[PATCH] usb: xhci: fix event trb handling missed

Ran Wang ran.wang_1 at nxp.com
Tue Nov 10 10:54:36 CET 2020


Hi Bin,

On Tuesday, November 10, 2020 5:47 PM Bin Meng wrote:
> 
> Hi Ran,
> 
> On Tue, Nov 10, 2020 at 5:41 PM Ran Wang <ran.wang_1 at nxp.com> wrote:
> >
> > Hi Bin,
> >
> > On Tuesday, November 10, 2020 5:03 PM Bin Meng wrote:
> > >
> > > Hi Ran,
> > >
> > > On Tue, Nov 10, 2020 at 4:31 PM Ran Wang <ran.wang_1 at nxp.com>
> wrote:
> > > >
> > > > Hi Bin,
> > > >
> > > > On Tuesday, November 10, 2020 4:06 PM Ran Wang wrote:
> > > > > Hi Bin,
> >
> > <snip>
> >
> > > >
> > >
> > > Based on your log, it matches what I suspected and we are getting
> > > close to the root cause.
> > >
> > > Could you please try the following simple test case to see if it can
> > > trigger the issue with a USB disk?
> > > After U-Boot boot on LS1028, with a USB flash disk attached, then
> > > type "usb start" to see if the USB disk can be recognized by U-Boot?
> > >
> > > commit 60e68ed667362870c20b36ae26dacc1af903e81e
> > > Author: Bin Meng <bmeng.cn at gmail.com>
> > > Date:   Tue Nov 10 16:19:06 2020 +0800
> > >
> > >     WIP: usb: A simple test case to trigger the TRB 64K boundary
> > > issue with mass storage device
> > >
> > >     This should not be applied as it aims to provide a simple test case to
> > >     trigger the TRB 64K boundary issue as reported by Ran Wang @ NXP.
> > >
> > >     Signed-off-by: Bin Meng <bmeng.cn at gmail.com>
> > >
> > > diff --git a/common/usb_storage.c b/common/usb_storage.c index
> > > ff25441..c8aec2e 100644
> > > --- a/common/usb_storage.c
> > > +++ b/common/usb_storage.c
> > > @@ -710,7 +710,15 @@ static int usb_stor_BBB_transport(struct
> > > scsi_cmd *srb, struct us_data *us)
> > >         int dir_in;
> > >         int actlen, data_actlen;
> > >         unsigned int pipe, pipein, pipeout;
> > > +#if 0
> > >         ALLOC_CACHE_ALIGN_BUFFER(struct umass_bbb_csw, csw, 1);
> > > +#else
> > > +       struct umass_bbb_csw *csw_org, *csw;
> > > +       csw_org = malloc(0x10000 + UMASS_BBB_CSW_SIZE);
> > > +       csw = (struct umass_bbb_csw *)roundup((ulong)csw_org,
> 0x10000);
> > > +       csw = (struct umass_bbb_csw *)((ulong)csw - 2);
> > > +       printf("csw org %p, adjusted to %p\n", csw_org, csw); #endif
> > >  #ifdef BBB_XPORT_TRACE
> > >         unsigned char *ptr;
> > >         int index;
> > > @@ -824,6 +832,7 @@ again:
> > >                 return USB_STOR_TRANSPORT_FAILED;
> > >         }
> > >
> > > +       free(csw_org);
> > >         return result;
> > >  }
> > >
> >
> > Issue cannot be reproduced on mass storage device with above hacking:
> 
> Thank you for the testing.
> 
> > =>
> > resetting USB...
> > Bus usb3 at 3100000: Register 200017f NbrPorts 2 Starting the controller
> > USB XHCI 1.00 Bus usb3 at 3110000: Register 200017f NbrPorts 2 Starting
> > the controller USB XHCI 1.00 scanning bus usb3 at 3100000 for devices...
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 13
> > record_transfer_result():comp_code: 13
> > record_transfer_result():comp_code: 13
> > record_transfer_result():comp_code: 13
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb53010, adjusted to 00000000fbb5fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb53010, adjusted to 00000000fbb5fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb53010, adjusted to 00000000fbb5fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > 2 USB Device(s) found
> > scanning bus usb3 at 3110000 for devices... 1 USB Device(s) found
> >        scanning usb for storage devices... 1 Storage Device(s) found
> > =>
> >
> > One more thing I'd like to tell is that I found this issue would not happened
> with 'usb start' (even with USB dongle).
> >
> > Below is the log I tested with ' usb read 0x82000000 0 300000', issue
> > could not be reproduced for at least 10 minutes ...
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > csw org 00000000fbb4ec90, adjusted to 00000000fbb4fffe
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> > record_transfer_result():comp_code: 1
> 
> In the earlier log you sent, you have the following:
> 
> dev=00000000fbb4f3c0, pipe=c0010283, buffer=00000000fbb4fd80,
> length=2048----------------------------buffer would cross 64KB boundary, so we will
> send request in more than 1 TRB, this is the key issue trigger condition
> xhci_bulk_tx()#0.1.running_total:0x280
> xhci_bulk_tx()#0.2.trb_buff_len:0x280
> xhci_bulk_tx()#0.3.running_total:0x280
> xhci_bulk_tx()#0.4.num_trbs:0x2--------------------------2 Transfer TRB
> xhci_bulk_tx()#0.5.running_total:0x10280
> xhci_bulk_tx()#0.start_trb:0x00000000fbb47140
> ----------xhci_bulk_tx()#0.&ring->enqueue->generic:0x00000000fbb47140---------
> -Assemble
> 1st Transfer TRB
> xhci_bulk_tx()#0.addr:0xfbb4fd80
> xhci_bulk_tx()#0.trb_buff_len:0x280
> xhci_bulk_tx()#0.running_total:0x280
> xhci_bulk_tx()#0.length:0x800
> xhci_bulk_tx()#0.TRB_MAX_BUFF_SIZE:0x10000
> ----------xhci_bulk_tx()#0.&ring->enqueue->generic:0x00000000fbb47150---------
> -Assemble
> 2nd Transfer TRB
> xhci_bulk_tx()#0.addr:0xfbb50000
> xhci_bulk_tx()#0.trb_buff_len:0x580
> xhci_bulk_tx()#0.running_total:0x800
> xhci_bulk_tx()#0.length:0x800
> xhci_bulk_tx()#0.TRB_MAX_BUFF_SIZE:0x10000
> 
> Could you please specify where this output is for?

All this prints is within function xhci_bulk_tx(),

Let me open those verbose output and check if that crossing 64KB case has been triggered or not.
But I have to get back to you later (tomorrow).

Regards,
Ran

> "xhci_bulk_tx()#0.length:0x800"
> 
> Regards,
> Bin


More information about the U-Boot mailing list