From: Felipe Balbi <balbi@kernel.org>
To: Jack Pham <jackp@codeaurora.org>, Roger Quadros <rogerq@ti.com>
Cc: "linux-usb\@vger.kernel.org" <linux-usb@vger.kernel.org>,
"Bin Liu \[EP\]" <b-liu@ti.com>
Subject: Re: g_audio breaks with dwc3
Date: Wed, 30 Oct 2019 10:57:34 +0200 [thread overview]
Message-ID: <87mudihapt.fsf@gmail.com> (raw)
In-Reply-To: <20191030081757.GB12661@jackp-linux.qualcomm.com>
Hi,
Jack Pham <jackp@codeaurora.org> writes:
> Will try to take a stab at this...
>
> On Tue, Oct 29, 2019 at 01:30:23PM +0200, Roger Quadros wrote:
>> irq/170-dwc3-1240 [000] d... 85.449686: dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
>> irq/170-dwc3-1240 [000] d... 85.449688: dwc3_ctrl_req: Set Interface(Intf = 1, Alt.Setting = 0)
>> irq/170-dwc3-1240 [000] d... 85.449693: dwc3_ep_dequeue: ep1out: req ee75d6ac length 0/256 zsI ==> -115
>> irq/170-dwc3-1240 [000] d... 85.449697: dwc3_gadget_ep_cmd: ep1out: cmd 'End Transfer' [20d08] params 00000000 00000000 00000000 --> status: Successful
>> irq/170-dwc3-1240 [000] d... 85.449799: dwc3_free_request: ep1out: req ee75d6ac length 0/256 zsI ==> -115
>
> req ee75d6ac is dequeued by f_uac2, and immediately freed. There is no
> giveback here, but oddly the givebacks happen at the end of the log
> right before the panic.
>
>> irq/170-dwc3-1240 [000] d... 85.449800: dwc3_ep_dequeue: ep1out: req c26c10a3 length 0/256 zsI ==> -115
>> irq/170-dwc3-1240 [000] d... 85.449803: dwc3_gadget_ep_cmd: ep1out: cmd 'End Transfer' [d08] params 00000000 00000000 00000000 --> status: Successful
>> irq/170-dwc3-1240 [000] d... 85.449905: dwc3_free_request: ep1out: req c26c10a3 length 0/256 zsI ==> -115
>
> ditto for req c26c10a3
>
>> irq/170-dwc3-1240 [000] d... 85.449906: dwc3_gadget_ep_disable: ep1out: mps 256/1024 streams 15 burst 0 ring 3/1 flags E:swBp:>
>> irq/170-dwc3-1240 [000] d... 85.449909: dwc3_gadget_ep_cmd: ep1out: cmd 'End Transfer' [c08] params 00000000 00000000 00000000 --> status: Successful
>
> Finally usb_ep_disable() is called on ep1out.
>
>> irq/170-dwc3-1240 [000] d... 85.450013: dwc3_event: event (000020c2): ep0in: [Status Phase]
>> irq/170-dwc3-1240 [000] d... 85.450013: dwc3_prepare_trb: ep0in: trb 089fca0d buf 00000000fe05b000 size 0 ctrl 00000c33 (HLcs:SC:status2)
>> irq/170-dwc3-1240 [000] d... 85.450019: dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 fe05b000 00000000 --> status: Successful
>> irq/170-dwc3-1240 [000] d... 85.450026: dwc3_event: event (080201c4): ep1out: Endpoint Command Complete
>> irq/170-dwc3-1240 [000] d... 85.450027: dwc3_event: event (080001c4): ep1out: Endpoint Command Complete
>
> Completions for the two End Transfer commands sent during ep_dequeue().
