Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Thinh Nguyen 405ac24a0a usb: gadget: f_mass_storage: Serialize wake and sleep execution ... commit dc9217b69d upstream. f_mass_storage has a memorry barrier issue with the sleep and wake functions that can cause a deadlock. This results in intermittent hangs during MSC file transfer. The host will reset the device after receiving no response to resume the transfer. This issue is seen when dwc3 is processing 2 transfer-in-progress events at the same time, invoking completion handlers for CSW and CBW. Also this issue occurs depending on the system timing and latency. To increase the chance to hit this issue, you can force dwc3 driver to wait and process those 2 events at once by adding a small delay (~100us) in dwc3_check_event_buf() whenever the request is for CSW and read the event count again. Avoid debugging with printk and ftrace as extra delays and memory barrier will mask this issue. Scenario which can lead to failure: ----------------------------------- 1) The main thread sleeps and waits for the next command in get_next_command(). 2) bulk_in_complete() wakes up main thread for CSW. 3) bulk_out_complete() tries to wake up the running main thread for CBW. 4) thread_wakeup_needed is not loaded with correct value in sleep_thread(). 5) Main thread goes to sleep again. The pattern is shown below. Note the 2 critical variables. * common->thread_wakeup_needed * bh->state CPU 0 (sleep_thread) CPU 1 (wakeup_thread) ============================== =============================== bh->state = BH_STATE_FULL; smp_wmb(); thread_wakeup_needed = 0; thread_wakeup_needed = 1; smp_rmb(); if (bh->state != BH_STATE_FULL) sleep again ... As pointed out by Alan Stern, this is an R-pattern issue. The issue can be seen when there are two wakeups in quick succession. The thread_wakeup_needed can be overwritten in sleep_thread, and the read of the bh->state maybe reordered before the write to thread_wakeup_needed. This patch applies full memory barrier smp_mb() in both sleep_thread() and wakeup_thread() to ensure the order which the thread_wakeup_needed and bh->state are written and loaded. However, a better solution in the future would be to use wait_queue method that takes care of managing memory barrier between waker and waiter. Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Thinh Nguyen <thinhn@synopsys.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2017-06-14 15:05:58 +02:00
..
function	usb: gadget: f_mass_storage: Serialize wake and sleep execution	2017-06-14 15:05:58 +02:00
legacy	USB: gadgetfs: fix checks of wTotalLength in config descriptors	2017-01-12 11:39:10 +01:00
udc	usb: gadget: udc: atmel: remove memory leak	2017-03-22 12:43:39 +01:00
composite.c	usb: gadget: composite: always set ep->mult to a sensible value	2017-01-12 11:39:46 +01:00
config.c	usb: Use (foo *) instead of (foo*).	2016-06-21 11:16:15 +03:00
configfs.c	usb: gadget: configfs: log function unbinding as debug	2016-08-31 10:06:05 +03:00
configfs.h	usb: gadget: OS descriptors: provide interface directory names	2014-06-19 10:06:48 -05:00
epautoconf.c	usb: gadget: epautoconf: add usb_ep_autoconfig_release() function	2015-09-27 10:54:31 -05:00
functions.c	usb: gadget: add a forward pointer from usb_function to its "instance"	2013-01-21 20:52:46 +02:00
Kconfig	usb: gadget: legacy gadgets are optional	2017-05-20 14:28:35 +02:00
Makefile	usb: gadget: use $(srctree) instead of $(PWD) for includes	2014-08-29 15:53:46 -05:00
u_f.c	usb: gadget: remove useless parameter in alloc_ep_req()	2016-08-25 12:13:19 +03:00
u_f.h	usb: gadget: remove useless parameter in alloc_ep_req()	2016-08-25 12:13:19 +03:00
u_os_desc.h	usb: gadget: u_os_desc: helper functions for accessing ext prop buffer	2014-07-10 08:36:51 -05:00
usbstring.c	usb: delete non-required instances of include <linux/init.h>	2014-01-08 15:01:39 -08:00