From patchwork Mon May 5 12:56:29 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mathias Nyman X-Patchwork-Id: 887727 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D8B1A20298D for ; Mon, 5 May 2025 12:57:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.16 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746449845; cv=none; b=ElYjSGbCEzaXBzdNyH0NJ8BcbVfqUO166YIv0HqF5h7AZj4CFd5az6rDR49gyR2Mn2l2ZFtiifJmujlXaWL+gE/R4kv+5uFJGmSxBYtyQnL1jXYCdJMZOLtoPnU5zVAmWT2MehGyMeeeACc3hf7QrKgjgQhkOMYmkXaAvBRTGvc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746449845; c=relaxed/simple; bh=RBGQJqtZQXL16vBQbxnBmYQSX1XnLkbrVgf1MiPjBW4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ptEQSh+T2YUcdbEibw8qf01qWpQ8FjpbAm750pK2xmayu/PpnNALW/lrWnRluT1SyHrTsWEqf1H9QHDqD2RKVoQN3ODOQe+NjiI2JC9Mtv5MLqDAI92lD487OC0iGVqaRpwbW2Uw4okV95HGN9ilgFu0O0CJffU6nnC95/n/MK0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=none smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=U+ZnRh11; arc=none smtp.client-ip=192.198.163.16 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="U+ZnRh11" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1746449844; x=1777985844; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=RBGQJqtZQXL16vBQbxnBmYQSX1XnLkbrVgf1MiPjBW4=; b=U+ZnRh117Ys69YdZhxAPG9HFWNQe/S9mZgsVgEMsVr9PUbqBGOxfi1Nm 1ON26a5A3QHTzUWwt3HQnGLvlLbMB/7AbHRaQyoHEAwMS5QR/HIH4bgNa dWrGZRhuYNQwsbNGrZi/WX4OqNvQSPePVOGPqfYCLlNLtoF8MnqRB7v52 Hk6qujsGdisJLETapktbD129IlEvww2z+4dtBTrElXEXRHqaLg0Lawbiv c14TTGgN97iZT8eon2xPhopTYrgV3tFcXPkmgu6z4X5bnQDqTXr+uXlyB 3nrBvE6saHhpsvuvsTdQXU3d/+UnCw2lgAHOre0SgLeJ69kxkWjnI/Y/O g==; X-CSE-ConnectionGUID: 9jwRnOiNROCwshVq4IPa2w== X-CSE-MsgGUID: oLnX6b8PSNmpxsK1fkm32A== X-IronPort-AV: E=McAfee;i="6700,10204,11423"; a="35675906" X-IronPort-AV: E=Sophos;i="6.15,262,1739865600"; d="scan'208";a="35675906" Received: from orviesa010.jf.intel.com ([10.64.159.150]) by fmvoesa110.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 May 2025 05:57:22 -0700 X-CSE-ConnectionGUID: YtD9pA7FSzmz04pKh1ie1g== X-CSE-MsgGUID: thOr+mXZTCOdO6/dR5867w== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.15,262,1739865600"; d="scan'208";a="135151082" Received: from unknown (HELO mnyman-desk.fi.intel.com) ([10.237.72.199]) by orviesa010.jf.intel.com with ESMTP; 05 May 2025 05:57:19 -0700 From: Mathias Nyman To: Cc: , Michal Pecio , Jonathan Bell , Oliver Neukum , Mathias Nyman Subject: [PATCH 1/2] usb: xhci: Don't trust the EP Context cycle bit when moving HW dequeue Date: Mon, 5 May 2025 15:56:29 +0300 Message-ID: <20250505125630.561699-2-mathias.nyman@linux.intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20250505125630.561699-1-mathias.nyman@linux.intel.com> References: <20250505125630.561699-1-mathias.nyman@linux.intel.com> Precedence: bulk X-Mailing-List: linux-usb@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Michal Pecio VIA VL805 doesn't bother updating the EP Context cycle bit when the endpoint halts. This is seen by patching xhci_move_dequeue_past_td() to print the cycle bits of the EP Context and the TRB at hw_dequeue and then disconnecting a flash drive while reading it. Actual cycle state is random as expected, but the EP Context bit is always 1. This means that the cycle state produced by