Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

32 messages, 7 authors, 2021-09-02 · open the first message on its own page

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Felipe Balbi <balbi@kernel.org>
Date: 2021-07-23 11:23:55

Ferry Toth [off-list ref] writes:
Hi

Op 23-07-2021 om 08:59 schreef Felipe Balbi:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
kernel: configfs-gadget gadget: u_audio_start_playback:451 Error!
kernel: configfs-gadget gadget: u_audio_start_playback:451 Error!
kernel: dwc3 dwc3.0.auto: request 00000000fbc71244 was not queued to ep5in
kernel: dwc3 dwc3.0.auto: request 00000000ad1b8c18 was not queued to ep5in
kernel: dwc3 dwc3.0.auto: Fifosize(2154) > RAM size(2022) ep5in
depth:115540359
kernel: configfs-gadget gadget: u_audio_start_playback:451 Error!
kernel: configfs-gadget gadget: u_audio_start_playback:451 Error!
kernel: dwc3 dwc3.0.auto: request 000000003c32dcc5 was not queued to ep5in
kernel: dwc3 dwc3.0.auto: request 00000000b2512aa9 was not queued to ep5in

Removing uac2 from the config makes the call trace go away, but the R/W
speed does not change.
I am testing with 5.14.0-rc2 and now related error appears (not in rc1).
Disabling uac2 solves it still. Any idea what it could be?

BUG: unable to handle page fault for address: 0000000500000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 0 P4D 0
Oops: 0010 [#1] SMP PTI
CPU: 0 PID: 494 Comm: irq/14-dwc3 Not tainted
5.14.0-rc2-edison-acpi-standard #1
(cool that you're running on ACPI heh)
Thanks to Andy this is Edison-Arduino board with ACPI.
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 00000000001006f0
Call Trace:
   ? dwc3_remove_requests.constprop.0+0x14d/0x170
   ? __dwc3_gadget_ep_disable+0x7a/0x160
   ? dwc3_gadget_ep_disable+0x3d/0xd0
   ? usb_ep_disable+0x1c/0x
   ? u_audio_stop_capture+0x79/0x120 [u_audio]
   ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
   ? composite_setup+0x224/0x1b90 [libcomposite]
   ? __dwc3_gadget_kick_transfer+0x160/0x400
   ? dwc3_gadget_ep_queue+0xf3/0x1a0
   ? configfs_composite_setup+0x6b/0x90 [libcomposite]
   ? configfs_composite_setup+0x6b/0x90 [libcomposite]
   ? dwc3_ep0_interrupt+0x459/0xa40
   ? dwc3_thread_interrupt+0x8ee/0xf40
   ? __schedule+0x235/0x6c0
   ? disable_irq_nosync+0x10/0x10
   ? irq_thread_fn+0x1b/0x60
   ? irq_thread+0xc0/0x160
   ? irq_thread_check_affinity+0x70/0x70
   ? irq_forced_thread_fn+0x70/0x70
   ? kthread+0x122/0x140
   ? set_kthread_struct+0x40/0x40
   ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in host mode 
and then switch to device mode. If so I can enable traces and collect as 
you explained me before.

I'll try before monday, as then I fly for a holiday and will not be 
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

you need ftrace_dump_on_oops=1 and also need the correct options on
trace_buf_size and trace_event.

-- 
balbi

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Ferry Toth <hidden>
Date: 2021-07-24 20:59:43

Hi,

Op 23-07-2021 om 13:23 schreef Felipe Balbi:
Ferry Toth [off-list ref] writes:
quoted
Hi

Op 23-07-2021 om 08:59 schreef Felipe Balbi:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
kernel: configfs-gadget gadget: u_audio_start_playback:451 Error!
kernel: configfs-gadget gadget: u_audio_start_playback:451 Error!
kernel: dwc3 dwc3.0.auto: request 00000000fbc71244 was not queued to ep5in
kernel: dwc3 dwc3.0.auto: request 00000000ad1b8c18 was not queued to ep5in
kernel: dwc3 dwc3.0.auto: Fifosize(2154) > RAM size(2022) ep5in
depth:115540359
kernel: configfs-gadget gadget: u_audio_start_playback:451 Error!
kernel: configfs-gadget gadget: u_audio_start_playback:451 Error!
kernel: dwc3 dwc3.0.auto: request 000000003c32dcc5 was not queued to ep5in
kernel: dwc3 dwc3.0.auto: request 00000000b2512aa9 was not queued to ep5in

Removing uac2 from the config makes the call trace go away, but the R/W
speed does not change.
I am testing with 5.14.0-rc2 and now related error appears (not in rc1).
Disabling uac2 solves it still. Any idea what it could be?

BUG: unable to handle page fault for address: 0000000500000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 0 P4D 0
Oops: 0010 [#1] SMP PTI
CPU: 0 PID: 494 Comm: irq/14-dwc3 Not tainted
5.14.0-rc2-edison-acpi-standard #1
(cool that you're running on ACPI heh)
Thanks to Andy this is Edison-Arduino board with ACPI.
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 00000000001006f0
Call Trace:
    ? dwc3_remove_requests.constprop.0+0x14d/0x170
    ? __dwc3_gadget_ep_disable+0x7a/0x160
    ? dwc3_gadget_ep_disable+0x3d/0xd0
    ? usb_ep_disable+0x1c/0x
    ? u_audio_stop_capture+0x79/0x120 [u_audio]
    ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
    ? composite_setup+0x224/0x1b90 [libcomposite]
    ? __dwc3_gadget_kick_transfer+0x160/0x400
    ? dwc3_gadget_ep_queue+0xf3/0x1a0
    ? configfs_composite_setup+0x6b/0x90 [libcomposite]
    ? configfs_composite_setup+0x6b/0x90 [libcomposite]
    ? dwc3_ep0_interrupt+0x459/0xa40
    ? dwc3_thread_interrupt+0x8ee/0xf40
    ? __schedule+0x235/0x6c0
    ? disable_irq_nosync+0x10/0x10
    ? irq_thread_fn+0x1b/0x60
    ? irq_thread+0xc0/0x160
    ? irq_thread_check_affinity+0x70/0x70
    ? irq_forced_thread_fn+0x70/0x70
    ? kthread+0x122/0x140
    ? set_kthread_struct+0x40/0x40
    ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in host mode
and then switch to device mode. If so I can enable traces and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

you need ftrace_dump_on_oops=1 and also need the correct options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after which udev 
triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs  <https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs>

Unfortunately the kernel crashes so badly I can not get to the ` cp 
/t/trace /root/trace.txt` line (after a while the watchdog kicks).

What to do next?


BTW there is a secondary problem not related to dwc3: the console is not 
working well and loosing chars. I can connect through wifi/ssh though.

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Andy Shevchenko <hidden>
Date: 2021-07-24 21:20:03

On Sat, Jul 24, 2021 at 11:59 PM Ferry Toth [off-list ref] wrote:
BTW there is a secondary problem not related to dwc3: the console is not
working well and loosing chars. I can connect through wifi/ssh though.
You mean even on the kernel before any crash happened due to DWC3 stuff?

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Ferry Toth <hidden>
Date: 2021-07-24 22:56:31

Hi

Op 24-07-2021 om 23:19 schreef Andy Shevchenko:
On Sat, Jul 24, 2021 at 11:59 PM Ferry Toth[off-list ref]  wrote:
quoted
BTW there is a secondary problem not related to dwc3: the console is not
working well and loosing chars. I can connect through wifi/ssh though.
You mean even on the kernel before any crash happened due to DWC3 stuff?
Exactly.

And this was working fine with rc1.

I do have patches (as you know) for improving dma for the hsu. But, for 
the console afaik dma is disabled.

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Felipe Balbi <balbi@kernel.org>
Date: 2021-07-25 06:06:08

Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 00000000001006f0
Call Trace:
    ? dwc3_remove_requests.constprop.0+0x14d/0x170
    ? __dwc3_gadget_ep_disable+0x7a/0x160
    ? dwc3_gadget_ep_disable+0x3d/0xd0
    ? usb_ep_disable+0x1c/0x
    ? u_audio_stop_capture+0x79/0x120 [u_audio]
    ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
    ? composite_setup+0x224/0x1b90 [libcomposite]
    ? __dwc3_gadget_kick_transfer+0x160/0x400
    ? dwc3_gadget_ep_queue+0xf3/0x1a0
    ? configfs_composite_setup+0x6b/0x90 [libcomposite]
    ? configfs_composite_setup+0x6b/0x90 [libcomposite]
    ? dwc3_ep0_interrupt+0x459/0xa40
    ? dwc3_thread_interrupt+0x8ee/0xf40
    ? __schedule+0x235/0x6c0
    ? disable_irq_nosync+0x10/0x10
    ? irq_thread_fn+0x1b/0x60
    ? irq_thread+0xc0/0x160
    ? irq_thread_check_affinity+0x70/0x70
    ? irq_forced_thread_fn+0x70/0x70
    ? kthread+0x122/0x140
    ? set_kthread_struct+0x40/0x40
    ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in host mode
and then switch to device mode. If so I can enable traces and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

you need ftrace_dump_on_oops=1 and also need the correct options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs  <https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs>

Unfortunately the kernel crashes so badly I can not get to the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.

-- 
balbi

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Ferry Toth <hidden>
Date: 2021-07-25 13:33:01

Hi

Op 25-07-2021 om 08:05 schreef Felipe Balbi:
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 00000000001006f0
Call Trace:
     ? dwc3_remove_requests.constprop.0+0x14d/0x170
     ? __dwc3_gadget_ep_disable+0x7a/0x160
     ? dwc3_gadget_ep_disable+0x3d/0xd0
     ? usb_ep_disable+0x1c/0x
     ? u_audio_stop_capture+0x79/0x120 [u_audio]
     ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
     ? composite_setup+0x224/0x1b90 [libcomposite]
     ? __dwc3_gadget_kick_transfer+0x160/0x400
     ? dwc3_gadget_ep_queue+0xf3/0x1a0
     ? configfs_composite_setup+0x6b/0x90 [libcomposite]
     ? configfs_composite_setup+0x6b/0x90 [libcomposite]
     ? dwc3_ep0_interrupt+0x459/0xa40
     ? dwc3_thread_interrupt+0x8ee/0xf40
     ? __schedule+0x235/0x6c0
     ? disable_irq_nosync+0x10/0x10
     ? irq_thread_fn+0x1b/0x60
     ? irq_thread+0xc0/0x160
     ? irq_thread_check_affinity+0x70/0x70
     ? irq_forced_thread_fn+0x70/0x70
     ? kthread+0x122/0x140
     ? set_kthread_struct+0x40/0x40
     ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in host mode
and then switch to device mode. If so I can enable traces and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

you need ftrace_dump_on_oops=1 and also need the correct options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs  <https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs>

Unfortunately the kernel crashes so badly I can not get to the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to console 
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Felipe Balbi <balbi@kernel.org>
Date: 2021-07-25 14:05:51

Hi,

Ferry Toth [off-list ref] writes:
Hi

Op 25-07-2021 om 08:05 schreef Felipe Balbi:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 00000000001006f0
Call Trace:
     ? dwc3_remove_requests.constprop.0+0x14d/0x170
     ? __dwc3_gadget_ep_disable+0x7a/0x160
     ? dwc3_gadget_ep_disable+0x3d/0xd0
     ? usb_ep_disable+0x1c/0x
     ? u_audio_stop_capture+0x79/0x120 [u_audio]
     ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
     ? composite_setup+0x224/0x1b90 [libcomposite]
     ? __dwc3_gadget_kick_transfer+0x160/0x400
     ? dwc3_gadget_ep_queue+0xf3/0x1a0
     ? configfs_composite_setup+0x6b/0x90 [libcomposite]
     ? configfs_composite_setup+0x6b/0x90 [libcomposite]
     ? dwc3_ep0_interrupt+0x459/0xa40
     ? dwc3_thread_interrupt+0x8ee/0xf40
     ? __schedule+0x235/0x6c0
     ? disable_irq_nosync+0x10/0x10
     ? irq_thread_fn+0x1b/0x60
     ? irq_thread+0xc0/0x160
     ? irq_thread_check_affinity+0x70/0x70
     ? irq_forced_thread_fn+0x70/0x70
     ? kthread+0x122/0x140
     ? set_kthread_struct+0x40/0x40
     ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in host mode
and then switch to device mode. If so I can enable traces and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

you need ftrace_dump_on_oops=1 and also need the correct options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs  <https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs>

Unfortunately the kernel crashes so badly I can not get to the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every endpoint
that's disabled. I'll take a guess and assume we're failing at the last
Set Interface, that means we should have something odd with ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI ==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   75.857360] irq/14-d-596       0d... 42789204us : dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI ==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   75.879244] irq/14-d-596       0d... 42789209us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> -115
[   76.308278] kworker/-23        0d... 42789695us : dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] params 00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   76.523315] irq/14-d-596       0d... 42789854us : dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   76.576937] irq/14-d-596       0d... 42789861us : dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0] (Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0] (Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 36/36 ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0] (Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to tell us which
endpoint is being processed? Then we'll know for sure which one caused
the crash.

-- 
balbi

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Ferry Toth <hidden>
Date: 2021-07-25 16:54:34

Hi

Op 25-07-2021 om 16:05 schreef Felipe Balbi:
Hi,

Ferry Toth [off-list ref] writes:
quoted
Hi

Op 25-07-2021 om 08:05 schreef Felipe Balbi:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 00000000001006f0
Call Trace:
      ? dwc3_remove_requests.constprop.0+0x14d/0x170
      ? __dwc3_gadget_ep_disable+0x7a/0x160
      ? dwc3_gadget_ep_disable+0x3d/0xd0
      ? usb_ep_disable+0x1c/0x
      ? u_audio_stop_capture+0x79/0x120 [u_audio]
      ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
      ? composite_setup+0x224/0x1b90 [libcomposite]
      ? __dwc3_gadget_kick_transfer+0x160/0x400
      ? dwc3_gadget_ep_queue+0xf3/0x1a0
      ? configfs_composite_setup+0x6b/0x90 [libcomposite]
      ? configfs_composite_setup+0x6b/0x90 [libcomposite]
      ? dwc3_ep0_interrupt+0x459/0xa40
      ? dwc3_thread_interrupt+0x8ee/0xf40
      ? __schedule+0x235/0x6c0
      ? disable_irq_nosync+0x10/0x10
      ? irq_thread_fn+0x1b/0x60
      ? irq_thread+0xc0/0x160
      ? irq_thread_check_affinity+0x70/0x70
      ? irq_forced_thread_fn+0x70/0x70
      ? kthread+0x122/0x140
      ? set_kthread_struct+0x40/0x40
      ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in host mode
and then switch to device mode. If so I can enable traces and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

you need ftrace_dump_on_oops=1 and also need the correct options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs  <https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs>

Unfortunately the kernel crashes so badly I can not get to the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every endpoint
that's disabled. I'll take a guess and assume we're failing at the last
Set Interface, that means we should have something odd with ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI ==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   75.857360] irq/14-d-596       0d... 42789204us : dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI ==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   75.879244] irq/14-d-596       0d... 42789209us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> -115
[   76.308278] kworker/-23        0d... 42789695us : dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] params 00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   76.523315] irq/14-d-596       0d... 42789854us : dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   76.576937] irq/14-d-596       0d... 42789861us : dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0] (Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0] (Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 36/36 ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0] (Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to tell us which
endpoint is being processed? Then we'll know for sure which one caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time until 6 aug.

But as I am using configfs (excerpt follows) and just disabling the last 
2 line resolves the issue, I'm guessing uac2 is the issue. Or exceeding 
the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Felipe Balbi <balbi@kernel.org>
Date: 2021-07-26 05:58:09

Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 00000000001006f0
Call Trace:
      ? dwc3_remove_requests.constprop.0+0x14d/0x170
      ? __dwc3_gadget_ep_disable+0x7a/0x160
      ? dwc3_gadget_ep_disable+0x3d/0xd0
      ? usb_ep_disable+0x1c/0x
      ? u_audio_stop_capture+0x79/0x120 [u_audio]
      ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
      ? composite_setup+0x224/0x1b90 [libcomposite]
      ? __dwc3_gadget_kick_transfer+0x160/0x400
      ? dwc3_gadget_ep_queue+0xf3/0x1a0
      ? configfs_composite_setup+0x6b/0x90 [libcomposite]
      ? configfs_composite_setup+0x6b/0x90 [libcomposite]
      ? dwc3_ep0_interrupt+0x459/0xa40
      ? dwc3_thread_interrupt+0x8ee/0xf40
      ? __schedule+0x235/0x6c0
      ? disable_irq_nosync+0x10/0x10
      ? irq_thread_fn+0x1b/0x60
      ? irq_thread+0xc0/0x160
      ? irq_thread_check_affinity+0x70/0x70
      ? irq_forced_thread_fn+0x70/0x70
      ? kthread+0x122/0x140
      ? set_kthread_struct+0x40/0x40
      ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in host mode
and then switch to device mode. If so I can enable traces and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

you need ftrace_dump_on_oops=1 and also need the correct options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs  <https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs>

Unfortunately the kernel crashes so badly I can not get to the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every endpoint
that's disabled. I'll take a guess and assume we're failing at the last
Set Interface, that means we should have something odd with ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI ==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   75.857360] irq/14-d-596       0d... 42789204us : dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI ==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   75.879244] irq/14-d-596       0d... 42789209us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> -115
[   76.308278] kworker/-23        0d... 42789695us : dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] params 00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   76.523315] irq/14-d-596       0d... 42789854us : dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   76.576937] irq/14-d-596       0d... 42789861us : dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0] (Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0] (Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 36/36 ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0] (Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to tell us which
endpoint is being processed? Then we'll know for sure which one caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time until 6 aug.
not a problem, we'll still be here when you're back :-)
But as I am using configfs (excerpt follows) and just disabling the
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
Right, either there's an actual bug in uac2, or we're running out of
FIFO space.

