xhci features for usb-next
Subsystems (3)
cover xhci features for usb-next
Hi Greg
Some xhci features and a fix for usb-next, improving DbC performance and defining a few missing bits in xhci spec
The NULL pointer fix by Michal solves a rare, 10 year old issue. I don't want to force it into 6.13/usb-linus at this stage over the holidays. Adding it to 6.14/usb-next and stable should be fine.
Thanks
Mathias
Mathias Nyman (4):
xhci: dbc: Improve performance by removing delay in transfer event
polling.
xhci: dbgtty: Improve performance by handling received data
immediately.
xhci: Add command completion parameter support
xhci: Add missing capability definition bits
Michal Pecio (1):
usb: xhci: Fix NULL pointer dereference on certain command aborts
drivers/usb/host/xhci-caps.h | 6 +++ drivers/usb/host/xhci-dbgcap.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 98 ++++++++++++++++++++++------------ drivers/usb/host/xhci-ring.c | 13 +++-- drivers/usb/host/xhci.h | 4 ++ 5 files changed, 84 insertions(+), 39 deletions(-)
Signature · 1 line
2.25.1
PATCH 1/5 xhci: dbc: Improve performance by removing delay in transfer event polling.
Queue event polling work with 0 delay in case there are pending transfers queued up. This is part 2 of a 3 part series that roughly triples dbc performace when using adb push and pull over dbc.
Max/min push rate after patches is 210/118 MB/s, pull rate 171/133 MB/s, tested with large files (300MB-9GB) by Łukasz Bartosik
First performance improvement patch was commit 31128e7492dc ("xhci: dbc: add dbgtty request to end of list once it completes")
--- drivers/usb/host/xhci-dbgcap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-dbgcap.c +1 -1
@@ -957,7 +957,7 @@ static void xhci_dbc_handle_events(struct work_struct *work)/* set fast poll rate if there are pending data transfers */ if (!list_empty (&dbc->eps[BULK_OUT ].list_pending) || !list_empty (&dbc->eps[BULK_IN ].list_pending)) - poll_interval =1 ; + poll_interval =0 ;break ;default :dev_info (dbc->dev,"stop handling dbc events\n" );
Signature · 1 line
2.25.1
PATCH 2/5 xhci: dbgtty: Improve performance by handling received data immediately.
In reply to Mathias NymanImprove dbc transfer rate performance by copying the received data to the tty buffer directly in the request complete callback function if possible.
Only defer it in case there is already pending deferred work, tty is throttled, or we fail copy the data to the tty buffer
The request complete callback is already called by a workqueue.
This is part 3/3 of a dbc performance improvement series that roughly triples dbc performace when using adb push and pull over dbc.
Max/min push rate after patches is 210/118 MB/s, pull rate 171/133 MB/s, tested with large files (300MB-9GB) by Łukasz Bartosik
--- drivers/usb/host/xhci-dbgtty.c | 98 ++++++++++++++++++++++------------ 1 file changed, 65 insertions(+), 33 deletions(-)
drivers/usb/host/xhci-dbgtty.c +65 -33
@@ -110,15 +110,74 @@ static void dbc_start_rx(struct dbc_port *port) } } +/* +* Queue received data to tty buffer and push it. +* +* Returns nr of remaining bytes that didn't fit tty buffer, i.e. 0 if all +* bytes sucessfullt moved. In case of error returns negative errno. +* Call with lock held +*/ +static int dbc_rx_push_buffer (struct dbc_port *port,struct dbc_request *req) +{ +char *packet = req->buf; +unsigned int n, size = req->actual; +int count; + +if (!req->actual) +return 0 ; + +/* if n_read is set then request was partially moved to tty buffer */ + n = port->n_read; +if (n) { + packet += n; + size -= n; + } + + count =tty_insert_flip_string (&port->port, packet, size); +if (count) +tty_flip_buffer_push (&port->port); +if (count != size) { + port->n_read += count; +return size - count; + } + + port->n_read =0 ; +return 0 ; +} +static void dbc_read_complete (struct xhci_dbc *dbc,struct