From 8326a366966fcede5631925e07b30e664aee6ab3 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 30 Mar 2023 07:12:58 -0400 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...-branch-condition-evaluates-to-a-gar.patch | 44 ++++++ ...void-accessing-uninitialized-tasklet.patch | 86 ++++++++++++ ...ror-handling-when-afbcd.ops-init-fai.patch | 87 ++++++++++++ ...ssing-component-unbind-on-bind-error.patch | 65 +++++++++ ...rop-pagecache-at-end-of-fs_ioc_enabl.patch | 73 ++++++++++ .../kcsan-avoid-passing-g-for-test.patch | 50 +++++++ ...an_test-build-without-structleak-plu.patch | 44 ++++++ queue-5.10/series | 9 ++ ...add-1ms-delay-after-end-transfer-com.patch | 87 ++++++++++++ ...move-cmd_endtransfer-to-extra-functi.patch | 125 ++++++++++++++++++ 10 files changed, 670 insertions(+) create mode 100644 queue-5.10/bus-imx-weim-fix-branch-condition-evaluates-to-a-gar.patch create mode 100644 queue-5.10/dm-crypt-avoid-accessing-uninitialized-tasklet.patch create mode 100644 queue-5.10/drm-meson-fix-error-handling-when-afbcd.ops-init-fai.patch create mode 100644 queue-5.10/drm-meson-fix-missing-component-unbind-on-bind-error.patch create mode 100644 queue-5.10/fsverity-don-t-drop-pagecache-at-end-of-fs_ioc_enabl.patch create mode 100644 queue-5.10/kcsan-avoid-passing-g-for-test.patch create mode 100644 queue-5.10/kernel-kcsan-kcsan_test-build-without-structleak-plu.patch create mode 100644 queue-5.10/usb-dwc3-gadget-add-1ms-delay-after-end-transfer-com.patch create mode 100644 queue-5.10/usb-dwc3-gadget-move-cmd_endtransfer-to-extra-functi.patch diff --git a/queue-5.10/bus-imx-weim-fix-branch-condition-evaluates-to-a-gar.patch b/queue-5.10/bus-imx-weim-fix-branch-condition-evaluates-to-a-gar.patch new file mode 100644 index 00000000000..ea2252c5d29 --- /dev/null +++ b/queue-5.10/bus-imx-weim-fix-branch-condition-evaluates-to-a-gar.patch @@ -0,0 +1,44 @@ +From d4bdf3c650322b6566c2d7e8190ed7a5f2919c2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 16:25:26 +0300 +Subject: bus: imx-weim: fix branch condition evaluates to a garbage value + +From: Ivan Bornyakov + +[ Upstream commit 1adab2922c58e7ff4fa9f0b43695079402cce876 ] + +If bus type is other than imx50_weim_devtype and have no child devices, +variable 'ret' in function weim_parse_dt() will not be initialized, but +will be used as branch condition and return value. Fix this by +initializing 'ret' with 0. + +This was discovered with help of clang-analyzer, but the situation is +quite possible in real life. + +Fixes: 52c47b63412b ("bus: imx-weim: improve error handling upon child probe-failure") +Signed-off-by: Ivan Bornyakov +Cc: stable@vger.kernel.org +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/bus/imx-weim.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bus/imx-weim.c b/drivers/bus/imx-weim.c +index 28bb65a5613fd..201767823edb5 100644 +--- a/drivers/bus/imx-weim.c ++++ b/drivers/bus/imx-weim.c +@@ -192,8 +192,8 @@ static int weim_parse_dt(struct platform_device *pdev, void __iomem *base) + const struct of_device_id *of_id = of_match_device(weim_id_table, + &pdev->dev); + const struct imx_weim_devtype *devtype = of_id->data; ++ int ret = 0, have_child = 0; + struct device_node *child; +- int ret, have_child = 0; + struct cs_timing_state ts = {}; + u32 reg; + +-- +2.39.2 + diff --git a/queue-5.10/dm-crypt-avoid-accessing-uninitialized-tasklet.patch b/queue-5.10/dm-crypt-avoid-accessing-uninitialized-tasklet.patch new file mode 100644 index 00000000000..d2a7619d5f4 --- /dev/null +++ b/queue-5.10/dm-crypt-avoid-accessing-uninitialized-tasklet.patch @@ -0,0 +1,86 @@ +From a95530ebdb4ef34ea248ae061d1fd676a6d4cc8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 14:39:54 -0500 +Subject: dm crypt: avoid