linux-kernel - Re: [PATCH v2] usb: dwc3: gadget: Prevent irq storm when TH re-executes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250211002155.62lyfqjlygod7cdp@synopsys.com>
Date: Tue, 11 Feb 2025 00:22:07 +0000
From: Thinh Nguyen <Thinh.Nguyen@...opsys.com>
To: Badhri Jagan Sridharan <badhri@...gle.com>
CC: Thinh Nguyen <Thinh.Nguyen@...opsys.com>,
        "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
        "felipe.balbi@...ux.intel.com" <felipe.balbi@...ux.intel.com>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "jameswei@...gle.com" <jameswei@...gle.com>,
        "stable@...nel.org" <stable@...nel.org>
Subject: Re: [PATCH v2] usb: dwc3: gadget: Prevent irq storm when TH
 re-executes

On Sat, Feb 08, 2025, Badhri Jagan Sridharan wrote:
> While commit d325a1de49d6 ("usb: dwc3: gadget: Prevent losing events in
> event cache") makes sure that top half(TH) does not end up overwriting the
> cached events before processing them when the TH gets invoked more than one
> time, returning IRQ_HANDLED results in occasional irq storm where the TH
> hogs the CPU. The irq storm can be prevented by clearing the flag before
> event handler busy is cleared. Default enable interrupt moderation in all
> versions which support them.
> 
> ftrace event stub during dwc3 irq storm:
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000866: irq_handler_exit: irq=14 ret=handled
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000872: irq_handler_entry: irq=504 name=dwc3
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000874: irq_handler_exit: irq=504 ret=handled
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000881: irq_handler_entry: irq=504 name=dwc3
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000883: irq_handler_exit: irq=504 ret=handled
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000889: irq_handler_entry: irq=504 name=dwc3
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000892: irq_handler_exit: irq=504 ret=handled
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000898: irq_handler_entry: irq=504 name=dwc3
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000901: irq_handler_exit: irq=504 ret=handled
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000907: irq_handler_entry: irq=504 name=dwc3
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000909: irq_handler_exit: irq=504 ret=handled
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000915: irq_handler_entry: irq=504 name=dwc3
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000918: irq_handler_exit: irq=504 ret=handled
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000924: irq_handler_entry: irq=504 name=dwc3
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000927: irq_handler_exit: irq=504 ret=handled
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000933: irq_handler_entry: irq=504 name=dwc3
>     irq/504_dwc3-1111  ( 1111) [000] .... 70.000935: irq_handler_exit: irq=504 ret=handled
>     ....
> 
> Cc: stable@...nel.org
> Suggested-by: Thinh Nguyen <Thinh.Nguyen@...opsys.com>
> Fixes: d325a1de49d6 ("usb: dwc3: gadget: Prevent losing events in event cache")
> Signed-off-by: Badhri Jagan Sridharan <badhri@...gle.com>
> ---
>  drivers/usb/dwc3/core.c   |  2 +-
>  drivers/usb/dwc3/gadget.c | 10 +++++++---
>  2 files changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index dfa1b5fe48dc..6df971ef7285 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -1835,7 +1835,7 @@ static void dwc3_get_properties(struct dwc3 *dwc)
>  	dwc->tx_thr_num_pkt_prd = tx_thr_num_pkt_prd;
>  	dwc->tx_max_burst_prd = tx_max_burst_prd;
>  
> -	dwc->imod_interval = 0;
> +	dwc->imod_interval = 1;

Use dwc3_has_imod() to determine whether to set this. Otherwise we get
a warning on setups that don't support imod.

>  
>  	dwc->tx_fifo_resize_max_num = tx_fifo_resize_max_num;
>  }
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index d27af65eb08a..fad115113d28 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -4467,14 +4467,18 @@ static irqreturn_t dwc3_process_event_buf(struct dwc3_event_buffer *evt)
>  	dwc3_writel(dwc->regs, DWC3_GEVNTSIZ(0),
>  		    DWC3_GEVNTSIZ_SIZE(evt->length));
>  
> +	evt->flags &= ~DWC3_EVENT_PENDING;
> +	/*
> +	 * Add an explicit write memory barrier to make sure that the update of
> +	 * clearing DWC3_EVENT_PENDING is observed in dwc3_check_event_buf()
> +	 */
> +	wmb();
> +
>  	if (dwc->imod_interval) {
>  		dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), DWC3_GEVNTCOUNT_EHB);
>  		dwc3_writel(dwc->regs, DWC3_DEV_IMOD(0), dwc->imod_interval);
>  	}
>  
> -	/* Keep the clearing of DWC3_EVENT_PENDING at the end */
> -	evt->flags &= ~DWC3_EVENT_PENDING;
> -
>  	return ret;
>  }
>  
> 
> base-commit: 9682c35ff6ecd76d9462d4749b8b413d3e8e605e
> -- 
> 2.48.1.502.g6dc24dfdaf-goog
> 

The rest looks fine.

Thanks,
Thinh