Fix allowing of ep queuing while stopping transfers
Subsystems (2)
cover Fix allowing of ep queuing while stopping transfers
commit f09ddcfcb8c5 ("usb: dwc3: gadget: Prevent EP queuing while stopping transfers") addressed an issue where the DWC3 gadget was still allowing EP queuing to occur while the pullup disable routine was executing. This led to a situation where the controller prepares a TRB, which will be unmapped by the stop active transfer call.
In addition to the above, there are a few other places in the DWC3 gadget where we need to block preparing of TRBs:
1. While the DWC3 gadget cleans up completed TRBs (during dwc3_gadget_endpoint_trbs_complete()), DWC3 gadget giveback is utilized and will release the dwc->lock. If a pullup disable call occurs while the cleanup is happening, then there is a chance dwc3_gadget_ep_should_continue will prepare a TRB, which will later on be unmapped by the stop active transfer in the pullup disable path.
2. If we are in the CONFIGURED state and the host issues a bus RESET. In this situation, the connected flag is still set to true while we stop active transfers, which can lead to the same initial problem. Ideally, function drivers would stop any pending usb requests through dwc3_reset_gadget() using the EP disable call, but for some function drivers, this does not occur synchronously in their disable() callback. These functions would rely on the stop active transfers in the reset handler to issue the endxfer cmd.
Wesley Cheng (2):
usb: dwc3: gadget: Avoid continuing preparing TRBs during teardown
usb: dwc3: gadget: Ignore EP queue requests during bus reset
drivers/usb/dwc3/gadget.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
Signature · 2 lines
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
PATCH 1/2 usb: dwc3: gadget: Avoid continuing preparing TRBs during teardown
Add checks similar to dwc3_gadget_ep_queue() before kicking off
transfers after getting an endpoint completion event. Since cleaning
up completed requests will momentarily unlock dwc->lock, there is a chance for a sequence like pullup disable to be executed. This can lead to preparing a TRB, which will be removed by the pullup disable routine.
--- drivers/usb/dwc3/gadget.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/dwc3/gadget.c +5 -0
@@ -2912,6 +2912,11 @@ static void dwc3_gadget_ep_cleanup_completed_requests(struct dwc3_ep *dep,static bool dwc3_gadget_ep_should_continue (struct dwc3_ep *dep) {struct dwc3_request *req; +struct dwc3 *dwc = dep->dwc; + +if (!dep->endpoint.desc || !dwc->pullups_connected || + !dwc->connected) +return false;if (!list_empty (&dep->pending_list))return true;
Signature · 2 lines
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
PATCH 2/2 usb: dwc3: gadget: Ignore EP queue requests during bus reset
In reply to Wesley ChengThe current dwc3_gadget_reset_interrupt() will stop any active transfers, but only addresses blocking of EP queuing for while we are coming from a disconnected scenario, i.e. after receiving the disconnect event. If the host decides to issue a bus reset on the device, the connected parameter will still be set to true, allowing for EP queuing to continue while we are disabling the functions. To avoid this, set the connected flag to false until the stop active transfers is complete.
--- drivers/usb/dwc3/gadget.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/dwc3/gadget.c +9 -0
@@ -3327,6 +3327,15 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)u32 reg;/* +* Ideally, dwc3_reset_gadget() would trigger the function +* drivers to stop any active transfers through ep disable. +* However, for functions which defer ep disable, such as mass +* storage, we will need to rely on the call to stop active +* transfers here, and avoid allowing of request queuing. +*/ + dwc->connected = false; + +/* * WORKAROUND: DWC3 revisions <1.88a have an issue which * would cause a missing Disconnect Event if there's a * pending Setup Packet in the FIFO.
Signature · 2 lines
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
Thinh Nguyen
maintainerRe: [PATCH 2/2] usb: dwc3: gadget: Ignore EP queue requests during bus reset
Hi,
Quoted 24 lines · Wesley Cheng
The current
dwc3_gadget_reset_interrupt()will stop any active transfers, but only addresses blocking of EP queuing for while we are coming from a disconnected scenario, i.e. after receiving the disconnect event. If the host decides to issue a bus reset on the device, the connected parameter will still be set to true, allowing for EP queuing to continue while we are disabling the functions. To avoid this, set the connected flag to false until the stop active transfers is complete.Signed-off-by Wesley Cheng <[email protected]>--- drivers/usb/dwc3/gadget.c | 9 +++++++++ 1 file changed, 9 insertions(+)drivers/usb/dwc3/gadget.c +2
-0@@ -3327,6 +3327,15 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)u32 reg;/* +* Ideally, dwc3_reset_gadget() would trigger the function +* drivers to stop any active transfers through ep disable.
