While using u-boot with qemu's virtio driver I stumbled across a problem reading files less than sector size. On the real hardware the block reader seems ok with reading zero blocks, and while we could fix the virtio host side of qemu to deal with a zero block read instead of crashing, the u-boot fat driver should not be doing zero block reads in the first place. If you ask hardware to read zero blocks you are just going to get zero data. There may also be other hardware that responds similarly to the virtio interface so this is worth fixing.

Without the patch I get the following and have to restart qemu because it dies. --------------------------------- => fatls virtio 0:1 30 cmdline.txt => fatload virtio 0:1 ${loadaddr} cmdline.txt qemu-system-aarch64: virtio: zero sized buffers are not allowed ---------------------------------

With the patch I get the expected results. --------------------------------- => fatls virtio 0:1 30 cmdline.txt => fatload virtio 0:1 ${loadaddr} cmdline.txt 30 bytes read in 11 ms (2 KiB/s) => md.b ${loadaddr} 0x1E 40080000: 64 77 63 5f 6f 74 67 2e 6c 70 6d 5f 65 6e 61 62 dwc_otg.lpm_enab 40080010: 6c 65 3d 30 20 72 6f 6f 74 77 61 69 74 0a le=0 rootwait.

---------------------------------

Signed-off-by: Jason Wessel jason.wessel@windriver.com Reviewed-by: Tom Rini trini@konsulko.com --- fs/fat/fat.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/fat/fat.c b/fs/fat/fat.c index 9578b74bae..28aa5aaa9f 100644 --- a/fs/fat/fat.c +++ b/fs/fat/fat.c @@ -278,7 +278,10 @@ get_cluster(fsdata *mydata, __u32 clustnum, __u8 *buffer, unsigned long size) } } else { idx = size / mydata->sect_size; - ret = disk_read(startsect, idx, buffer); + if (idx == 0) + ret = 0; + else + ret = disk_read(startsect, idx, buffer); if (ret != idx) { debug("Error reading data (got %d)\n", ret); return -1;

The xhci driver was causing intermittent 5 second delays from the USB keyboard polling hook. Executing something like a "sleep 1" for example would sleep for 5 seconds, unless an event occurred on the USB bus to shorten the delay.

Modeled after the code in the DWC2 driver, a nonblock state was added to quickly return instead of blocking for up to 5 seconds waiting for an event before timing out.

Signed-off-by: Jason Wessel jason.wessel@windriver.com --- drivers/usb/host/xhci-ring.c | 26 +++++++++++++++++--------- drivers/usb/host/xhci.c | 11 ++++++----- include/usb/xhci.h | 5 +++-- 3 files changed, 26 insertions(+), 16 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 86aeaab412..b7b2e16410 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -432,9 +432,11 @@ static int event_ready(struct xhci_ctrl *ctrl) * * @param ctrl Host controller data structure * @param expected TRB type expected from Event TRB + * @param nonblock when true do not block waiting for response * @return pointer to event trb */ -union xhci_trb *xhci_wait_for_event(struct xhci_ctrl *ctrl, trb_type expected) +union xhci_trb *xhci_wait_for_event(struct xhci_ctrl *ctrl, trb_type expected, + bool nonblock) { trb_type type; unsigned long ts = get_timer(0); @@ -442,8 +444,11 @@ union xhci_trb *xhci_wait_for_event(struct xhci_ctrl *ctrl, trb_type expected) do { union xhci_trb *event = ctrl->event_ring->dequeue;

- if (!event_ready(ctrl)) + if (!event_ready(ctrl)) { + if (nonblock) + return NULL; continue; + }

type = TRB_FIELD_TO_TYPE(le32_to_cpu(event->event_cmd.flags)); if (type == expected) @@ -493,7 +498,7 @@ static void abort_td(struct usb_device *udev, int ep_index)

xhci_queue_command(ctrl, NULL, udev->slot_id, ep_index, TRB_STOP_RING);