accessing uninitialized tasklet + +From: Mike Snitzer + +[ Upstream commit d9a02e016aaf5a57fb44e9a5e6da8ccd3b9e2e70 ] + +When neither "no_read_workqueue" nor "no_write_workqueue" are enabled, +tasklet_trylock() in crypt_dec_pending() may still return false due to +an uninitialized state, and dm-crypt will unnecessarily do io completion +in io_queue workqueue instead of current context. + +Fix this by adding an 'in_tasklet' flag to dm_crypt_io struct and +initialize it to false in crypt_io_init(). Set this flag to true in +kcryptd_queue_crypt() before calling tasklet_schedule(). If set +crypt_dec_pending() will punt io completion to a workqueue. + +This also nicely avoids the tasklet_trylock/unlock hack when tasklets +aren't in use. + +Fixes: 8e14f610159d ("dm crypt: do not call bio_endio() from the dm-crypt tasklet") +Cc: stable@vger.kernel.org +Reported-by: Hou Tao +Suggested-by: Ignat Korchagin +Reviewed-by: Ignat Korchagin +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-crypt.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 17ddca293965c..5d772f322a245 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -67,7 +67,9 @@ struct dm_crypt_io { + struct crypt_config *cc; + struct bio *base_bio; + u8 *integrity_metadata; +- bool integrity_metadata_from_pool; ++ bool integrity_metadata_from_pool:1; ++ bool in_tasklet:1; ++ + struct work_struct work; + struct tasklet_struct tasklet; + +@@ -1722,6 +1724,7 @@ static void crypt_io_init(struct dm_crypt_io *io, struct crypt_config *cc, + io->ctx.r.req = NULL; + io->integrity_metadata = NULL; + io->integrity_metadata_from_pool = false; ++ io->in_tasklet = false; + atomic_set(&io->io_pending, 0); + } + +@@ -1767,14 +1770,13 @@ static void crypt_dec_pending(struct dm_crypt_io *io) + * our tasklet. In this case we need to delay bio_endio() + * execution to after the tasklet is done and dequeued. + */ +- if (tasklet_trylock(&io->tasklet)) { +- tasklet_unlock(&io->tasklet); +- bio_endio(base_bio); ++ if (io->in_tasklet) { ++ INIT_WORK(&io->work, kcryptd_io_bio_endio); ++ queue_work(cc->io_queue, &io->work); + return; + } + +- INIT_WORK(&io->work, kcryptd_io_bio_endio); +- queue_work(cc->io_queue, &io->work); ++ bio_endio(base_bio); + } + + /* +@@ -2228,6 +2230,7 @@ static void kcryptd_queue_crypt(struct dm_crypt_io *io) + * it is being executed with irqs disabled. + */ + if (in_irq() || irqs_disabled()) { ++ io->in_tasklet = true; + tasklet_init(&io->tasklet, kcryptd_crypt_tasklet, (unsigned long)&io->work); + tasklet_schedule(&io->tasklet); + return; +-- +2.39.2 + diff --git a/queue-5.10/drm-meson-fix-error-handling-when-afbcd.ops-init-fai.patch b/queue-5.10/drm-meson-fix-error-handling-when-afbcd.ops-init-fai.patch new file mode 100644 index 00000000000..01dc2493e16 --- /dev/null +++ b/queue-5.10/drm-meson-fix-error-handling-when-afbcd.ops-init-fai.patch @@ -0,0 +1,87 @@ +From 6489bfb2104de81422e4e283842cb8ae557915bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Dec 2021 00:55:15 +0100 +Subject: drm/meson: Fix error handling when afbcd.ops->init fails + +From: Martin Blumenstingl + +[ Upstream commit fa747d75f65d1b1cbc3f4691fa67b695e8a399c8 ] + +When afbcd.ops->init fails we need to free the struct drm_device. Also +all errors which come after afbcd.ops->init was successful need to exit +the AFBCD, just like meson_drv_unbind() does. + +Fixes: d1b5e41e13a7e9 ("drm/meson: Add AFBCD module driver") +Signed-off-by: Martin Blumenstingl +Acked-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20211230235515.1627522-3-martin.blumenstingl@googlemail.com +Stable-dep-of: ba98413bf45e ("drm/meson: fix missing component unbind on bind errors") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_drv.