>
>> irq/170-dwc3-1240 [000] d... 85.450043: dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
>> irq/170-dwc3-1240 [000] d... 85.450044: dwc3_complete_trb: ep0out: trb 089fca0d buf 00000000fe05b000 size 0 ctrl 00000c32 (hLcs:SC:status2)
>> irq/170-dwc3-1240 [000] d... 85.450047: dwc3_gadget_giveback: ep0out: req 36600525 length 0/0 zsI ==> 0
>> irq/170-dwc3-1240 [000] d... 85.450049: dwc3_prepare_trb: ep0out: trb 089fca0d buf 00000000fe05b000 size 8 ctrl 00000c23 (HLcs:SC:setup)
>> irq/170-dwc3-1240 [000] d... 85.450055: dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 fe05b000 00000000 --> status: Successful
>> irq/170-dwc3-1240 [000] d... 85.450547: dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
>> irq/170-dwc3-1240 [000] d... 85.450550: dwc3_ctrl_req: Set Interface(Intf = 2, Alt.Setting = 0)
>> irq/170-dwc3-1240 [000] d... 85.450555: dwc3_ep_dequeue: ep1in: req f11a91c0 length 0/192 zsI ==> -115
>> irq/170-dwc3-1240 [000] d... 85.450556: dwc3_gadget_giveback: ep1in: req f11a91c0 length 0/192 zsI ==> -104
>> irq/170-dwc3-1240 [000] d... 85.450557: dwc3_free_request: ep1in: req f11a91c0 length 0/192 zsI ==> -104
>> irq/170-dwc3-1240 [000] d... 85.450559: dwc3_ep_dequeue: ep1in: req d9b92dec length 0/192 zsI ==> -115
>> irq/170-dwc3-1240 [000] d... 85.450560: dwc3_gadget_giveback: ep1in: req d9b92dec length 0/192 zsI ==> -104
>> irq/170-dwc3-1240 [000] d... 85.450561: dwc3_free_request: ep1in: req d9b92dec length 0/192 zsI ==> -104
>> irq/170-dwc3-1240 [000] d... 85.450562: dwc3_gadget_ep_disable: ep1in: mps 192/1024 streams 15 burst 0 ring 0/0 flags E:swbp:<
>> irq/170-dwc3-1240 [000] d... 85.450564: dwc3_gadget_giveback: ep1out: req ee75d6ac length 0/256 zsI ==> -108
>> irq/170-dwc3-1240 [000] d... 85.450566: dwc3_gadget_giveback: ep1out: req c26c10a3 length 0/256 zsI ==> -108
>> irq/170-dwc3-1240 [000] d... 85.450567: dwc3_gadget_giveback: : req d4301893 length 0/0 zsI ==> 0
>
> Giveback happens on above two reqs after they are already freed. Could
> it be due to f_uac2 / u_audio.c performing usb_ep_free_request()
> immediately after usb_ep_dequeue() without waiting for completion?
this could be a race condition. Add a trace_printk() at the cancelation,
see if the request is moved to cancelled list.
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 86dc1db788a9..affc2f7a929d 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1513,6 +1513,7 @@ static void dwc3_gadget_ep_cleanup_cancelled_requests(struct dwc3_ep *dep)
struct dwc3_request *tmp;
list_for_each_entry_safe(req, tmp, &dep->cancelled_list, list) {
+ trace_printk("---> completing cancellation of req %p\n", req);
dwc3_gadget_ep_skip_trbs(dep, req);
dwc3_gadget_giveback(dep, req, -ECONNRESET);
}
@@ -1551,6 +1552,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
if (!r->trb)
goto out0;
+ trace_printk("---> req %p moved to cancelled\n", req);
dwc3_gadget_move_cancelled_request(req);
if (dep->flags & DWC3_EP_TRANSFER_STARTED)
goto out0;
--
balbi
next prev parent reply other threads:[~2019-10-30 8:57 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-29 11:30 g_audio breaks with dwc3 Roger Quadros
2019-10-29 12:25 ` Felipe Balbi
2019-10-29 12:33 ` Roger Quadros
2019-10-30 8:17 ` Jack Pham
2019-10-30 8:57 ` Felipe Balbi [this message]
2019-10-30 10:00 ` Roger Quadros
2019-10-30 11:26 ` Felipe Balbi
2019-10-30 12:39 ` Roger Quadros
2019-10-31 8:56 ` Felipe Balbi
2019-10-30 10:08 ` Roger Quadros
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87mudihapt.fsf@gmail.com \
--to=balbi@kernel.org \
--cc=b-liu@ti.com \
--cc=jackp@codeaurora.org \
--cc=linux-usb@vger.kernel.org \
--cc=rogerq@ti.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.