-- 
balbi

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Wesley Cheng <hidden>
Date: 2021-07-26 14:34:08

Hi Ferry,

On 7/25/2021 10:57 PM, Felipe Balbi wrote:
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 00000000001006f0
Call Trace:
      ? dwc3_remove_requests.constprop.0+0x14d/0x170
      ? __dwc3_gadget_ep_disable+0x7a/0x160
      ? dwc3_gadget_ep_disable+0x3d/0xd0
      ? usb_ep_disable+0x1c/0x
      ? u_audio_stop_capture+0x79/0x120 [u_audio]
      ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
      ? composite_setup+0x224/0x1b90 [libcomposite]
      ? __dwc3_gadget_kick_transfer+0x160/0x400
      ? dwc3_gadget_ep_queue+0xf3/0x1a0
      ? configfs_composite_setup+0x6b/0x90 [libcomposite]
      ? configfs_composite_setup+0x6b/0x90 [libcomposite]
      ? dwc3_ep0_interrupt+0x459/0xa40
      ? dwc3_thread_interrupt+0x8ee/0xf40
      ? __schedule+0x235/0x6c0
      ? disable_irq_nosync+0x10/0x10
      ? irq_thread_fn+0x1b/0x60
      ? irq_thread+0xc0/0x160
      ? irq_thread_check_affinity+0x70/0x70
      ? irq_forced_thread_fn+0x70/0x70
      ? kthread+0x122/0x140
      ? set_kthread_struct+0x40/0x40
      ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in host mode
and then switch to device mode. If so I can enable traces and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

you need ftrace_dump_on_oops=1 and also need the correct options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs  <https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs>

Unfortunately the kernel crashes so badly I can not get to the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every endpoint
that's disabled. I'll take a guess and assume we're failing at the last
Set Interface, that means we should have something odd with ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI ==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   75.857360] irq/14-d-596       0d... 42789204us : dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI ==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   75.879244] irq/14-d-596       0d... 42789209us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> -115
[   76.308278] kworker/-23        0d... 42789695us : dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] params 00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   76.523315] irq/14-d-596       0d... 42789854us : dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   76.576937] irq/14-d-596       0d... 42789861us : dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0] (Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0] (Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 36/36 ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0] (Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to tell us which
endpoint is being processed? Then we'll know for sure which one caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time until 6 aug.
not a problem, we'll still be here when you're back :-)
quoted
But as I am using configfs (excerpt follows) and just disabling the
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
Right, either there's an actual bug in uac2, or we're running out of
FIFO space.
Are you enabling the TXFIFO flag here again?  If we suspect that we're
running out of FIFO space, then:
- First, making sure we're explicitly enabling the TXFIFO resize flag.
- Second, we should see the same warning we saw previously:
	dwc3 dwc3.0.auto: Fifosize(2154) > RAM size(2022) ep5in
depth:115540359


Thanks
Wesley Cheng

-- 
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Ferry Toth <hidden>
Date: 2021-07-26 21:51:40

Hi

Op 26-07-2021 om 16:33 schreef Wesley Cheng:
Hi Ferry,

On 7/25/2021 10:57 PM, Felipe Balbi wrote:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 00000000001006f0
Call Trace:
       ? dwc3_remove_requests.constprop.0+0x14d/0x170
       ? __dwc3_gadget_ep_disable+0x7a/0x160
       ? dwc3_gadget_ep_disable+0x3d/0xd0
       ? usb_ep_disable+0x1c/0x
       ? u_audio_stop_capture+0x79/0x120 [u_audio]
       ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
       ? composite_setup+0x224/0x1b90 [libcomposite]
       ? __dwc3_gadget_kick_transfer+0x160/0x400
       ? dwc3_gadget_ep_queue+0xf3/0x1a0
       ? configfs_composite_setup+0x6b/0x90 [libcomposite]
       ? configfs_composite_setup+0x6b/0x90 [libcomposite]
       ? dwc3_ep0_interrupt+0x459/0xa40
       ? dwc3_thread_interrupt+0x8ee/0xf40
       ? __schedule+0x235/0x6c0
       ? disable_irq_nosync+0x10/0x10
       ? irq_thread_fn+0x1b/0x60
       ? irq_thread+0xc0/0x160
       ? irq_thread_check_affinity+0x70/0x70
       ? irq_forced_thread_fn+0x70/0x70
       ? kthread+0x122/0x140
       ? set_kthread_struct+0x40/0x40
       ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in host mode
and then switch to device mode. If so I can enable traces and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

you need ftrace_dump_on_oops=1 and also need the correct options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs  <https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs>

Unfortunately the kernel crashes so badly I can not get to the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every endpoint
that's disabled. I'll take a guess and assume we're failing at the last
Set Interface, that means we should have something odd with ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI ==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   75.857360] irq/14-d-596       0d... 42789204us : dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI ==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   75.879244] irq/14-d-596       0d... 42789209us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> -115
[   76.308278] kworker/-23        0d... 42789695us : dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] params 00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   76.523315] irq/14-d-596       0d... 42789854us : dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   76.576937] irq/14-d-596       0d... 42789861us : dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0] (Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0] (Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 36/36 ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0] (Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to tell us which
endpoint is being processed? Then we'll know for sure which one caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time until 6 aug.
not a problem, we'll still be here when you're back :-)
quoted
But as I am using configfs (excerpt follows) and just disabling the
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
Right, either there's an actual bug in uac2, or we're running out of
FIFO space.
Are you enabling the TXFIFO flag here again?  If we suspect that we're
running out of FIFO space, then:
- First, making sure we're explicitly enabling the TXFIFO resize flag.
- Second, we should see the same warning we saw previously:
	dwc3 dwc3.0.auto: Fifosize(2154) > RAM size(2022) ep5in
depth:115540359
No, I'm building using a Yocto recipe:
https://github.com/htot/meta-intel-edison/blob/gatesgarth/meta-intel-edison-bsp/recipes-kernel/linux/linux-yocto_5.14-rc2.bb

patches are line #64 and on, just one old dwc3 related (edison) patch.
Thanks
Wesley Cheng

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Ferry Toth <hidden>
Date: 2021-08-15 20:57:02

Hi,

Op 26-07-2021 om 07:57 schreef Felipe Balbi:
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 00000000001006f0
Call Trace:
       ? dwc3_remove_requests.constprop.0+0x14d/0x170
       ? __dwc3_gadget_ep_disable+0x7a/0x160
       ? dwc3_gadget_ep_disable+0x3d/0xd0
       ? usb_ep_disable+0x1c/0x
       ? u_audio_stop_capture+0x79/0x120 [u_audio]
       ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
       ? composite_setup+0x224/0x1b90 [libcomposite]
       ? __dwc3_gadget_kick_transfer+0x160/0x400
       ? dwc3_gadget_ep_queue+0xf3/0x1a0
       ? configfs_composite_setup+0x6b/0x90 [libcomposite]
       ? configfs_composite_setup+0x6b/0x90 [libcomposite]
       ? dwc3_ep0_interrupt+0x459/0xa40
       ? dwc3_thread_interrupt+0x8ee/0xf40
       ? __schedule+0x235/0x6c0
       ? disable_irq_nosync+0x10/0x10
       ? irq_thread_fn+0x1b/0x60
       ? irq_thread+0xc0/0x160
       ? irq_thread_check_affinity+0x70/0x70
       ? irq_forced_thread_fn+0x70/0x70
       ? kthread+0x122/0x140
       ? set_kthread_struct+0x40/0x40
       ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in host mode
and then switch to device mode. If so I can enable traces and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

you need ftrace_dump_on_oops=1 and also need the correct options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs  <https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs>

Unfortunately the kernel crashes so badly I can not get to the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every endpoint
that's disabled. I'll take a guess and assume we're failing at the last
Set Interface, that means we should have something odd with ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI ==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   75.857360] irq/14-d-596       0d... 42789204us : dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI ==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   75.879244] irq/14-d-596       0d... 42789209us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> -115
[   76.308278] kworker/-23        0d... 42789695us : dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] params 00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   76.523315] irq/14-d-596       0d... 42789854us : dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   76.576937] irq/14-d-596       0d... 42789861us : dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0] (Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0] (Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 36/36 ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0] (Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to tell us which
endpoint is being processed? Then we'll know for sure which one caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time until 6 aug.
not a problem, we'll still be here when you're back :-)
Well, let's go then :-)

To get back in the mood I have retested 5.13.0, 5.14.0-rc1, 5.14.0-rc2 
and 5.14.0-rc5.

I find that 5.13.0 works fine, and the issue starts from 5.14.0-rc1.

With 5.14.0-rc5 the problem seems worse (or different?), and just 
disabling uac2 gadget does not prevent the crash. Even disabling gser 
and mass_storage.usb0 as well there is still a crash.

Now I'm not sure how to proceed. Bisect rc1? Or focus on rc5 (rc6?)?
quoted
But as I am using configfs (excerpt follows) and just disabling the
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
Right, either there's an actual bug in uac2, or we're running out of
FIFO space.

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Felipe Balbi <balbi@kernel.org>
Date: 2021-08-16 05:22:04

Hi,

Ferry Toth [off-list ref] writes:
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 00000000001006f0
Call Trace:
       ? dwc3_remove_requests.constprop.0+0x14d/0x170
       ? __dwc3_gadget_ep_disable+0x7a/0x160
       ? dwc3_gadget_ep_disable+0x3d/0xd0
       ? usb_ep_disable+0x1c/0x
       ? u_audio_stop_capture+0x79/0x120 [u_audio]
       ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
       ? composite_setup+0x224/0x1b90 [libcomposite]
       ? __dwc3_gadget_kick_transfer+0x160/0x400
       ? dwc3_gadget_ep_queue+0xf3/0x1a0
       ? configfs_composite_setup+0x6b/0x90 [libcomposite]
       ? configfs_composite_setup+0x6b/0x90 [libcomposite]
       ? dwc3_ep0_interrupt+0x459/0xa40
       ? dwc3_thread_interrupt+0x8ee/0xf40
       ? __schedule+0x235/0x6c0
       ? disable_irq_nosync+0x10/0x10
       ? irq_thread_fn+0x1b/0x60
       ? irq_thread+0xc0/0x160
       ? irq_thread_check_affinity+0x70/0x70
       ? irq_forced_thread_fn+0x70/0x70
       ? kthread+0x122/0x140
       ? set_kthread_struct+0x40/0x40
       ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in host mode
and then switch to device mode. If so I can enable traces and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

you need ftrace_dump_on_oops=1 and also need the correct options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs  <https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs>

Unfortunately the kernel crashes so badly I can not get to the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every endpoint
that's disabled. I'll take a guess and assume we're failing at the last
Set Interface, that means we should have something odd with ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI ==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   75.857360] irq/14-d-596       0d... 42789204us : dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI ==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   75.879244] irq/14-d-596       0d... 42789209us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> -115
[   76.308278] kworker/-23        0d... 42789695us : dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] params 00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   76.523315] irq/14-d-596       0d... 42789854us : dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   76.576937] irq/14-d-596       0d... 42789861us : dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0] (Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0] (Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 36/36 ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0] (Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to tell us which
endpoint is being processed? Then we'll know for sure which one caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time until 6 aug.
not a problem, we'll still be here when you're back :-)
Well, let's go then :-)

To get back in the mood I have retested 5.13.0, 5.14.0-rc1, 5.14.0-rc2
and 5.14.0-rc5.

I find that 5.13.0 works fine, and the issue starts from 5.14.0-rc1.
That's great finding. We have a bisection point. There are a total of
13764 commits between v5.13 and v5.14-rc1

	$ git rev-list  --count v5.13..v5.14-rc1
	13764

git bisect should find the offending commit in at most 14 tries. That's
not too bad.
With 5.14.0-rc5 the problem seems worse (or different?), and just
disabling uac2 gadget does not prevent the crash. Even disabling gser 
and mass_storage.usb0 as well there is still a crash.

Now I'm not sure how to proceed. Bisect rc1? Or focus on rc5 (rc6?)?
I'd first bisect between 5.13 and v5.14-rc1. Once you find the offending
commit, verify if reverting that on -rc1 works, then verify if reverting
on -rc5 also works :-)

-- 
balbi

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Ferry Toth <hidden>
Date: 2021-08-17 22:00:21

Hi,

Op 16-08-2021 om 07:18 schreef Felipe Balbi:
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 00000000001006f0
Call Trace:
        ? dwc3_remove_requests.constprop.0+0x14d/0x170
        ? __dwc3_gadget_ep_disable+0x7a/0x160
        ? dwc3_gadget_ep_disable+0x3d/0xd0
        ? usb_ep_disable+0x1c/0x
        ? u_audio_stop_capture+0x79/0x120 [u_audio]
        ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
        ? composite_setup+0x224/0x1b90 [libcomposite]
        ? __dwc3_gadget_kick_transfer+0x160/0x400
        ? dwc3_gadget_ep_queue+0xf3/0x1a0
        ? configfs_composite_setup+0x6b/0x90 [libcomposite]
        ? configfs_composite_setup+0x6b/0x90 [libcomposite]
        ? dwc3_ep0_interrupt+0x459/0xa40
        ? dwc3_thread_interrupt+0x8ee/0xf40
        ? __schedule+0x235/0x6c0
        ? disable_irq_nosync+0x10/0x10
        ? irq_thread_fn+0x1b/0x60
        ? irq_thread+0xc0/0x160
        ? irq_thread_check_affinity+0x70/0x70
        ? irq_forced_thread_fn+0x70/0x70
        ? kthread+0x122/0x140
        ? set_kthread_struct+0x40/0x40
        ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in host mode
and then switch to device mode. If so I can enable traces and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

you need ftrace_dump_on_oops=1 and also need the correct options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs  <https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs>

Unfortunately the kernel crashes so badly I can not get to the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every endpoint
that's disabled. I'll take a guess and assume we're failing at the last
Set Interface, that means we should have something odd with ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI ==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   75.857360] irq/14-d-596       0d... 42789204us : dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI ==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   75.879244] irq/14-d-596       0d... 42789209us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> -115
[   76.308278] kworker/-23        0d... 42789695us : dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] params 00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   76.523315] irq/14-d-596       0d... 42789854us : dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 zsI ==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   76.576937] irq/14-d-596       0d... 42789861us : dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0] (Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0] (Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) [Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 36/36 ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0] (Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to tell us which
endpoint is being processed? Then we'll know for sure which one caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time until 6 aug.
not a problem, we'll still be here when you're back :-)
Well, let's go then :-)

To get back in the mood I have retested 5.13.0, 5.14.0-rc1, 5.14.0-rc2
and 5.14.0-rc5.

I find that 5.13.0 works fine, and the issue starts from 5.14.0-rc1.
That's great finding. We have a bisection point. There are a total of
13764 commits between v5.13 and v5.14-rc1

	$ git rev-list  --count v5.13..v5.14-rc1
	13764

git bisect should find the offending commit in at most 14 tries. That's
not too bad.
I correctly guesstimated that the problem got introduced by the usb 
merge 79160a60

"Merge tag 'usb-5.14-rc1' of 
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb"

116 commits(7 bisects).

24f779dac8f3efb9629adc0e486914d93dc45517 is the first bad commit

"usb: gadget: f_uac2/u_audio: add feedback endpoint support"

Ruslan's 3 patches are related to each other so I reverted all three 
24f779da...e89bb428 and applied the reverts to rc1.

I can confirm this indeed resolves the problem in rc1.

Is late now, tomorrow evening I will apply the reverts to rc6.
quoted
With 5.14.0-rc5 the problem seems worse (or different?), and just
disabling uac2 gadget does not prevent the crash. Even disabling gser
and mass_storage.usb0 as well there is still a crash.

Now I'm not sure how to proceed. Bisect rc1? Or focus on rc5 (rc6?)?
I'd first bisect between 5.13 and v5.14-rc1. Once you find the offending
commit, verify if reverting that on -rc1 works, then verify if reverting
on -rc5 also works :-)

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Ferry Toth <hidden>
Date: 2021-08-18 19:08:00

Hi,

Op 18-08-2021 om 00:00 schreef Ferry Toth:
Hi,

Op 16-08-2021 om 07:18 schreef Felipe Balbi:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, 
BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 
0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: 
ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 
0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: 
ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: 
ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) 
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 
00000000001006f0
Call Trace:
        ? dwc3_remove_requests.constprop.0+0x14d/0x170
        ? __dwc3_gadget_ep_disable+0x7a/0x160
        ? dwc3_gadget_ep_disable+0x3d/0xd0
        ? usb_ep_disable+0x1c/0x
        ? u_audio_stop_capture+0x79/0x120 [u_audio]
        ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
        ? composite_setup+0x224/0x1b90 [libcomposite]
        ? __dwc3_gadget_kick_transfer+0x160/0x400
        ? dwc3_gadget_ep_queue+0xf3/0x1a0
        ? configfs_composite_setup+0x6b/0x90 [libcomposite]
        ? configfs_composite_setup+0x6b/0x90 [libcomposite]
        ? dwc3_ep0_interrupt+0x459/0xa40
        ? dwc3_thread_interrupt+0x8ee/0xf40
        ? __schedule+0x235/0x6c0
        ? disable_irq_nosync+0x10/0x10
        ? irq_thread_fn+0x1b/0x60
        ? irq_thread+0xc0/0x160
        ? irq_thread_check_affinity+0x70/0x70
        ? irq_forced_thread_fn+0x70/0x70
        ? kthread+0x122/0x140
        ? set_kthread_struct+0x40/0x40
        ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? 
Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in 
host mode
and then switch to device mode. If so I can enable traces 
and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will 
not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html 


you need ftrace_dump_on_oops=1 and also need the correct 
options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after 
which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs 
<https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs> 


Unfortunately the kernel crashes so badly I can not get to the 
` cp
/t/trace /root/trace.txt` line (after a while the watchdog 
kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to 
console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every endpoint
that's disabled. I'll take a guess and assume we're failing at 
the last
Set Interface, that means we should have something odd with 
ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : 
dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 ring 
0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : 
dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI ==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : 
dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   75.857360] irq/14-d-596       0d... 42789204us : 
dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI ==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : 
dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   75.879244] irq/14-d-596       0d... 42789209us : dwc3_event: 
event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) 
[Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : dwc3_event: 
event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI 
==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : 
dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> -115
[   76.308278] kworker/-23        0d... 42789695us : 
dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 
0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : 
dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] params 
00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : dwc3_event: 
event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : 
dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : 
dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI ==> 
-115
[   76.523315] irq/14-d-596       0d... 42789854us : 
dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192 
zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : 
dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 zsI 
==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : 
dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> 
-115
[   76.576937] irq/14-d-596       0d... 42789861us : 
dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192 
zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : 
dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 zsI 
==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : 
dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 
ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : dwc3_event: 
event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) 
[Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : dwc3_event: 
event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI 
==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : dwc3_event: 
event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : 
dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : dwc3_event: 
event (000010c2): ep0in: Transfer Not Ready [0] (Not Active) 
[Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : dwc3_event: 
event (000090c2): ep0in: Transfer Not Ready [0] (Active) [Data 
Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : dwc3_event: 
event (0000c042): ep0in: Transfer Complete (sIL) [Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 36/36 
ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : dwc3_event: 
event (000020c0): ep0out: Transfer Not Ready [0] (Not Active) 
[Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to tell 
us which
endpoint is being processed? Then we'll know for sure which one 
caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time until 
6 aug.
not a problem, we'll still be here when you're back :-)
Well, let's go then :-)

To get back in the mood I have retested 5.13.0, 5.14.0-rc1, 5.14.0-rc2
and 5.14.0-rc5.

