LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH] usb: dwc3: gadget: trb_dequeue is not updated properly
@ 2019-07-17  0:07 fei.yang
  0 siblings, 0 replies; only message in thread
From: fei.yang @ 2019-07-17  0:07 UTC (permalink / raw)
  To: felipe.balbi, john.stultz, andrzej.p, linux-usb, linux-kernel,
	gregkh, stable

From: Fei Yang <fei.yang@intel.com>

If scatter-gather operation is allowed, a large USB request is split into
multiple TRBs. These TRBs are chained up by setting DWC3_TRB_CTRL_CHN bit
except the last one which has DWC3_TRB_CTRL_IOC bit set instead.
Since only the last TRB has IOC set for the whole USB request, the
dwc3_gadget_ep_reclaim_completed_trb() gets called only once for the request
and all TRBs are supposed to be reclaimed. However that is not what happens
with the current code.

This patch addresses the issue by checking req->num_pending_sgs. In case the
pending sgs is not zero, update trb_dequeue and req->num_trbs accordingly.

Signed-off-by: Fei Yang <fei.yang@intel.com>
Cc: stable <stable@vger.kernel.org>
---
 drivers/usb/dwc3/gadget.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 173f532..4d5b4eb 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2394,8 +2394,14 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
 	if (event->status & DEPEVT_STATUS_SHORT && !chain)
 		return 1;
 
-	if (event->status & DEPEVT_STATUS_IOC)
+	if (event->status & DEPEVT_STATUS_IOC) {
+		for (count = 0; count < req->num_pending_sgs; count++) {
+			dwc3_ep_inc_deq(dep);
+			req->num_trbs--;
+		}
+		req->num_pending_sgs = 0;
 		return 1;
+	}
 
 	return 0;
 }
@@ -2404,7 +2410,7 @@ static int dwc3_gadget_ep_reclaim_trb_sg(struct dwc3_ep *dep,
 		struct dwc3_request *req, const struct dwc3_event_depevt *event,
 		int status)
 {
-	struct dwc3_trb *trb = &dep->trb_pool[dep->trb_dequeue];
+	struct dwc3_trb *trb;
 	struct scatterlist *sg = req->sg;
 	struct scatterlist *s;
 	unsigned int pending = req->num_pending_sgs;
-- 
2.7.4


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2019-07-17  0:07 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-17  0:07 [PATCH] usb: dwc3: gadget: trb_dequeue is not updated properly fei.yang

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).