Hi,
> cppi_next_tx_segment is not checking for Transmit Buffer Descriptor
> ownership before modifying parameters.
>
> Transmit Buffer Descriptor ram is shared between the host processor and
> the DMA. The "Ownership" bit is set by the host processor to give the
> DMA ownership of the Transmit Buffer Descriptor, and the bit is cleared
> by the DMA to return ownership to the host processor.
>
> On USB Tx, when the system is heavily loaded, cppi_next_tx_segment can
> overwrite a Transmit Buffer Descriptor that is still owned by the DMA,
> causing DMA truncation error to fire, resulting in a channel abort. This
> proposed fix adds a check for host processor ownership of the bd and
> does not proceed to program it until the DMA has ended ownership.
[...]
> --- a/drivers/usb/musb/cppi_dma.c 2010-12-06 20:09:04.000000000 -0800
> +++ b/drivers/usb/musb/cppi_dma.c 2010-12-07 11:22:04.000000000 -0800
> @@ -625,6 +625,14 @@ cppi_next_tx_segment(struct musb *musb,
> * size; for RNDIS there _is_ only that last packet.
> */
> for (i = 0; i < n_bds; ) {
> +
> + /* wait for DMA to release ownership of this bd */
> + if (unlikely(bd->hw_options & CPPI_OWN_SET)) {
> + do {
> + cpu_relax();
> + } while (bd->hw_options & CPPI_OWN_SET);
> + }
> +
The bd has been taken from freelist and therefore should have ownership
Bit already cleared. I think we need to fix the root cause by ensuring
that ownership bit is cleared before the bd is reclaimed and added to
the freelist.
-Ravi
> if (++i < n_bds && bd->next)
> bd->hw_next = bd->next->dma;
linux.davincidsp.com/mailman/listinfo/davinci-linux-open-source
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
