mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-25 11:55:37 +00:00
usb: cdns3: remove fetched trb from cache before dequeuing
commit1301c7b9f7
upstream. After doorbell DMA fetches the TRB. If during dequeuing request driver changes NORMAL TRB to LINK TRB but doesn't delete it from controller cache then controller will handle cached TRB and packet can be lost. The example scenario for this issue looks like: 1. queue request - set doorbell 2. dequeue request 3. send OUT data packet from host 4. Device will accept this packet which is unexpected 5. queue new request - set doorbell 6. Device lost the expected packet. By setting DFLUSH controller clears DRDY bit and stop DMA transfer. Fixes:7733f6c32e
("usb: cdns3: Add Cadence USB3 DRD Driver") cc: <stable@vger.kernel.org> Signed-off-by: Pawel Laszczak <pawell@cadence.com> Acked-by: Peter Chen <peter.chen@kernel.org> Link: https://lore.kernel.org/r/20221115100039.441295-1-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
feb7840e57
commit
34f207ed1c
1 changed files with 12 additions and 0 deletions
|
@ -2614,6 +2614,7 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep,
|
|||
u8 req_on_hw_ring = 0;
|
||||
unsigned long flags;
|
||||
int ret = 0;
|
||||
int val;
|
||||
|
||||
if (!ep || !request || !ep->desc)
|
||||
return -EINVAL;
|
||||
|
@ -2649,6 +2650,13 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep,
|
|||
|
||||
/* Update ring only if removed request is on pending_req_list list */
|
||||
if (req_on_hw_ring && link_trb) {
|
||||
/* Stop DMA */
|
||||
writel(EP_CMD_DFLUSH, &priv_dev->regs->ep_cmd);
|
||||
|
||||
/* wait for DFLUSH cleared */
|
||||
readl_poll_timeout_atomic(&priv_dev->regs->ep_cmd, val,
|
||||
!(val & EP_CMD_DFLUSH), 1, 1000);
|
||||
|
||||
link_trb->buffer = cpu_to_le32(TRB_BUFFER(priv_ep->trb_pool_dma +
|
||||
((priv_req->end_trb + 1) * TRB_SIZE)));
|
||||
link_trb->control = cpu_to_le32((le32_to_cpu(link_trb->control) & TRB_CYCLE) |
|
||||
|
@ -2660,6 +2668,10 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep,
|
|||
|
||||
cdns3_gadget_giveback(priv_ep, priv_req, -ECONNRESET);
|
||||
|
||||
req = cdns3_next_request(&priv_ep->pending_req_list);
|
||||
if (req)
|
||||
cdns3_rearm_transfer(priv_ep, 1);
|
||||
|
||||
not_found:
|
||||
spin_unlock_irqrestore(&priv_dev->lock, flags);
|
||||
return ret;
|
||||
|
|
Loading…
Reference in a new issue