drivers/usb/dwc3/gadget.c static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) · line 3341
Quoted 10 lines
drivers/usb/dwc3/gadget.c +7
-0+* However, for functions which defer ep disable, such as mass +* storage, we will need to rely on the call to stop active +* transfers here, and avoid allowing of request queuing. +*/ + dwc->connected = false; + +/* * WORKAROUND: DWC3 revisions <1.88a have an issue which * would cause a missing Disconnect Event if there's a * pending Setup Packet in the FIFO.
This doesn't look right. Did you have rebase issue with your local change again?
BR,
Thinh
Re: [PATCH 2/2] usb: dwc3: gadget: Ignore EP queue requests during bus reset
Quoted 41 lines · Thinh Nguyen
Hi,
Quoted 24 lines · Wesley Cheng
The current
dwc3_gadget_reset_interrupt()will stop any active transfers, but only addresses blocking of EP queuing for while we are coming from a disconnected scenario, i.e. after receiving the disconnect event. If the host decides to issue a bus reset on the device, the connected parameter will still be set to true, allowing for EP queuing to continue while we are disabling the functions. To avoid this, set the connected flag to false until the stop active transfers is complete.Signed-off-by Wesley Cheng <[email protected]>--- drivers/usb/dwc3/gadget.c | 9 +++++++++ 1 file changed, 9 insertions(+)drivers/usb/dwc3/gadget.c +2
-0@@ -3327,6 +3327,15 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)u32 reg;/* +* Ideally, dwc3_reset_gadget() would trigger the function +* drivers to stop any active transfers through ep disable. drivers/usb/dwc3/gadget.c static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) · line 3341
Quoted 10 lines
drivers/usb/dwc3/gadget.c +7
-0+* However, for functions which defer ep disable, such as mass +* storage, we will need to rely on the call to stop active +* transfers here, and avoid allowing of request queuing. +*/ + dwc->connected = false; + +/* * WORKAROUND: DWC3 revisions <1.88a have an issue which * would cause a missing Disconnect Event if there's a * pending Setup Packet in the FIFO. This doesn't look right. Did you have rebase issue with your local change again?
Quoted 3 lines
BR,
Thinh
Hi Thinh,
This was rebased on Greg's usb-linus branch, which has commit f09ddcfcb8c5 ("usb: dwc3: gadget: Prevent EP queuing while stopping transfers") merged.
commit f09ddcfcb8c5 moved the dwc->connected = true to after we have finished stop active transfers. However, this change will also ensure that the connected flag is set to false to ensure that when we call stop active transfers, nothing can prepare TRBs. (previous commit only addresses the case where we get the reset interrupt when coming from a disconnected state)
Thanks
Wesley Cheng
Signature · 2 lines
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
Thinh Nguyen
maintainerRe: [PATCH 2/2] usb: dwc3: gadget: Ignore EP queue requests during bus reset
Quoted 44 lines · Wesley Cheng
Quoted 41 lines · Thinh Nguyen
Hi,
Quoted 24 lines · Wesley Cheng
The current
dwc3_gadget_reset_interrupt()will stop any active transfers, but only addresses blocking of EP queuing for while we are coming from a disconnected scenario, i.e. after receiving the disconnect event. If the host decides to issue a bus reset on the device, the connected parameter will still be set to true, allowing for EP queuing to continue while we are disabling the functions. To avoid this, set the connected flag to false until the stop active transfers is complete.Signed-off-by Wesley Cheng <[email protected]>--- drivers/usb/dwc3/gadget.c | 9 +++++++++ 1 file changed, 9 insertions(+)drivers/usb/dwc3/gadget.c +2
-0@@ -3327,6 +3327,15 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)u32 reg;/* +* Ideally, dwc3_reset_gadget() would trigger the function +* drivers to stop any active transfers through ep disable. drivers/usb/dwc3/gadget.c static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) · line 3341
Quoted 10 lines
drivers/usb/dwc3/gadget.c +7
-0+* However, for functions which defer ep disable, such as mass +* storage, we will need to rely on the call to stop active +* transfers here, and avoid allowing of request queuing. +*/ + dwc->connected = false; + +/* * WORKAROUND: DWC3 revisions <1.88a have an issue which * would cause a missing Disconnect Event if there's a * pending Setup Packet in the FIFO. This doesn't look right. Did you have rebase issue with your local change again?
