Commit 25dda9fc authored by Thinh Nguyen's avatar Thinh Nguyen Committed by Greg Kroah-Hartman
Browse files

usb: dwc3: gadget: Properly track pending and queued SG 



The driver incorrectly uses req->num_pending_sgs to track both the
number of pending and queued SG entries. It only prepares the next
request if the previous is done, and it doesn't update num_pending_sgs
until there is TRB completion interrupt. This may starve the controller
of more TRBs until the num_pending_sgs is decremented.

Fix this by decrementing the num_pending_sgs after they are queued and
properly track both num_mapped_sgs and num_queued_sgs.

Fixes: c96e6725 ("usb: dwc3: gadget: Correct the logic for queuing sgs")
Cc: <stable@vger.kernel.org>
Reported-by: default avatarMichael Grzeschik <m.grzeschik@pengutronix.de>
Tested-by: default avatarMichael Grzeschik <m.grzeschik@pengutronix.de>
Acked-by: default avatarFelipe Balbi <balbi@kernel.org>
Signed-off-by: default avatarThinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/ba24591dbcaad8f244a3e88bd449bb7205a5aec3.1620874069.git.Thinh.Nguyen@synopsys.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4f2629ea

drivers/usb/dwc3/gadget.c

+7 −6
Original line number Diff line number Diff line
@@ -1244,6 +1244,7 @@ static int dwc3_prepare_trbs_sg(struct dwc3_ep *dep, 
			req->start_sg = sg_next(s);



		req->num_queued_sgs++;

		req->num_pending_sgs--;



		/*

		 * The number of pending SG entries may not correspond to the
@@ -1251,7 +1252,7 @@ static int dwc3_prepare_trbs_sg(struct dwc3_ep *dep, 
		 * don't include unused SG entries.

		 */

		if (length == 0) {

			req->num_pending_sgs -= req->request.num_mapped_sgs - req->num_queued_sgs;

			req->num_pending_sgs = 0;

			break;

		}
@@ -2873,15 +2874,15 @@ static int dwc3_gadget_ep_reclaim_trb_sg(struct dwc3_ep *dep, 
	struct dwc3_trb *trb = &dep->trb_pool[dep->trb_dequeue];

	struct scatterlist *sg = req->sg;

	struct scatterlist *s;

	unsigned int pending = req->num_pending_sgs;

	unsigned int num_queued = req->num_queued_sgs;

	unsigned int i;

	int ret = 0;



	for_each_sg(sg, s, pending, i) {

	for_each_sg(sg, s, num_queued, i) {

		trb = &dep->trb_pool[dep->trb_dequeue];



		req->sg = sg_next(s);

		req->num_pending_sgs--;

		req->num_queued_sgs--;



		ret = dwc3_gadget_ep_reclaim_completed_trb(dep, req,

				trb, event, status, true);
@@ -2904,7 +2905,7 @@ static int dwc3_gadget_ep_reclaim_trb_linear(struct dwc3_ep *dep, 


static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req)

{

	return req->num_pending_sgs == 0;

	return req->num_pending_sgs == 0 && req->num_queued_sgs == 0;

}



static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
@@ -2913,7 +2914,7 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep, 
{

	int ret;



	if (req->num_pending_sgs)

	if (req->request.num_mapped_sgs)

		ret = dwc3_gadget_ep_reclaim_trb_sg(dep, req, event,

				status);

	else