this function is wrong half the time, and then the endpoint stops working. Work around it by looking at the cycle bit of TD's end_trb instead of believing the Endpoint or Stream Context. Specifically: - rename cycle_found to hw_dequeue_found to avoid confusion - initialize new_cycle from td->end_trb instead of hw_dequeue - switch new_cycle toggling to happen after end_trb is found Now a workload which regularly stalls the device works normally for a few hours and clearly demonstrates the HW bug - the EP Context bit is not updated in a new cycle until Set TR Dequeue overwrites it: [ +0,000298] sd 10:0:0:0: [sdc] Attached SCSI disk [ +0,011758] cycle bits: TRB 1 EP Ctx 1 [ +5,947138] cycle bits: TRB 1 EP Ctx 1 [ +0,065731] cycle bits: TRB 0 EP Ctx 1 [ +0,064022] cycle bits: TRB 0 EP Ctx 0 [ +0,063297] cycle bits: TRB 0 EP Ctx 0 [ +0,069823] cycle bits: TRB 0 EP Ctx 0 [ +0,063390] cycle bits: TRB 1 EP Ctx 0 [ +0,063064] cycle bits: TRB 1 EP Ctx 1 [ +0,062293] cycle bits: TRB 1 EP Ctx 1 [ +0,066087] cycle bits: TRB 0 EP Ctx 1 [ +0,063636] cycle bits: TRB 0 EP Ctx 0 [ +0,066360] cycle bits: TRB 0 EP Ctx 0 Also tested on the buggy ASM1042 which moves EP Context dequeue to the next TRB after errors, one problem case addressed by the rework that implemented this loop. In this case hw_dequeue can be enqueue, so simply picking the cycle bit of TRB at hw_dequeue wouldn't work. Commit 5255660b208a ("xhci: add quirk for host controllers that don't update endpoint DCS") tried to solve the stale cycle problem, but it was more complex and got reverted due to a reported issue. Cc: Jonathan Bell Cc: Oliver Neukum Signed-off-by: Michal Pecio Signed-off-by: Mathias Nyman --- drivers/usb/host/xhci-ring.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index b906bc2eea5f..423bf3649570 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -699,7 +699,7 @@ static int xhci_move_dequeue_past_td(struct xhci_hcd *xhci, int new_cycle; dma_addr_t addr; u64 hw_dequeue; - bool cycle_found = false; + bool hw_dequeue_found = false; bool td_last_trb_found = false; u32 trb_sct = 0; int ret; @@ -715,25 +715,24 @@ static int xhci_move_dequeue_past_td(struct xhci_hcd *xhci, hw_dequeue = xhci_get_hw_deq(xhci, dev, ep_index, stream_id); new_seg = ep_ring->deq_seg; new_deq = ep_ring->dequeue; - new_cycle = hw_dequeue & 0x1; + new_cycle = le32_to_cpu(td->end_trb->generic.field[3]) & TRB_CYCLE; /* - * We want to find the pointer, segment and cycle state of the new trb - * (the one after current TD's end_trb). We know the cycle state at - * hw_dequeue, so walk the ring until both hw_dequeue and end_trb are - * found. + * Walk the ring until both the next TRB and hw_dequeue are found (don't + * move hw_dequeue back if it went forward due to a HW bug). Cycle state + * is loaded from a known good TRB, track later toggles to maintain it. */ do { - if (!cycle_found && xhci_trb_virt_to_dma(new_seg, new_deq) + if (!hw_dequeue_found && xhci_trb_virt_to_dma(new_seg, new_deq) == (dma_addr_t)(hw_dequeue & ~0xf)) { - cycle_found = true; + hw_dequeue_found = true; if (td_last_trb_found) break; } if (new_deq == td->end_trb) td_last_trb_found = true; - if (cycle_found && trb_is_link(new_deq) && + if (td_last_trb_found && trb_is_link(new_deq) && link_trb_toggles_cycle(new_deq)) new_cycle ^= 0x1; @@ -745,7 +744,7 @@ static int xhci_move_dequeue_past_td(struct xhci_hcd *xhci, return -EINVAL; } - } while (!cycle_found || !td_last_trb_found); + } while (!hw_dequeue_found || !td_last_trb_found); /* Don't update the ring cycle state for the producer (us). */ addr = xhci_trb_virt_to_dma(new_seg, new_deq); From patchwork Mon May 5 12:56:30 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Mathias Nyman X-Patchwork-Id: 889048 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EEBA2146D53; Mon, 5 May 2025 12:57:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.16 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746449846; cv=none; b=Y/3gAFfxGw9U9I+21USVMQjRnZybl6+KRG5WO9W2p0a8sWnOcaCBBJod7ZZMcJ2ffvPwFJ3JHjc9dVoScTvCjdJxI77y54Ii0GVIZG6fWDEjoHnhgTmFmVIOCx9ztiyEKaft/VlrJtiuc14EerGYG0c7wKb10O8mBK8cCT/icoU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746449846; c=relaxed/simple; bh=A8dahzrlKe2KglU8LHZBXCxvVFCHODOywH9O+yQASNU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=H4hH1R6Y3sqPELpNi+SlNxitt1ahBAi8MEdIacJOIgapDrcabNzr5GDxbkAZKMcPMse4JCSsjQbPDrxIxXlCW3Du2JnOI/sYBQJRQ0EHNRwNmhUOSgmNTMF/I0ys19B0vrLVaPVZwmiFKfRkr+gpj+YSyHk46PDV6le1WhU+9rI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=none smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=exql5B09; arc=none smtp.client-ip=192.198.163.16 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="exql5B09" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1746449845; x=1777985845; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=A8dahzrlKe2KglU8LHZBXCxvVFCHODOywH9O+yQASNU=; b=exql5B09DKgDbYEO84PPTSArqOsnlI2KNBIEr60zFntrZjTRi7poc4iw qUdeZhP4BlrZv9JY9fUHfeUvI8UZf6se1wzhHmnWvYR1RvAOUVpPyiegR ZZ724rCyM95mJqOLMZUX/2XTFtkyhvQKpoYYrek5dVJUrOIu1FHloId6S cLklhRYr9mR1Z2UJX+8DRm4vVfilJtGscyncaW9FJnAjeHJf+S2K6DzhZ RGe6NqqMbc2p28/njWVn+dyPjmzFlpZUhiA+v0E5S2CNBAqrXHqPIoJ80 JctBam0ind0+DhcT8t6HNNPF4Sc7o/Qad6Zur5gVmKI6LgytACGbBhyPL A==; X-CSE-ConnectionGUID: lEO8AYKXQoa6IFcaYLCanw== X-CSE-MsgGUID: TGeL6MqUSVWnOf1Husiy+g== X-IronPort-AV: E=McAfee;i="6700,10204,11423"; a="35675911" X-IronPort-AV: E=Sophos;i="6.15,262,1739865600"; d="scan'208";a="35675911" Received: from orviesa010.jf.intel.com ([10.64.159.150]) by fmvoesa110.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 May 2025 05:57:24 -0700 X-CSE-ConnectionGUID: DsmJJm4wS9WNyh+Wwzc69A== X-CSE-MsgGUID: ileZhGtrSdSkoxzhti2K6g== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.15,262,1739865600"; d="scan'208";a="135151089" Received: from unknown (HELO mnyman-desk.fi.intel.com) ([10.237.72.199]) by orviesa010.jf.intel.com with ESMTP; 05 May 2025 05:57:22 -0700 From: Mathias Nyman To: Cc: , Mathias Nyman , =?utf-8?q?=C5=81ukasz_Bartos?= =?utf-8?q?ik?= , stable@vger.kernel.org Subject: [PATCH 2/2] xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. Date: Mon, 5 May 2025 15:56:30 +0300 Message-ID: <20250505125630.561699-3-mathias.nyman@linux.intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20250505125630.561699-1-mathias.nyman@linux.intel.com> References: <20250505125630.561699-1-mathias.nyman@linux.intel.com> Precedence: bulk X-Mailing-List: linux-usb@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Event polling delay is set to 0 if there are any pending