- event = xhci_wait_for_event(ctrl, TRB_TRANSFER); + event = xhci_wait_for_event(ctrl, TRB_TRANSFER, false); field = le32_to_cpu(event->trans_event.flags); BUG_ON(TRB_TO_SLOT_ID(field) != udev->slot_id); BUG_ON(TRB_TO_EP_INDEX(field) != ep_index); @@ -501,7 +506,7 @@ static void abort_td(struct usb_device *udev, int ep_index) != COMP_STOP))); xhci_acknowledge_event(ctrl);

- event = xhci_wait_for_event(ctrl, TRB_COMPLETION); + event = xhci_wait_for_event(ctrl, TRB_COMPLETION, false); BUG_ON(TRB_TO_SLOT_ID(le32_to_cpu(event->event_cmd.flags)) != udev->slot_id || GET_COMP_CODE(le32_to_cpu( event->event_cmd.status)) != COMP_SUCCESS); @@ -509,7 +514,7 @@ static void abort_td(struct usb_device *udev, int ep_index)

xhci_queue_command(ctrl, (void *)((uintptr_t)ring->enqueue | ring->cycle_state), udev->slot_id, ep_index, TRB_SET_DEQ); - event = xhci_wait_for_event(ctrl, TRB_COMPLETION); + event = xhci_wait_for_event(ctrl, TRB_COMPLETION, false); BUG_ON(TRB_TO_SLOT_ID(le32_to_cpu(event->event_cmd.flags)) != udev->slot_id || GET_COMP_CODE(le32_to_cpu( event->event_cmd.status)) != COMP_SUCCESS); @@ -552,10 +557,11 @@ static void record_transfer_result(struct usb_device *udev, * @param pipe contains the DIR_IN or OUT , devnum * @param length length of the buffer * @param buffer buffer to be read/written based on the request + * @param nonblock when true do not block waiting for response * @return returns 0 if successful else -1 on failure */ int xhci_bulk_tx(struct usb_device *udev, unsigned long pipe, - int length, void *buffer) + int length, void *buffer, bool nonblock) { int num_trbs = 0; struct xhci_generic_trb *start_trb; @@ -714,8 +720,10 @@ int xhci_bulk_tx(struct usb_device *udev, unsigned long pipe,

giveback_first_trb(udev, ep_index, start_cycle, start_trb);

- event = xhci_wait_for_event(ctrl, TRB_TRANSFER); + event = xhci_wait_for_event(ctrl, TRB_TRANSFER, nonblock); if (!event) { + if (nonblock) + return -EINVAL; debug("XHCI bulk transfer timed out, aborting...\n"); abort_td(udev, ep_index); udev->status = USB_ST_NAK_REC; /* closest thing to a timeout */ @@ -911,7 +919,7 @@ int xhci_ctrl_tx(struct usb_device *udev, unsigned long pipe,

giveback_first_trb(udev, ep_index, start_cycle, start_trb);

- event = xhci_wait_for_event(ctrl, TRB_TRANSFER); + event = xhci_wait_for_event(ctrl, TRB_TRANSFER, false); if (!event) goto abort; field = le32_to_cpu(event->trans_event.flags); @@ -929,7 +937,7 @@ int xhci_ctrl_tx(struct usb_device *udev, unsigned long pipe, if (GET_COMP_CODE(le32_to_cpu(event->trans_event.transfer_len)) == COMP_SHORT_TX) { /* Short data stage, clear up additional status stage event */ - event = xhci_wait_for_event(ctrl, TRB_TRANSFER); + event = xhci_wait_for_event(ctrl, TRB_TRANSFER, false); if (!event) goto abort; BUG_ON(TRB_TO_SLOT_ID(field) != slot_id); diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index f635bb39f6..57d799e4cb 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -495,7 +495,7 @@ static int xhci_configure_endpoints(struct usb_device *udev, bool ctx_change) xhci_flush_cache((uintptr_t)in_ctx->bytes, in_ctx->size); xhci_queue_command(ctrl, in_ctx->bytes, udev->slot_id, 0, ctx_change ? TRB_EVAL_CONTEXT : TRB_CONFIG_EP); - event = xhci_wait_for_event(ctrl, TRB_COMPLETION); + event = xhci_wait_for_event(ctrl, TRB_COMPLETION, false); BUG_ON(TRB_TO_SLOT_ID(le32_to_cpu(event->event_cmd.flags)) != udev->slot_id);

