Hi,
 
We are using TDI based High speed USB EHCI controller.
Linux version is 2.6.12

I think that I found the problem with reuse ITD structures in the file
ehci-sched.c
The scenario that the problem happens is the following:

We have High speed device with ISO endpoint, maxPktSize=1024 and
Interval = 1 uframe
Now Host test application (we using usbtest.ko with testusb.c) sending 
for example 10 URBs one after other.
They will using 10 ITDs and will be put on periodic scheduler structure
in the following way.

Frame X:           -> itd7 -> itd6 -> itd5 -> itd4 -> itd3 -> itd2 ->
itd1 -> itd0 -> NULL
Frame X+1:       -> itd9 -> itd8 -> NULL

So itd0 will be sent on uframe 0 of Frame X, itd1 on uframe 1 of Frame
X, itd8 on uframe 0 of Frame X+1, itd9 on uframe 1 of Frame X+1, etc.

Now assume itd0 was sent, so function itd_complete was called and itd0
will moved to stream->free_list, 
but itd1 still point to itd0 by hw_next field of struct ehci_itd 

Now exactly after that test application will send new URB. 
Function itd_submit() and itd_urb_transaction() will be called.

Function itd_urb_transaction() first will try get ehci_itd structure
from the free_list and will get itd0.
Other functions will set all needed fields of ehci_itd structure and
will link itd0 to Frame X+1 list.

Frame X+1:       -> itd0 -> itd9 -> itd8 -> NULL

So itd0 should be sent on uframe 3 of Frame X+1.

But HW still process uframe 2 of Frame X. When HW will process uframe 3
of Frame X the itd2 will be send first and in the same uframe itd 0 will
be sent because itd0 still linked to itd1 in Frame X.

On Frame X+1 itd0 will not be sent because it was sent on Frame X.

It cause on miss-ordering of data sending and to bandwidth violations.

I am not familiar enough with all corners of EHCI periodic scheduling, 
but it looks dangerous to unlink ehci_itd structure from Frame X list
(change hw_next field) while the hardware still working on Frame X list.

I see few possible solutions:

1. Don't move ehci_itd structure to stream->free_list during
itd_complete function immediately, 
move all ehci_itd structures linked to Frame X list only when HW will
start to process Frame X+1.

2. In the itd_complete function move ehci_itd structure to the tail of
stream->free_list 
and in the itd_urb_transaction() function before reusing of ehci_itd
structure from 
the stream->free_list check if HW already finished to process the frame
that 
ehci_itd structure was linked before (itd->frame).

I will be glad to hear about other possible solutions.
Maybe somebody already meet the problem and there is patch for it.

Thanks
Dima
 
Dmitri Epshtein - Software engineer
Marvell Semiconductor Israel Ltd
6 Hamada Street 
Mordot HaCarmel Industrial Park
Yokneam 20692, ISRAEL
Email - [EMAIL PROTECTED]
Tel - + 972 4 9091455 
Fax - + 972 4 9091501
WWW Page: http://www.marvell.com 

This message may contain confidential, proprietary or legally privileged
information. The information is intended only for the use of the
individual or entity named above. If the reader of this message is not
the
intended recipient, you are hereby notified that any dissemination,
distribution or copying of this communication is strictly prohibited. If
you have received this communication in error, please notify us
immediately by telephone, or by e-mail and delete the message from your
computer.


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid3432&bid#0486&dat1642
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

Reply via email to