From patchwork Thu Mar 21 17:04:59 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Soeren Moch X-Patchwork-Id: 2315721 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) by patchwork2.kernel.org (Postfix) with ESMTP id 22446DF264 for ; Thu, 21 Mar 2013 17:09:40 +0000 (UTC) Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1UIiwj-0006p6-Cn; Thu, 21 Mar 2013 17:06:34 +0000 Received: from mout.web.de ([212.227.17.12]) by merlin.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1UIiwR-0006mF-2h for linux-arm-kernel@lists.infradead.org; Thu, 21 Mar 2013 17:06:16 +0000 Received: from [192.168.43.12] ([89.204.139.253]) by smtp.web.de (mrweb002) with ESMTPSA (Nemesis) id 0MI6F4-1UH3yF3KO6-004F3v; Thu, 21 Mar 2013 18:05:28 +0100 Message-ID: <514B3DBB.3060302@web.de> Date: Thu, 21 Mar 2013 18:04:59 +0100 From: Soeren Moch User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/20130308 Thunderbird/17.0.4 MIME-Version: 1.0 To: Alan Stern Subject: Re: [PATCH] USB: EHCI: fix for leaking isochronous data References: In-Reply-To: X-Provags-ID: V02:K0:yHkXVBl150mmsQB7SFZmNOjcHcaEffDLXXRLatz36zC 26sby/zTJuqexNOtcloqRAYKdpy3LnQEprSYIFXvYlcpqVA3mw AaFKNqfRmmMwFuwmCsGNq670gqMgyOBMB8N2smQatM59vgN2Am MuIQbs7jqZ+IPqCt9aLV2c4O3SWT2HRt/MSdMHrvvobIJr9Dac fw1NrAyVSEwZnXiTqtKnQ== X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20130321_130615_490334_34A8CD72 X-CRM114-Status: GOOD ( 20.46 ) X-Spam-Score: -4.4 (----) X-Spam-Report: SpamAssassin version 3.3.2 on merlin.infradead.org summary: Content analysis details: (-4.4 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [212.227.17.12 listed in list.dnswl.org] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (smoch[at]web.de) -2.5 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] Cc: Andrew Lunn , Jason Cooper , Arnd Bergmann , USB list , Kernel development list , linux-mm@kvack.org, michael@amarulasolutions.com, linux-arm-kernel@lists.infradead.org, Sebastian Hesselbarth X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org On 03/17/13 18:36, Alan Stern wrote: > On Sun, 17 Mar 2013, Soeren Moch wrote: > >> For each device only one isochronous endpoint is used (EP IN4, 1x 940 >> Bytes, Interval 1). >> When the ENOMEM error occurs, a huge number of iTDs is in the free_list >> of one stream. This number is much higher than the 2*M entries, which >> should be there according to your description. > > Okay, but how did they get there? With each URB requiring 9 iTDs, and > about 5 URBs active at any time, there should be about 5*9 = 45 iTDs in > use and 2*9 = 18 iTDs on the free list. By the time each URB > completes, it should have released all 9 iTDs back to the free list, > and each time an URB is submitted, it should be able to acquire all 9 > of the iTDs that it needs from the free list -- it shouldn't have to > allocate any from the DMA pool. > > Looks like you'll have to investigate what's going on inside > itd_urb_transaction(). Print out some useful information whenever the > size of stream->free_list is above 50, such as the value of num_itds, > how many of the loop iterations could get an iTD from the free list, > and the value of itd->frame in the case where the "goto alloc_itd" > statement is followed. > > It might be a good idea also to print out the size of the free list in > itd_complete(), where it calls ehci_urb_done(), and include the value > of ehci->now_frame. > Now I found out what is going on here: In itd_urb_transaction() we allocate 9 iTDs for each URB with number_of_packets == 64 in my case. The iTDs are added to sched->td_list. For a frame-aligned scheduling we need 8 iTDs, the 9th one is released back to the front of the streams free_list in iso_sched_free(). This iTD was cleared after allocation and has a frame number of 0 now. So for each allocation when now_frame == 0 we allocate from the dma_pool, not from the free_list. The attached patch invalidates the frame number in each iTD before it is sent to the scheduler. This fixes the problem without the need to iterate over a iTD list. Signed-off-by: Soeren Moch --- linux-3.9.0-rc3-guru/drivers/usb/host/ehci-sched.c.orig 2013-03-21 17:36:21.000000000 +0100 +++ linux-3.9.0-rc3-guru/drivers/usb/host/ehci-sched.c 2013-03-21 17:38:56.000000000 +0100 @@ -1214,6 +1214,7 @@ itd_urb_transaction ( memset (itd, 0, sizeof *itd); itd->itd_dma = itd_dma; + itd->frame = -1; list_add (&itd->itd_list, &sched->td_list); } spin_unlock_irqrestore (&ehci->lock, flags); @@ -1915,6 +1916,7 @@ sitd_urb_transaction ( memset (sitd, 0, sizeof *sitd); sitd->sitd_dma = sitd_dma; + sitd->frame = -1; list_add (&sitd->sitd_list, &iso_sched->td_list); }