Patch "usb: dwc3: ep0: explicitly call dwc3_ep0_prepare_one_trb()" has been added to the 4.4-stable tree

Patch "usb: dwc3: ep0: explicitly call dwc3_ep0_prepare_one_trb()" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    usb: dwc3: ep0: explicitly call dwc3_ep0_prepare_one_trb()

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-dwc3-ep0-explicitly-call-dwc3_ep0_prepare_one_trb.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 19ec31230eb3084431bc2e565fd085f79f564274 Mon Sep 17 00:00:00 2001
From: Felipe Balbi <felipe.balbi@linux.intel.com>
Date: Tue, 20 Dec 2016 14:08:48 +0200
Subject: usb: dwc3: ep0: explicitly call dwc3_ep0_prepare_one_trb()

From: Felipe Balbi <felipe.balbi@linux.intel.com>

commit 19ec31230eb3084431bc2e565fd085f79f564274 upstream.

Let's call dwc3_ep0_prepare_one_trb() explicitly
because there are occasions where we will need more
than one TRB to handle an EP0 transfer.

A follow-up patch will fix one bug related to
multiple-TRB Data Phases when it comes to
mapping/unmapping requests for DMA.

Reported-by: Janusz Dziedzic <januszx.dziedzic@linux.intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>


---
 drivers/usb/dwc3/ep0.c |   28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -85,8 +85,7 @@ static void dwc3_ep0_prepare_one_trb(str
 	trace_dwc3_prepare_trb(dep, trb);
 }
 
-static int dwc3_ep0_start_trans(struct dwc3 *dwc, u8 epnum, dma_addr_t buf_dma,
-		u32 len, u32 type, bool chain)
+static int dwc3_ep0_start_trans(struct dwc3 *dwc, u8 epnum)
 {
 	struct dwc3_gadget_ep_cmd_params params;
 	struct dwc3_ep			*dep;
@@ -98,8 +97,6 @@ static int dwc3_ep0_start_trans(struct d
 		return 0;
 	}
 
-	dwc3_ep0_prepare_one_trb(dwc, epnum, buf_dma, len, type, chain);
-
 	memset(&params, 0, sizeof(params));
 	params.param0 = upper_32_bits(dwc->ep0_trb_addr);
 	params.param1 = lower_32_bits(dwc->ep0_trb_addr);
@@ -317,8 +314,9 @@ void dwc3_ep0_out_start(struct dwc3 *dwc
 {
 	int				ret;
 
-	ret = dwc3_ep0_start_trans(dwc, 0, dwc->ctrl_req_addr, 8,
+	dwc3_ep0_prepare_one_trb(dwc, 0, dwc->ctrl_req_addr, 8,
 			DWC3_TRBCTL_CONTROL_SETUP, false);
+	ret = dwc3_ep0_start_trans(dwc, 0);
 	WARN_ON(ret < 0);
 }
 
@@ -877,9 +875,9 @@ static void dwc3_ep0_complete_data(struc
 
 			dwc->ep0_next_event = DWC3_EP0_COMPLETE;
 
-			ret = dwc3_ep0_start_trans(dwc, epnum,
-					dwc->ctrl_req_addr, 0,
-					DWC3_TRBCTL_CONTROL_DATA, false);
+			dwc3_ep0_prepare_one_trb(dwc, epnum, dwc->ctrl_req_addr,
+					0, DWC3_TRBCTL_CONTROL_DATA, false);
+			ret = dwc3_ep0_start_trans(dwc, epnum);
 			WARN_ON(ret < 0);
 		}
 	}
@@ -961,9 +959,10 @@ static void __dwc3_ep0_do_control_data(s
 	req->direction = !!dep->number;
 