Quoted 8 lines
Quoted 3 lines
BR,
ThinhHi Thinh,
This was rebased on Greg's usb-linus branch, which has commit
f09ddcfcb8c5("usb: dwc3: gadget: Prevent EP queuing while stopping transfers") merged.
Ah I see.
Quoted 8 lines
commit
f09ddcfcb8c5moved thedwc->connected= true to after we have finished stop active transfers. However, this change will also ensure that the connected flag is set to false to ensure that when we call stop active transfers, nothing can prepare TRBs. (previous commit only addresses the case where we get the reset interrupt when coming from a disconnected state)
That still doesn't address this issue.
Because:
1) We're still protected by the spin_lock_irq*(), so this change doesn't make any difference while handling an event.
2) We don't enable the interrupt for END_TRANSFER command completion when doing dwc3_stop_active_transfers(), the DWC3_EP_END_TRANSFER_PENDING flag will not be set to prevent preparing new requests.
We should do dwc->connected = true when we handle connection_done interrupt instead. The END_TRANSFER command should complete before this.
Thanks,
Thinh
Thinh Nguyen
maintainerRe: [PATCH 2/2] usb: dwc3: gadget: Ignore EP queue requests during bus reset
Quoted 75 lines · Thinh Nguyen
Quoted 44 lines · Wesley Cheng
Quoted 41 lines · Thinh Nguyen
Hi,
Quoted 24 lines · Wesley Cheng
The current
dwc3_gadget_reset_interrupt()will stop any active transfers, but only addresses blocking of EP queuing for while we are coming from a disconnected scenario, i.e. after receiving the disconnect event. If the host decides to issue a bus reset on the device, the connected parameter will still be set to true, allowing for EP queuing to continue while we are disabling the functions. To avoid this, set the connected flag to false until the stop active transfers is complete.Signed-off-by Wesley Cheng <[email protected]>--- drivers/usb/dwc3/gadget.c | 9 +++++++++ 1 file changed, 9 insertions(+)drivers/usb/dwc3/gadget.c +2
-0@@ -3327,6 +3327,15 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)u32 reg;/* +* Ideally, dwc3_reset_gadget() would trigger the function +* drivers to stop any active transfers through ep disable. drivers/usb/dwc3/gadget.c static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) · line 3341
Quoted 10 lines
drivers/usb/dwc3/gadget.c +7
-0+* However, for functions which defer ep disable, such as mass +* storage, we will need to rely on the call to stop active +* transfers here, and avoid allowing of request queuing. +*/ + dwc->connected = false; + +/* * WORKAROUND: DWC3 revisions <1.88a have an issue which * would cause a missing Disconnect Event if there's a * pending Setup Packet in the FIFO. This doesn't look right. Did you have rebase issue with your local change again?
Quoted 8 lines
Quoted 3 lines
BR,
ThinhHi Thinh,
This was rebased on Greg's usb-linus branch, which has commit
f09ddcfcb8c5("usb: dwc3: gadget: Prevent EP queuing while stopping transfers") merged.Ah I see.
Quoted 8 lines
commit
f09ddcfcb8c5moved thedwc->connected= true to after we have finished stop active transfers. However, this change will also ensure that the connected flag is set to false to ensure that when we call stop active transfers, nothing can prepare TRBs. (previous commit only addresses the case where we get the reset interrupt when coming from a disconnected state)That still doesn't address this issue.
Because:
1) We're still protected by the spin_lock_irq*(), so this change doesn't make any difference while handling an event.
2) We don't enable the interrupt forEND_TRANSFERcommand completion when doingdwc3_stop_active_transfers(), theDWC3_EP_END_TRANSFER_PENDINGflag will not be set to prevent preparing new requests.
Quoted 6 lines
We should do
dwc->connected= true when we handleconnection_doneinterrupt instead. TheEND_TRANSFERcommand should complete before this.Thanks,
Thinh
Just want to clarify, I was referring to your previous commit f09ddcfcb8c5, we'd still need dwc->connected = false when handling reset interrupt as you've done here.