@@ -691,7 +691,7 @@ static int xhci_address_device(struct usb_device *udev, int root_portnr) ctrl_ctx->drop_flags = 0;

xhci_queue_command(ctrl, (void *)ctrl_ctx, slot_id, 0, TRB_ADDR_DEV); - event = xhci_wait_for_event(ctrl, TRB_COMPLETION); + event = xhci_wait_for_event(ctrl, TRB_COMPLETION, false); BUG_ON(TRB_TO_SLOT_ID(le32_to_cpu(event->event_cmd.flags)) != slot_id);

switch (GET_COMP_CODE(le32_to_cpu(event->event_cmd.status))) { @@ -766,7 +766,7 @@ static int _xhci_alloc_device(struct usb_device *udev) }

xhci_queue_command(ctrl, NULL, 0, 0, TRB_ENABLE_SLOT); - event = xhci_wait_for_event(ctrl, TRB_COMPLETION); + event = xhci_wait_for_event(ctrl, TRB_COMPLETION, false); BUG_ON(GET_COMP_CODE(le32_to_cpu(event->event_cmd.status)) != COMP_SUCCESS);

@@ -1152,6 +1152,7 @@ unknown: * @param buffer buffer to be read/written based on the request * @param length length of the buffer * @param interval interval of the interrupt + * @param nonblock when true do not block waiting for response * @return 0 */ static int _xhci_submit_int_msg(struct usb_device *udev, unsigned long pipe, @@ -1169,7 +1170,7 @@ static int _xhci_submit_int_msg(struct usb_device *udev, unsigned long pipe, * (at most) one TD. A TD (comprised of sg list entries) can * take several service intervals to transmit. */ - return xhci_bulk_tx(udev, pipe, length, buffer); + return xhci_bulk_tx(udev, pipe, length, buffer, nonblock); }

/** @@ -1189,7 +1190,7 @@ static int _xhci_submit_bulk_msg(struct usb_device *udev, unsigned long pipe, return -EINVAL; }

- return xhci_bulk_tx(udev, pipe, length, buffer); + return xhci_bulk_tx(udev, pipe, length, buffer, false); }

/** diff --git a/include/usb/xhci.h b/include/usb/xhci.h index 7d34103fd5..73db77fc02 100644 --- a/include/usb/xhci.h +++ b/include/usb/xhci.h @@ -1249,9 +1249,10 @@ void xhci_setup_addressable_virt_dev(struct xhci_ctrl *ctrl, void xhci_queue_command(struct xhci_ctrl *ctrl, u8 *ptr, u32 slot_id, u32 ep_index, trb_type cmd); void xhci_acknowledge_event(struct xhci_ctrl *ctrl); -union xhci_trb *xhci_wait_for_event(struct xhci_ctrl *ctrl, trb_type expected); +union xhci_trb *xhci_wait_for_event(struct xhci_ctrl *ctrl, trb_type expected, + bool nonblock); int xhci_bulk_tx(struct usb_device *udev, unsigned long pipe, - int length, void *buffer); + int length, void *buffer, bool nonblock); int xhci_ctrl_tx(struct usb_device *udev, unsigned long pipe, struct devrequest *req, int length, void *buffer); int xhci_check_maxpacket(struct usb_device *udev);

When resetting the rpi3 board sometimes it will display: USB device not accepting new address (error=0)

After the message appears, the usb keyboard will not work. It seems that the configuration actually did succeed however. Checking the device status for a return code of zero and continuing allows the usb keyboard and other usb devices to work function.