I find that 5.13.0 works fine, and the issue starts from 5.14.0-rc1.
That's great finding. We have a bisection point. There are a total of
13764 commits between v5.13 and v5.14-rc1

    $ git rev-list  --count v5.13..v5.14-rc1
    13764

git bisect should find the offending commit in at most 14 tries. That's
not too bad.
I correctly guesstimated that the problem got introduced by the usb 
merge 79160a60

"Merge tag 'usb-5.14-rc1' of 
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb"

116 commits(7 bisects).

24f779dac8f3efb9629adc0e486914d93dc45517 is the first bad commit

"usb: gadget: f_uac2/u_audio: add feedback endpoint support"

Ruslan's 3 patches are related to each other so I reverted all three 
24f779da...e89bb428 and applied the reverts to rc1.

I can confirm this indeed resolves the problem in rc1.

Is late now, tomorrow evening I will apply the reverts to rc6.
With these reverts rc6 works fine as well.

So, where do we go from here?
quoted
quoted
With 5.14.0-rc5 the problem seems worse (or different?), and just
disabling uac2 gadget does not prevent the crash. Even disabling gser
and mass_storage.usb0 as well there is still a crash.

Now I'm not sure how to proceed. Bisect rc1? Or focus on rc5 (rc6?)?
I'd first bisect between 5.13 and v5.14-rc1. Once you find the offending
commit, verify if reverting that on -rc1 works, then verify if reverting
on -rc5 also works :-)

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Andy Shevchenko <hidden>
Date: 2021-08-19 07:55:56

On Wed, Aug 18, 2021 at 10:07 PM Ferry Toth [off-list ref] wrote:
Op 18-08-2021 om 00:00 schreef Ferry Toth:
quoted
Op 16-08-2021 om 07:18 schreef Felipe Balbi:
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY,
BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX:
0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI:
ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09:
0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12:
ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15:
ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4:
00000000001006f0
Call Trace:
        ? dwc3_remove_requests.constprop.0+0x14d/0x170
        ? __dwc3_gadget_ep_disable+0x7a/0x160
        ? dwc3_gadget_ep_disable+0x3d/0xd0
        ? usb_ep_disable+0x1c/0x
        ? u_audio_stop_capture+0x79/0x120 [u_audio]
        ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
        ? composite_setup+0x224/0x1b90 [libcomposite]
        ? __dwc3_gadget_kick_transfer+0x160/0x400
        ? dwc3_gadget_ep_queue+0xf3/0x1a0
        ? configfs_composite_setup+0x6b/0x90 [libcomposite]
        ? configfs_composite_setup+0x6b/0x90 [libcomposite]
        ? dwc3_ep0_interrupt+0x459/0xa40
        ? dwc3_thread_interrupt+0x8ee/0xf40
        ? __schedule+0x235/0x6c0
        ? disable_irq_nosync+0x10/0x10
        ? irq_thread_fn+0x1b/0x60
        ? irq_thread+0xc0/0x160
        ? irq_thread_check_affinity+0x70/0x70
        ? irq_forced_thread_fn+0x70/0x70
        ? kthread+0x122/0x140
        ? set_kthread_struct+0x40/0x40
        ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them?
Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in
host mode
and then switch to device mode. If so I can enable traces
and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will
not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html


you need ftrace_dump_on_oops=1 and also need the correct
options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after
which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs
<https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs>


Unfortunately the kernel crashes so badly I can not get to the
` cp
/t/trace /root/trace.txt` line (after a while the watchdog
kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to
console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every endpoint
that's disabled. I'll take a guess and assume we're failing at
the last
Set Interface, that means we should have something odd with
ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us :
dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 ring
0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us :
dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI ==> 0
[   75.846416] irq/14-d-596       0d... 42789202us :
dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   75.857360] irq/14-d-596       0d... 42789204us :
dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI ==> 0
[   75.868301] irq/14-d-596       0d... 42789206us :
dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   75.879244] irq/14-d-596       0d... 42789209us : dwc3_event:
event (000020c2): ep0in: Transfer Not Ready [0] (Not Active)
[Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us :
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us :
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : dwc3_event:
event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us :
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us :
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI
==> 0
[   76.134160] irq/14-d-596       0d... 42789280us :
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us :
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us :
dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> -115
[   76.308278] kworker/-23        0d... 42789695us :
dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf
0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us :
dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] params
00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : dwc3_event:
event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us :
dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us :
dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI ==>
-115
[   76.523315] irq/14-d-596       0d... 42789854us :
dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192
zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us :
dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 zsI
==> -104
[   76.559267] irq/14-d-596       0d... 42789859us :
dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==>
-115
[   76.576937] irq/14-d-596       0d... 42789861us :
dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192
zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us :
dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 zsI
==> -104
[   76.612892] irq/14-d-596       0d... 42789865us :
dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0
ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : dwc3_event:
event (000020c2): ep0in: Transfer Not Ready [0] (Not Active)
[Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us :
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us :
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : dwc3_event:
event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us :
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us :
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI
==> 0
[   76.964217] irq/14-d-596       0d... 42789938us :
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us :
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : dwc3_event:
event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us :
dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us :
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf
0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us :
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : dwc3_event:
event (000010c2): ep0in: Transfer Not Ready [0] (Not Active)
[Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : dwc3_event:
event (000090c2): ep0in: Transfer Not Ready [0] (Active) [Data
Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : dwc3_event:
event (0000c042): ep0in: Transfer Complete (sIL) [Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us :
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us :
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 36/36
ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : dwc3_event:
event (000020c0): ep0out: Transfer Not Ready [0] (Not Active)
[Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us :
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us :
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to tell
us which
endpoint is being processed? Then we'll know for sure which one
caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time until
6 aug.
not a problem, we'll still be here when you're back :-)
Well, let's go then :-)

To get back in the mood I have retested 5.13.0, 5.14.0-rc1, 5.14.0-rc2
and 5.14.0-rc5.

I find that 5.13.0 works fine, and the issue starts from 5.14.0-rc1.
That's great finding. We have a bisection point. There are a total of
13764 commits between v5.13 and v5.14-rc1

    $ git rev-list  --count v5.13..v5.14-rc1
    13764

git bisect should find the offending commit in at most 14 tries. That's
not too bad.
I correctly guesstimated that the problem got introduced by the usb
merge 79160a60

"Merge tag 'usb-5.14-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb"

116 commits(7 bisects).

24f779dac8f3efb9629adc0e486914d93dc45517 is the first bad commit

"usb: gadget: f_uac2/u_audio: add feedback endpoint support"

Ruslan's 3 patches are related to each other so I reverted all three
24f779da...e89bb428 and applied the reverts to rc1.

I can confirm this indeed resolves the problem in rc1.

Is late now, tomorrow evening I will apply the reverts to rc6.
With these reverts rc6 works fine as well.

So, where do we go from here?
Since it's rc6 to rc7 I think the best is to send a revert series to
handle the regression.
quoted
quoted
quoted
With 5.14.0-rc5 the problem seems worse (or different?), and just
disabling uac2 gadget does not prevent the crash. Even disabling gser
and mass_storage.usb0 as well there is still a crash.

Now I'm not sure how to proceed. Bisect rc1? Or focus on rc5 (rc6?)?
I'd first bisect between 5.13 and v5.14-rc1. Once you find the offending
commit, verify if reverting that on -rc1 works, then verify if reverting
on -rc5 also works :-)
-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Pavel Hofman <hidden>
Date: 2021-08-19 07:56:41

Hi,

Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
Hi,

Op 18-08-2021 om 00:00 schreef Ferry Toth:
quoted
Hi,

Op 16-08-2021 om 07:18 schreef Felipe Balbi:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, 
BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 
0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: 
ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 
0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: 
ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: 
ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) 
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 
00000000001006f0
Call Trace:
        ? dwc3_remove_requests.constprop.0+0x14d/0x170
        ? __dwc3_gadget_ep_disable+0x7a/0x160
        ? dwc3_gadget_ep_disable+0x3d/0xd0
        ? usb_ep_disable+0x1c/0x
        ? u_audio_stop_capture+0x79/0x120 [u_audio]
        ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
        ? composite_setup+0x224/0x1b90 [libcomposite]
        ? __dwc3_gadget_kick_transfer+0x160/0x400
        ? dwc3_gadget_ep_queue+0xf3/0x1a0
        ? configfs_composite_setup+0x6b/0x90 [libcomposite]
        ? configfs_composite_setup+0x6b/0x90 [libcomposite]
        ? dwc3_ep0_interrupt+0x459/0xa40
        ? dwc3_thread_interrupt+0x8ee/0xf40
        ? __schedule+0x235/0x6c0
        ? disable_irq_nosync+0x10/0x10
        ? irq_thread_fn+0x1b/0x60
        ? irq_thread+0xc0/0x160
        ? irq_thread_check_affinity+0x70/0x70
        ? irq_forced_thread_fn+0x70/0x70
        ? kthread+0x122/0x140
        ? set_kthread_struct+0x40/0x40
        ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? 
Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in 
host mode
and then switch to device mode. If so I can enable traces 
and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and will 
not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html 


you need ftrace_dump_on_oops=1 and also need the correct 
options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after 
which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs 
<https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs> 


Unfortunately the kernel crashes so badly I can not get to the 
` cp
/t/trace /root/trace.txt` line (after a while the watchdog 
kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to 
console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every endpoint
that's disabled. I'll take a guess and assume we're failing at 
the last
Set Interface, that means we should have something odd with 
ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : 
dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 ring 
0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : 
dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI ==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : 
dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI ==> -115
[   75.857360] irq/14-d-596       0d... 42789204us : 
dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI ==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : 
dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> -115
[   75.879244] irq/14-d-596       0d... 42789209us : dwc3_event: 
event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) 
[Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : dwc3_event: 
event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI 
==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : 
dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> -115
[   76.308278] kworker/-23        0d... 42789695us : 
dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 
0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : 
dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] params 
00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : dwc3_event: 
event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : 
dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : 
dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI ==> 
-115
[   76.523315] irq/14-d-596       0d... 42789854us : 
dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192 
zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : 
dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 zsI 
==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : 
dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> 
-115
[   76.576937] irq/14-d-596       0d... 42789861us : 
dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192 
zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : 
dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 zsI 
==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : 
dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 
ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : dwc3_event: 
event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) 
[Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : dwc3_event: 
event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 zsI 
==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : dwc3_event: 
event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : 
dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : dwc3_event: 
event (000010c2): ep0in: Transfer Not Ready [0] (Not Active) 
[Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : dwc3_event: 
event (000090c2): ep0in: Transfer Not Ready [0] (Active) [Data 
Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : dwc3_event: 
event (0000c042): ep0in: Transfer Complete (sIL) [Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 36/36 
ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : dwc3_event: 
event (000020c0): ep0out: Transfer Not Ready [0] (Not Active) 
[Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to tell 
us which
endpoint is being processed? Then we'll know for sure which one 
caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time until 
6 aug.
not a problem, we'll still be here when you're back :-)
Well, let's go then :-)

To get back in the mood I have retested 5.13.0, 5.14.0-rc1, 5.14.0-rc2
and 5.14.0-rc5.

I find that 5.13.0 works fine, and the issue starts from 5.14.0-rc1.
That's great finding. We have a bisection point. There are a total of
13764 commits between v5.13 and v5.14-rc1

    $ git rev-list  --count v5.13..v5.14-rc1
    13764

git bisect should find the offending commit in at most 14 tries. That's
not too bad.
I correctly guesstimated that the problem got introduced by the usb 
merge 79160a60

"Merge tag 'usb-5.14-rc1' of 
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb"

116 commits(7 bisects).

24f779dac8f3efb9629adc0e486914d93dc45517 is the first bad commit

"usb: gadget: f_uac2/u_audio: add feedback endpoint support"

Ruslan's 3 patches are related to each other so I reverted all three 
24f779da...e89bb428 and applied the reverts to rc1.

I can confirm this indeed resolves the problem in rc1.

Is late now, tomorrow evening I will apply the reverts to rc6.
With these reverts rc6 works fine as well.

So, where do we go from here?
I know the patches have been tested on dwc2 (by me and others).  I do 
not know if Ruslan or Jerome tested them on dwc3 but probably not. 
Ruslan has talked about RPi (my case too) and BeagleboneBlack, both with 
dwc2. Perhaps the dwc2 behaves a bit differently than dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have not 
followed your long thread (it started as unrelated to uac). Does the 
problem appear with f_uac1 or f_uac2? Please how have you reached the 
above problem?

u_audio_stop_capture calls free_ep_fback 
https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/u_audio.c#L414 
which clears the feedback request prm->req_fback.

Then (reading from your the call trace), usb_ep_disable calls 
dwc3_gadget_ep_disable which for every request in the EP calls 
dwc3_remove_requests which gives every found request back to the gadget 
function, IIUC by calling the complete method of the request 
https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/udc/core.c#L912 
. Perhaps the problem is somewhere here?

The dwc2 gadget has its endpoint_disable method a bit different 
https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/dwc2/gadget.c#L4200 
  -> 
https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/dwc2/gadget.c#L3251 
-> 
https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/dwc2/gadget.c#L2090 
which also calls usb_gadget_giveback_request 
https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/dwc2/gadget.c#L2126 
. Perhaps there is some minor but important difference in processing the 
requests when disabling the endpoint between dwc2 and dwc3?

Thanks,

Pavel.

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Ferry Toth <hidden>
Date: 2021-08-19 20:11:04

Hi

Op 19-08-2021 om 09:51 schreef Pavel Hofman:
Hi,

Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
quoted
Hi,

Op 18-08-2021 om 00:00 schreef Ferry Toth:
quoted
Hi,

Op 16-08-2021 om 07:18 schreef Felipe Balbi:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, 
BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 
0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: 
ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 
0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: 
ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: 
ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) 
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 
00000000001006f0
Call Trace:
        ? dwc3_remove_requests.constprop.0+0x14d/0x170
        ? __dwc3_gadget_ep_disable+0x7a/0x160
        ? dwc3_gadget_ep_disable+0x3d/0xd0
        ? usb_ep_disable+0x1c/0x
        ? u_audio_stop_capture+0x79/0x120 [u_audio]
        ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
        ? composite_setup+0x224/0x1b90 [libcomposite]
        ? __dwc3_gadget_kick_transfer+0x160/0x400
        ? dwc3_gadget_ep_queue+0xf3/0x1a0
        ? configfs_composite_setup+0x6b/0x90 [libcomposite]
        ? configfs_composite_setup+0x6b/0x90 [libcomposite]
        ? dwc3_ep0_interrupt+0x459/0xa40
        ? dwc3_thread_interrupt+0x8ee/0xf40
        ? __schedule+0x235/0x6c0
        ? disable_irq_nosync+0x10/0x10
        ? irq_thread_fn+0x1b/0x60
        ? irq_thread+0xc0/0x160
        ? irq_thread_check_affinity+0x70/0x70
        ? irq_forced_thread_fn+0x70/0x70
        ? kthread+0x122/0x140
        ? set_kthread_struct+0x40/0x40
        ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? 
Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB in 
host mode
and then switch to device mode. If so I can enable traces 
and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and 
will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html 


you need ftrace_dump_on_oops=1 and also need the correct 
options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, after 
which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs 
<https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs> 


Unfortunately the kernel crashes so badly I can not get to 
the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog 
kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to 
console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every endpoint
that's disabled. I'll take a guess and assume we're failing at 
the last
Set Interface, that means we should have something odd with 
ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : 
dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 
ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : 
dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI 
==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : 
dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI ==> 
-115
[   75.857360] irq/14-d-596       0d... 42789204us : 
dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI 
==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : 
dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> 
-115
[   75.879244] irq/14-d-596       0d... 42789209us : dwc3_event: 
event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) 
[Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : dwc3_event: 
event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 
zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : 
dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> -115
[   76.308278] kworker/-23        0d... 42789695us : 
dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 
0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : 
dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] params 
00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : dwc3_event: 
event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : 
dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : 
dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI 
==> -115
[   76.523315] irq/14-d-596       0d... 42789854us : 
dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192 
zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : 
dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 zsI 
==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : 
dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI 
==> -115
[   76.576937] irq/14-d-596       0d... 42789861us : 
dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192 
zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : 
dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 zsI 
==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : 
dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 
ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : dwc3_event: 
event (000020c2): ep0in: Transfer Not Ready [0] (Not Active) 
[Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : dwc3_event: 
event (0000c042): ep0in: Transfer Complete (sIL) [Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 
zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : dwc3_event: 
event (0000c040): ep0out: Transfer Complete (sIL) [Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : 
dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : dwc3_event: 
event (000010c2): ep0in: Transfer Not Ready [0] (Not Active) 
[Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : dwc3_event: 
event (000090c2): ep0in: Transfer Not Ready [0] (Active) [Data 
Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : dwc3_event: 
event (0000c042): ep0in: Transfer Complete (sIL) [Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 36/36 
ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : dwc3_event: 
event (000020c0): ep0out: Transfer Not Ready [0] (Not Active) 
[Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to tell 
us which
endpoint is being processed? Then we'll know for sure which one 
caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time 
until 6 aug.
not a problem, we'll still be here when you're back :-)
Well, let's go then :-)

To get back in the mood I have retested 5.13.0, 5.14.0-rc1, 5.14.0-rc2
and 5.14.0-rc5.

I find that 5.13.0 works fine, and the issue starts from 5.14.0-rc1.
That's great finding. We have a bisection point. There are a total of
13764 commits between v5.13 and v5.14-rc1

    $ git rev-list  --count v5.13..v5.14-rc1
    13764

git bisect should find the offending commit in at most 14 tries. That's
not too bad.
I correctly guesstimated that the problem got introduced by the usb 
merge 79160a60

"Merge tag 'usb-5.14-rc1' of 
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb"

116 commits(7 bisects).

24f779dac8f3efb9629adc0e486914d93dc45517 is the first bad commit

"usb: gadget: f_uac2/u_audio: add feedback endpoint support"

Ruslan's 3 patches are related to each other so I reverted all three 
24f779da...e89bb428 and applied the reverts to rc1.

I can confirm this indeed resolves the problem in rc1.

Is late now, tomorrow evening I will apply the reverts to rc6.
With these reverts rc6 works fine as well.