BR,
Thinh
Re: [PATCH 2/2] usb: dwc3: gadget: Ignore EP queue requests during bus reset
In reply to Thinh NguyenHi Thinh,
Quoted 65 lines · Thinh Nguyen
Quoted 44 lines · Wesley Cheng
Quoted 41 lines · Thinh Nguyen
Hi,
Quoted 24 lines · Wesley Cheng
The current
dwc3_gadget_reset_interrupt()will stop any active transfers, but only addresses blocking of EP queuing for while we are coming from a disconnected scenario, i.e. after receiving the disconnect event. If the host decides to issue a bus reset on the device, the connected parameter will still be set to true, allowing for EP queuing to continue while we are disabling the functions. To avoid this, set the connected flag to false until the stop active transfers is complete.Signed-off-by Wesley Cheng <[email protected]>--- drivers/usb/dwc3/gadget.c | 9 +++++++++ 1 file changed, 9 insertions(+)drivers/usb/dwc3/gadget.c +2
-0@@ -3327,6 +3327,15 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)u32 reg;/* +* Ideally, dwc3_reset_gadget() would trigger the function +* drivers to stop any active transfers through ep disable. drivers/usb/dwc3/gadget.c static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) · line 3341
Quoted 10 lines
drivers/usb/dwc3/gadget.c +7
-0+* However, for functions which defer ep disable, such as mass +* storage, we will need to rely on the call to stop active +* transfers here, and avoid allowing of request queuing. +*/ + dwc->connected = false; + +/* * WORKAROUND: DWC3 revisions <1.88a have an issue which * would cause a missing Disconnect Event if there's a * pending Setup Packet in the FIFO. This doesn't look right. Did you have rebase issue with your local change again?
Quoted 8 lines
Quoted 3 lines
BR,
ThinhHi Thinh,
This was rebased on Greg's usb-linus branch, which has commit
f09ddcfcb8c5("usb: dwc3: gadget: Prevent EP queuing while stopping transfers") merged.Ah I see.
Quoted 8 lines
commit
f09ddcfcb8c5moved thedwc->connected= true to after we have finished stop active transfers. However, this change will also ensure that the connected flag is set to false to ensure that when we call stop active transfers, nothing can prepare TRBs. (previous commit only addresses the case where we get the reset interrupt when coming from a disconnected state)
Quoted 5 lines
That still doesn't address this issue.
Because:
1) We're still protected by the spin_lock_irq*(), so this change doesn't make any difference while handling an event.
Thank you for the feedback. So it is true that we lock dwc->lock while handling EP/device events, but what these changes are trying to address is that during dwc3_stop_active_transfers() we will eventually call dwc3_gadget_giveback() to call the complete() functions registered by the function driver. Before we call the complete() callbacks, we unlock dwc->lock, so we are no longer protected, and if there was a pending ep queue from a function driver, that would allow it to acquire the lock and continue preparing the TRBs.
Quoted 5 lines
2) We don't enable the interrupt for
END_TRANSFERcommand completion when doingdwc3_stop_active_transfers(), theDWC3_EP_END_TRANSFER_PENDINGflag will not be set to prevent preparing new requests.
Agreed. That is the reason for adding the check to dwc->connected in __dwc3_gadget_ep_queue()
if (!dep->endpoint.desc || !dwc->pullups_connected || !dwc->connected) {
dev_err(dwc->dev, "%s: can't queue to disabled endpoint\n",
dep->name);
return -ESHUTDOWN;
Quoted 3 lines
We should do
dwc->connected= true when we handleconnection_doneinterrupt instead. TheEND_TRANSFERcommand should complete before this.