Signed-off-by: Jason Wessel jason.wessel@windriver.com --- common/usb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/common/usb.c b/common/usb.c index aad13fd9c5..0eb5d40a2d 100644 --- a/common/usb.c +++ b/common/usb.c @@ -1054,11 +1054,12 @@ static int usb_prepare_device(struct usb_device *dev, int addr, bool do_read, dev->devnum = addr;

err = usb_set_address(dev); /* set address */ - - if (err < 0) { + if (err < 0) + debug("\n usb_set_address return < 0\n"); + if (err < 0 && dev->status != 0) { printf("\n USB device not accepting new address " \ "(error=%lX)\n", dev->status); - return err; + return err; }

mdelay(10); /* Let the SET_ADDRESS settle */

If a "usb reset" is issued when the poll_pend state is set the abort_td() function will hit one of the BUG() statements in abort_td() or the BUG() statement at the end of xhci_wait_for_event().

The controller has been reset, so the rest of the cleanup should be skipped and poll_pend flag should be cleared.

Signed-off-by: Jason Wessel jason.wessel@windriver.com --- drivers/usb/host/xhci-ring.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index d6339f4f0a..f2a07204cd 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -483,6 +483,8 @@ union xhci_trb *xhci_wait_for_event(struct xhci_ctrl *ctrl, trb_type expected, if (expected == TRB_TRANSFER) return NULL;

+ if (poll_pend) + return NULL; printf("XHCI timeout on event type %d... cannot recover.\n", expected); BUG(); } @@ -505,11 +507,16 @@ static void abort_td(struct usb_device *udev, int ep_index) xhci_queue_command(ctrl, NULL, udev->slot_id, ep_index, TRB_STOP_RING);

event = xhci_wait_for_event(ctrl, TRB_TRANSFER, false); - field = le32_to_cpu(event->trans_event.flags); - BUG_ON(TRB_TO_SLOT_ID(field) != udev->slot_id); - BUG_ON(TRB_TO_EP_INDEX(field) != ep_index); - BUG_ON(GET_COMP_CODE(le32_to_cpu(event->trans_event.transfer_len - != COMP_STOP))); + if (event) { + field = le32_to_cpu(event->trans_event.flags); + BUG_ON(TRB_TO_SLOT_ID(field) != udev->slot_id); + BUG_ON(TRB_TO_EP_INDEX(field) != ep_index); + BUG_ON(GET_COMP_CODE(le32_to_cpu(event->trans_event.transfer_len + != COMP_STOP))); + } else { + debug("XHCI abort timeout\n"); + return; + } xhci_acknowledge_event(ctrl);

event = xhci_wait_for_event(ctrl, TRB_COMPLETION, false);

This commit fixes a serious issue occurring when several network commands are run on a raspberry pi 4 board: for instance a "dhcp" command and then one or several "tftp" commands. In this case, packet recv callbacks were called several times on the same packets, and send function was failing most of the time.

note: if the boot procedure is made of a single network command, the issue is not visible.

The issue is related to management of the packet ring buffers (producer / consumer) and DMA. Each time a packet is received, the ethernet device stores it in the buffer and increments an index called RDMA_PROD_INDEX. Each time the driver outputs a received packet, it increments another index called RDMA_CONS_INDEX.

Between each pair of network commands, as part of the driver 'start' function, previous code tried to reset both RDMA_CONS_INDEX and RDMA_PROD_INDEX to 0. But RDMA_PROD_INDEX cannot be written from driver side, thus its value was actually not updated, and only RDMA_CONS_INDEX was reset to 0. This was resulting in a major synchronization issue between the driver and the device. Most visible behavior was that the driver seemed to receive again the packets from the previous commands (e.g. DHCP response packets "received" again when performing the first TFTP command).

