usb: dwc3: Stop active transfers before halting the controller

[ Upstream commit ae7e86108b12351028fa7e8796a59f9b2d9e1774 ]

In the DWC3 databook, for a device initiated disconnect or bus reset, the
driver is required to send dependxfer commands for any pending transfers.
In addition, before the controller can move to the halted state, the SW
needs to acknowledge any pending events.  If the controller is not halted
properly, there is a chance the controller will continue accessing stale or
freed TRBs and buffers.

Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
Reviewed-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 03b444f753aa2d8e055737f0deb00f51e2cf160a..4f28122f1bb83ed231fd1370c0311e1c0c5603d8 100644 (file)
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -197,7 +197,7 @@ int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request,
        int                             ret;
 
        spin_lock_irqsave(&dwc->lock, flags);
-       if (!dep->endpoint.desc) {
+       if (!dep->endpoint.desc || !dwc->pullups_connected) {
                dev_err(dwc->dev, "%s: can't queue to disabled endpoint\n",
                                dep->name);
                ret = -ESHUTDOWN;

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 9cf66636b19d5ad564b5c80d21b1d1e46626bb2e..94c430dcce5d374aedb8c5b40f80cdcde23b069a 100644 (file)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1511,7 +1511,7 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
 {
        struct dwc3             *dwc = dep->dwc;
 
-       if (!dep->endpoint.desc) {
+       if (!dep->endpoint.desc || !dwc->pullups_connected) {
                dev_err(dwc->dev, "%s: can't queue to disabled endpoint\n",
                                dep->name);
                return -ESHUTDOWN;
@@ -1931,6 +1931,21 @@ static int dwc3_gadget_set_selfpowered(struct usb_gadget *g,
        return 0;
 }
 
+static void dwc3_stop_active_transfers(struct dwc3 *dwc)
+{
+       u32 epnum;
+
+       for (epnum = 2; epnum < dwc->num_eps; epnum++) {
+               struct dwc3_ep *dep;
+
+               dep = dwc->eps[epnum];
+               if (!dep)
+                       continue;
+
+               dwc3_remove_requests(dwc, dep);
+       }
+}
+
 static int dwc3_gadget_run_stop(struct dwc3 *dwc, int is_on, int suspend)
 {
        u32                     reg;
@@ -1976,6 +1991,9 @@ static int dwc3_gadget_run_stop(struct dwc3 *dwc, int is_on, int suspend)
        return 0;
 }
 
+static void dwc3_gadget_disable_irq(struct dwc3 *dwc);
+static void __dwc3_gadget_stop(struct dwc3 *dwc);
+
 static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
 {
        struct dwc3             *dwc = gadget_to_dwc(g);
@@ -1999,7 +2017,46 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
                }
        }
 
+       /*
+        * Synchronize any pending event handling before executing the controller
+        * halt routine.
+        */
+       if (!is_on) {
+               dwc3_gadget_disable_irq(dwc);
+               synchronize_irq(dwc->irq_gadget);
+       }
+
        spin_lock_irqsave(&dwc->lock, flags);
+
+       if (!is_on) {
+               u32 count;
+
+               /*
+                * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a
+                * Section 4.1.8 Table 4-7, it states that for a device-initiated
+                * disconnect, the SW needs to ensure that it sends "a DEPENDXFER
+                * command for any active transfers" before clearing the RunStop
+                * bit.
+                */
+               dwc3_stop_active_transfers(dwc);
+               __dwc3_gadget_stop(dwc);
+
+               /*
+                * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a
+                * Section 1.3.4, it mentions that for the DEVCTRLHLT bit, the
+                * "software needs to acknowledge the events that are generated
+                * (by writing to GEVNTCOUNTn) while it is waiting for this bit
+                * to be set to '1'."
+                */
+               count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
+               count &= DWC3_GEVNTCOUNT_MASK;
+               if (count > 0) {
+                       dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), count);
+                       dwc->ev_buf->lpos = (dwc->ev_buf->lpos + count) %
+                                               dwc->ev_buf->length;
+               }
+       }
+
        ret = dwc3_gadget_run_stop(dwc, is_on, false);
        spin_unlock_irqrestore(&dwc->lock, flags);
 
@@ -3038,6 +3095,13 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)
        }
 
        dwc3_reset_gadget(dwc);
+       /*
+        * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a
+        * Section 4.1.2 Table 4-2, it states that during a USB reset, the SW
+        * needs to ensure that it sends "a DEPENDXFER command for any active
+        * transfers."
+        */
+       dwc3_stop_active_transfers(dwc);
 
        reg = dwc3_readl(dwc->regs, DWC3_DCTL);
        reg &= ~DWC3_DCTL_TSTCTRL_MASK;