So how this change will address the issue is:
1. IRQ handler will acquire dwc->lock 2. dwc3_gadget_reset_handler() sets dwc->connected = false 3. Call to dwc3_stop_active_transfers() ---> dwc3_gadget_giveback() releases dwc->lock
4. If there was a pending ep queue (waiting for dwc->lock) it can continue here
5. __dwc3_gadget_ep_queue() exits early due to dwc->connected = false
6. dwc3_gadget_giveback() re-acquires dwc->lock and continues
Thanks
Wesley Cheng
Signature · 2 lines
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
Thinh Nguyen
maintainerRe: [PATCH 2/2] usb: dwc3: gadget: Ignore EP queue requests during bus reset
Quoted 75 lines · Wesley Cheng
Hi Thinh,
Quoted 65 lines · Thinh Nguyen
Quoted 44 lines · Wesley Cheng
Quoted 41 lines · Thinh Nguyen
Hi,
Quoted 24 lines · Wesley Cheng
The current
dwc3_gadget_reset_interrupt()will stop any active transfers, but only addresses blocking of EP queuing for while we are coming from a disconnected scenario, i.e. after receiving the disconnect event. If the host decides to issue a bus reset on the device, the connected parameter will still be set to true, allowing for EP queuing to continue while we are disabling the functions. To avoid this, set the connected flag to false until the stop active transfers is complete.Signed-off-by Wesley Cheng <[email protected]>--- drivers/usb/dwc3/gadget.c | 9 +++++++++ 1 file changed, 9 insertions(+)drivers/usb/dwc3/gadget.c +2
-0@@ -3327,6 +3327,15 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)u32 reg;/* +* Ideally, dwc3_reset_gadget() would trigger the function +* drivers to stop any active transfers through ep disable. drivers/usb/dwc3/gadget.c static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) · line 3341
Quoted 10 lines
drivers/usb/dwc3/gadget.c +7
-0+* However, for functions which defer ep disable, such as mass +* storage, we will need to rely on the call to stop active +* transfers here, and avoid allowing of request queuing. +*/ + dwc->connected = false; + +/* * WORKAROUND: DWC3 revisions <1.88a have an issue which * would cause a missing Disconnect Event if there's a * pending Setup Packet in the FIFO. This doesn't look right. Did you have rebase issue with your local change again?
Quoted 8 lines
Quoted 3 lines
BR,
ThinhHi Thinh,
This was rebased on Greg's usb-linus branch, which has commit
f09ddcfcb8c5("usb: dwc3: gadget: Prevent EP queuing while stopping transfers") merged.Ah I see.
Quoted 8 lines
commit
f09ddcfcb8c5moved thedwc->connected= true to after we have finished stop active transfers. However, this change will also ensure that the connected flag is set to false to ensure that when we call stop active transfers, nothing can prepare TRBs. (previous commit only addresses the case where we get the reset interrupt when coming from a disconnected state)Quoted 5 lines
That still doesn't address this issue.
Because:
1) We're still protected by the spin_lock_irq*(), so this change doesn't make any difference while handling an event.
Quoted 9 lines
Thank you for the feedback. So it is true that we lock
dwc->lockwhile handling EP/device events, but what these changes are trying to address is that duringdwc3_stop_active_transfers()we will eventually calldwc3_gadget_giveback()to call thecomplete()functions registered by the function driver. Before we call thecomplete()callbacks, we unlockdwc->lock, so we are no longer protected, and if there was a pending ep queue from a function driver, that would allow it to acquire the lock and continue preparing the TRBs.
Ah I forgot about that.
Quoted 18 lines
Quoted 5 lines
2) We don't enable the interrupt for
END_TRANSFERcommand completion when doingdwc3_stop_active_transfers(), theDWC3_EP_END_TRANSFER_PENDINGflag will not be set to prevent preparing new requests.Agreed. That is the reason for adding the check to
dwc->connectedin__dwc3_gadget_ep_queue()if (!dep->endpoint.desc || !dwc->pullups_connected || !dwc->connected) {
(quoted diff) +0
-0dev_err(dwc->dev, "%s: can't queue to disabled endpoint\n", dep->name); return -ESHUTDOWN;Quoted 4 lines
We should do
dwc->connected= true when we handleconnection_doneinterrupt instead. TheEND_TRANSFERcommand should complete before this.So how this change will address the issue is:
Quoted 9 lines
1. IRQ handler will acquire dwc->lock 2. dwc3_gadget_reset_handler() sets dwc->connected = false 3. Call to dwc3_stop_active_transfers() ---> dwc3_gadget_giveback() releases dwc->lock4. If there was a pending ep queue (waiting for
dwc->lock) it can continue here
5.__dwc3_gadget_ep_queue()exits early due todwc->connected= false
6.dwc3_gadget_giveback()re-acquiresdwc->lockand continues
Ok. I thought this was for different issue. I thought you were trying to solve an issue where a request is queued immediately after handling the reset interrupt but before the END_TRANSFER command completion.
Thanks for the clarification.
BR,
Thinh