So, where do we go from here?
I know the patches have been tested on dwc2 (by me and others).  I do 
not know if Ruslan or Jerome tested them on dwc3 but probably not. 
Ruslan has talked about RPi (my case too) and BeagleboneBlack, both with 
dwc2. Perhaps the dwc2 behaves a bit differently than dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have not 
followed your long thread (it started as unrelated to uac). Does the 
problem appear with f_uac1 or f_uac2? Please how have you reached the 
above problem?
I'm sorry too. I first believed the issue was related to the patch 
mentioned in the subject line.

The problem appaers with f_uac2. I bost Edison_Arduino board in host 
mode (there is a switch allowing to select host/device mode). When 
flipping the switch to device mode udev run a script:
But as I am using configfs (excerpt follows) and just disabling the last 
2 line resolves the issue, I'm guessing uac2 is the issue. Or exceeding 
the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
....

u_audio_stop_capture calls free_ep_fback 
https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/u_audio.c#L414 
which clears the feedback request prm->req_fback.

Then (reading from your the call trace), usb_ep_disable calls 
dwc3_gadget_ep_disable which for every request in the EP calls 
dwc3_remove_requests which gives every found request back to the gadget 
function, IIUC by calling the complete method of the request 
https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/udc/core.c#L912 
. Perhaps the problem is somewhere here?

The dwc2 gadget has its endpoint_disable method a bit different 
https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/dwc2/gadget.c#L4200 
  -> 
https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/dwc2/gadget.c#L3251 
-> 
https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/dwc2/gadget.c#L2090 
which also calls usb_gadget_giveback_request 
https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/dwc2/gadget.c#L2126 
. Perhaps there is some minor but important difference in processing the 
requests when disabling the endpoint between dwc2 and dwc3?

Thanks,

Pavel.

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Pavel Hofman <hidden>
Date: 2021-08-19 21:05:08

Dne 19. 08. 21 v 22:10 Ferry Toth napsal(a):
Hi

Op 19-08-2021 om 09:51 schreef Pavel Hofman:
quoted
Hi,

Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
quoted
Hi,

Op 18-08-2021 om 00:00 schreef Ferry Toth:
quoted
Hi,

Op 16-08-2021 om 07:18 schreef Felipe Balbi:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, 
BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 
0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: 
ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 
0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: 
ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: 
ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) 
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 
00000000001006f0
Call Trace:
        ? dwc3_remove_requests.constprop.0+0x14d/0x170
        ? __dwc3_gadget_ep_disable+0x7a/0x160
        ? dwc3_gadget_ep_disable+0x3d/0xd0
        ? usb_ep_disable+0x1c/0x
        ? u_audio_stop_capture+0x79/0x120 [u_audio]
        ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
        ? composite_setup+0x224/0x1b90 [libcomposite]
        ? __dwc3_gadget_kick_transfer+0x160/0x400
        ? dwc3_gadget_ep_queue+0xf3/0x1a0
        ? configfs_composite_setup+0x6b/0x90 [libcomposite]
        ? configfs_composite_setup+0x6b/0x90 [libcomposite]
        ? dwc3_ep0_interrupt+0x459/0xa40
        ? dwc3_thread_interrupt+0x8ee/0xf40
        ? __schedule+0x235/0x6c0
        ? disable_irq_nosync+0x10/0x10
        ? irq_thread_fn+0x1b/0x60
        ? irq_thread+0xc0/0x160
        ? irq_thread_check_affinity+0x70/0x70
        ? irq_forced_thread_fn+0x70/0x70
        ? kthread+0x122/0x140
        ? set_kthread_struct+0x40/0x40
        ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? 
Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB 
in host mode
and then switch to device mode. If so I can enable traces 
and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and 
will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html 


you need ftrace_dump_on_oops=1 and also need the correct 
options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, 
after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs 
<https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs> 


Unfortunately the kernel crashes so badly I can not get to 
the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog 
kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to 
console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every 
endpoint
that's disabled. I'll take a guess and assume we're failing at 
the last
Set Interface, that means we should have something odd with 
ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : 
dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 
ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : 
dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI 
==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : 
dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI ==> 
-115
[   75.857360] irq/14-d-596       0d... 42789204us : 
dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI 
==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : 
dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI ==> 
-115
[   75.879244] irq/14-d-596       0d... 42789209us : 
dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] 
(Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : 
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) 
[Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 
zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : 
dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> 
-115
[   76.308278] kworker/-23        0d... 42789695us : 
dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 
0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : 
dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] params 
00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : 
dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) 
[Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : 
dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : 
dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI 
==> -115
[   76.523315] irq/14-d-596       0d... 42789854us : 
dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192 
zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : 
dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 zsI 
==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : 
dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI 
==> -115
[   76.576937] irq/14-d-596       0d... 42789861us : 
dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192 
zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : 
dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 zsI 
==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : 
dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 
ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : 
dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] 
(Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : 
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) 
[Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 
zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : 
dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) 
[Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : 
dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : 
dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0] 
(Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : 
dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0] 
(Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : 
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) 
[Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 36/36 
ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : 
dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0] 
(Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to tell 
us which
endpoint is being processed? Then we'll know for sure which one 
caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time 
until 6 aug.
not a problem, we'll still be here when you're back :-)
Well, let's go then :-)

To get back in the mood I have retested 5.13.0, 5.14.0-rc1, 
5.14.0-rc2
and 5.14.0-rc5.

I find that 5.13.0 works fine, and the issue starts from 5.14.0-rc1.
That's great finding. We have a bisection point. There are a total of
13764 commits between v5.13 and v5.14-rc1

    $ git rev-list  --count v5.13..v5.14-rc1
    13764

git bisect should find the offending commit in at most 14 tries. 
That's
not too bad.
I correctly guesstimated that the problem got introduced by the usb 
merge 79160a60

"Merge tag 'usb-5.14-rc1' of 
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb"

116 commits(7 bisects).

24f779dac8f3efb9629adc0e486914d93dc45517 is the first bad commit

"usb: gadget: f_uac2/u_audio: add feedback endpoint support"

Ruslan's 3 patches are related to each other so I reverted all three 
24f779da...e89bb428 and applied the reverts to rc1.

I can confirm this indeed resolves the problem in rc1.

Is late now, tomorrow evening I will apply the reverts to rc6.
With these reverts rc6 works fine as well.

So, where do we go from here?
I know the patches have been tested on dwc2 (by me and others).  I do 
not know if Ruslan or Jerome tested them on dwc3 but probably not. 
Ruslan has talked about RPi (my case too) and BeagleboneBlack, both 
with dwc2. Perhaps the dwc2 behaves a bit differently than dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have not 
followed your long thread (it started as unrelated to uac). Does the 
problem appear with f_uac1 or f_uac2? Please how have you reached the 
above problem?
I'm sorry too. I first believed the issue was related to the patch 
mentioned in the subject line.

The problem appaers with f_uac2. I bost Edison_Arduino board in host 
mode (there is a switch allowing to select host/device mode). When 
flipping the switch to device mode udev run a script:
But as I am using configfs (excerpt follows) and just disabling the last 
2 line resolves the issue, I'm guessing uac2 is the issue. Or exceeding 
the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
....
As you say, could perhaps the reason be that the extra EP-IN added in 
those patches (previously 1, now 2 with the default config you use) 
exceeds your EP-IN max count or available fifos somehow?  You have a 
number of functions initialized. If you change the load order of the 
functions, do you get the error later with a different function? Just 
guessing...

You should be able to switch the default async EP-OUT (which configures 
the new feedback EP-IN ) to adaptive EP-OUT (which requires no feedback 
EP) with c_sync=8 parameter of f_uac2.

https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c#L47

https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c#L830

https://elixir.bootlin.com/linux/v5.14-rc6/source/include/uapi/linux/usb/ch9.h#L453

Does that fix the problem?

Thanks,

Pavel.

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Date: 2021-08-21 02:57:26

Pavel Hofman wrote:
Dne 19. 08. 21 v 22:10 Ferry Toth napsal(a):
quoted
Hi

Op 19-08-2021 om 09:51 schreef Pavel Hofman:
quoted
Hi,

Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
quoted
Hi,

Op 18-08-2021 om 00:00 schreef Ferry Toth:
quoted
Hi,

Op 16-08-2021 om 07:18 schreef Felipe Balbi:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY,
BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX:
0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI:
ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09:
0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12:
ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15:
ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4:
00000000001006f0
Call Trace:
        ? dwc3_remove_requests.constprop.0+0x14d/0x170
        ? __dwc3_gadget_ep_disable+0x7a/0x160
        ? dwc3_gadget_ep_disable+0x3d/0xd0
        ? usb_ep_disable+0x1c/0x
        ? u_audio_stop_capture+0x79/0x120 [u_audio]
        ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
        ? composite_setup+0x224/0x1b90 [libcomposite]
        ? __dwc3_gadget_kick_transfer+0x160/0x400
        ? dwc3_gadget_ep_queue+0xf3/0x1a0
        ? configfs_composite_setup+0x6b/0x90
[libcomposite]
        ? configfs_composite_setup+0x6b/0x90
[libcomposite]
        ? dwc3_ep0_interrupt+0x459/0xa40
        ? dwc3_thread_interrupt+0x8ee/0xf40
        ? __schedule+0x235/0x6c0
        ? disable_irq_nosync+0x10/0x10
        ? irq_thread_fn+0x1b/0x60
        ? irq_thread+0xc0/0x160
        ? irq_thread_check_affinity+0x70/0x70
        ? irq_forced_thread_fn+0x70/0x70
        ? kthread+0x122/0x140
        ? set_kthread_struct+0x40/0x40
        ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them?
Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB
in host mode
and then switch to device mode. If so I can enable traces
and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and
will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://urldefense.com/v3/__https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html__;!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAPch0qja$ 


you need ftrace_dump_on_oops=1 and also need the correct
options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode,
after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://urldefense.com/v3/__https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html*reporting-bugs__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAG64agnA$ 
<https://urldefense.com/v3/__https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html*reporting-bugs__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAG64agnA$
quoted
Unfortunately the kernel crashes so badly I can not get to
the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog
kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to
console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every
endpoint
that's disabled. I'll take a guess and assume we're failing at
the last
Set Interface, that means we should have something odd with
ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us :
dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0
ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us :
dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI
==> 0
[   75.846416] irq/14-d-596       0d... 42789202us :
dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI
==> -115
[   75.857360] irq/14-d-596       0d... 42789204us :
dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI
==> 0
[   75.868301] irq/14-d-596       0d... 42789206us :
dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI
==> -115
[   75.879244] irq/14-d-596       0d... 42789209us :
dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0]
(Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us :
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us :
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us :
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL)
[Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us :
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us :
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0
zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us :
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us :
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us :
dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==>
-115
[   76.308278] kworker/-23        0d... 42789695us :
dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf
0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us :
dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007]
params 00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us :
dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL)
[Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us :
dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us :
dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI
==> -115
[   76.523315] irq/14-d-596       0d... 42789854us :
dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192
zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us :
dwc3_free_request: ep6in: req 0000000002c71409 length 0/192
zsI ==> -104
[   76.559267] irq/14-d-596       0d... 42789859us :
dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI
==> -115
[   76.576937] irq/14-d-596       0d... 42789861us :
dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192
zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us :
dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192
zsI ==> -104
[   76.612892] irq/14-d-596       0d... 42789865us :
dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0
ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us :
dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0]
(Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us :
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us :
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us :
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL)
[Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us :
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us :
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0
zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us :
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us :
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us :
dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL)
[Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us :
dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us :
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf
0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us :
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us :
dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0]
(Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us :
dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0]
(Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us :
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL)
[Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us :
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us :
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length
36/36 ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us :
dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0]
(Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us :
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us :
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to
tell us which
endpoint is being processed? Then we'll know for sure which
one caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time
until 6 aug.
not a problem, we'll still be here when you're back :-)
Well, let's go then :-)

To get back in the mood I have retested 5.13.0, 5.14.0-rc1,
5.14.0-rc2
and 5.14.0-rc5.

I find that 5.13.0 works fine, and the issue starts from 5.14.0-rc1.
That's great finding. We have a bisection point. There are a total of
13764 commits between v5.13 and v5.14-rc1

    $ git rev-list  --count v5.13..v5.14-rc1
    13764

git bisect should find the offending commit in at most 14 tries.
That's
not too bad.
I correctly guesstimated that the problem got introduced by the usb
merge 79160a60

"Merge tag 'usb-5.14-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb"

116 commits(7 bisects).

24f779dac8f3efb9629adc0e486914d93dc45517 is the first bad commit

"usb: gadget: f_uac2/u_audio: add feedback endpoint support"

Ruslan's 3 patches are related to each other so I reverted all
three 24f779da...e89bb428 and applied the reverts to rc1.

I can confirm this indeed resolves the problem in rc1.

Is late now, tomorrow evening I will apply the reverts to rc6.
With these reverts rc6 works fine as well.

So, where do we go from here?
I know the patches have been tested on dwc2 (by me and others).  I do
not know if Ruslan or Jerome tested them on dwc3 but probably not.
Ruslan has talked about RPi (my case too) and BeagleboneBlack, both
with dwc2. Perhaps the dwc2 behaves a bit differently than dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have not
followed your long thread (it started as unrelated to uac). Does the
problem appear with f_uac1 or f_uac2? Please how have you reached the
above problem?
I'm sorry too. I first believed the issue was related to the patch
mentioned in the subject line.

The problem appaers with f_uac2. I bost Edison_Arduino board in host
mode (there is a switch allowing to select host/device mode). When
flipping the switch to device mode udev run a script:
But as I am using configfs (excerpt follows) and just disabling the
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
....
As you say, could perhaps the reason be that the extra EP-IN added in
those patches (previously 1, now 2 with the default config you use)
exceeds your EP-IN max count or available fifos somehow?  You have a
number of functions initialized. If you change the load order of the
functions, do you get the error later with a different function? Just
guessing...

You should be able to switch the default async EP-OUT (which configures
the new feedback EP-IN ) to adaptive EP-OUT (which requires no feedback
EP) with c_sync=8 parameter of f_uac2.

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c*L47__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAHQ6Lj4y$

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c*L830__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAC7mfgo7$

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/include/uapi/linux/usb/ch9.h*L453__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPANdeuGIx$

Does that fix the problem?
Hi Pavel,

I took a look at 24f779dac8f3 ("usb: gadget: f_uac2/u_audio: add
feedback endpoint support") that Ferry reported the issue from
bisection. I see at least a couple problems in the new UAC2 changes.

1) usb_ep_dequeue() is asynchronous. Don't free requests before the
controller driver give them back.

2) Did you test with SuperSpeed? I don't see companion descriptor.

Please fix them.

Thanks,
Thinh

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Ferry Toth <hidden>
Date: 2021-08-22 20:10:33

Op 21-08-2021 om 04:57 schreef Thinh Nguyen:
Pavel Hofman wrote:
quoted
Dne 19. 08. 21 v 22:10 Ferry Toth napsal(a):
quoted
Hi

Op 19-08-2021 om 09:51 schreef Pavel Hofman:
quoted
Hi,

Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
quoted
Hi,

Op 18-08-2021 om 00:00 schreef Ferry Toth:
quoted
Hi,

Op 16-08-2021 om 07:18 schreef Felipe Balbi:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY,
BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX:
0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI:
ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09:
0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12:
ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15:
ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4:
00000000001006f0
Call Trace:
         ? dwc3_remove_requests.constprop.0+0x14d/0x170
         ? __dwc3_gadget_ep_disable+0x7a/0x160
         ? dwc3_gadget_ep_disable+0x3d/0xd0
         ? usb_ep_disable+0x1c/0x
         ? u_audio_stop_capture+0x79/0x120 [u_audio]
         ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
         ? composite_setup+0x224/0x1b90 [libcomposite]
         ? __dwc3_gadget_kick_transfer+0x160/0x400
         ? dwc3_gadget_ep_queue+0xf3/0x1a0
         ? configfs_composite_setup+0x6b/0x90
[libcomposite]
         ? configfs_composite_setup+0x6b/0x90
[libcomposite]
         ? dwc3_ep0_interrupt+0x459/0xa40
         ? dwc3_thread_interrupt+0x8ee/0xf40
         ? __schedule+0x235/0x6c0
         ? disable_irq_nosync+0x10/0x10
         ? irq_thread_fn+0x1b/0x60
         ? irq_thread+0xc0/0x160
         ? irq_thread_check_affinity+0x70/0x70
         ? irq_forced_thread_fn+0x70/0x70
         ? kthread+0x122/0x140
         ? set_kthread_struct+0x40/0x40
         ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them?
Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB
in host mode
and then switch to device mode. If so I can enable traces
and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and
will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://urldefense.com/v3/__https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html__;!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAPch0qja$


you need ftrace_dump_on_oops=1 and also need the correct
options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode,
after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://urldefense.com/v3/__https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html*reporting-bugs__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAG64agnA$
<https://urldefense.com/v3/__https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html*reporting-bugs__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAG64agnA$
quoted
Unfortunately the kernel crashes so badly I can not get to
the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog
kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to
console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every
endpoint
that's disabled. I'll take a guess and assume we're failing at
the last
Set Interface, that means we should have something odd with
ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us :
dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0
ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us :
dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI
==> 0
[   75.846416] irq/14-d-596       0d... 42789202us :
dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI
==> -115
[   75.857360] irq/14-d-596       0d... 42789204us :
dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI
==> 0
[   75.868301] irq/14-d-596       0d... 42789206us :
dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI
==> -115
[   75.879244] irq/14-d-596       0d... 42789209us :
dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0]
(Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us :
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us :
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us :
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL)
[Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us :
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us :
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0
zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us :
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us :
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us :
dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==>
-115
[   76.308278] kworker/-23        0d... 42789695us :
dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf
0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us :
dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007]
params 00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us :
dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL)
[Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us :
dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us :
dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI
==> -115
[   76.523315] irq/14-d-596       0d... 42789854us :
dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192
zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us :
dwc3_free_request: ep6in: req 0000000002c71409 length 0/192
zsI ==> -104
[   76.559267] irq/14-d-596       0d... 42789859us :
dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI
==> -115
[   76.576937] irq/14-d-596       0d... 42789861us :
dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192
zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us :
dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192
zsI ==> -104
[   76.612892] irq/14-d-596       0d... 42789865us :
dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0
ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us :
dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0]
(Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us :
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us :
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us :
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL)
[Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us :
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us :
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0
zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us :
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us :
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us :
dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL)
[Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us :
dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us :
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf
0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us :
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us :
dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0]
(Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us :
dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0]
(Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us :
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL)
[Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us :
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us :
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length
36/36 ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us :
dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0]
(Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us :
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us :
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to
tell us which
endpoint is being processed? Then we'll know for sure which
one caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time
until 6 aug.
not a problem, we'll still be here when you're back :-)
Well, let's go then :-)

To get back in the mood I have retested 5.13.0, 5.14.0-rc1,
5.14.0-rc2
and 5.14.0-rc5.

