--- /dev/null
+From 7931ec86c1b738e4e90e58c6d95e5f720d45ee56 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Tue, 20 Dec 2016 13:57:32 +0200
+Subject: usb: dwc3: ep0: add dwc3_ep0_prepare_one_trb()
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit 7931ec86c1b738e4e90e58c6d95e5f720d45ee56 upstream.
+
+For now this is just a cleanup patch, no functional
+changes. We will be using the new function to fix a
+bug introduced long ago by commit 0416e494ce7d
+("usb: dwc3: ep0: correct cache sync issue in case
+of ep0_bounced") and further worsened by commit
+c0bd5456a470 ("usb: dwc3: ep0: handle non maxpacket
+aligned transfers > 512")
+
+Reported-by: Janusz Dziedzic <januszx.dziedzic@linux.intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/usb/dwc3/ep0.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -55,20 +55,13 @@ static const char *dwc3_ep0_state_string
+ }
+ }
+
+-static int dwc3_ep0_start_trans(struct dwc3 *dwc, u8 epnum, dma_addr_t buf_dma,
+- u32 len, u32 type, bool chain)
++static void dwc3_ep0_prepare_one_trb(struct dwc3 *dwc, u8 epnum,
++ dma_addr_t buf_dma, u32 len, u32 type, bool chain)
+ {
+- struct dwc3_gadget_ep_cmd_params params;
+ struct dwc3_trb *trb;
+ struct dwc3_ep *dep;
+
+- int ret;
+-
+ dep = dwc->eps[epnum];
+- if (dep->flags & DWC3_EP_BUSY) {
+- dwc3_trace(trace_dwc3_ep0, "%s still busy", dep->name);
+- return 0;
+- }
+
+ trb = &dwc->ep0_trb[dep->trb_enqueue];
+
+@@ -89,15 +82,28 @@ static int dwc3_ep0_start_trans(struct d
+ trb->ctrl |= (DWC3_TRB_CTRL_IOC
+ | DWC3_TRB_CTRL_LST);
+
+- if (chain)
++ trace_dwc3_prepare_trb(dep, trb);
++}
++
++static int dwc3_ep0_start_trans(struct dwc3 *dwc, u8 epnum, dma_addr_t buf_dma,
++ u32 len, u32 type, bool chain)
++{
++ struct dwc3_gadget_ep_cmd_params params;
++ struct dwc3_ep *dep;
++ int ret;
++
++ dep = dwc->eps[epnum];
++ if (dep->flags & DWC3_EP_BUSY) {
++ dwc3_trace(trace_dwc3_ep0, "%s still busy", dep->name);
+ return 0;
++ }
++
++ dwc3_ep0_prepare_one_trb(dwc, epnum, buf_dma, len, type, chain);
+
+ memset(¶ms, 0, sizeof(params));
+ params.param0 = upper_32_bits(dwc->ep0_trb_addr);
+ params.param1 = lower_32_bits(dwc->ep0_trb_addr);
+
+- trace_dwc3_prepare_trb(dep, trb);
+-
+ ret = dwc3_send_gadget_ep_cmd(dep, DWC3_DEPCMD_STARTTRANSFER, ¶ms);
+ if (ret < 0) {
+ dwc3_trace(trace_dwc3_ep0, "%s STARTTRANSFER failed",
--- /dev/null
+From 19ec31230eb3084431bc2e565fd085f79f564274 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Tue, 20 Dec 2016 14:08:48 +0200
+Subject: usb: dwc3: ep0: explicitly call dwc3_ep0_prepare_one_trb()
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit 19ec31230eb3084431bc2e565fd085f79f564274 upstream.
+
+Let's call dwc3_ep0_prepare_one_trb() explicitly
+because there are occasions where we will need more
+than one TRB to handle an EP0 transfer.
+
+A follow-up patch will fix one bug related to
+multiple-TRB Data Phases when it comes to
+mapping/unmapping requests for DMA.
