linux.git/drivers/usb/cdns3, branch v5.10

usb: cdns3: core: fix goto label for error path

2020-11-30T05:48:32+00:00

The usb_role_switch_register has been already called, so if the
devm_request_irq has failed, it needs to call usb_role_switch_unregister.

Fixes: b1234e3b3b26 ("usb: cdns3: add runtime PM support")
Signed-off-by: Peter Chen

usb: cdns3: gadget: clear trb->length as zero after preparing every trb

2020-11-30T05:48:32+00:00

It clears trb->length as zero before preparing td, but if scatter
buffer is used for td, there are several trbs within td, it needs to clear
every trb->length as zero, otherwise, the default value for trb->length
may not be zero after it begins to use the second round of trb rings.

Fixes: abc6b579048e ("usb: cdns3: gadget: using correct sg operations")
Signed-off-by: Peter Chen

usb: cdns3: Fix hardware based role switch

2020-11-30T05:48:32+00:00

Hardware based role switch is broken as the driver always skips it.
Fix this by registering for  SW role switch only if 'usb-role-switch'
property is present in the device tree.

Fixes: 50642709f659 ("usb: cdns3: core: quit if it uses role switch class")
Signed-off-by: Roger Quadros 
Signed-off-by: Peter Chen

usb: cdns3: gadget: calculate TD_SIZE based on TD

2020-11-16T07:08:52+00:00

The TRB entry TD_SIZE is the packet number for the TD (request) but not the
each TRB, so it only needs to be assigned for the first TRB during the TD,
and the value of it is for TD too.

Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Peter Chen

usb: cdns3: gadget: initialize link_trb as NULL

2020-11-16T07:08:52+00:00

There is an uninitialized variable "link_trb" usage at function cdns3_ep_run_transfer.
Fixed it by initialize "link_trb" as NULL.

Fixes: 4e218882eb5a ("usb: cdns3: gadget: improve the dump TRB operation at cdns3_ep_run_transfer")
Reported-by: Dan Carpenter 
Signed-off-by: Peter Chen

usb: cdns3: gadget: own the lock wrongly at the suspend routine

2020-10-30T03:40:54+00:00

When the system goes to suspend, if the controller is at device mode with
cable connecting to host, the call stack is: cdns3_suspend->
cdns3_gadget_suspend -> cdns3_disconnect_gadget, after cdns3_disconnect_gadget
is called, it owns lock wrongly, it causes the system being deadlock after
resume due to at cdns3_device_thread_irq_handler, it tries to get the lock,
but can't get it forever.

To fix it, we delete the unlock-lock operations at cdns3_disconnect_gadget,
and do it at the caller.

Fixes: b1234e3b3b26 ("usb: cdns3: add runtime PM support")
Acked-by: Pawel Laszczak 
Signed-off-by: Peter Chen

usb: cdns3: Fix on-chip memory overflow issue

2020-10-30T03:40:54+00:00

Patch fixes issue caused setting On-chip memory overflow bit in usb_sts
register. The issue occurred because EP_CFG register was set twice
before USB_STS.CFGSTS was set. Every write operation on EP_CFG.BUFFERING
causes that controller increases internal counter holding the number
of reserved on-chip buffers. First time this register was updated in
function cdns3_ep_config before delegating SET_CONFIGURATION request
to class driver and again it was updated when class wanted to enable
endpoint.  This patch fixes this issue by configuring endpoints
enabled by class driver in cdns3_gadget_ep_enable and others just
before status stage.

Cc: stable@vger.kernel.org#v5.8+
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Reported-and-tested-by: Peter Chen 
Signed-off-by: Pawel Laszczak 
Signed-off-by: Peter Chen

usb: cdns3: gadget: suspicious implicit sign extension

2020-10-29T10:01:47+00:00

The code:
trb->length = cpu_to_le32(TRB_BURST_LEN(priv_ep->trb_burst_size)
	       	| TRB_LEN(length));

TRB_BURST_LEN(priv_ep->trb_burst_size) may be overflow for int 32 if
priv_ep->trb_burst_size is equal or larger than 0x80;

Below is the Coverity warning:
sign_extension: Suspicious implicit sign extension: priv_ep->trb_burst_size
with type u8 (8 bits, unsigned) is promoted in priv_ep->trb_burst_size << 24
to type int (32 bits, signed), then sign-extended to type unsigned long
(64 bits, unsigned). If priv_ep->trb_burst_size << 24 is greater than 0x7FFFFFFF,
the upper bits of the result will all be 1.

To fix it, it needs to add an explicit cast to unsigned int type for ((p) << 24).

Reviewed-by: Jun Li 
Signed-off-by: Peter Chen

usb: cdns3: Variable 'length' set but not used

2020-10-28T07:25:59+00:00

Patch removes not used variable 'length' from
cdns3_wa2_descmiss_copy_data function.

Fixes: 141e70fef4ee ("usb: cdns3: gadget: need to handle sg case for workaround 2 case")
Acked-by: Roger Quadros 
Signed-off-by: Pawel Laszczak 
Signed-off-by: Peter Chen

usb: cdns3: gadget: enlarge the TRB ring length

2020-10-02T06:57:46+00:00

At Android ADB and MTP use case, it uses f_fs which supports scatter list,
it means one request may need several TRBs for it. Besides, TRB consumes
very fast compared to TRB has prepared for above use case, there are at
most 120 pending requests, the date size is 16KB for each request, so four
TRBs (4KB per TRB) per sg entry at worst case. so we need to enlarge the
TRB ring length to avoid "no free TRB error". Since each TRB only consumes
12 bytes (3 * 32 bits), we enlarge the TRB length to 600, it leaves some
buffers for potential "no free TRB error", and only increases a little
memory cost.

Signed-off-by: Peter Chen 
Signed-off-by: Felipe Balbi