I find that 5.13.0 works fine, and the issue starts from 5.14.0-rc1.
That's great finding. We have a bisection point. There are a total of
13764 commits between v5.13 and v5.14-rc1

     $ git rev-list  --count v5.13..v5.14-rc1
     13764

git bisect should find the offending commit in at most 14 tries.
That's
not too bad.
I correctly guesstimated that the problem got introduced by the usb
merge 79160a60

"Merge tag 'usb-5.14-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb"

116 commits(7 bisects).

24f779dac8f3efb9629adc0e486914d93dc45517 is the first bad commit

"usb: gadget: f_uac2/u_audio: add feedback endpoint support"

Ruslan's 3 patches are related to each other so I reverted all
three 24f779da...e89bb428 and applied the reverts to rc1.

I can confirm this indeed resolves the problem in rc1.

Is late now, tomorrow evening I will apply the reverts to rc6.
With these reverts rc6 works fine as well.

So, where do we go from here?
I know the patches have been tested on dwc2 (by me and others).  I do
not know if Ruslan or Jerome tested them on dwc3 but probably not.
Ruslan has talked about RPi (my case too) and BeagleboneBlack, both
with dwc2. Perhaps the dwc2 behaves a bit differently than dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have not
followed your long thread (it started as unrelated to uac). Does the
problem appear with f_uac1 or f_uac2? Please how have you reached the
above problem?
I'm sorry too. I first believed the issue was related to the patch
mentioned in the subject line.

The problem appaers with f_uac2. I bost Edison_Arduino board in host
mode (there is a switch allowing to select host/device mode). When
flipping the switch to device mode udev run a script:
But as I am using configfs (excerpt follows) and just disabling the
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
....
As you say, could perhaps the reason be that the extra EP-IN added in
those patches (previously 1, now 2 with the default config you use)
exceeds your EP-IN max count or available fifos somehow?  You have a
number of functions initialized. If you change the load order of the
functions, do you get the error later with a different function? Just
guessing...

You should be able to switch the default async EP-OUT (which configures
the new feedback EP-IN ) to adaptive EP-OUT (which requires no feedback
EP) with c_sync=8 parameter of f_uac2.

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c*L47__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAHQ6Lj4y$

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c*L830__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAC7mfgo7$

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/include/uapi/linux/usb/ch9.h*L453__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPANdeuGIx$

Does that fix the problem?
Hi Pavel,

I took a look at 24f779dac8f3 ("usb: gadget: f_uac2/u_audio: add
feedback endpoint support") that Ferry reported the issue from
bisection. I see at least a couple problems in the new UAC2 changes.

1) usb_ep_dequeue() is asynchronous. Don't free requests before the
controller driver give them back.

2) Did you test with SuperSpeed? I don't see companion descriptor.

Please fix them.
Given it's late in the cycle I agree with Andy it would be best to 
revert the series now.

I will be happy to test on dwc3 when a fixed series arrives.
Thanks,
Thinh

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Pavel Hofman <hidden>
Date: 2021-08-23 07:57:55


Dne 22. 08. 21 v 22:10 Ferry Toth napsal(a):
Op 21-08-2021 om 04:57 schreef Thinh Nguyen:
quoted
Pavel Hofman wrote:
quoted
Dne 19. 08. 21 v 22:10 Ferry Toth napsal(a):
quoted
Hi

Op 19-08-2021 om 09:51 schreef Pavel Hofman:
quoted
Hi,

Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
quoted
Hi,

Op 18-08-2021 om 00:00 schreef Ferry Toth:
quoted
Hi,

Op 16-08-2021 om 07:18 schreef Felipe Balbi:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY,
BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX:
0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI:
ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09:
0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12:
ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15:
ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4:
00000000001006f0
Call Trace:
         ? dwc3_remove_requests.constprop.0+0x14d/0x170
         ? __dwc3_gadget_ep_disable+0x7a/0x160
         ? dwc3_gadget_ep_disable+0x3d/0xd0
         ? usb_ep_disable+0x1c/0x
         ? u_audio_stop_capture+0x79/0x120 [u_audio]
         ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
         ? composite_setup+0x224/0x1b90 [libcomposite]
         ? __dwc3_gadget_kick_transfer+0x160/0x400
         ? dwc3_gadget_ep_queue+0xf3/0x1a0
         ? configfs_composite_setup+0x6b/0x90
[libcomposite]
         ? configfs_composite_setup+0x6b/0x90
[libcomposite]
         ? dwc3_ep0_interrupt+0x459/0xa40
         ? dwc3_thread_interrupt+0x8ee/0xf40
         ? __schedule+0x235/0x6c0
         ? disable_irq_nosync+0x10/0x10
         ? irq_thread_fn+0x1b/0x60
         ? irq_thread+0xc0/0x160
         ? irq_thread_check_affinity+0x70/0x70
         ? irq_forced_thread_fn+0x70/0x70
         ? kthread+0x122/0x140
         ? set_kthread_struct+0x40/0x40
         ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them?
Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB
in host mode
and then switch to device mode. If so I can enable traces
and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and
will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://urldefense.com/v3/__https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html__;!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAPch0qja$ 



you need ftrace_dump_on_oops=1 and also need the correct
options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode,
after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://urldefense.com/v3/__https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html*reporting-bugs__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAG64agnA$ 

<https://urldefense.com/v3/__https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html*reporting-bugs__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAG64agnA$ 
quoted
Unfortunately the kernel crashes so badly I can not get to
the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog
kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to
console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, 
looking at
the logs around Set Interface requests, we can track every
endpoint
that's disabled. I'll take a guess and assume we're failing at
the last
Set Interface, that means we should have something odd with
ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us :
dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0
ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us :
dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI
==> 0
[   75.846416] irq/14-d-596       0d... 42789202us :
dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI
==> -115
[   75.857360] irq/14-d-596       0d... 42789204us :
dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI
==> 0
[   75.868301] irq/14-d-596       0d... 42789206us :
dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI
==> -115
[   75.879244] irq/14-d-596       0d... 42789209us :
dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0]
(Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us :
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us :
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us :
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL)
[Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us :
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us :
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0
zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us :
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us :
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us :
dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==>
-115
[   76.308278] kworker/-23        0d... 42789695us :
dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf
0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us :
dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007]
params 00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us :
dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL)
[Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us :
dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us :
dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI
==> -115
[   76.523315] irq/14-d-596       0d... 42789854us :
dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192
zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us :
dwc3_free_request: ep6in: req 0000000002c71409 length 0/192
zsI ==> -104
[   76.559267] irq/14-d-596       0d... 42789859us :
dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI
==> -115
[   76.576937] irq/14-d-596       0d... 42789861us :
dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192
zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us :
dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192
zsI ==> -104
[   76.612892] irq/14-d-596       0d... 42789865us :
dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0
ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us :
dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0]
(Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us :
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us :
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us :
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL)
[Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us :
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us :
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0
zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us :
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us :
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us :
dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL)
[Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us :
dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us :
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf
0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us :
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us :
dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0]
(Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us :
dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0]
(Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us :
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL)
[Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us :
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us :
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length
36/36 ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us :
dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0]
(Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us :
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf
000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us :
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params
00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to
tell us which
endpoint is being processed? Then we'll know for sure which
one caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time
until 6 aug.
not a problem, we'll still be here when you're back :-)
Well, let's go then :-)

To get back in the mood I have retested 5.13.0, 5.14.0-rc1,
5.14.0-rc2
and 5.14.0-rc5.

I find that 5.13.0 works fine, and the issue starts from 
5.14.0-rc1.
That's great finding. We have a bisection point. There are a 
total of
13764 commits between v5.13 and v5.14-rc1

     $ git rev-list  --count v5.13..v5.14-rc1
     13764

git bisect should find the offending commit in at most 14 tries.
That's
not too bad.
I correctly guesstimated that the problem got introduced by the usb
merge 79160a60

"Merge tag 'usb-5.14-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb"

116 commits(7 bisects).

24f779dac8f3efb9629adc0e486914d93dc45517 is the first bad commit

"usb: gadget: f_uac2/u_audio: add feedback endpoint support"

Ruslan's 3 patches are related to each other so I reverted all
three 24f779da...e89bb428 and applied the reverts to rc1.

I can confirm this indeed resolves the problem in rc1.

Is late now, tomorrow evening I will apply the reverts to rc6.
With these reverts rc6 works fine as well.

So, where do we go from here?
I know the patches have been tested on dwc2 (by me and others).  I do
not know if Ruslan or Jerome tested them on dwc3 but probably not.
Ruslan has talked about RPi (my case too) and BeagleboneBlack, both
with dwc2. Perhaps the dwc2 behaves a bit differently than dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have not
followed your long thread (it started as unrelated to uac). Does the
problem appear with f_uac1 or f_uac2? Please how have you reached the
above problem?
I'm sorry too. I first believed the issue was related to the patch
mentioned in the subject line.

The problem appaers with f_uac2. I bost Edison_Arduino board in host
mode (there is a switch allowing to select host/device mode). When
flipping the switch to device mode udev run a script:
But as I am using configfs (excerpt follows) and just disabling the
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
....
As you say, could perhaps the reason be that the extra EP-IN added in
those patches (previously 1, now 2 with the default config you use)
exceeds your EP-IN max count or available fifos somehow?  You have a
number of functions initialized. If you change the load order of the
functions, do you get the error later with a different function? Just
guessing...

You should be able to switch the default async EP-OUT (which configures
the new feedback EP-IN ) to adaptive EP-OUT (which requires no feedback
EP) with c_sync=8 parameter of f_uac2.

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c*L47__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAHQ6Lj4y$ 


https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c*L830__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPAC7mfgo7$ 


https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/include/uapi/linux/usb/ch9.h*L453__;Iw!!A4F2R9G_pg!PZHOWnH3HDs-9a9bz4KLDShZpsubSfG84fu3wEZyK4Q_Wvv2lhHKuk7LJpWPANdeuGIx$ 


Does that fix the problem?
Hi Pavel,

I took a look at 24f779dac8f3 ("usb: gadget: f_uac2/u_audio: add
feedback endpoint support") that Ferry reported the issue from
bisection. I see at least a couple problems in the new UAC2 changes.

1) usb_ep_dequeue() is asynchronous. Don't free requests before the
controller driver give them back.

2) Did you test with SuperSpeed? I don't see companion descriptor.

Please fix them.
Given it's late in the cycle I agree with Andy it would be best to 
revert the series now.

I will be happy to test on dwc3 when a fixed series arrives.
Yes, I agree it's the best solution now. I have asked the patch devs 
Ruslan and Jerome for help with these issues, I am mostly a tester of 
the UAC2 gadget changes (with dwc2 USB2 only available for now).

Best regards,

Pavel.

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Jack Pham <hidden>
Date: 2021-09-02 00:28:24

Hi Thinh,

On Sat, Aug 21, 2021 at 02:57:07AM +0000, Thinh Nguyen wrote:
I took a look at 24f779dac8f3 ("usb: gadget: f_uac2/u_audio: add
feedback endpoint support") that Ferry reported the issue from
bisection. I see at least a couple problems in the new UAC2 changes.

1) usb_ep_dequeue() is asynchronous. Don't free requests before the
controller driver give them back.

2) Did you test with SuperSpeed? I don't see companion descriptor.
We caught this too when testing f_uac2 in SuperSpeed mode.  I can
prepare a patch.

Thanks,
Jack
-- 
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Date: 2021-09-02 22:59:00

Jack Pham wrote:
Hi Thinh,

On Sat, Aug 21, 2021 at 02:57:07AM +0000, Thinh Nguyen wrote:
quoted
I took a look at 24f779dac8f3 ("usb: gadget: f_uac2/u_audio: add
feedback endpoint support") that Ferry reported the issue from
bisection. I see at least a couple problems in the new UAC2 changes.

1) usb_ep_dequeue() is asynchronous. Don't free requests before the
controller driver give them back.

2) Did you test with SuperSpeed? I don't see companion descriptor.
We caught this too when testing f_uac2 in SuperSpeed mode.  I can
prepare a patch.
Thanks for the test and the fix.

BR,
Thinh

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Ferry Toth <hidden>
Date: 2021-08-22 19:43:18

Op 19-08-2021 om 23:04 schreef Pavel Hofman:
Dne 19. 08. 21 v 22:10 Ferry Toth napsal(a):
quoted
Hi

Op 19-08-2021 om 09:51 schreef Pavel Hofman:
quoted
Hi,

Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
quoted
Hi,

Op 18-08-2021 om 00:00 schreef Ferry Toth:
quoted
Hi,

Op 16-08-2021 om 07:18 schreef Felipe Balbi:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA BAY, 
BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 
0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: 
ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 
0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: 
ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: 
ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) 
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 
00000000001006f0
Call Trace:
        ? dwc3_remove_requests.constprop.0+0x14d/0x170
        ? __dwc3_gadget_ep_disable+0x7a/0x160
        ? dwc3_gadget_ep_disable+0x3d/0xd0
        ? usb_ep_disable+0x1c/0x
        ? u_audio_stop_capture+0x79/0x120 [u_audio]
        ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
        ? composite_setup+0x224/0x1b90 [libcomposite]
        ? __dwc3_gadget_kick_transfer+0x160/0x400
        ? dwc3_gadget_ep_queue+0xf3/0x1a0
        ? configfs_composite_setup+0x6b/0x90 
[libcomposite]
        ? configfs_composite_setup+0x6b/0x90 
[libcomposite]
        ? dwc3_ep0_interrupt+0x459/0xa40
        ? dwc3_thread_interrupt+0x8ee/0xf40
        ? __schedule+0x235/0x6c0
        ? disable_irq_nosync+0x10/0x10
        ? irq_thread_fn+0x1b/0x60
        ? irq_thread+0xc0/0x160
        ? irq_thread_check_affinity+0x70/0x70
        ? irq_forced_thread_fn+0x70/0x70
        ? kthread+0x122/0x140
        ? set_kthread_struct+0x40/0x40
        ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? 
Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB 
in host mode
and then switch to device mode. If so I can enable traces 
and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and 
will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html 


you need ftrace_dump_on_oops=1 and also need the correct 
options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, 
after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs 
<https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs> 


Unfortunately the kernel crashes so badly I can not get to 
the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog 
kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to 
console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, looking at
the logs around Set Interface requests, we can track every 
endpoint
that's disabled. I'll take a guess and assume we're failing at 
the last
Set Interface, that means we should have something odd with 
ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : 
dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 
ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : 
dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 zsI 
==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : 
dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI 
==> -115
[   75.857360] irq/14-d-596       0d... 42789204us : 
dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 zsI 
==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : 
dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI 
==> -115
[   75.879244] irq/14-d-596       0d... 42789209us : 
dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] 
(Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : 
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) 
[Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 
zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : 
dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI ==> 
-115
[   76.308278] kworker/-23        0d... 42789695us : 
dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 
0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : 
dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] 
params 00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : 
dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) 
[Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : 
dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : 
dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI 
==> -115
[   76.523315] irq/14-d-596       0d... 42789854us : 
dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 0/192 
zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : 
dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 
zsI ==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : 
dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI 
==> -115
[   76.576937] irq/14-d-596       0d... 42789861us : 
dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 0/192 
zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : 
dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 
zsI ==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : 
dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 
ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : 
dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] 
(Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : 
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) 
[Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 
zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : 
dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) 
[Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : 
dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : 
dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0] 
(Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : 
dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0] 
(Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : 
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) 
[Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 
36/36 ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : 
dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0] 
(Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to 
tell us which
endpoint is being processed? Then we'll know for sure which 
one caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time 
until 6 aug.
not a problem, we'll still be here when you're back :-)
Well, let's go then :-)

To get back in the mood I have retested 5.13.0, 5.14.0-rc1, 
5.14.0-rc2
and 5.14.0-rc5.

I find that 5.13.0 works fine, and the issue starts from 5.14.0-rc1.
That's great finding. We have a bisection point. There are a total of
13764 commits between v5.13 and v5.14-rc1

    $ git rev-list  --count v5.13..v5.14-rc1
    13764

git bisect should find the offending commit in at most 14 tries. 
That's
not too bad.
I correctly guesstimated that the problem got introduced by the usb 
merge 79160a60

"Merge tag 'usb-5.14-rc1' of 
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb"

116 commits(7 bisects).

24f779dac8f3efb9629adc0e486914d93dc45517 is the first bad commit

"usb: gadget: f_uac2/u_audio: add feedback endpoint support"

Ruslan's 3 patches are related to each other so I reverted all 
three 24f779da...e89bb428 and applied the reverts to rc1.

I can confirm this indeed resolves the problem in rc1.

Is late now, tomorrow evening I will apply the reverts to rc6.
With these reverts rc6 works fine as well.

So, where do we go from here?
I know the patches have been tested on dwc2 (by me and others).  I do 
not know if Ruslan or Jerome tested them on dwc3 but probably not. 
Ruslan has talked about RPi (my case too) and BeagleboneBlack, both 
with dwc2. Perhaps the dwc2 behaves a bit differently than dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have not 
followed your long thread (it started as unrelated to uac). Does the 
problem appear with f_uac1 or f_uac2? Please how have you reached the 
above problem?
I'm sorry too. I first believed the issue was related to the patch 
mentioned in the subject line.

The problem appaers with f_uac2. I bost Edison_Arduino board in host 
mode (there is a switch allowing to select host/device mode). When 
flipping the switch to device mode udev run a script:
But as I am using configfs (excerpt follows) and just disabling the 
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or 
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
....
As you say, could perhaps the reason be that the extra EP-IN added in 
those patches (previously 1, now 2 with the default config you use) 
exceeds your EP-IN max count or available fifos somehow?  You have a 
number of functions initialized. If you change the load order of the 
functions, do you get the error later with a different function? Just 
guessing...

You should be able to switch the default async EP-OUT (which configures 
the new feedback EP-IN ) to adaptive EP-OUT (which requires no feedback 
EP) with c_sync=8 parameter of f_uac2.

https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c#L47 


https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c#L830 


https://elixir.bootlin.com/linux/v5.14-rc6/source/include/uapi/linux/usb/ch9.h#L453 


Does that fix the problem?
Not sure how to do that. Do you mean the module should have a parameter 
called c_sync? `modinfo` list no parameters for usb_f_uac2.
Thanks,

Pavel.