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index b0bfe85f5f6a8..090878bd74f6a 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -320,38 +320,38 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + if (priv->afbcd.ops) { + ret = priv->afbcd.ops->init(priv); + if (ret) +- return ret; ++ goto free_drm; + } + + /* Encoder Initialization */ + + ret = meson_venc_cvbs_create(priv); + if (ret) +- goto free_drm; ++ goto exit_afbcd; + + if (has_components) { + ret = component_bind_all(drm->dev, drm); + if (ret) { + dev_err(drm->dev, "Couldn't bind all components\n"); +- goto free_drm; ++ goto exit_afbcd; + } + } + + ret = meson_plane_create(priv); + if (ret) +- goto free_drm; ++ goto exit_afbcd; + + ret = meson_overlay_create(priv); + if (ret) +- goto free_drm; ++ goto exit_afbcd; + + ret = meson_crtc_create(priv); + if (ret) +- goto free_drm; ++ goto exit_afbcd; + + ret = drm_irq_install(drm, priv->vsync_irq); + if (ret) +- goto free_drm; ++ goto exit_afbcd; + + drm_mode_config_reset(drm); + +@@ -369,6 +369,9 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + + uninstall_irq: + drm_irq_uninstall(drm); ++exit_afbcd: ++ if (priv->afbcd.ops) ++ priv->afbcd.ops->exit(priv); + free_drm: + drm_dev_put(drm); + +-- +2.39.2 + diff --git a/queue-5.10/drm-meson-fix-missing-component-unbind-on-bind-error.patch b/queue-5.10/drm-meson-fix-missing-component-unbind-on-bind-error.patch new file mode 100644 index 00000000000..b164f951afb --- /dev/null +++ b/queue-5.10/drm-meson-fix-missing-component-unbind-on-bind-error.patch @@ -0,0 +1,65 @@ +From dc3ec0d7f8b1d5c5c654ba5cd19f35c4eb03afd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 11:35:33 +0100 +Subject: drm/meson: fix missing component unbind on bind errors + +From: Johan Hovold + +[ Upstream commit ba98413bf45edbf33672e2539e321b851b2cfbd1 ] + +Make sure to unbind all subcomponents when binding the aggregate device +fails. + +Fixes: a41e82e6c457 ("drm/meson: Add support for components") +Cc: stable@vger.kernel.org # 4.12 +Cc: Neil Armstrong +Signed-off-by: Johan Hovold +Acked-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230306103533.4915-1-johan+linaro@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_drv.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index 090878bd74f6a..5c29ddf93eb3f 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -339,19 +339,19 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + + ret = meson_plane_create(priv); + if (ret) +- goto exit_afbcd; ++ goto unbind_all; + + ret = meson_overlay_create(priv); + if (ret) +- goto exit_afbcd; ++ goto unbind_all; + + ret = meson_crtc_create(priv); + if (ret) +- goto exit_afbcd; ++ goto unbind_all; + + ret = drm_irq_install(drm, priv->vsync_irq); + if (ret) +- goto exit_afbcd; ++ goto unbind_all; + + drm_mode_config_reset(drm); + +@@ -369,6 +369,9 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + + uninstall_irq: + drm_irq_uninstall(drm); ++unbind_all: ++ if (has_components) ++ component_unbind_all(drm->dev, drm); + exit_afbcd: + if (priv->afbcd.ops) + priv->afbcd.ops->exit(priv); +-- +2.39.2 + diff --git a/queue-5.10/fsverity-don-t-drop-pagecache-at-end-of-fs_ioc_enabl.patch b/queue-5.10/fsverity-don-t-drop-pagecache-at-end-of-fs_ioc_enabl.patch new file mode 100644 index 00000000000..ee259cb7ae2 --- /dev/null +++ b/queue-5.10/fsverity-don-t-drop-pagecache-at-end-of-fs_ioc_enabl.patch @@ -0,0 +1,73 @@ +From dc5ef54273e118067464a09e21624995ed12b308 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 16:31:32 -0700 +Subject: fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY + +From: Eric Biggers + +[ Upstream commit a075bacde257f755bea0e53400c9f1cdd1b8e8e6 ] + +The full pagecache drop at the end of FS_IOC_ENABLE_VERITY is causing +performance problems and