+
+Reported-by: Janusz Dziedzic <januszx.dziedzic@linux.intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/usb/dwc3/ep0.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -85,8 +85,7 @@ static void dwc3_ep0_prepare_one_trb(str
+ trace_dwc3_prepare_trb(dep, trb);
+ }
+
+-static int dwc3_ep0_start_trans(struct dwc3 *dwc, u8 epnum, dma_addr_t buf_dma,
+- u32 len, u32 type, bool chain)
++static int dwc3_ep0_start_trans(struct dwc3 *dwc, u8 epnum)
+ {
+ struct dwc3_gadget_ep_cmd_params params;
+ struct dwc3_ep *dep;
+@@ -98,8 +97,6 @@ static int dwc3_ep0_start_trans(struct d
+ return 0;
+ }
+
+- dwc3_ep0_prepare_one_trb(dwc, epnum, buf_dma, len, type, chain);
+-
+ memset(¶ms, 0, sizeof(params));
+ params.param0 = upper_32_bits(dwc->ep0_trb_addr);
+ params.param1 = lower_32_bits(dwc->ep0_trb_addr);
+@@ -314,8 +311,9 @@ void dwc3_ep0_out_start(struct dwc3 *dwc
+ {
+ int ret;
+
+- ret = dwc3_ep0_start_trans(dwc, 0, dwc->ctrl_req_addr, 8,
++ dwc3_ep0_prepare_one_trb(dwc, 0, dwc->ctrl_req_addr, 8,
+ DWC3_TRBCTL_CONTROL_SETUP, false);
++ ret = dwc3_ep0_start_trans(dwc, 0);
+ WARN_ON(ret < 0);
+ }
+
+@@ -886,9 +884,9 @@ static void dwc3_ep0_complete_data(struc
+
+ dwc->ep0_next_event = DWC3_EP0_COMPLETE;
+
+- ret = dwc3_ep0_start_trans(dwc, epnum,
+- dwc->ctrl_req_addr, 0,
+- DWC3_TRBCTL_CONTROL_DATA, false);
++ dwc3_ep0_prepare_one_trb(dwc, epnum, dwc->ctrl_req_addr,
++ 0, DWC3_TRBCTL_CONTROL_DATA, false);
++ ret = dwc3_ep0_start_trans(dwc, epnum);
+ WARN_ON(ret < 0);
+ }
+ }
+@@ -972,9 +970,10 @@ static void __dwc3_ep0_do_control_data(s
+ req->direction = !!dep->number;
+
+ if (req->request.length == 0) {
+- ret = dwc3_ep0_start_trans(dwc, dep->number,
++ dwc3_ep0_prepare_one_trb(dwc, dep->number,
+ dwc->ctrl_req_addr, 0,
+ DWC3_TRBCTL_CONTROL_DATA, false);
++ ret = dwc3_ep0_start_trans(dwc, dep->number);
+ } else if (!IS_ALIGNED(req->request.length, dep->endpoint.maxpacket)
+ && (dep->number == 0)) {
+ u32 transfer_size = 0;
+@@ -992,7 +991,7 @@ static void __dwc3_ep0_do_control_data(s
+ if (req->request.length > DWC3_EP0_BOUNCE_SIZE) {
+ transfer_size = ALIGN(req->request.length - maxpacket,
+ maxpacket);
+- ret = dwc3_ep0_start_trans(dwc, dep->number,
++ dwc3_ep0_prepare_one_trb(dwc, dep->number,
+ req->request.dma,
+ transfer_size,
+ DWC3_TRBCTL_CONTROL_DATA,
+@@ -1004,9 +1003,10 @@ static void __dwc3_ep0_do_control_data(s
+
+ dwc->ep0_bounced = true;
+
+- ret = dwc3_ep0_start_trans(dwc, dep->number,
++ dwc3_ep0_prepare_one_trb(dwc, dep->number,
+ dwc->ep0_bounce_addr, transfer_size,
+ DWC3_TRBCTL_CONTROL_DATA, false);
++ ret = dwc3_ep0_start_trans(dwc, dep->number);
+ } else {
+ ret = usb_gadget_map_request(&dwc->gadget, &req->request,
+ dep->number);
+@@ -1015,9 +1015,10 @@ static void __dwc3_ep0_do_control_data(s
+ return;
+ }
+
+- ret = dwc3_ep0_start_trans(dwc, dep->number, req->request.dma,
++ dwc3_ep0_prepare_one_trb(dwc, dep->number, req->request.dma,
+ req->request.length, DWC3_TRBCTL_CONTROL_DATA,
+ false);
++ ret = dwc3_ep0_start_trans(dwc, dep->number);
+ }
+
+ WARN_ON(ret < 0);
+@@ -1031,8 +1032,9 @@ static int dwc3_ep0_start_control_status
+ type = dwc->three_stage_setup ? DWC3_TRBCTL_CONTROL_STATUS3
+ : DWC3_TRBCTL_CONTROL_STATUS2;
+
+- return dwc3_ep0_start_trans(dwc, dep->number,
++ dwc3_ep0_prepare_one_trb(dwc, dep->number,
+ dwc->ctrl_req_addr, 0, type, false);
++ return dwc3_ep0_start_trans(dwc, dep->number);
+ }
+
+ static void __dwc3_ep0_do_control_status(struct dwc3 *dwc, struct dwc3_ep *dep)
--- /dev/null
+From d62145929992f331fdde924d5963ab49588ccc7d Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Tue, 20 Dec 2016 14:14:40 +0200
+Subject: usb: dwc3: gadget: always unmap EP0 requests
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit d62145929992f331fdde924d5963ab49588ccc7d upstream.
+
+commit 0416e494ce7d ("usb: dwc3: ep0: correct cache
+sync issue in case of ep0_bounced") introduced a bug
+where we would leak DMA resources which would cause
+us to starve the system of them resulting in failing
+DMA transfers.
+
+Fix the bug by making sure that we always unmap EP0
+requests since those are *always* mapped.
+
+Fixes: 0416e494ce7d ("usb: dwc3: ep0: correct cache
+ sync issue in case of ep0_bounced")
+Cc: <stable@vger.kernel.org>
+Tested-by: Tomasz Medrek <tomaszx.medrek@intel.com>
+Reported-by: Janusz Dziedzic <januszx.dziedzic@linux.intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -182,11 +182,11 @@ void dwc3_gadget_giveback(struct dwc3_ep
+ if (req->request.status == -EINPROGRESS)
+ req->request.status = status;
+
+- if (dwc->ep0_bounced && dep->number == 0)
++ if (dwc->ep0_bounced && dep->number <= 1)
+ dwc->ep0_bounced = false;
+- else
+- usb_gadget_unmap_request(&dwc->gadget, &req->request,
+- req->direction);
++
++ usb_gadget_unmap_request(&dwc->gadget, &req->request,
++ req->direction);
+
+ trace_dwc3_gadget_giveback(req);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