dbc_request *req) {unsigned long flags;struct dbc_port *port =dbc_to_port (dbc); +struct tty_struct *tty; +int untransferred; + + tty = port->port.tty;spin_lock_irqsave (&port->port_lock, flags); + +/* +* Only defer copyig data to tty buffer in case: +* - !list_empty(&port->read_queue), there are older pending data +* - tty is throttled +* - failed to copy all data to buffer, defer remaining part +*/ + +if (list_empty (&port->read_queue) && tty && !tty_throttled (tty)) { + untransferred =dbc_rx_push_buffer (port, req); +if (untransferred ==0 ) { +list_add_tail (&req->list_pool, &port->read_pool); +if (req->status != -ESHUTDOWN ) +dbc_start_rx (port); + goto out; + } + } + +/* defer moving data from req to tty buffer to a tasklet */ list_add_tail (&req->list_pool, &port->read_queue);tasklet_schedule (&port->push); +out:spin_unlock_irqrestore (&port->port_lock, flags); }
@@ -331,10 +390,10 @@ static void dbc_rx_push(struct tasklet_struct *t)struct dbc_request *req;struct tty_struct *tty;unsigned long flags; -bool do_push = false;bool disconnect = false;struct dbc_port *port =from_tasklet (port, t, push);struct list_head *queue = &port->read_queue; +int untransferred;spin_lock_irqsave (&port->port_lock, flags); tty = port->port.tty;
@@ -356,42 +415,15 @@ static void dbc_rx_push(struct tasklet_struct *t)break ; } -if (req->actual) { -char *packet = req->buf; -unsigned int n, size = req->actual; -int count; - - n = port->n_read; -if (n) { - packet += n; - size -= n; - } - - count =tty_insert_flip_string (&port->port, packet, - size); -if (count) - do_push = true; -if (count != size) { - port->n_read += count; -break ; - } - port->n_read =0 ; - } + untransferred =dbc_rx_push_buffer (port, req); +if (untransferred >0 ) +break ;list_move_tail (&req->list_pool, &port->read_pool); } -if (do_push) -tty_flip_buffer_push (&port->port); - -if (!list_empty (queue) && tty) { -if (!tty_throttled (tty)) { -if (do_push) -tasklet_schedule (&port->push); -else -pr_warn ("ttyDBC0: RX not scheduled?\n" ); - } - } +if (!list_empty (queue)) +tasklet_schedule (&port->push);if (!disconnect)dbc_start_rx (port);
Signature · 1 line
2.25.1
PATCH 3/5 usb: xhci: Fix NULL pointer dereference on certain command aborts
In reply to Mathias NymanFrom: Michal Pecio <[email protected]>
If a command is queued to the final usable TRB of a ring segment, the enqueue pointer is advanced to the subsequent link TRB and no further. If the command is later aborted, when the abort completion is handled the dequeue pointer is advanced to the first TRB of the next segment.
If no further commands are queued, xhci_handle_stopped_cmd_ring() sees the ring pointers unequal and assumes that there is a pending command, so it calls xhci_mod_cmd_timer() which crashes if cur_cmd was NULL.
Don't attempt timer setup if cur_cmd is NULL. The subsequent doorbell ring likely is unnecessary too, but it's harmless. Leave it alone.
This is probably Bug 219532, but no confirmation has been received.
The issue has been independently reproduced and confirmed fixed using a USB MCU programmed to NAK the Status stage of SET_ADDRESS forever. Everything continued working normally after several prevented crashes.
--- drivers/usb/host/xhci-ring.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-ring.c +2 -1
@@ -422,7 +422,8 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci,if ((xhci->cmd_ring->dequeue != xhci->cmd_ring->enqueue) && !(xhci->xhc_state &XHCI_STATE_DYING )) { xhci->current_cmd = cur_cmd; -xhci_mod_cmd_timer (xhci); +if (cur_cmd) +xhci_mod_cmd_timer (xhci);xhci_ring_cmd_db (xhci); } }
Signature · 1 line
2.25.1
PATCH 4/5 xhci: Add command completion parameter support
In reply to Mathias NymanxHC hosts can pass 24 bits of data with a command completion event TRB as the completion code only uses 8 bits of the 32 bit status field.
