xhci fixes for usb-linus
Subsystems (3)
cover xhci fixes for usb-linus
Hi Greg
A couple xhci fixes for usb-linus
Fixing a xhci memory leak regression in 6.17-rc3, and a DbC issue triggered when re-connecting DbC cable ~10 times without data transfers in between
Thanks
Mathias
Mathias Nyman (3):
xhci: dbc: decouple endpoint allocation from initialization
xhci: dbc: Fix full DbC transfer ring after several reconnects
xhci: fix memory leak regression when freeing xhci vdev devices depth
first
drivers/usb/host/xhci-dbgcap.c | 94 ++++++++++++++++++++++++---------- drivers/usb/host/xhci-mem.c | 2 +- 2 files changed, 68 insertions(+), 28 deletions(-)
Signature · 1 line
2.43.0
PATCH 1/3 xhci: dbc: decouple endpoint allocation from initialization
Decouple allocation of endpoint ring buffer from initialization of the buffer, and initialization of endpoint context parts from from the rest of the contexts.
It allows driver to clear up and reinitialize endpoint rings after disconnect without reallocating everything.
This is a prerequisite for the next patch that prevents the transfer ring from filling up with cancelled (no-op) TRBs if a debug cable is reconnected several times without transferring anything.
--- drivers/usb/host/xhci-dbgcap.c | 71 ++++++++++++++++++++++------------ 1 file changed, 46 insertions(+), 25 deletions(-)
drivers/usb/host/xhci-dbgcap.c +46 -25
@@ -101,13 +101,34 @@ static u32 xhci_dbc_populate_strings(struct dbc_str_descs *strings)return string_length; } +static void xhci_dbc_init_ep_contexts (struct xhci_dbc *dbc) +{ +struct xhci_ep_ctx *ep_ctx; +unsigned int max_burst; +dma_addr_t deq; + + max_burst =DBC_CTRL_MAXBURST (readl (&dbc->regs->control)); + +/* Populate bulk out endpoint context: */ + ep_ctx =dbc_bulkout_ctx (dbc); + deq =dbc_bulkout_enq (dbc); + ep_ctx->ep_info =0 ; + ep_ctx->ep_info2 =dbc_epctx_info2 (BULK_OUT_EP ,1024 , max_burst); + ep_ctx->deq =cpu_to_le64 (deq | dbc->ring_out->cycle_state); + +/* Populate bulk in endpoint context: */ + ep_ctx =dbc_bulkin_ctx (dbc); + deq =dbc_bulkin_enq (dbc); + ep_ctx->ep_info =0 ; + ep_ctx->ep_info2 =dbc_epctx_info2 (BULK_IN_EP ,1024 , max_burst); + ep_ctx->deq =cpu_to_le64 (deq | dbc->ring_in->cycle_state); +} +static void xhci_dbc_init_contexts (struct xhci_dbc *dbc,u32 string_length) {struct dbc_info_context *info; -struct xhci_ep_ctx *ep_ctx;u32 dev_info; -dma_addr_t deq, dma; -unsigned int max_burst; +dma_addr_t dma;if (!dbc)return ;
@@ -121,20 +142,8 @@ static void xhci_dbc_init_contexts(struct xhci_dbc *dbc, u32 string_length) info->serial =cpu_to_le64 (dma +DBC_MAX_STRING_LENGTH *3 ); info->length =cpu_to_le32 (string_length); -/* Populate bulk out endpoint context: */ - ep_ctx =dbc_bulkout_ctx (dbc); - max_burst =DBC_CTRL_MAXBURST (readl (&dbc->regs->control)); - deq =dbc_bulkout_enq (dbc); - ep_ctx->ep_info =0 ; - ep_ctx->ep_info2 =dbc_epctx_info2 (BULK_OUT_EP ,1024 , max_burst); - ep_ctx->deq =cpu_to_le64 (deq | dbc->ring_out->cycle_state); - -/* Populate bulk in endpoint context: */ - ep_ctx =dbc_bulkin_ctx (dbc); - deq =dbc_bulkin_enq (dbc); - ep_ctx->ep_info =0 ; - ep_ctx->ep_info2 =dbc_epctx_info2 (BULK_IN_EP ,1024 , max_burst); - ep_ctx->deq =cpu_to_le64 (deq | dbc->ring_in->cycle_state); +/* Populate bulk in and out endpoint contexts: */ +xhci_dbc_init_ep_contexts (dbc);/* Set DbC context and info registers: */ lo_hi_writeq (dbc->ctx->dma, &dbc->regs->dccp);
@@ -436,6 +445,23 @@ dbc_alloc_ctx(struct device *dev, gfp_t flags)return ctx; } +static void xhci_dbc_ring_init (struct xhci_ring *ring) +{ +struct xhci_segment *seg = ring->first_seg; + +/* clear all trbs on ring in case of old ring */ +memset (seg->trbs,0 ,TRB_SEGMENT_SIZE ); + +/* Only event ring does not use link TRB */ +if (ring->type !=TYPE_EVENT ) { +union xhci_trb *trb = &seg->trbs[TRBS_PER_SEGMENT -1 ]; + + trb->link.segment_ptr =cpu_to_le64 (ring->first_seg->dma); + trb->link.control =cpu_to_le32 (LINK_TOGGLE |TRB_TYPE (TRB_LINK )); + } +xhci_initialize_ring_info (ring); +} +static struct xhci_ring *xhci_dbc_ring_alloc (struct device *dev,enum xhci_ring_type type,gfp_t flags) {