This fix consists in setting RDMA_CONS_INDEX to the same value as RDMA_PROD_INDEX, when resetting the driver.

The same kind of fix was needed on the TX side, and a few variables had to be reset accordingly (c_index, tx_index, rx_index).

The rx_index and tx_index have only 256 entries so the bottom 8 bits must be masked off.

Originated-by: Etienne Dublé etienne.duble@imag.fr Signed-off-by: Jason Wessel jason.wessel@windriver.com --- drivers/net/bcmgenet.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/net/bcmgenet.c b/drivers/net/bcmgenet.c index 11b6148ab6..1b7e7ba2bf 100644 --- a/drivers/net/bcmgenet.c +++ b/drivers/net/bcmgenet.c @@ -378,8 +378,6 @@ static void rx_descs_init(struct bcmgenet_eth_priv *priv) u32 len_stat, i; void *desc_base = priv->rx_desc_base;

- priv->c_index = 0; - len_stat = (RX_BUF_LENGTH << DMA_BUFLENGTH_SHIFT) | DMA_OWN;

for (i = 0; i < RX_DESCS; i++) { @@ -403,8 +401,11 @@ static void rx_ring_init(struct bcmgenet_eth_priv *priv) writel(RX_DESCS * DMA_DESC_SIZE / 4 - 1, priv->mac_reg + RDMA_RING_REG_BASE + DMA_END_ADDR);

- writel(0x0, priv->mac_reg + RDMA_PROD_INDEX); - writel(0x0, priv->mac_reg + RDMA_CONS_INDEX); + /* cannot init RDMA_PROD_INDEX to 0, so align RDMA_CONS_INDEX on it instead */ + priv->c_index = readl(priv->mac_reg + RDMA_PROD_INDEX); + writel(priv->c_index, priv->mac_reg + RDMA_CONS_INDEX); + priv->rx_index = priv->c_index; + priv->rx_index &= 0xFF; writel((RX_DESCS << DMA_RING_SIZE_SHIFT) | RX_BUF_LENGTH, priv->mac_reg + RDMA_RING_REG_BASE + DMA_RING_BUF_SIZE); writel(DMA_FC_THRESH_VALUE, priv->mac_reg + RDMA_XON_XOFF_THRESH); @@ -421,8 +422,10 @@ static void tx_ring_init(struct bcmgenet_eth_priv *priv) writel(0x0, priv->mac_reg + TDMA_WRITE_PTR); writel(TX_DESCS * DMA_DESC_SIZE / 4 - 1, priv->mac_reg + TDMA_RING_REG_BASE + DMA_END_ADDR); - writel(0x0, priv->mac_reg + TDMA_PROD_INDEX); - writel(0x0, priv->mac_reg + TDMA_CONS_INDEX); + /* cannot init TDMA_CONS_INDEX to 0, so align TDMA_PROD_INDEX on it instead */ + priv->tx_index = readl(priv->mac_reg + TDMA_CONS_INDEX); + writel(priv->tx_index, priv->mac_reg + TDMA_PROD_INDEX); + priv->tx_index &= 0xFF; writel(0x1, priv->mac_reg + TDMA_RING_REG_BASE + DMA_MBUF_DONE_THRESH); writel(0x0, priv->mac_reg + TDMA_FLOW_PERIOD); writel((TX_DESCS << DMA_RING_SIZE_SHIFT) | RX_BUF_LENGTH, @@ -469,8 +472,6 @@ static int bcmgenet_gmac_eth_start(struct udevice *dev)

priv->tx_desc_base = priv->mac_reg + GENET_TX_OFF; priv->rx_desc_base = priv->mac_reg + GENET_RX_OFF; - priv->tx_index = 0x0; - priv->rx_index = 0x0;

bcmgenet_umac_reset(priv);