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Pavel Hofman <hidden>
Date: 2021-08-23 15:01:26

Dne 22. 08. 21 v 21:43 Ferry Toth napsal(a):
Op 19-08-2021 om 23:04 schreef Pavel Hofman:
quoted
Dne 19. 08. 21 v 22:10 Ferry Toth napsal(a):
quoted
Hi

Op 19-08-2021 om 09:51 schreef Pavel Hofman:
quoted
Hi,

Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
quoted
Hi,

Op 18-08-2021 om 00:00 schreef Ferry Toth:
quoted
Hi,

Op 16-08-2021 om 07:18 schreef Felipe Balbi:
quoted
Hi,

Ferry Toth [off-list ref] writes:
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
Ferry Toth [off-list ref] writes:
quoted
quoted
quoted
quoted
quoted
Hardware name: Intel Corporation Merrifield/BODEGA 
BAY, BIOS 542
2015.01.21:18.19.48
RIP: 0010:0x500000000
Code: Unable to access opcode bytes at RIP 0x4ffffffd6.
RSP: 0018:ffffa4d00045fc28 EFLAGS: 00010046
RAX: 0000000500000000 RBX: ffff8cd546aed200 RCX: 
0000000000000000
RDX: 0000000000000000 RSI: ffff8cd547bfcae0 RDI: 
ffff8cd546aed200
RBP: ffff8cd547bfcae0 R08: 0000000000000000 R09: 
0000000000000001
R10: ffff8cd541fd28c0 R11: 0000000000000000 R12: 
ffff8cd547342828
R13: ffff8cd546aed248 R14: 0000000000000000 R15: 
ffff8cd548b1d000
FS:  0000000000000000(0000) GS:ffff8cd57e200000(0000) 
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000500000000 CR3: 000000000311e000 CR4: 
00000000001006f0
Call Trace:
        ? dwc3_remove_requests.constprop.0+0x14d/0x170
        ? __dwc3_gadget_ep_disable+0x7a/0x160
        ? dwc3_gadget_ep_disable+0x3d/0xd0
        ? usb_ep_disable+0x1c/0x
        ? u_audio_stop_capture+0x79/0x120 [u_audio]
        ? afunc_set_alt+0x73/0x80 [usb_f_uac2]
So this is triggered by a SetInterface request...
quoted
quoted
quoted
quoted
quoted
quoted
quoted
        ? composite_setup+0x224/0x1b90 [libcomposite]
        ? __dwc3_gadget_kick_transfer+0x160/0x400
        ? dwc3_gadget_ep_queue+0xf3/0x1a0
        ? configfs_composite_setup+0x6b/0x90 
[libcomposite]
        ? configfs_composite_setup+0x6b/0x90 
[libcomposite]
        ? dwc3_ep0_interrupt+0x459/0xa40
        ? dwc3_thread_interrupt+0x8ee/0xf40
        ? __schedule+0x235/0x6c0
        ? disable_irq_nosync+0x10/0x10
        ? irq_thread_fn+0x1b/0x60
        ? irq_thread+0xc0/0x160
        ? irq_thread_check_affinity+0x70/0x70
        ? irq_forced_thread_fn+0x70/0x70
        ? kthread+0x122/0x140
        ? set_kthread_struct+0x40/0x40
        ? ret_from_fork+0x22/0x30
Do you mind enabling dwc3 traces and collecting them? 
Trying to figure
out how we got here.
I'll try if I can get the same error by booting with USB 
in host mode
and then switch to device mode. If so I can enable 
traces and collect as
you explained me before.

I'll try before monday, as then I fly for a holiday and 
will not be
available before rc5.
you can enable all of those with kernel cmdline :-)

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html 


you need ftrace_dump_on_oops=1 and also need the correct 
options on
trace_buf_size and trace_event.
On Edison-Arduino I have a switch to go to device mode, 
after which
udev triggers a script configure gadgets through configfs.

I tried to log following these instructions:

https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs 
<https://www.kernel.org/doc/html/latest/driver-api/usb/dwc3.html#reporting-bugs> 


Unfortunately the kernel crashes so badly I can not get to 
the ` cp
/t/trace /root/trace.txt` line (after a while the watchdog 
kicks).

What to do next?
Pass ftrace_dump_on_oops to kernel cmdline.
No sure if I did this right, on oops everything is pushed to 
console
(115k2 serial), I hope nothing essential is lost.

I copied the screen buffer to file see attached.
Thank you, I bet it took quite a some time :-) Anyway, 
looking at
the logs around Set Interface requests, we can track every 
endpoint
that's disabled. I'll take a guess and assume we're failing 
at the last
Set Interface, that means we should have something odd with 
ep6in, but
everything looks fine in the trace output:

[   75.823107] irq/14-d-596       0d... 42789194us : 
dwc3_gadget_ep_enable: ep6in: mps 192/346 streams 16 burst 0 
ring 0/0 flags E:swbp:<
[   75.835472] irq/14-d-596       0d... 42789198us : 
dwc3_alloc_request: ep6in: req 0000000002c71409 length 0/0 
zsI ==> 0
[   75.846416] irq/14-d-596       0d... 42789202us : 
dwc3_ep_queue: ep6in: req 0000000002c71409 length 0/192 zsI 
==> -115
[   75.857360] irq/14-d-596       0d... 42789204us : 
dwc3_alloc_request: ep6in: req 00000000a324f5d0 length 0/0 
zsI ==> 0
[   75.868301] irq/14-d-596       0d... 42789206us : 
dwc3_ep_queue: ep6in: req 00000000a324f5d0 length 0/192 zsI 
==> -115
[   75.879244] irq/14-d-596       0d... 42789209us : 
dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] 
(Not Active) [Status Phase]
[   75.891880] irq/14-d-596       0d... 42789211us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   75.989131] irq/14-d-596       0d... 42789224us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.096261] irq/14-d-596       0d... 42789272us : 
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) 
[Status Phase]
[   76.107834] irq/14-d-596       0d... 42789275us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.122944] irq/14-d-596       0d... 42789277us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 
zsI ==> 0
[   76.134160] irq/14-d-596       0d... 42789280us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   76.231322] irq/14-d-596       0d... 42789292us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.297418] kworker/-23        0d... 42789670us : 
dwc3_ep_queue: ep3in: req 0000000029586135 length 0/96 ZsI 
==> -115
[   76.308278] kworker/-23        0d... 42789695us : 
dwc3_prepare_trb: ep3in: trb 00000000b81213d6 (E1:D0) buf 
0000000003b7a800 size 96 ctrl 00000811 (Hlcs:sC:normal)
[   76.395294] kworker/-23        0d... 42789707us : 
dwc3_gadget_ep_cmd: ep3in: cmd 'Update Transfer' [60007] 
params 00000000 00000000 00000000 --> status: Successful
[   76.471900] irq/14-d-596       0d... 42789842us : 
dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) 
[Setup Phase]
[   76.489308] irq/14-d-596       0d... 42789845us : 
dwc3_ctrl_req: Set Interface(Intf = 5, Alt.Setting = 0)
[   76.505650] irq/14-d-596       0d... 42789851us : 
dwc3_ep_dequeue: ep6in: req 0000000002c71409 length 0/192 zsI 
==> -115
[   76.523315] irq/14-d-596       0d... 42789854us : 
dwc3_gadget_giveback: ep6in: req 0000000002c71409 length 
0/192 zsI ==> -104
[   76.541427] irq/14-d-596       0d... 42789857us : 
dwc3_free_request: ep6in: req 0000000002c71409 length 0/192 
zsI ==> -104
[   76.559267] irq/14-d-596       0d... 42789859us : 
dwc3_ep_dequeue: ep6in: req 00000000a324f5d0 length 0/192 zsI 
==> -115
[   76.576937] irq/14-d-596       0d... 42789861us : 
dwc3_gadget_giveback: ep6in: req 00000000a324f5d0 length 
0/192 zsI ==> -104
[   76.595046] irq/14-d-596       0d... 42789862us : 
dwc3_free_request: ep6in: req 00000000a324f5d0 length 0/192 
zsI ==> -104
[   76.612892] irq/14-d-596       0d... 42789865us : 
dwc3_gadget_ep_disable: ep6in: mps 192/346 streams 16 burst 0 
ring 0/0 flags E:swbp:<
[   76.665535] irq/14-d-596       0d... 42789873us : 
dwc3_event: event (000020c2): ep0in: Transfer Not Ready [0] 
(Not Active) [Status Phase]
[   76.684716] irq/14-d-596       0d... 42789875us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c33 (HLcs:SC:status2)
[   76.819195] irq/14-d-596       0d... 42789886us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   76.926324] irq/14-d-596       0d... 42789930us : 
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) 
[Status Phase]
[   76.937892] irq/14-d-596       0d... 42789933us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c32 (hLcs:SC:status2)
[   76.953003] irq/14-d-596       0d... 42789935us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 0/0 
zsI ==> 0
[   76.964217] irq/14-d-596       0d... 42789938us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 8 ctrl 00000c23 (HLcs:SC:setup)
[   77.061379] irq/14-d-596       0d... 42789950us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   77.168595] irq/14-d-596       0d... 42790509us : 
dwc3_event: event (0000c040): ep0out: Transfer Complete (sIL) 
[Setup Phase]
[   77.180159] irq/14-d-596       0d... 42790512us : 
dwc3_ctrl_req: Get String Descriptor(Index = 18, Length = 255)
[   77.190578] irq/14-d-596       0d... 42790537us : 
dwc3_prepare_trb: ep0in: trb 000000004c0ae319 (E0:D0) buf 
0000000003b68000 size 36 ctrl 00000c53 (HLcs:SC:data)
[   77.287648] irq/14-d-596       0d... 42790550us : 
dwc3_gadget_ep_cmd: ep0in: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful
[   77.333107] irq/14-d-596       0d... 42790557us : 
dwc3_event: event (000010c2): ep0in: Transfer Not Ready [0] 
(Not Active) [Data Phase]
[   77.407223] irq/14-d-596       0d... 42790575us : 
dwc3_event: event (000090c2): ep0in: Transfer Not Ready [0] 
(Active) [Data Phase]
[   77.480985] irq/14-d-596       0d... 42790588us : 
dwc3_event: event (0000c042): ep0in: Transfer Complete (sIL) 
[Data Phase]
[   77.492376] irq/14-d-596       0d... 42790590us : 
dwc3_complete_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
0000000003b68000 size 0 ctrl 00000c52 (hLcs:SC:data)
[   77.507221] irq/14-d-596       0d... 42790595us : 
dwc3_gadget_giveback: ep0out: req 00000000cb1bd3cd length 
36/36 ZsI ==> 0
[   77.518609] irq/14-d-596       0d... 42790597us : 
dwc3_event: event (000020c0): ep0out: Transfer Not Ready [0] 
(Not Active) [Status Phase]
[   77.531332] irq/14-d-596       0d... 42790598us : 
dwc3_prepare_trb: ep0out: trb 000000004c0ae319 (E0:D0) buf 
000000001bded000 size 0 ctrl 00000c43 (HLcs:SC:status3)
[   77.628669] irq/14-d-596       0d... 42790609us : 
dwc3_gadget_ep_cmd: ep0out: cmd 'Start Transfer' [406] params 
00000000 1bded000 00000000 --> status: Successful

Do you mind adding a few prints in dwc3_remove_requests to 
tell us which
endpoint is being processed? Then we'll know for sure which 
one caused
the crash.
I wouldn't mind but am leaving on a holiday, won't have time 
until 6 aug.
not a problem, we'll still be here when you're back :-)
Well, let's go then :-)

To get back in the mood I have retested 5.13.0, 5.14.0-rc1, 
5.14.0-rc2
and 5.14.0-rc5.

I find that 5.13.0 works fine, and the issue starts from 
5.14.0-rc1.
That's great finding. We have a bisection point. There are a 
total of
13764 commits between v5.13 and v5.14-rc1

    $ git rev-list  --count v5.13..v5.14-rc1
    13764

git bisect should find the offending commit in at most 14 tries. 
That's
not too bad.
I correctly guesstimated that the problem got introduced by the 
usb merge 79160a60

"Merge tag 'usb-5.14-rc1' of 
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb"

116 commits(7 bisects).

24f779dac8f3efb9629adc0e486914d93dc45517 is the first bad commit

"usb: gadget: f_uac2/u_audio: add feedback endpoint support"

Ruslan's 3 patches are related to each other so I reverted all 
three 24f779da...e89bb428 and applied the reverts to rc1.

I can confirm this indeed resolves the problem in rc1.

Is late now, tomorrow evening I will apply the reverts to rc6.
With these reverts rc6 works fine as well.

So, where do we go from here?
I know the patches have been tested on dwc2 (by me and others).  I 
do not know if Ruslan or Jerome tested them on dwc3 but probably 
not. Ruslan has talked about RPi (my case too) and BeagleboneBlack, 
both with dwc2. Perhaps the dwc2 behaves a bit differently than dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have 
not followed your long thread (it started as unrelated to uac). Does 
the problem appear with f_uac1 or f_uac2? Please how have you 
reached the above problem?
I'm sorry too. I first believed the issue was related to the patch 
mentioned in the subject line.

The problem appaers with f_uac2. I bost Edison_Arduino board in host 
mode (there is a switch allowing to select host/device mode). When 
flipping the switch to device mode udev run a script:
But as I am using configfs (excerpt follows) and just disabling the 
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or 
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
....
As you say, could perhaps the reason be that the extra EP-IN added in 
those patches (previously 1, now 2 with the default config you use) 
exceeds your EP-IN max count or available fifos somehow?  You have a 
number of functions initialized. If you change the load order of the 
functions, do you get the error later with a different function? Just 
guessing...

You should be able to switch the default async EP-OUT (which 
configures the new feedback EP-IN ) to adaptive EP-OUT (which requires 
no feedback EP) with c_sync=8 parameter of f_uac2.

https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c#L47 


https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c#L830 


https://elixir.bootlin.com/linux/v5.14-rc6/source/include/uapi/linux/usb/ch9.h#L453 


Does that fix the problem?
Not sure how to do that. Do you mean the module should have a parameter 
called c_sync? `modinfo` list no parameters for usb_f_uac2.
Those are configfs params, not available in modinfo.

I checked and the value is "adaptive" 
https://elixir.bootlin.com/linux/v5.14-rc7/source/drivers/usb/gadget/function/f_uac2.c#L1312

In your configfs script:

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1


On the USB Host:
cat /proc/asound/Gadget/stream:
Playback:
   Status: Stop
   Interface 1
     Altset 1
     Format: S16_LE
     Channels: 2
     Endpoint: 0x01 (1 OUT) (ASYNC)
     Rates: 64000
     Data packet interval: 125 us
     Bits: 16
     Channel map: FL FR
     Sync Endpoint: 0x82 (2 IN)
     Sync EP Interface: 1
     Sync EP Altset: 1
     Implicit Feedback Mode: No


lsusb -v -d 1d6b:0104 | | grep EP.*IN
         bEndpointAddress     0x81  EP 1 IN
         bEndpointAddress     0x82  EP 2 IN
         bEndpointAddress     0x83  EP 3 IN

I have additional patches applied which define controls via EP IN 
interrupt mode, not part of that patchset.


Switching to the adaptive mode:
# UAC2 device
mkdir functions/uac2.usb0
echo "adaptive" > functions/uac2.usb0/c_sync
ln -s functions/uac2.usb0 configs/c.1

On the USB Host:
cat /proc/asound/Gadget/stream:
Playback:
   Status: Stop
   Interface 1
     Altset 1
     Format: S16_LE
     Channels: 2
     Endpoint: 0x01 (1 OUT) (ADAPTIVE)
     Rates: 64000
     Data packet interval: 125 us
     Bits: 16
     Channel map: FL FR


lsusb -v -d 1d6b:0104 | grep EP.*IN
         bEndpointAddress     0x81  EP 1 IN
         bEndpointAddress     0x82  EP 2 IN


The feedback EP-IN is gone because the mode is adaptive now.

If you think the new input endpoints should not be created by default 
for resource-compatibility reasons, the adaptive mode can be set by 
default in a fixed patch.

Also the patches defining the new interrupt endpoints can have the 
controls disabled by default (and not allocate the EP-IN). These patches 
on top of the async patches are already accepted by Greg for usb-next 
branch 
https://kernel.googlesource.com/pub/scm/linux/kernel/git/gregkh/usb/+/eaf6cbe0992052a46d93047dc122fad5126aa3bd 
. That's why I was trying to sort out the async patches without 
reverting them as it will call for more reverts.

Thanks,

Pavel.

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Andy Shevchenko <hidden>
Date: 2021-08-23 15:21:55

On Mon, Aug 23, 2021 at 5:59 PM Pavel Hofman [off-list ref] wrote:
Dne 22. 08. 21 v 21:43 Ferry Toth napsal(a):
quoted
Op 19-08-2021 om 23:04 schreef Pavel Hofman:
quoted
Dne 19. 08. 21 v 22:10 Ferry Toth napsal(a):
quoted
Op 19-08-2021 om 09:51 schreef Pavel Hofman:
quoted
Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
quoted
Op 18-08-2021 om 00:00 schreef Ferry Toth:
...
quoted
quoted
quoted
quoted
quoted
So, where do we go from here?
I know the patches have been tested on dwc2 (by me and others).  I
do not know if Ruslan or Jerome tested them on dwc3 but probably
not. Ruslan has talked about RPi (my case too) and BeagleboneBlack,
both with dwc2. Perhaps the dwc2 behaves a bit differently than dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have
not followed your long thread (it started as unrelated to uac). Does
the problem appear with f_uac1 or f_uac2? Please how have you
reached the above problem?
I'm sorry too. I first believed the issue was related to the patch
mentioned in the subject line.

The problem appaers with f_uac2. I bost Edison_Arduino board in host
mode (there is a switch allowing to select host/device mode). When
flipping the switch to device mode udev run a script:
But as I am using configfs (excerpt follows) and just disabling the
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
....
As you say, could perhaps the reason be that the extra EP-IN added in
those patches (previously 1, now 2 with the default config you use)
exceeds your EP-IN max count or available fifos somehow?  You have a
number of functions initialized. If you change the load order of the
functions, do you get the error later with a different function? Just
guessing...

