On 18-06-20, 00:56, Yoshihiro Shimoda wrote:
> Hi Vinod,
>
> > From: Vinod Koul, Sent: Wednesday, June 17, 2020 1:56 AM
> >
> > On 21-05-20, 20:46, Yoshihiro Shimoda wrote:
> > > This driver assumed that freed descriptors have "done_cookie".
> > > But, after the commit 24461d9792c2 ("dmaengine: virt-dma: Fix
> > > access after free in vchan_complete()"), since the desc is freed
> > > after callback function was called, this driver could not
> > > match any done_cookie when a client driver (renesas_usbhs driver)
> > > calls dmaengine_tx_status() in the callback function.
> >
> > Hmmm, I am not sure about this, why should we try to match! cookie is
> > monotonically increasing number so if you see that current cookie
> > completed is > requested you should return DMA_COMPLETE
>
> The reason is this hardware is possible to stop the transfer even if
> all transfer length is not received. This is related to one of USB
> specification which allows to stop when getting a short packet.
> So, a client driver has to get residue even if DMA_COMPLETE.
We have additional dma_async_tx_callback_result callback to indicate the
residue in these cases, please use that
> > The below case of checking residue should not even get executed
>
> I see...
> So, I'm thinking the current implementation was a tricky because we didn't
> have dma_async_tx_callback_result when I wrote this usb-dmac driver.
> I'll try this to fix the issue.
Right :)
Also please use tag dmaengine: .. for these patches
--
~Vinod