is hindering adoption of fsverity. It was +intended to solve a race condition where unverified pages might be left +in the pagecache. But actually it doesn't solve it fully. + +Since the incomplete solution for this race condition has too much +performance impact for it to be worth it, let's remove it for now. + +Fixes: 3fda4c617e84 ("fs-verity: implement FS_IOC_ENABLE_VERITY ioctl") +Cc: stable@vger.kernel.org +Reviewed-by: Victor Hsieh +Link: https://lore.kernel.org/r/20230314235332.50270-1-ebiggers@kernel.org +Signed-off-by: Eric Biggers +Signed-off-by: Sasha Levin +--- + fs/verity/enable.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/fs/verity/enable.c b/fs/verity/enable.c +index 734862e608fd3..5ceae66e1ae02 100644 +--- a/fs/verity/enable.c ++++ b/fs/verity/enable.c +@@ -391,25 +391,27 @@ int fsverity_ioctl_enable(struct file *filp, const void __user *uarg) + goto out_drop_write; + + err = enable_verity(filp, &arg); +- if (err) +- goto out_allow_write_access; + + /* +- * Some pages of the file may have been evicted from pagecache after +- * being used in the Merkle tree construction, then read into pagecache +- * again by another process reading from the file concurrently. Since +- * these pages didn't undergo verification against the file measurement +- * which fs-verity now claims to be enforcing, we have to wipe the +- * pagecache to ensure that all future reads are verified. ++ * We no longer drop the inode's pagecache after enabling verity. This ++ * used to be done to try to avoid a race condition where pages could be ++ * evicted after being used in the Merkle tree construction, then ++ * re-instantiated by a concurrent read. Such pages are unverified, and ++ * the backing storage could have filled them with different content, so ++ * they shouldn't be used to fulfill reads once verity is enabled. ++ * ++ * But, dropping the pagecache has a big performance impact, and it ++ * doesn't fully solve the race condition anyway. So for those reasons, ++ * and also because this race condition isn't very important relatively ++ * speaking (especially for small-ish files, where the chance of a page ++ * being used, evicted, *and* re-instantiated all while enabling verity ++ * is quite small), we no longer drop the inode's pagecache. + */ +- filemap_write_and_wait(inode->i_mapping); +- invalidate_inode_pages2(inode->i_mapping); + + /* + * allow_write_access() is needed to pair with deny_write_access(). + * Regardless, the filesystem won't allow writing to verity files. + */ +-out_allow_write_access: + allow_write_access(filp); + out_drop_write: + mnt_drop_write_file(filp); +-- +2.39.2 + diff --git a/queue-5.10/kcsan-avoid-passing-g-for-test.patch b/queue-5.10/kcsan-avoid-passing-g-for-test.patch new file mode 100644 index 00000000000..6d82de55167 --- /dev/null +++ b/queue-5.10/kcsan-avoid-passing-g-for-test.patch @@ -0,0 +1,50 @@ +From f5c7f06e3d36c8716e077148466430ceca46e8df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 23:47:05 +0100 +Subject: kcsan: avoid passing -g for test + +From: Marco Elver + +[ Upstream commit 5eb39cde1e2487ba5ec1802dc5e58a77e700d99e ] + +Nathan reported that when building with GNU as and a version of clang that +defaults to DWARF5, the assembler will complain with: + + Error: non-constant .uleb128 is not supported + +This is because `-g` defaults to the compiler debug info default. If the +assembler does not support some of the directives used, the above errors +occur. To fix, remove the explicit passing of `-g`. + +All the test wants is that stack traces print valid function names, and +debug info is not required for that. (I currently cannot recall why I +added the explicit `-g`.) + +Link: https://lkml.kernel.org/r/20230316224705.709984-2-elver@google.com +Fixes: 1fe84fd4a402 ("kcsan: Add test suite") +Signed-off-by: Marco Elver +Reported-by: Nathan Chancellor +Cc: Alexander Potapenko +Cc: Dmitry Vyukov +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + kernel/kcsan/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/kcsan/Makefile b/kernel/kcsan/Makefile +index c95957741d366..a9b0ee63b6978 100644 +--- a/kernel/kcsan/Makefile ++++ b/kernel/kcsan/Makefile +@@ -13,6 +13,6 @@ CFLAGS_core.o := $(call cc-option,-fno-conserve-stack) \ + obj-y := core.o debugfs.o report.o + obj-$(CONFIG_KCSAN_SELFTEST) += selftest.o + +-CFLAGS_kcsan-test.o := $(CFLAGS_KCSAN) -g -fno-omit-frame-pointer ++CFLAGS_kcsan-test.o := $(CFLAGS_KCSAN) -fno-omit-frame-pointer + CFLAGS_kcsan_test.o += $(DISABLE_STRUCTLEAK_PLUGIN) + obj-$(CONFIG_KCSAN_TEST) += kcsan-test.o +-- +2.39.2 + diff --git a/queue-5.10/kernel-kcsan-kcsan_test-build-without-structleak-plu.patch b/queue-5.10/kernel-kcsan-kcsan_test-build-without-structleak-plu.patch new file mode 100644 index 00000000000..e75ff331573 --- /dev/null +++ b/queue-5.10/kernel-kcsan-kcsan_test-build-without-structleak-plu.patch @@ -0,0 +1,44 @@ +From ee5a199e7777b70fe4d8ae46433b2c842fe07a5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Nov 2022 11:43:58 +0100 +Subject: kernel: kcsan: kcsan_test: build without structleak plugin + +From: Anders Roxell + +[ Upstream commit 6fcd4267a840d0536b8e5334ad5f31e4105fce85 ] + +Building kcsan_test with structleak plugin enabled makes the stack frame +size to grow. + +kernel/kcsan/kcsan_test.c:704:1: error: the frame size of 3296 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] + +Turn off the structleak plugin checks for kcsan_test. + +Link: https://lkml.kernel.org/r/20221128104358.2660634-1-anders.roxell@linaro.org +Signed-off-by: Anders Roxell +Suggested-by: Arnd Bergmann +Acked-by: Marco Elver +Cc: Arnd Bergmann +Cc: David Gow +Cc: Jason A. Donenfeld +Cc: Kees Cook +Signed-off-by: Andrew Morton +Stable-dep-of: 5eb39cde1e24 ("kcsan: avoid passing -g for test") +Signed-off-by: Sasha Levin +--- + kernel/kcsan/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/kcsan/Makefile b/kernel/kcsan/Makefile +index 65ca5539c470e..c95957741d366 100644 +--- a/kernel/kcsan/Makefile ++++ b/kernel/kcsan/Makefile +@@ -14,4 +14,5 @@ obj-y := core.o debugfs.o report.o + obj-$(CONFIG_KCSAN_SELFTEST) += selftest.o + + CFLAGS_kcsan-test.o := $(CFLAGS_KCSAN) -g -fno-omit-frame-pointer ++CFLAGS_kcsan_test.o += $(DISABLE_STRUCTLEAK_PLUGIN) + obj-$(CONFIG_KCSAN_TEST) += kcsan-test.o +-- +2.39.2 + diff --git a/queue-5.10/series b/queue-5.10/series index 2f1efcf482b..e8b5b4ec5a0 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -101,3 +101,12 @@ xfs-shut-down-the-filesystem-if-we-screw-up-quota-reservation.patch xfs-don-t-reuse-busy-extents-on-extent-trim.patch kvm-fix-memoryleak-in-kvm_init.patch nfsd-fix-use-after-free-in-__nfs42_ssc_open.patch +usb-dwc3-gadget-move-cmd_endtransfer-to-extra-functi.patch +usb-dwc3-gadget-add-1ms-delay-after-end-transfer-com.patch +kernel-kcsan-kcsan_test-build-without-structleak-plu.patch +kcsan-avoid-passing-g-for-test.patch +drm-meson-fix-error-handling-when-afbcd.ops-init-fai.patch +drm-meson-fix-missing-component-unbind-on-bind-error.patch +bus-imx-weim-fix-branch-condition-evaluates-to-a-gar.patch +dm-crypt-avoid-accessing-uninitialized-tasklet.patch +fsverity-don-t-drop-pagecache-at-end-of-fs_ioc_enabl.patch diff --git a/queue-5.10/usb-dwc3-gadget-add-1ms-delay-after-end-transfer-com.patch b/queue-5.10/usb-dwc3-gadget-add-1ms-delay-after-end-transfer-com.patch new file mode 100644 index 00000000000..e86f75df22e --- /dev/null +++ b/queue-5.10/usb-dwc3-gadget-add-1ms-delay-after-end-transfer-com.patch @@ -0,0 +1,87 @@ +From 3f3f379e577ca9f79ba9951a9d2e6b1193cd3d2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 12:05:57 -0800 +Subject: usb: dwc3: gadget: Add 1ms delay after end transfer command without + IOC + +From: Wesley Cheng + +[ Upstream commit d8a2bb4eb75866275b5cf7de2e593ac3449643e2 ] + +Previously, there was a 100uS delay inserted after issuing an end transfer +command for specific controller revisions. This was due to the fact that +there was a GUCTL2 bit field which enabled synchronous completion of the +end transfer command once the CMDACT bit was cleared in the DEPCMD +register. Since this bit does not exist for all controller revisions and +the current implementation heavily relies on utizling the EndTransfer +command completion interrupt, add the delay back in for uses where the +interrupt on completion bit is not set, and increase the duration to 1ms +for the controller to complete the command. + +An issue was seen where the USB request buffer was unmapped while the DWC3 +controller was still accessing the TRB. However, it was confirmed that the +end transfer command was successfully submitted. (no end transfer timeout) +In situations, such as dwc3_gadget_soft_disconnect() and +__dwc3_gadget_ep_disable(), the dwc3_remove_request() is utilized, which +will issue the end transfer command, and follow up with +dwc3_gadget_giveback(). At least for the USB ep disable path, it is +required for any pending and started requests to be completed and returned +to the function driver in the same context of the disable call. Without +the GUCTL2 bit, it is not ensured that the end transfer is completed before +the buffers are unmapped. + +Fixes: cf2f8b63f7f1 ("usb: dwc3: gadget: Remove END_TRANSFER delay") +Cc: stable +Signed-off-by: Wesley Cheng +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20230306200557.29387-1-quic_wcheng@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index ce5131ccd60a9..01cecde76140b 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1453,6 +1453,7 @@ static int __dwc3_gadget_get_frame(struct dwc3 *dwc) + */ + static int __dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool interrupt) + { ++ struct dwc3 *dwc = dep->dwc; + struct dwc3_gadget_ep_cmd_params params; + u32 cmd; + int ret; +@@ -1466,10 +1467,13 @@ static int __dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool int + WARN_ON_ONCE(ret); + dep->resource_index = 0; + +- if (!interrupt) ++ if (!interrupt) { ++ if (!DWC3_IP_IS(DWC3) || DWC3_VER_IS_PRIOR(DWC3, 310A)) ++ mdelay(1); + dep->flags &= ~DWC3_EP_TRANSFER_STARTED; +- else if (!ret) ++ } else if (!ret) { + dep->flags |= DWC3_EP_END_TRANSFER_PENDING; ++ } + + return ret; + } +@@ -3299,7 +3303,11 @@ static void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, + * enabled, the EndTransfer command will have completed upon + * returning from this function. + * +- * This mode is NOT available on the DWC_usb31 IP. ++ * This mode is NOT available on the DWC_usb31 IP. In this ++ * case, if the IOC bit is not set, then delay by 1ms ++ * after issuing the EndTransfer command. This allows for the ++ * controller to handle the command completely before DWC3 ++ * remove requests attempts to unmap USB request buffers. + */ + + __dwc3_stop_active_transfer(dep, force, interrupt); +-- +2.39.2 + diff --git a/queue-5.10/usb-dwc3-gadget-move-cmd_endtransfer-to-extra-functi.patch b/queue-5.10/usb-dwc3-gadget-move-cmd_endtransfer-to-extra-functi.patch new file mode 100644 index 00000000000..1ff369388cd --- /dev/null +++ b/queue-5.10/usb-dwc3-gadget-move-cmd_endtransfer-to-extra-functi.patch @@ -0,0 +1,125 @@ +From 8ce6f621d84ddba9920201dba7e45803d506fba6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Mar 2022 22:12:51 +0100 +Subject: usb: dwc3: gadget: move cmd_endtransfer to extra function + +From: Michael Grzeschik + +[ Upstream commit e192cc7b52399d1b073f88cd3ba128b74d3a57f1 ] + +This patch adds the extra function __dwc3_stop_active_transfer to +consolidate the same codepath. + +Signed-off-by: Michael Grzeschik +Link: https://lore.kernel.org/r/20220306211251.2281335-3-m.grzeschik@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: d8a2bb4eb758 ("usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 69 +++++++++++++++++++++------------------ + 1 file changed, 37 insertions(+), 32 deletions(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 28a1194f849fc..ce5131ccd60a9 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1440,6 +1440,40 @@ static int __dwc3_gadget_get_frame(struct dwc3 *dwc) + return DWC3_DSTS_SOFFN(reg); + } + ++/** ++ * __dwc3_stop_active_transfer - stop the current active transfer ++ * @dep: isoc endpoint ++ * @force: set forcerm bit in the command ++ * @interrupt: command complete interrupt after End Transfer command ++ * ++ * When setting force, the ForceRM bit will be set. In that case ++ * the controller won't update the TRB progress on command ++ * completion. It also won't clear the HWO bit in the TRB. ++ * The command will also not complete immediately in that case. ++ */ ++static int __dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool interrupt) ++{ ++ struct dwc3_gadget_ep_cmd_params params; ++ u32 cmd; ++ int ret; ++ ++ cmd = DWC3_DEPCMD_ENDTRANSFER; ++ cmd |= force ? DWC3_DEPCMD_HIPRI_FORCERM : 0; ++ cmd |= interrupt ? DWC3_DEPCMD_CMDIOC : 0; ++ cmd |= DWC3_DEPCMD_PARAM(dep->resource_index); ++ memset(¶ms, 0, sizeof(params)); ++ ret = dwc3_send_gadget_ep_cmd(dep, cmd, ¶ms); ++ WARN_ON_ONCE(ret); ++ dep->resource_index = 0; ++ ++ if (!interrupt) ++ dep->flags &= ~DWC3_EP_TRANSFER_STARTED; ++ else if (!ret) ++ dep->flags |= DWC3_EP_END_TRANSFER_PENDING; ++ ++ return ret; ++} ++ + /** + * dwc3_gadget_start_isoc_quirk - workaround invalid frame number + * @dep: isoc endpoint +@@ -1609,21 +1643,8 @@ static int __dwc3_gadget_start_isoc(struct dwc3_ep *dep) + * status, issue END_TRANSFER command and retry on the next XferNotReady + * event. + */ +- if (ret == -EAGAIN) { +- struct dwc3_gadget_ep_cmd_params params; +- u32 cmd; +- +- cmd = DWC3_DEPCMD_ENDTRANSFER | +- DWC3_DEPCMD_CMDIOC | +- DWC3_DEPCMD_PARAM(dep->resource_index); +- +- dep->resource_index = 0; +- memset(¶ms, 0, sizeof(params)); +- +- ret = dwc3_send_gadget_ep_cmd(dep, cmd, ¶ms); +- if (!ret) +- dep->flags |= DWC3_EP_END_TRANSFER_PENDING; +- } ++ if (ret == -EAGAIN) ++ ret = __dwc3_stop_active_transfer(dep, false, true); + + return ret; + } +@@ -3250,10 +3271,6 @@ static void dwc3_reset_gadget(struct dwc3 *dwc) + static void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, + bool interrupt) + { +- struct dwc3_gadget_ep_cmd_params params; +- u32 cmd; +- int ret; +- + if (!(dep->flags & DWC3_EP_TRANSFER_STARTED) || + (dep->flags & DWC3_EP_END_TRANSFER_PENDING)) + return; +@@ -3285,19 +3302,7 @@ static void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, + * This mode is NOT available on the DWC_usb31 IP. + */ + +- cmd = DWC3_DEPCMD_ENDTRANSFER; +- cmd |= force ? DWC3_DEPCMD_HIPRI_FORCERM : 0; +- cmd |= interrupt ? DWC3_DEPCMD_CMDIOC : 0; +- cmd |= DWC3_DEPCMD_PARAM(dep->resource_index); +- memset(¶ms, 0, sizeof(params)); +- ret = dwc3_send_gadget_ep_cmd(dep, cmd, ¶ms); +- WARN_ON_ONCE(ret); +- dep->resource_index = 0; +- +- if (!interrupt) +- dep->flags &= ~DWC3_EP_TRANSFER_STARTED; +- else +- dep->flags |= DWC3_EP_END_TRANSFER_PENDING; ++ __dwc3_stop_active_transfer(dep, force, interrupt); + } + + static void dwc3_clear_stall_all_ep(struct dwc3 *dwc) +-- +2.39.2 + -- 2.47.3