You should be able to switch the default async EP-OUT (which
configures the new feedback EP-IN ) to adaptive EP-OUT (which requires
no feedback EP) with c_sync=8 parameter of f_uac2.

https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c#L47

https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c#L830

https://elixir.bootlin.com/linux/v5.14-rc6/source/include/uapi/linux/usb/ch9.h#L453

Does that fix the problem?
Not sure how to do that. Do you mean the module should have a parameter
called c_sync? `modinfo` list no parameters for usb_f_uac2.
Those are configfs params, not available in modinfo.

I checked and the value is "adaptive"
https://elixir.bootlin.com/linux/v5.14-rc7/source/drivers/usb/gadget/function/f_uac2.c#L1312
In your configfs script:
Kernel shouldn't crash with any available set of configuration
parameters, right? So, even if the parameter would fix the crash the
series is buggy and has to be reverted in my opinion.
# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1


On the USB Host:
cat /proc/asound/Gadget/stream:
Playback:
   Status: Stop
   Interface 1
     Altset 1
     Format: S16_LE
     Channels: 2
     Endpoint: 0x01 (1 OUT) (ASYNC)
     Rates: 64000
     Data packet interval: 125 us
     Bits: 16
     Channel map: FL FR
     Sync Endpoint: 0x82 (2 IN)
     Sync EP Interface: 1
     Sync EP Altset: 1
     Implicit Feedback Mode: No

lsusb -v -d 1d6b:0104 | | grep EP.*IN
         bEndpointAddress     0x81  EP 1 IN
         bEndpointAddress     0x82  EP 2 IN
         bEndpointAddress     0x83  EP 3 IN

I have additional patches applied which define controls via EP IN
interrupt mode, not part of that patchset.

Switching to the adaptive mode:
# UAC2 device
mkdir functions/uac2.usb0
echo "adaptive" > functions/uac2.usb0/c_sync
ln -s functions/uac2.usb0 configs/c.1

On the USB Host:
cat /proc/asound/Gadget/stream:
Playback:
   Status: Stop
   Interface 1
     Altset 1
     Format: S16_LE
     Channels: 2
     Endpoint: 0x01 (1 OUT) (ADAPTIVE)
     Rates: 64000
     Data packet interval: 125 us
     Bits: 16
     Channel map: FL FR

lsusb -v -d 1d6b:0104 | grep EP.*IN
         bEndpointAddress     0x81  EP 1 IN
         bEndpointAddress     0x82  EP 2 IN

The feedback EP-IN is gone because the mode is adaptive now.

If you think the new input endpoints should not be created by default
for resource-compatibility reasons, the adaptive mode can be set by
default in a fixed patch.
Would it be possible to change the mode? If so, then the user may
configure it and crash again.
Also the patches defining the new interrupt endpoints can have the
controls disabled by default (and not allocate the EP-IN). These patches
on top of the async patches are already accepted by Greg for usb-next
branch
https://kernel.googlesource.com/pub/scm/linux/kernel/git/gregkh/usb/+/eaf6cbe0992052a46d93047dc122fad5126aa3bd
. That's why I was trying to sort out the async patches without
reverting them as it will call for more reverts.
-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Pavel Hofman <hidden>
Date: 2021-08-23 15:35:08


Dne 23. 08. 21 v 17:21 Andy Shevchenko napsal(a):
On Mon, Aug 23, 2021 at 5:59 PM Pavel Hofman [off-list ref] wrote:
quoted
Dne 22. 08. 21 v 21:43 Ferry Toth napsal(a):
quoted
Op 19-08-2021 om 23:04 schreef Pavel Hofman:
quoted
Dne 19. 08. 21 v 22:10 Ferry Toth napsal(a):
quoted
Op 19-08-2021 om 09:51 schreef Pavel Hofman:
quoted
Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
quoted
Op 18-08-2021 om 00:00 schreef Ferry Toth:
...
quoted
quoted
quoted
quoted
quoted
quoted
So, where do we go from here?
I know the patches have been tested on dwc2 (by me and others).  I
do not know if Ruslan or Jerome tested them on dwc3 but probably
not. Ruslan has talked about RPi (my case too) and BeagleboneBlack,
both with dwc2. Perhaps the dwc2 behaves a bit differently than dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have
not followed your long thread (it started as unrelated to uac). Does
the problem appear with f_uac1 or f_uac2? Please how have you
reached the above problem?
I'm sorry too. I first believed the issue was related to the patch
mentioned in the subject line.

The problem appaers with f_uac2. I bost Edison_Arduino board in host
mode (there is a switch allowing to select host/device mode). When
flipping the switch to device mode udev run a script:
But as I am using configfs (excerpt follows) and just disabling the
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
....
As you say, could perhaps the reason be that the extra EP-IN added in
those patches (previously 1, now 2 with the default config you use)
exceeds your EP-IN max count or available fifos somehow?  You have a
number of functions initialized. If you change the load order of the
functions, do you get the error later with a different function? Just
guessing...

You should be able to switch the default async EP-OUT (which
configures the new feedback EP-IN ) to adaptive EP-OUT (which requires
no feedback EP) with c_sync=8 parameter of f_uac2.

https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c#L47

https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c#L830

https://elixir.bootlin.com/linux/v5.14-rc6/source/include/uapi/linux/usb/ch9.h#L453

Does that fix the problem?
Not sure how to do that. Do you mean the module should have a parameter
called c_sync? `modinfo` list no parameters for usb_f_uac2.
Those are configfs params, not available in modinfo.

I checked and the value is "adaptive"
https://elixir.bootlin.com/linux/v5.14-rc7/source/drivers/usb/gadget/function/f_uac2.c#L1312
quoted
In your configfs script:
Kernel shouldn't crash with any available set of configuration
parameters, right? So, even if the parameter would fix the crash the
series is buggy and has to be reverted in my opinion.
Sure, no problem with reverting. I am just trying to start up some 
troubleshooting. A resource exhaustion was mentioned here, that's why I 
suggested a way to test the patch with the original number of endpoints 
allocated. I do not get any crashes on my setup which uses fewer gadget 
functions. That's why I asked what happens if the functions load order 
is changed. I am afraid this thread is so complex that the actual 
problem has been burried in the history.

Again, I am not the author of the patches, my USB knowledge is way 
unsufficient for that. I am trying to make them work as they are 
important and make the existing audio gadget actually usable.

Thanks,

Pavel.

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Ferry Toth <hidden>
Date: 2021-08-23 18:55:00

Op 23-08-2021 om 17:34 schreef Pavel Hofman:

Dne 23. 08. 21 v 17:21 Andy Shevchenko napsal(a):
quoted
On Mon, Aug 23, 2021 at 5:59 PM Pavel Hofman 
[off-list ref] wrote:
quoted
Dne 22. 08. 21 v 21:43 Ferry Toth napsal(a):
quoted
Op 19-08-2021 om 23:04 schreef Pavel Hofman:
quoted
Dne 19. 08. 21 v 22:10 Ferry Toth napsal(a):
quoted
Op 19-08-2021 om 09:51 schreef Pavel Hofman:
quoted
Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
quoted
Op 18-08-2021 om 00:00 schreef Ferry Toth:
...
quoted
quoted
quoted
quoted
quoted
quoted
So, where do we go from here?
I know the patches have been tested on dwc2 (by me and others).  I
do not know if Ruslan or Jerome tested them on dwc3 but probably
not. Ruslan has talked about RPi (my case too) and BeagleboneBlack,
both with dwc2. Perhaps the dwc2 behaves a bit differently than 
dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have
not followed your long thread (it started as unrelated to uac). Does
the problem appear with f_uac1 or f_uac2? Please how have you
reached the above problem?
I'm sorry too. I first believed the issue was related to the patch
mentioned in the subject line.

The problem appaers with f_uac2. I bost Edison_Arduino board in host
mode (there is a switch allowing to select host/device mode). When
flipping the switch to device mode udev run a script:
But as I am using configfs (excerpt follows) and just disabling the
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
....
As you say, could perhaps the reason be that the extra EP-IN added in
those patches (previously 1, now 2 with the default config you use)
exceeds your EP-IN max count or available fifos somehow?  You have a
number of functions initialized. If you change the load order of the
functions, do you get the error later with a different function? Just
guessing...

You should be able to switch the default async EP-OUT (which
configures the new feedback EP-IN ) to adaptive EP-OUT (which requires
no feedback EP) with c_sync=8 parameter of f_uac2.

https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c#L47 


https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c#L830 


https://elixir.bootlin.com/linux/v5.14-rc6/source/include/uapi/linux/usb/ch9.h#L453 


Does that fix the problem?
Not sure how to do that. Do you mean the module should have a parameter
called c_sync? `modinfo` list no parameters for usb_f_uac2.
Those are configfs params, not available in modinfo.

I checked and the value is "adaptive"
https://elixir.bootlin.com/linux/v5.14-rc7/source/drivers/usb/gadget/function/f_uac2.c#L1312 
quoted
In your configfs script:
Kernel shouldn't crash with any available set of configuration
parameters, right? So, even if the parameter would fix the crash the
series is buggy and has to be reverted in my opinion.
I will send in reverts tomorrow, unless someone has a better idea.
Sure, no problem with reverting. I am just trying to start up some 
troubleshooting. A resource exhaustion was mentioned here, that's why I 
suggested a way to test the patch with the original number of endpoints 
allocated. I do not get any crashes on my setup which uses fewer gadget 
functions. That's why I asked what happens if the functions load order 
is changed. I am afraid this thread is so complex that the actual 
problem has been burried in the history.
I found some time to test your suggestions. So below 3 cases on rc6 with 
the reverts removed again:
1) the original configfs setup script
2) with uac2 moved to the top so it is created first (I hope)
3) same as 1) but with c_sync = adaptive

Summary:
1) still shows the crash as expected
2) has no effect
3) resolves the issue as you expect

1) Normal configfs order (uac2 last)
------------------------------------

root@yuna:~# [   50.975986] BUG: kernel NULL pointer dereference, 
address: 0000000000000008
[   50.983125] #PF: supervisor write access in kernel mode
[   50.988470] #PF: error_code(0x0002) - not-present page
[   50.993723] PGD 0 P4D 0
[   50.996327] Oops: 0002 [#1] SMP PTI
[   50.999899] CPU: 0 PID: 596 Comm: irq/14-dwc3 Tainted: G        W 
      5.14.0-rc6-edison-acpi-standard #1
[   51.009948] Hardware name: Intel Corporation Merrifield/BODEGA BAY, 
BIOS 542 2015.01.21:18.19.48
[   51.018922] RIP: 0010:dwc3_gadget_del_and_unmap_request+0x19/0xe0
[   51.025169] Code: 8b 78 08 e8 89 d6 ff ff 48 89 ef 5d e9 f0 61 a6 ff 
41 54 55 48 89 f5 53 48 8b 46 68 48 89 fb 48 8b 4e 60 4c 8b a7 90 00 00 
00 <48> 89 41 08 48 89 08 48 b8 00 01 00 00
00 00 ad de 80 a6 b4 00 00
[   51.044345] RSP: 0000:ffffb2ea40313c10 EFLAGS: 00010093
[   51.049692] RAX: ffff94dc03aa2c48 RBX: ffff94dc03aa2c00 RCX: 
0000000000000000
[   51.056985] RDX: 00000000ffffff94 RSI: ffff94dc02303d80 RDI: 
ffff94dc03aa2c00
[   51.064278] RBP: ffff94dc02303d80 R08: 0000000000000014 R09: 
0000000000000001
[   51.071572] R10: ffff94dc02303d80 R11: 0000000000000001 R12: 
ffff94dc08b43028
[   51.078864] R13: ffff94dc03aa2c48 R14: 0000000000000000 R15: 
ffff94dc031b3c00
[   51.086159] FS:  0000000000000000(0000) GS:ffff94dc3e200000(0000) 
knlGS:0000000000000000
[   51.094429] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   51.100304] CR2: 0000000000000008 CR3: 0000000007e20000 CR4: 
00000000001006f0
[   51.107596] Call Trace:
[   51.110103]  dwc3_remove_requests.constprop.0+0x12f/0x170
[   51.115637]  __dwc3_gadget_ep_disable+0x7a/0x160
[   51.120366]  dwc3_gadget_ep_disable+0x3d/0xd0
[   51.124827]  usb_ep_disable+0x1c/0x70
[   51.128586]  u_audio_stop_capture+0x79/0x120 [u_audio]
[   51.133857]  afunc_set_alt+0x73/0x80 [usb_f_uac2]
[   51.138683]  composite_setup+0x224/0x1b90 [libcomposite]
[   51.144137]  ? __dwc3_gadget_kick_transfer+0x160/0x400
[   51.149404]  ? configfs_composite_setup+0x6b/0x90 [libcomposite]
[   51.155562]  configfs_composite_setup+0x6b/0x90 [libcomposite]
[   51.161544]  dwc3_ep0_interrupt+0x466/0xa70
[   51.165831]  dwc3_thread_interrupt+0x829/0xe90
[   51.170379]  ? __schedule+0x235/0x6c0
[   51.174138]  ? disable_irq_nosync+0x10/0x10
[   51.178425]  irq_thread_fn+0x1b/0x60
[   51.182092]  irq_thread+0xc0/0x160
[   51.185580]  ? irq_thread_check_affinity+0x70/0x70
[   51.190486]  ? irq_forced_thread_fn+0x70/0x70
[   51.194948]  kthread+0x122/0x140
[   51.198259]  ? set_kthread_struct+0x40/0x40
[   51.202545]  ret_from_fork+0x22/0x30
[   51.206214] Modules linked in: usb_f_uac2 u_audio usb_f_mass_storage 
usb_f_eem u_ether usb_f_serial u_serial libcomposite rfcomm iptable_nat 
bnep spi_pxa2xx_platform snd_sof_nocodec dw_dmac smsc smsc95xx 
intel_mrfld_pwrbtn intel_mrfld_adc dw_dmac_pci pwm_lpss_pci dw_dmac_core 
pwm_lpss snd_sof_pci_intel_tng snd_sof_pci snd_sof_intel_ipc 
snd_sof_intel_atom snd_sof snd_sof_xtensa_dsp snd_soc_acpi 
spi_pxa2xx_pci brcmfmac brcmutil hci_uart btbcm ti_ads7950 
industrialio_triggered_buffer kfifo_buf leds_gpio ledtrig_timer 
ledtrig_heartbeat mmc_block extcon_intel_mrfld sdhci_pci cqhci sdhci 
led_class mmc_core intel_soc_pmic_mrfld btrfs libcrc32c xor 
zstd_compress zlib_deflate raid6_pq
[   51.267592] CR2: 0000000000000008
[   51.270981] ---[ end trace 135abe76b19414cc ]---

ferry@delfion:~$ cat /proc/asound/Gadget/stream0
USBArmory USBArmory Gadget at usb-0000:00:14.0-5, high speed : USB Audio

Playback:
   Status: Stop
   Interface 4
     Altset 1
     Format: S16_LE
     Channels: 2
     Endpoint: 0x04 (4 OUT) (ASYNC)
     Rates: 64000
     Data packet interval: 1000 us
     Bits: 16
     Channel map: FL FR
     Sync Endpoint: 0x85 (5 IN)
     Sync EP Interface: 4
     Sync EP Altset: 1
     Implicit Feedback Mode: No

Capture:
   Status: Stop
   Interface 5
     Altset 1
     Format: S16_LE
     Channels: 2
     Endpoint: 0x86 (6 IN) (ASYNC)
     Rates: 48000
     Data packet interval: 1000 us
     Bits: 16
     Channel map: FL FR

root@delfion:~# lsusb -v -d 1d6b:0104 | grep EP.*IN
         bEndpointAddress     0x82  EP 2 IN
         bEndpointAddress     0x83  EP 3 IN
         bEndpointAddress     0x84  EP 4 IN
         bEndpointAddress     0x85  EP 5 IN
         bEndpointAddress     0x86  EP 6 IN
can't get debug descriptor: Resource temporarily unavailable
cannot read device status, Resource temporarily unavailable (11)

2) uac2 first in configfs
-------------------------

root@yuna:~# [  172.094997] BUG: kernel NULL pointer dereference, 
address: 0000000000000008
[  172.102136] #PF: supervisor write access in kernel mode
[  172.107480] #PF: error_code(0x0002) - not-present page
[  172.112733] PGD 0 P4D 0
[  172.115338] Oops: 0002 [#1] SMP PTI
[  172.118909] CPU: 0 PID: 604 Comm: irq/14-dwc3 Tainted: G        W 
      5.14.0-rc6-edison-acpi-standard #1
[  172.128958] Hardware name: Intel Corporation Merrifield/BODEGA BAY, 
BIOS 542 2015.01.21:18.19.48
[  172.137931] RIP: 0010:dwc3_gadget_del_and_unmap_request+0x19/0xe0
[  172.144175] Code: 8b 78 08 e8 89 d6 ff ff 48 89 ef 5d e9 f0 61 a6 ff 
41 54 55 48 89 f5 53 48 8b 46 68 48 89 fb 48 8b 4e 60 4c 8b a7 90 00 00 
00 <48> 89 41 08 48 89 08 48 b8 00 01 00 00
00 00 ad de 80 a6 b4 00 00
[  172.163352] RSP: 0018:ffffa1438053bc10 EFLAGS: 00010097
[  172.168698] RAX: ffff9b76c7ec3848 RBX: ffff9b76c7ec3800 RCX: 
0000000000000000
[  172.175990] RDX: 00000000ffffff94 RSI: ffff9b76c79ffc00 RDI: 
ffff9b76c7ec3800
[  172.183283] RBP: ffff9b76c79ffc00 R08: 0000000000000014 R09: 
0000000000000001
[  172.190577] R10: ffff9b76c79ffc00 R11: 0000000000000002 R12: 
ffff9b76c8a66028
[  172.197870] R13: ffff9b76c7ec3848 R14: 0000000000000000 R15: 
ffff9b76c7255c00
[  172.205163] FS:  0000000000000000(0000) GS:ffff9b76fe200000(0000) 
knlGS:0000000000000000
[  172.213436] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  172.219309] CR2: 0000000000000008 CR3: 000000001360c000 CR4: 
00000000001006f0
[  172.226600] Call Trace:
[  172.229107]  dwc3_remove_requests.constprop.0+0x12f/0x170
[  172.234640]  __dwc3_gadget_ep_disable+0x7a/0x160
[  172.239372]  dwc3_gadget_ep_disable+0x3d/0xd0
[  172.243834]  usb_ep_disable+0x1c/0x70
[  172.247590]  u_audio_stop_capture+0x79/0x120 [u_audio]
[  172.252862]  afunc_set_alt+0x73/0x80 [usb_f_uac2]
[  172.257688]  composite_setup+0x224/0x1b90 [libcomposite]
[  172.263143]  ? __dwc3_gadget_kick_transfer+0x160/0x400
[  172.268410]  ? configfs_composite_setup+0x6b/0x90 [libcomposite]
[  172.274568]  configfs_composite_setup+0x6b/0x90 [libcomposite]
[  172.280551]  dwc3_ep0_interrupt+0x466/0xa70
[  172.284834]  ? newidle_balance.constprop.0+0xfa/0x380
[  172.290008]  dwc3_thread_interrupt+0x829/0xe90
[  172.294561]  ? __schedule+0x235/0x6c0
[  172.298316]  ? disable_irq_nosync+0x10/0x10
[  172.302606]  irq_thread_fn+0x1b/0x60
[  172.306272]  irq_thread+0xc0/0x160
[  172.309761]  ? irq_thread_check_affinity+0x70/0x70
[  172.314666]  ? irq_forced_thread_fn+0x70/0x70
[  172.319128]  kthread+0x122/0x140
[  172.322440]  ? set_kthread_struct+0x40/0x40
[  172.326724]  ret_from_fork+0x22/0x30
[  172.330390] Modules linked in: usb_f_mass_storage usb_f_eem u_ether 
usb_f_serial u_serial usb_f_uac2 u_audio libcomposite rfcomm iptable_nat 
bnep snd_sof_nocodec spi_pxa2xx_platform dw_dmac smsc smsc95xx 
pwm_lpss_pci pwm_lpss snd_sof_pci_intel_tng snd_sof_pci 
snd_sof_intel_ipc intel_mrfld_pwrbtn snd_sof_intel_atom intel_mrfld_adc 
dw_dmac_pci dw_dmac_core snd_sof snd_sof_xtensa_dsp snd_soc_acpi 
spi_pxa2xx_pci brcmfmac brcmutil hci_uart leds_gpio btbcm ti_ads7950 
industrialio_triggered_buffer kfifo_buf ledtrig_timer ledtrig_heartbeat 
mmc_block extcon_intel_mrfld sdhci_pci cqhci sdhci led_class mmc_core 
intel_soc_pmic_mrfld btrfs libcrc32c xor zstd_compress zlib_deflate raid6_pq
[  172.391766] CR2: 0000000000000008
[  172.395157] ---[ end trace 8272319264d5a2c0 ]---

