usb: dwc3: gadget: Fix isoc interrupt check
Subsystems (3)
Thinh Nguyen
maintainerv3 cover usb: dwc3: gadget: Fix isoc interrupt check
Fix issues where usb_request->no_interrupt is set for isoc transfers.
* Make sure no interrupt is asserted if no_interrupt is set
* Make sure to stop reclaiming TRBs when the driver needs to stop
Thinh Nguyen (2):
usb: dwc3: gadget: Stop processing more requests on IMI
usb: dwc3: gadget: Don't set IMI for no_interrupt
drivers/usb/dwc3/gadget.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
Changes in v3:
* Only set IMI to the last TRB of the chained TRBs
Changes in v2:
* Fix missing cover letter subject
* No need to check for the last chained TRB
base-commit: fb8f60dd1b67520e0e0d7978ef17d015690acfc1
Signature · 1 line
2.28.0
Thinh Nguyen
maintainerPATCH v3 1/2 usb: dwc3: gadget: Stop processing more requests on IMI
When servicing a transfer completion event, the dwc3 driver will reclaim TRBs of started requests up to the request associated with the interrupt event. Currently we don't check for interrupt due to missed isoc, and the driver may attempt to reclaim TRBs beyond the associated event. This causes invalid memory access when the hardware still owns the TRB. If there's a missed isoc TRB with IMI (interrupt on missed isoc), make sure to stop servicing further.
Note that only the last TRB of chained TRBs has its status updated with missed isoc.
---
Changes in v3:
- None
Changes in v2:
- No need to check for CHN=0 since only the last TRB has its status updated to missed isoc
drivers/usb/dwc3/gadget.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/dwc3/gadget.c +4 -0
@@ -3248,6 +3248,10 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,if (event->status &DEPEVT_STATUS_SHORT && !chain)return 1 ; +if ((trb->ctrl &DWC3_TRB_CTRL_ISP_IMI ) && +DWC3_TRB_SIZE_TRBSTS (trb->size) ==DWC3_TRBSTS_MISSED_ISOC ) +return 1 ; +if ((trb->ctrl &DWC3_TRB_CTRL_IOC ) || (trb->ctrl &DWC3_TRB_CTRL_LST ))return 1 ;
Signature · 1 line
2.28.0
Re: [PATCH v3 1/2] usb: dwc3: gadget: Stop processing more requests on IMI
Quoted 45 lines · Thinh Nguyen
When servicing a transfer completion event, the dwc3 driver will reclaim TRBs of started requests up to the request associated with the interrupt event. Currently we don't check for interrupt due to missed isoc, and the driver may attempt to reclaim TRBs beyond the associated event. This causes invalid memory access when the hardware still owns the TRB. If there's a missed isoc TRB with IMI (interrupt on missed isoc), make sure to stop servicing further.
Note that only the last TRB of chained TRBs has its status updated with missed isoc.
Fixes 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")Reported-by Jeff Vanhoof <[email protected]>Reported-by Dan Vacura <[email protected]>Signed-off-by Thinh Nguyen <[email protected]>---
Changes in v3:
- None
Changes in v2:
- No need to check for CHN=0 since only the last TRB has its status updated to missed isocdrivers/usb/dwc3/gadget.c | 4 ++++ 1 file changed, 4 insertions(+)drivers/usb/dwc3/gadget.c +4
-0@@ -3248,6 +3248,10 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,if (event->status &DEPEVT_STATUS_SHORT && !chain)return 1 ; +if ((trb->ctrl &DWC3_TRB_CTRL_ISP_IMI ) && +DWC3_TRB_SIZE_TRBSTS (trb->size) ==DWC3_TRBSTS_MISSED_ISOC ) +return 1 ; +if ((trb->ctrl &DWC3_TRB_CTRL_IOC ) || (trb->ctrl &DWC3_TRB_CTRL_LST ))return 1 ;Signature · 1 line
2.28.0
No new issues seen with these changes. Changes look good to me.
Regards,
Jeff
Thinh Nguyen
maintainerPATCH v3 2/2 usb: dwc3: gadget: Don't set IMI for no_interrupt
In reply to Thinh NguyenThe gadget driver may have a certain expectation of how the request completion flow should be from to its configuration. Make sure the controller driver respect that. That is, don't set IMI (Interrupt on Missed Isoc) when usb_request->no_interrupt is set. Also, the driver should only set IMI to the last TRB of a chain.
---
Changes in v3:
- Set IMI to only the last TRB of a chain
Changes in v2:
- None
drivers/usb/dwc3/gadget.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/dwc3/gadget.c +2 -2
@@ -1292,8 +1292,8 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep, trb->ctrl =DWC3_TRBCTL_ISOCHRONOUS ; } -/* always enable Interrupt on Missed ISOC */ - trb->ctrl |=DWC3_TRB_CTRL_ISP_IMI ; +if (!no_interrupt && !chain) + trb->ctrl |=DWC3_TRB_CTRL_ISP_IMI ;break ;case USB_ENDPOINT_XFER_BULK :
Signature · 1 line
2.28.0
Re: [PATCH v3 2/2] usb: dwc3: gadget: Don't set IMI for no_interrupt
Quoted 36 lines · Thinh Nguyen
The gadget driver may have a certain expectation of how the request completion flow should be from to its configuration. Make sure the controller driver respect that. That is, don't set IMI (Interrupt on Missed Isoc) when
usb_request->no_interruptis set. Also, the driver should only set IMI to the last TRB of a chain.Fixes 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")Signed-off-by Thinh Nguyen <[email protected]>---
Changes in v3:
- Set IMI to only the last TRB of a chain
Changes in v2:
- Nonedrivers/usb/dwc3/gadget.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)drivers/usb/dwc3/gadget.c +2
-2@@ -1292,8 +1292,8 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep, trb->ctrl =DWC3_TRBCTL_ISOCHRONOUS ; } -/* always enable Interrupt on Missed ISOC */ - trb->ctrl |=DWC3_TRB_CTRL_ISP_IMI ; +if (!no_interrupt && !chain) + trb->ctrl |=DWC3_TRB_CTRL_ISP_IMI ;break ;case USB_ENDPOINT_XFER_BULK :Signature · 1 line
2.28.0
No new issues seen with these changes. Changes look good to me.
Regards,
Jeff