From: Guenter Roeck <linux@roeck-us.net>
To: Alan Stern <stern@rowland.harvard.edu>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-usb@vger.kernel.org, Gerd Hoffmann <kraxel@redhat.com>,
qemu-devel@nongnu.org
Subject: Problems (timeouts) when testing usb-ohci with qemu
Date: Tue, 23 Apr 2024 10:04:17 -0700 [thread overview]
Message-ID: <4664cf39-5dfe-4557-959d-149640ca36e1@roeck-us.net> (raw)
Hi,
when testing usb-ohci with qemu's pci-ohci emulation, I keep getting
random usb interface timeouts. Sometimes the usb_hub_wq times out.
[ 9.555666] Waiting for root device /dev/sda...
[ 62.452625] INFO: task kworker/0:2:42 blocked for more than 30 seconds.
[ 62.453036] Tainted: G N 6.9.0-rc1-00305-geae7a41d2233 #1
[ 62.453393] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 62.453778] task:kworker/0:2 state:D stack:0 pid:42 tgid:42 ppid:2 flags:0x00000000
[ 62.454700] Workqueue: usb_hub_wq hub_event
[ 62.455137] Call Trace:
[ 62.455416] [<c0b47836>] __schedule+0x35c/0xe00
[ 62.455708] [<c0b4830c>] schedule+0x32/0x178
[ 62.455906] [<c07da782>] usb_kill_urb+0xa8/0xda
[ 62.456220] [<c07db53c>] usb_start_wait_urb+0xca/0xe2
[ 62.456441] [<c07db5ee>] usb_control_msg+0x9a/0x102
[ 62.456648] [<c07d3970>] hub_port_init+0x5de/0xb40
[ 62.456851] [<c07d67fe>] hub_event+0xb90/0x1364
[ 62.457049] [<c002ead6>] process_one_work+0x200/0x564
Sometimes there is an i/o scheduling timeout such as
[ 6.361811] Run /sbin/init as init process
[ 93.167039] INFO: task kworker/u4:0:10 blocked for more than 30 seconds.
[ 93.167715] Tainted: G N 6.9.0-rc5-00036-gaece0dd54838 #4
[ 93.168169] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 93.168607] task:kworker/u4:0 state:D stack:0 pid:10 tgid:10 ppid:2 flags:0x00000000
[ 93.169602] Workqueue: scsi_tmf_0 scmd_eh_abort_handler
[ 93.170278] Call Trace:
[ 93.170584] [<c0b3a70e>] __schedule+0x358/0xd4e
[ 93.170904] [<c0b3b136>] schedule+0x32/0x166
[ 93.171161] [<c0b41d6c>] schedule_timeout+0xd8/0x10a
[ 93.171420] [<c0b3ba0e>] __wait_for_common+0xce/0x1ce
[ 93.171604] [<c0b3bb2a>] wait_for_completion+0x1c/0x24
[ 93.171716] [<c0810a70>] command_abort_matching.part.0+0x38/0x52
[ 93.171841] [<c0810ac0>] command_abort+0x36/0x70
[ 93.171946] [<c06970a4>] scmd_eh_abort_handler+0xa6/0x192
...
This is not a new problem; I have seen it forever. Recently I spent some
time trying to understand the problem and found that the linux driver does
not always handle all ohci interupts. Since the interrupt is shared and
thus level triggered, that means that interrupts are still pending when
ohci_irq() exits. The interrupt core in Linux does not re-enter the
interrupt handler, presumably because it is marked as shared interrupt
and returns that the interrupt has been handled.
I found two possible fixes for the problem. One essentially mirrors the
code from ehci_irq(), the other adds a (bad) kludge into qemu. Both "fix"
or work around the problem.
Question is: What is actually wrong ? Something in the generic interrupt
handling code in Linux, something in the Linux usb-ohci driver, or
something in qemu ? Any idea how a proper fix might look like ?
Thanks,
Guenter
---
Linux hack:
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 4f9982ecfb58..48d523e71ea0 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -883,6 +883,7 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd)
* optimization of checking the LSB of hcca->done_head; it doesn't
* work on all systems (edge triggering for OHCI can be a factor).
*/
+retry:
ints = ohci_readl(ohci, ®s->intrstatus);
/* Check for an all 1's result which is a typical consequence
@@ -982,6 +983,14 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd)
}
spin_unlock(&ohci->lock);
+ ints = ohci_readl(ohci, ®s->intrstatus);
+ ints &= ohci_readl(ohci, ®s->intrenable);
+ if (ints) {
+ pr_err("######## Interrupts still pending 0x%x mask 0x%x\n", ints,
+ ohci_readl(ohci, ®s->intrenable));
+ goto retry;
+ }
+
return IRQ_HANDLED;
}
---
qemu hack:
hw/usb/hcd-ohci.c | 11 +++++++++++
hw/usb/hcd-ohci.h | 1 +
2 files changed, 12 insertions(+)
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index fc8fc91a1d..99e52ad13a 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -267,6 +267,10 @@ static inline void ohci_intr_update(OHCIState *ohci)
(ohci->intr_status & ohci->intr))
level = 1;
+ if (level && ohci->level)
+ qemu_set_irq(ohci->irq, 0);
+
+ ohci->level = level;
qemu_set_irq(ohci->irq, level);
}
diff --git a/hw/usb/hcd-ohci.h b/hw/usb/hcd-ohci.h
index e1827227ac..6f82e72bd9 100644
--- a/hw/usb/hcd-ohci.h
+++ b/hw/usb/hcd-ohci.h
@@ -52,6 +52,7 @@ struct OHCIState {
uint32_t ctl, status;
uint32_t intr_status;
uint32_t intr;
+ int level;
/* memory pointer partition */
uint32_t hcca;
--
2.39.2
next reply other threads:[~2024-04-23 17:04 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-23 17:04 Guenter Roeck [this message]
2024-04-23 17:30 ` Problems (timeouts) when testing usb-ohci with qemu Alan Stern
2024-04-23 21:10 ` Guenter Roeck
2024-04-24 2:11 ` Alan Stern
2024-04-24 15:11 ` Guenter Roeck
2024-04-24 11:16 ` Gerd Hoffmann
2024-04-24 15:23 ` Guenter Roeck
2024-04-24 17:05 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4664cf39-5dfe-4557-959d-149640ca36e1@roeck-us.net \
--to=linux@roeck-us.net \
--cc=gregkh@linuxfoundation.org \
--cc=kraxel@redhat.com \
--cc=linux-usb@vger.kernel.org \
--cc=qemu-devel@nongnu.org \
--cc=stern@rowland.harvard.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).