@@ -464,15 +490,10 @@ xhci_dbc_ring_alloc(struct device *dev, enum xhci_ring_type type, gfp_t flags) seg->dma = dma; -/* Only event ring does not use link TRB */ -if (type !=TYPE_EVENT ) { -union xhci_trb *trb = &seg->trbs[TRBS_PER_SEGMENT -1 ]; - - trb->link.segment_ptr =cpu_to_le64 (dma); - trb->link.control =cpu_to_le32 (LINK_TOGGLE |TRB_TYPE (TRB_LINK )); - }INIT_LIST_HEAD (&ring->td_list); -xhci_initialize_ring_info (ring); + +xhci_dbc_ring_init (ring); +return ring; dma_fail:kfree (seg);
Signature · 1 line
2.43.0
PATCH 2/3 xhci: dbc: Fix full DbC transfer ring after several reconnects
In reply to Mathias NymanPending requests will be flushed on disconnect, and the corresponding TRBs will be turned into No-op TRBs, which are ignored by the xHC controller once it starts processing the ring.
If the USB debug cable repeatedly disconnects before ring is started then the ring will eventually be filled with No-op TRBs. No new transfers can be queued when the ring is full, and driver will print the following error message:
"xhci_hcd 0000:00:14.0: failed to queue trbs"
This is a normal case for 'in' transfers where TRBs are always enqueued in advance, ready to take on incoming data. If no data arrives, and device is disconnected, then ring dequeue will remain at beginning of the ring while enqueue points to first free TRB after last cancelled No-op TRB.
s
Solve this by reinitializing the rings when the debug cable disconnects and DbC is leaving the configured state.
Clear the whole ring buffer and set enqueue and dequeue to the beginning of ring, and set cycle bit to its initial state.
--- drivers/usb/host/xhci-dbgcap.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-dbgcap.c +21 -2
@@ -462,6 +462,25 @@ static void xhci_dbc_ring_init(struct xhci_ring *ring)xhci_initialize_ring_info (ring); } +static int xhci_dbc_reinit_ep_rings (struct xhci_dbc *dbc) +{ +struct xhci_ring *in_ring = dbc->eps[BULK_IN ].ring; +struct xhci_ring *out_ring = dbc->eps[BULK_OUT ].ring; + +if (!in_ring || !out_ring || !dbc->ctx) { +dev_warn (dbc->dev,"Can't re-init unallocated endpoints\n" ); +return -ENODEV ; + } + +xhci_dbc_ring_init (in_ring); +xhci_dbc_ring_init (out_ring); + +/* set ep context enqueue, dequeue, and cycle to initial values */ +xhci_dbc_init_ep_contexts (dbc); + +return 0 ; +} +static struct xhci_ring *xhci_dbc_ring_alloc (struct device *dev,enum xhci_ring_type type,gfp_t flags) {
@@ -885,7 +904,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc)dev_info (dbc->dev,"DbC cable unplugged\n" ); dbc->state =DS_ENABLED ;xhci_dbc_flush_requests (dbc); - +xhci_dbc_reinit_ep_rings (dbc);return EVT_DISC ; }
@@ -895,7 +914,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc)writel (portsc, &dbc->regs->portsc); dbc->state =DS_ENABLED ;xhci_dbc_flush_requests (dbc); - +xhci_dbc_reinit_ep_rings (dbc);return EVT_DISC ; }
Signature · 1 line
2.43.0
PATCH 3/3 xhci: fix memory leak regression when freeing xhci vdev devices depth first
In reply to Mathias NymanSuspend-resume cycle test revealed a memory leak in 6.17-rc3
Turns out the slot_id race fix changes accidentally ends up calling xhci_free_virt_device() with an incorrect vdev parameter. The vdev variable was reused for temporary purposes right before calling xhci_free_virt_device().
Fix this by passing the correct vdev parameter.
The slot_id race fix that caused this regression was targeted for stable, so this needs to be applied there as well.
--- drivers/usb/host/xhci-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-mem.c +1 -1
@@ -962,7 +962,7 @@ static void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_i out:/* we are now at a leaf device */ xhci_debugfs_remove_slot (xhci, slot_id); -xhci_free_virt_device (xhci, vdev, slot_id); +xhci_free_virt_device (xhci, xhci->devs[slot_id], slot_id); } int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
Signature · 1 line
2.43.0