3) With c_sync = adaptive
-------------------------
# UAC2 device
mkdir functions/uac2.usb0
echo "adaptive" > functions/uac2.usb0/c_sync
ln -s functions/uac2.usb0 configs/c.1

(No BUG)

root@delfion:~# cat /proc/asound/Gadget/stream0
USBArmory USBArmory Gadget at usb-0000:00:14.0-5, high speed : USB Audio

Playback:
   Status: Stop
   Interface 4
     Altset 1
     Format: S16_LE
     Channels: 2
     Endpoint: 0x04 (4 OUT) (ADAPTIVE)
     Rates: 64000
     Data packet interval: 1000 us
     Bits: 16
     Channel map: FL FR

Capture:
   Status: Stop
   Interface 5
     Altset 1
     Format: S16_LE
     Channels: 2
     Endpoint: 0x85 (5 IN) (ASYNC)
     Rates: 48000
     Data packet interval: 1000 us
     Bits: 16
     Channel map: FL FR


root@delfion:~# lsusb -v -d 1d6b:0104 |  grep EP.*IN
         bEndpointAddress     0x82  EP 2 IN
         bEndpointAddress     0x83  EP 3 IN
         bEndpointAddress     0x84  EP 4 IN
         bEndpointAddress     0x85  EP 5 IN
can't get debug descriptor: Resource temporarily unavailable
Again, I am not the author of the patches, my USB knowledge is way 
unsufficient for that. I am trying to make them work as they are 
important and make the existing audio gadget actually usable.
Thanks for the suggestions, I didn't think to set params through configfs.

Maybe this will help in tracing the root cause, although that's way over 
my head.
Thanks,

Pavel.

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Date: 2021-08-23 22:50:28

Pavel Hofman wrote:

Dne 23. 08. 21 v 17:21 Andy Shevchenko napsal(a):
quoted
On Mon, Aug 23, 2021 at 5:59 PM Pavel Hofman
[off-list ref] wrote:
quoted
Dne 22. 08. 21 v 21:43 Ferry Toth napsal(a):
quoted
Op 19-08-2021 om 23:04 schreef Pavel Hofman:
quoted
Dne 19. 08. 21 v 22:10 Ferry Toth napsal(a):
quoted
Op 19-08-2021 om 09:51 schreef Pavel Hofman:
quoted
Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
quoted
Op 18-08-2021 om 00:00 schreef Ferry Toth:
...
quoted
quoted
quoted
quoted
quoted
quoted
So, where do we go from here?
I know the patches have been tested on dwc2 (by me and others).  I
do not know if Ruslan or Jerome tested them on dwc3 but probably
not. Ruslan has talked about RPi (my case too) and BeagleboneBlack,
both with dwc2. Perhaps the dwc2 behaves a bit differently than
dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have
not followed your long thread (it started as unrelated to uac). Does
the problem appear with f_uac1 or f_uac2? Please how have you
reached the above problem?
I'm sorry too. I first believed the issue was related to the patch
mentioned in the subject line.

The problem appaers with f_uac2. I bost Edison_Arduino board in host
mode (there is a switch allowing to select host/device mode). When
flipping the switch to device mode udev run a script:
But as I am using configfs (excerpt follows) and just disabling the
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
....
As you say, could perhaps the reason be that the extra EP-IN added in
those patches (previously 1, now 2 with the default config you use)
exceeds your EP-IN max count or available fifos somehow?  You have a
number of functions initialized. If you change the load order of the
functions, do you get the error later with a different function? Just
guessing...

You should be able to switch the default async EP-OUT (which
configures the new feedback EP-IN ) to adaptive EP-OUT (which requires
no feedback EP) with c_sync=8 parameter of f_uac2.

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c*L47__;Iw!!A4F2R9G_pg!LBySrM_zgMGV0x-zZ7nSrs54yJw1GlnpUVUVxdQE8PeszSMZ6OkFX8lSoigwRbWQzLcU$

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c*L830__;Iw!!A4F2R9G_pg!LBySrM_zgMGV0x-zZ7nSrs54yJw1GlnpUVUVxdQE8PeszSMZ6OkFX8lSoigwRfP5TdZC$

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/include/uapi/linux/usb/ch9.h*L453__;Iw!!A4F2R9G_pg!LBySrM_zgMGV0x-zZ7nSrs54yJw1GlnpUVUVxdQE8PeszSMZ6OkFX8lSoigwRejzMbWO$

Does that fix the problem?
Not sure how to do that. Do you mean the module should have a parameter
called c_sync? `modinfo` list no parameters for usb_f_uac2.
Those are configfs params, not available in modinfo.

I checked and the value is "adaptive"
https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc7/source/drivers/usb/gadget/function/f_uac2.c*L1312__;Iw!!A4F2R9G_pg!LBySrM_zgMGV0x-zZ7nSrs54yJw1GlnpUVUVxdQE8PeszSMZ6OkFX8lSoigwRTETcbsN$
quoted
In your configfs script:
Kernel shouldn't crash with any available set of configuration
parameters, right? So, even if the parameter would fix the crash the
series is buggy and has to be reverted in my opinion.
Sure, no problem with reverting. I am just trying to start up some
troubleshooting. A resource exhaustion was mentioned here, that's why I
suggested a way to test the patch with the original number of endpoints
allocated. I do not get any crashes on my setup which uses fewer gadget
functions. That's why I asked what happens if the functions load order
is changed. I am afraid this thread is so complex that the actual
problem has been burried in the history.
As I pointed out previously, the crash is probably because of f_uac2
prematurely freeing feedback request before its completion.
usb_ep_dequeue() is asynchronous. dwc2() may treat it as a synchronous
call so you didn't get a crash.
Again, I am not the author of the patches, my USB knowledge is way
unsufficient for that. I am trying to make them work as they are
important and make the existing audio gadget actually usable.
I'm not sure how easy it is for you to obtain/test a device with dwc3,
but it would be great to also have it as part of your testing suite. :)

Thanks,
Thinh

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Pavel Hofman <hidden>
Date: 2021-08-24 05:39:48


Dne 24. 08. 21 v 0:50 Thinh Nguyen napsal(a):
Pavel Hofman wrote:
quoted

Dne 23. 08. 21 v 17:21 Andy Shevchenko napsal(a):
quoted
On Mon, Aug 23, 2021 at 5:59 PM Pavel Hofman
[off-list ref] wrote:
quoted
Dne 22. 08. 21 v 21:43 Ferry Toth napsal(a):
quoted
Op 19-08-2021 om 23:04 schreef Pavel Hofman:
quoted
Dne 19. 08. 21 v 22:10 Ferry Toth napsal(a):
quoted
Op 19-08-2021 om 09:51 schreef Pavel Hofman:
quoted
Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
quoted
Op 18-08-2021 om 00:00 schreef Ferry Toth:
...
quoted
quoted
quoted
quoted
quoted
quoted
So, where do we go from here?
I know the patches have been tested on dwc2 (by me and others).  I
do not know if Ruslan or Jerome tested them on dwc3 but probably
not. Ruslan has talked about RPi (my case too) and BeagleboneBlack,
both with dwc2. Perhaps the dwc2 behaves a bit differently than
dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have
not followed your long thread (it started as unrelated to uac). Does
the problem appear with f_uac1 or f_uac2? Please how have you
reached the above problem?
I'm sorry too. I first believed the issue was related to the patch
mentioned in the subject line.

The problem appaers with f_uac2. I bost Edison_Arduino board in host
mode (there is a switch allowing to select host/device mode). When
flipping the switch to device mode udev run a script:
But as I am using configfs (excerpt follows) and just disabling the
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
....
As you say, could perhaps the reason be that the extra EP-IN added in
those patches (previously 1, now 2 with the default config you use)
exceeds your EP-IN max count or available fifos somehow?  You have a
number of functions initialized. If you change the load order of the
functions, do you get the error later with a different function? Just
guessing...

You should be able to switch the default async EP-OUT (which
configures the new feedback EP-IN ) to adaptive EP-OUT (which requires
no feedback EP) with c_sync=8 parameter of f_uac2.

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c*L47__;Iw!!A4F2R9G_pg!LBySrM_zgMGV0x-zZ7nSrs54yJw1GlnpUVUVxdQE8PeszSMZ6OkFX8lSoigwRbWQzLcU$

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c*L830__;Iw!!A4F2R9G_pg!LBySrM_zgMGV0x-zZ7nSrs54yJw1GlnpUVUVxdQE8PeszSMZ6OkFX8lSoigwRfP5TdZC$

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/include/uapi/linux/usb/ch9.h*L453__;Iw!!A4F2R9G_pg!LBySrM_zgMGV0x-zZ7nSrs54yJw1GlnpUVUVxdQE8PeszSMZ6OkFX8lSoigwRejzMbWO$

Does that fix the problem?
Not sure how to do that. Do you mean the module should have a parameter
called c_sync? `modinfo` list no parameters for usb_f_uac2.
Those are configfs params, not available in modinfo.

I checked and the value is "adaptive"
https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc7/source/drivers/usb/gadget/function/f_uac2.c*L1312__;Iw!!A4F2R9G_pg!LBySrM_zgMGV0x-zZ7nSrs54yJw1GlnpUVUVxdQE8PeszSMZ6OkFX8lSoigwRTETcbsN$
quoted
In your configfs script:
Kernel shouldn't crash with any available set of configuration
parameters, right? So, even if the parameter would fix the crash the
series is buggy and has to be reverted in my opinion.
Sure, no problem with reverting. I am just trying to start up some
troubleshooting. A resource exhaustion was mentioned here, that's why I
suggested a way to test the patch with the original number of endpoints
allocated. I do not get any crashes on my setup which uses fewer gadget
functions. That's why I asked what happens if the functions load order
is changed. I am afraid this thread is so complex that the actual
problem has been burried in the history.
As I pointed out previously, the crash is probably because of f_uac2
prematurely freeing feedback request before its completion.
usb_ep_dequeue() is asynchronous. dwc2() may treat it as a synchronous
call so you didn't get a crash.
Thanks for your hint, it greatly helps.
quoted
I'm not sure how easy it is for you to obtain/test a device with dwc3,
but it would be great to also have it as part of your testing suite. :)
Can you recommend a reasonably priced device with viable kernel updates 
for the testing? Optionally with SS which you mentioned last time? Thanks.

Best regards,

Pavel.

Re: [PATCH v10 0/6] Re-introduce TX FIFO resize for larger EP bursting

From: Ferry Toth <hidden>
Date: 2021-08-24 13:44:49

Hi

Op 24-08-2021 om 07:39 schreef Pavel Hofman:

Dne 24. 08. 21 v 0:50 Thinh Nguyen napsal(a):
quoted
Pavel Hofman wrote:
quoted

Dne 23. 08. 21 v 17:21 Andy Shevchenko napsal(a):
quoted
On Mon, Aug 23, 2021 at 5:59 PM Pavel Hofman
[off-list ref] wrote:
quoted
Dne 22. 08. 21 v 21:43 Ferry Toth napsal(a):
quoted
Op 19-08-2021 om 23:04 schreef Pavel Hofman:
quoted
Dne 19. 08. 21 v 22:10 Ferry Toth napsal(a):
quoted
Op 19-08-2021 om 09:51 schreef Pavel Hofman:
quoted
Dne 18. 08. 21 v 21:07 Ferry Toth napsal(a):
quoted
Op 18-08-2021 om 00:00 schreef Ferry Toth:
...
quoted
quoted
quoted
quoted
quoted
quoted
So, where do we go from here?
I know the patches have been tested on dwc2 (by me and 
others).  I
do not know if Ruslan or Jerome tested them on dwc3 but probably
not. Ruslan has talked about RPi (my case too) and 
BeagleboneBlack,
both with dwc2. Perhaps the dwc2 behaves a bit differently than
dwc3?

The patches add a new EP-IN for async feedback. I am sorry I have
not followed your long thread (it started as unrelated to 
uac). Does
the problem appear with f_uac1 or f_uac2? Please how have you
reached the above problem?
I'm sorry too. I first believed the issue was related to the patch
mentioned in the subject line.

The problem appaers with f_uac2. I bost Edison_Arduino board in 
host
mode (there is a switch allowing to select host/device mode). When
flipping the switch to device mode udev run a script:
But as I am using configfs (excerpt follows) and just disabling 
the
last 2 line resolves the issue, I'm guessing uac2 is the issue. Or
exceeding the available resources.

# Create directory structure
mkdir "${GADGET_BASE_DIR}"
cd "${GADGET_BASE_DIR}"
mkdir -p configs/c.1/strings/0x409
mkdir -p strings/0x409

# Serial device
mkdir functions/gser.usb0
ln -s functions/gser.usb0 configs/c.1/
###

# Ethernet device
mkdir functions/eem.usb0
echo "${DEV_ETH_ADDR}" > functions/eem.usb0/dev_addr
echo "${HOST_ETH_ADDR}" > functions/eem.usb0/host_addr
ln -s functions/eem.usb0 configs/c.1/

# Mass Storage device
mkdir functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo "${USBDISK}" > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/

# UAC2 device
mkdir functions/uac2.usb0
ln -s functions/uac2.usb0 configs/c.1
....
As you say, could perhaps the reason be that the extra EP-IN 
added in
those patches (previously 1, now 2 with the default config you use)
exceeds your EP-IN max count or available fifos somehow?  You 
have a
number of functions initialized. If you change the load order of 
the
functions, do you get the error later with a different function? 
Just
guessing...

You should be able to switch the default async EP-OUT (which
configures the new feedback EP-IN ) to adaptive EP-OUT (which 
requires
no feedback EP) with c_sync=8 parameter of f_uac2.

https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c*L47__;Iw!!A4F2R9G_pg!LBySrM_zgMGV0x-zZ7nSrs54yJw1GlnpUVUVxdQE8PeszSMZ6OkFX8lSoigwRbWQzLcU$ 


https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/drivers/usb/gadget/function/f_uac2.c*L830__;Iw!!A4F2R9G_pg!LBySrM_zgMGV0x-zZ7nSrs54yJw1GlnpUVUVxdQE8PeszSMZ6OkFX8lSoigwRfP5TdZC$ 


https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc6/source/include/uapi/linux/usb/ch9.h*L453__;Iw!!A4F2R9G_pg!LBySrM_zgMGV0x-zZ7nSrs54yJw1GlnpUVUVxdQE8PeszSMZ6OkFX8lSoigwRejzMbWO$ 


Does that fix the problem?
Not sure how to do that. Do you mean the module should have a 
parameter
called c_sync? `modinfo` list no parameters for usb_f_uac2.
Those are configfs params, not available in modinfo.

I checked and the value is "adaptive"
https://urldefense.com/v3/__https://elixir.bootlin.com/linux/v5.14-rc7/source/drivers/usb/gadget/function/f_uac2.c*L1312__;Iw!!A4F2R9G_pg!LBySrM_zgMGV0x-zZ7nSrs54yJw1GlnpUVUVxdQE8PeszSMZ6OkFX8lSoigwRTETcbsN$ 
quoted
In your configfs script:
Kernel shouldn't crash with any available set of configuration
parameters, right? So, even if the parameter would fix the crash the
series is buggy and has to be reverted in my opinion.
Sure, no problem with reverting. I am just trying to start up some
troubleshooting. A resource exhaustion was mentioned here, that's why I
suggested a way to test the patch with the original number of endpoints
allocated. I do not get any crashes on my setup which uses fewer gadget
functions. That's why I asked what happens if the functions load order
is changed. I am afraid this thread is so complex that the actual
problem has been burried in the history.
As I pointed out previously, the crash is probably because of f_uac2
prematurely freeing feedback request before its completion.
usb_ep_dequeue() is asynchronous. dwc2() may treat it as a synchronous
call so you didn't get a crash.
Thanks for your hint, it greatly helps.
quoted
quoted
I'm not sure how easy it is for you to obtain/test a device with dwc3,
but it would be great to also have it as part of your testing suite. :)
Can you recommend a reasonably priced device with viable kernel 
updates for the testing? Optionally with SS which you mentioned last 
time? Thanks.
Edison-Arduino kit 2nd hand with display on ebay ~$100 :-)
Best regards,

Pavel.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help