending short pkt (zero=%d, length=%d, actual=%d, dma->desired_mode=%d)\n",
> > > +				 request->zero, request->length, request->actual,
> > > +				 dma->desired_mode);
> > > +			musb_writew(epio, MUSB_TXCSR, csr | MUSB_TXCSR_TXPKTRDY);
> > 
> > Sorry I didn't catch this in the last review, but this change seems not
> > required, isn't it? In the first version of the patch, the code is
> > 'returned' in the 'if (musb_dma_inventra())' branch above, doesn't reach
> > here.
> 
> Do you mean change compared to the last version of the patch, or this
> last chunk of the diff?

I meant that the chunk above seems not related to this webcam short
packet test case, so am wondering if this change is not neccessary

-                  musb_writew(epio, MUSB_TXCSR, MUSB_TXCSR_MODE
-                                 | MUSB_TXCSR_TXPKTRDY);
+                 musb_writew(epio, MUSB_TXCSR, csr | MUSB_TXCSR_TXPKTRDY);


> 
> I guess I did also remove the return when I removed the 'if
> (musb_dma_inventra())' block that had the FLUSHFIFIO, but when I tested
> it it still worked. In fact, I reverted this last diff chunk and it
> still worked.

so the last chunk is not related, we don't have to touch it.

Regards,
-Bin.