requests in either rx or tx requests lists. Checking for pending requests does not work well for "IN" transfers as the tty driver always queues requests to the list and TRBs to the ring, preparing to receive data from the host. This causes unnecessary busylooping and cpu hogging. Only set the event polling delay to 0 if there are pending tx "write" transfers, or if it was less than 10ms since last active data transfer in any direction. Cc: Łukasz Bartosik Fixes: fb18e5bb9660 ("xhci: dbc: poll at different rate depending on data transfer activity") Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman --- drivers/usb/host/xhci-dbgcap.c | 19 ++++++++++++++++--- drivers/usb/host/xhci-dbgcap.h | 3 +++ 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c index fd7895b24367..0d4ce5734165 100644 --- a/drivers/usb/host/xhci-dbgcap.c +++ b/drivers/usb/host/xhci-dbgcap.c @@ -823,6 +823,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) { dma_addr_t deq; union xhci_trb *evt; + enum evtreturn ret = EVT_DONE; u32 ctrl, portsc; bool update_erdp = false; @@ -909,6 +910,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) break; case TRB_TYPE(TRB_TRANSFER): dbc_handle_xfer_event(dbc, evt); + ret = EVT_XFER_DONE; break; default: break; @@ -927,7 +929,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) lo_hi_writeq(deq, &dbc->regs->erdp); } - return EVT_DONE; + return ret; } static void xhci_dbc_handle_events(struct work_struct *work) @@ -936,6 +938,7 @@ static void xhci_dbc_handle_events(struct work_struct *work) struct xhci_dbc *dbc; unsigned long flags; unsigned int poll_interval; + unsigned long busypoll_timelimit; dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work); poll_interval = dbc->poll_interval; @@ -954,11 +957,21 @@ static void xhci_dbc_handle_events(struct work_struct *work) dbc->driver->disconnect(dbc); break; case EVT_DONE: - /* set fast poll rate if there are pending data transfers */ + /* + * Set fast poll rate if there are pending out transfers, or + * a transfer was recently processed + */ + busypoll_timelimit = dbc->xfer_timestamp + + msecs_to_jiffies(DBC_XFER_INACTIVITY_TIMEOUT); + if (!list_empty(&dbc->eps[BULK_OUT].list_pending) || - !list_empty(&dbc->eps[BULK_IN].list_pending)) + time_is_after_jiffies(busypoll_timelimit)) poll_interval = 0; break; + case EVT_XFER_DONE: + dbc->xfer_timestamp = jiffies; + poll_interval = 0; + break; default: dev_info(dbc->dev, "stop handling dbc events\n"); return; diff --git a/drivers/usb/host/xhci-dbgcap.h b/drivers/usb/host/xhci-dbgcap.h index 9dc8f4d8077c..47ac72c2286d 100644 --- a/drivers/usb/host/xhci-dbgcap.h +++ b/drivers/usb/host/xhci-dbgcap.h @@ -96,6 +96,7 @@ struct dbc_ep { #define DBC_WRITE_BUF_SIZE 8192 #define DBC_POLL_INTERVAL_DEFAULT 64 /* milliseconds */ #define DBC_POLL_INTERVAL_MAX 5000 /* milliseconds */ +#define DBC_XFER_INACTIVITY_TIMEOUT 10 /* milliseconds */ /* * Private structure for DbC hardware state: */ @@ -142,6 +143,7 @@ struct xhci_dbc { enum dbc_state state; struct delayed_work event_work; unsigned int poll_interval; /* ms */ + unsigned long xfer_timestamp; unsigned resume_required:1; struct dbc_ep eps[2]; @@ -187,6 +189,7 @@ struct dbc_request { enum evtreturn { EVT_ERR = -1, EVT_DONE, + EVT_XFER_DONE, EVT_GSER, EVT_DISC, };