Only Configure Endpoint, and Get Extended Property commands utilize this "command completion parameter" 24 bit field.
For other command completion events the xHC should keep it RsvdZ.
--- drivers/usb/host/xhci-ring.c | 10 ++++++---- drivers/usb/host/xhci.h | 4 ++++ 2 files changed, 10 insertions(+), 4 deletions(-)
drivers/usb/host/xhci-ring.c +6 -4
@@ -1652,12 +1652,13 @@ static void xhci_handle_cmd_nec_get_fw(struct xhci_hcd *xhci, NEC_FW_MINOR(le32_to_cpu(event->status))); } -static void xhci_complete_del_and_free_cmd (struct xhci_command *cmd,u32 status) +static void xhci_complete_del_and_free_cmd (struct xhci_command *cmd,u32 comp_code,u32 comp_param) {list_del (&cmd->cmd_list);if (cmd->completion) { - cmd->status = status; + cmd->status = comp_code; + cmd->comp_param = comp_param;complete (cmd->completion); }else {kfree (cmd);
@@ -1669,7 +1670,7 @@ void xhci_cleanup_command_queue(struct xhci_hcd *xhci)struct xhci_command *cur_cmd, *tmp_cmd; xhci->current_cmd =NULL ;list_for_each_entry_safe (cur_cmd, tmp_cmd, &xhci->cmd_list, cmd_list) -xhci_complete_del_and_free_cmd (cur_cmd,COMP_COMMAND_ABORTED ); +xhci_complete_del_and_free_cmd (cur_cmd,COMP_COMMAND_ABORTED ,0 ); }void xhci_handle_command_timeout (struct work_struct *work)
@@ -1754,6 +1755,7 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, struct xhci_event_cmd *event) {unsigned int slot_id =TRB_TO_SLOT_ID (le32_to_cpu (event->flags)); +u32 status =le32_to_cpu (event->status);u64 cmd_dma;dma_addr_t cmd_dequeue_dma;u32 cmd_comp_code;
@@ -1882,7 +1884,7 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, } event_handled: -xhci_complete_del_and_free_cmd (cmd, cmd_comp_code); +xhci_complete_del_and_free_cmd (cmd, cmd_comp_code,COMP_PARAM (status));inc_deq (xhci, xhci->cmd_ring); }
drivers/usb/host/xhci.h +4 -0
@@ -529,6 +529,7 @@ struct xhci_command {/* Input context for changing device state */ struct xhci_container_ctx *in_ctx;u32 status; +u32 comp_param;int slot_id;/* If completion is null, no one is waiting on this command * and the structure can be freed after the command completes.
@@ -959,6 +960,9 @@ struct xhci_event_cmd {__le32 flags; }; +/* status bitmasks */ +#define COMP_PARAM (p) ((p) & 0xffffff)/* Command Completion Parameter */ +/* Address device - disable SetAddress */ #define TRB_BSR (1<<9)
Signature · 1 line
2.25.1
PATCH 5/5 xhci: Add missing capability definition bits
In reply to Mathias NymanAdd capability bits for the xHC Capability Parameters 2 (HCCPARAMS2) register described in xHCI specification section 5.3.9
bit 7 Extended TBC TRB Status Capability (ETC_TSC) bit 8 Get/Set Extended Property Capability (GSC) bit 9 Virtualization Based Trusted I/O Capability (VTC)
--- drivers/usb/host/xhci-caps.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/host/xhci-caps.h +6 -0
@@ -83,3 +83,9 @@#define HCC2_CIC (p) ((p) & (1 << 5))/* true: HC support Extended TBC Capability, Isoc burst count > 65535 */ #define HCC2_ETC (p) ((p) & (1 << 6)) +/* true: HC support Extended TBC TRB Status Capability */ +#define HCC2_ETC_TSC (p) ((p) & (1 << 7)) +/* true: HC support Get/Set Extended Property Capability */ +#define HCC2_GSC (p) ((p) & (1 << 8)) +/* true: HC support Virtualization Based Trusted I/O Capability */ +#define HCC2_VTC (p) ((p) & (1 << 9))
Signature · 1 line
2.25.1