 	if (req->request.length == 0) {
-		ret = dwc3_ep0_start_trans(dwc, dep->number,
+		dwc3_ep0_prepare_one_trb(dwc, dep->number,
 				dwc->ctrl_req_addr, 0,
 				DWC3_TRBCTL_CONTROL_DATA, false);
+		ret = dwc3_ep0_start_trans(dwc, dep->number);
 	} else if (!IS_ALIGNED(req->request.length, dep->endpoint.maxpacket)
 			&& (dep->number == 0)) {
 		u32	transfer_size = 0;
@@ -981,7 +980,7 @@ static void __dwc3_ep0_do_control_data(s
 		if (req->request.length > DWC3_EP0_BOUNCE_SIZE) {
 			transfer_size = ALIGN(req->request.length - maxpacket,
 					      maxpacket);
-			ret = dwc3_ep0_start_trans(dwc, dep->number,
+			dwc3_ep0_prepare_one_trb(dwc, dep->number,
 						   req->request.dma,
 						   transfer_size,
 						   DWC3_TRBCTL_CONTROL_DATA,
@@ -993,9 +992,10 @@ static void __dwc3_ep0_do_control_data(s
 
 		dwc->ep0_bounced = true;
 
-		ret = dwc3_ep0_start_trans(dwc, dep->number,
+		dwc3_ep0_prepare_one_trb(dwc, dep->number,
 				dwc->ep0_bounce_addr, transfer_size,
 				DWC3_TRBCTL_CONTROL_DATA, false);
+		ret = dwc3_ep0_start_trans(dwc, dep->number);
 	} else {
 		ret = usb_gadget_map_request(&dwc->gadget, &req->request,
 				dep->number);
@@ -1004,9 +1004,10 @@ static void __dwc3_ep0_do_control_data(s
 			return;
 		}
 
-		ret = dwc3_ep0_start_trans(dwc, dep->number, req->request.dma,
+		dwc3_ep0_prepare_one_trb(dwc, dep->number, req->request.dma,
 				req->request.length, DWC3_TRBCTL_CONTROL_DATA,
 				false);
+		ret = dwc3_ep0_start_trans(dwc, dep->number);
 	}
 
 	WARN_ON(ret < 0);
@@ -1020,8 +1021,9 @@ static int dwc3_ep0_start_control_status
 	type = dwc->three_stage_setup ? DWC3_TRBCTL_CONTROL_STATUS3
 		: DWC3_TRBCTL_CONTROL_STATUS2;
 
-	return dwc3_ep0_start_trans(dwc, dep->number,
+	dwc3_ep0_prepare_one_trb(dwc, dep->number,
 			dwc->ctrl_req_addr, 0, type, false);
+	return dwc3_ep0_start_trans(dwc, dep->number);
 }
 
 static void __dwc3_ep0_do_control_status(struct dwc3 *dwc, struct dwc3_ep *dep)


Patches currently in stable-queue which might be from felipe.balbi@linux.intel.com are

queue-4.4/usb-dummy-hcd-fix-bug-in-stop_activity-handle-ep0.patch
queue-4.4/usb-dwc3-core-avoid-overflow-events.patch
queue-4.4/usb-gadgetfs-fix-use-after-free-bug.patch
queue-4.4/usb-gadget-composite-test-get_alt-presence-instead-of-set_alt.patch
queue-4.4/usb-dwc3-ep0-explicitly-call-dwc3_ep0_prepare_one_trb.patch
queue-4.4/usb-phy-am335x-control-fix-device-and-of_node-leaks.patch
queue-4.4/usb-gadgetfs-restrict-upper-bound-on-device-configuration-size.patch
queue-4.4/usb-gadgetfs-fix-checks-of-wtotallength-in-config-descriptors.patch
queue-4.4/usb-dwc3-gadget-always-unmap-ep0-requests.patch
queue-4.4/usb-dwc3-ep0-add-dwc3_ep0_prepare_one_trb.patch
queue-4.4/usb-dwc3-pci-add-intel-gemini-lake-pci-id.patch
queue-4.4/usb-gadgetfs-fix-unbounded-memory-allocation-bug.patch