On Mon, Jan 03, 2011 at 07:07:06PM +0530, B, Ravi wrote:
> Hi,
> > cppi_next_tx_segment is not checking for Transmit Buffer Descriptor
> > ownership before modifying parameters.
> >
> > Transmit Buffer Descriptor ram is shared between the host processor and
> > the DMA. The "Ownership" bit is set by the host processor to give the
> > DMA ownership of the Transmit Buffer Descriptor, and the bit is cleared
> > by the DMA to return ownership to the host processor.
> >
> > On USB Tx, when the system is heavily loaded, cppi_next_tx_segment can
> > overwrite a Transmit Buffer Descriptor that is still owned by the DMA,
> > causing DMA truncation error to fire, resulting in a channel abort. This
> > proposed fix adds a check for host processor ownership of the bd and
> > does not proceed to program it until the DMA has ended ownership.
> [...]
> > --- a/drivers/usb/musb/cppi_dma.c 2010-12-06 20:09:04.000000000 -0800
> > +++ b/drivers/usb/musb/cppi_dma.c 2010-12-07 11:22:04.000000000 -0800
> > @@ -625,6 +625,14 @@ cppi_next_tx_segment(struct musb *musb,
> > * size; for RNDIS there _is_ only that last packet.
> > */
> > for (i = 0; i < n_bds; ) {
> > +
> > + /* wait for DMA to release ownership of this bd */
> > + if (unlikely(bd->hw_options & CPPI_OWN_SET)) {
> > + do {
> > + cpu_relax();
> > + } while (bd->hw_options & CPPI_OWN_SET);
> > + }
> > +
> The bd has been taken from freelist and therefore should have ownership
> Bit already cleared. I think we need to fix the root cause by ensuring
> that ownership bit is cleared before the bd is reclaimed and added to
> the freelist.
ping... do we need this patch ?
--
balbi
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
