[PATCH 0/3] usb: dwc3: gadget: Fix halt/clear_stall handling

[PATCH 0/3] usb: dwc3: gadget: Fix halt/clear_stall handling

[Thinh Nguyen]

This series fixes a couple of driver issues handling ClearFeature(halt)
request:

1) A function driver often uses set_halt() to reject a class driver protocol
command. After set_halt(), the endpoint will be stalled. It can queue new
requests while the endpoint is stalled. However, dwc3 currently drops those
requests after CLEAR_STALL. The driver should only drop started requests. Keep
the pending requests in the pending list to resume and process them after the
host issues ClearFeature(Halt) to the endpoint.

2) DWC3 should issue CLEAR_STALL command _after_ END_TRANSFER command completes.


Thinh Nguyen (3):
  usb: dwc3: gadget: Resume pending requests after CLEAR_STALL
  usb: dwc3: gadget: END_TRANSFER before CLEAR_STALL command
  usb: dwc3: gadget: Refactor ep command completion

 drivers/usb/dwc3/core.h   |  1 +
 drivers/usb/dwc3/ep0.c    | 16 +++++++++
 drivers/usb/dwc3/gadget.c | 85 +++++++++++++++++++++++++++++++----------------
 drivers/usb/dwc3/gadget.h |  1 +
 4 files changed, 75 insertions(+), 28 deletions(-)


base-commit: e3ee0e740c3887d2293e8d54a8707218d70d86ca
-- 
2.11.0

[PATCH 1/3] usb: dwc3: gadget: Resume pending requests after CLEAR_STALL

[Thinh Nguyen]

The function driver may queue new requests right after halting the
endpoint (i.e. queue new requests while the endpoint is stalled).
There's no restriction preventing it from doing so. However, dwc3
currently drops those requests after CLEAR_STALL. The driver should only
drop started requests. Keep the pending requests in the pending list to
resume and process them after the host issues ClearFeature(Halt) to the
endpoint.

Cc: stable@vger.kernel.org
Fixes: cb11ea56f37a ("usb: dwc3: gadget: Properly handle ClearFeature(halt)")
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
---
 drivers/usb/dwc3/gadget.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index e44bfc3b5096..fcd0df1e7d3f 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1566,8 +1566,12 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
 	if (dep->flags & DWC3_EP_WAIT_TRANSFER_COMPLETE)
 		return 0;
 
-	/* Start the transfer only after the END_TRANSFER is completed */
-	if (dep->flags & DWC3_EP_END_TRANSFER_PENDING) {
+	/*
+	 * Start the transfer only after the END_TRANSFER is completed
+	 * and endpoint STALL is cleared.
+	 */
+	if ((dep->flags & DWC3_EP_END_TRANSFER_PENDING) ||
+	    (dep->flags & DWC3_EP_STALL)) {
 		dep->flags |= DWC3_EP_DELAY_START;
 		return 0;
 	}
@@ -1774,9 +1778,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
 		list_for_each_entry_safe(req, tmp, &dep->started_list, list)
 			dwc3_gadget_move_cancelled_request(req);
 
-		list_for_each_entry_safe(req, tmp, &dep->pending_list, list)
-			dwc3_gadget_move_cancelled_request(req);
-
 		if (!(dep->flags & DWC3_EP_END_TRANSFER_PENDING)) {
 			dep->flags &= ~DWC3_EP_DELAY_START;
 			dwc3_gadget_ep_cleanup_cancelled_requests(dep);
-- 
2.11.0

[PATCH 2/3] usb: dwc3: gadget: END_TRANSFER before CLEAR_STALL command

[Thinh Nguyen]

According the programming guide (for all DWC3 IPs), when the driver
handles ClearFeature(halt) request, it should issue CLEAR_STALL command
_after_ the END_TRANSFER command completes. The END_TRANSFER command may
take some time to complete. So, delay the ClearFeature(halt) request
control status stage and wait for END_TRANSFER command completion
interrupt. Only after END_TRANSFER command completes that the driver
may issue CLEAR_STALL command.

Cc: stable@vger.kernel.org
Fixes: cb11ea56f37a ("usb: dwc3: gadget: Properly handle ClearFeature(halt)")
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
---
 drivers/usb/dwc3/core.h   |  1 +
 drivers/usb/dwc3/ep0.c    | 16 ++++++++++++++++
 drivers/usb/dwc3/gadget.c | 43 +++++++++++++++++++++++++++++++++----------
 drivers/usb/dwc3/gadget.h |  1 +
 4 files changed, 51 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 2f04b3e42bf1..eb026c9cca28 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -706,6 +706,7 @@ struct dwc3_ep {
 #define DWC3_EP_IGNORE_NEXT_NOSTREAM	BIT(8)
 #define DWC3_EP_FORCE_RESTART_STREAM	BIT(9)
 #define DWC3_EP_FIRST_STREAM_PRIMED	BIT(10)
+#define DWC3_EP_PENDING_CLEAR_STALL	BIT(11)
 
 	/* This last one is specific to EP0 */
 #define DWC3_EP0_DIR_IN		BIT(31)
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 59f2e8c31bd1..92bc1044e7ab 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -524,6 +524,11 @@ static int dwc3_ep0_handle_endpoint(struct dwc3 *dwc,
 		ret = __dwc3_gadget_ep_set_halt(dep, set, true);
 		if (ret)
 			return -EINVAL;
+
+		/* ClearFeature(Halt) may need delayed status */
+		if (!set && (dep->flags & DWC3_EP_END_TRANSFER_PENDING))
+			return USB_GADGET_DELAYED_STATUS;
+
 		break;
 	default:
 		return -EINVAL;
@@ -1042,6 +1047,17 @@ static void dwc3_ep0_do_control_status(struct dwc3 *dwc,
 	__dwc3_ep0_do_control_status(dwc, dep);
 }
 
+void dwc3_ep0_send_delayed_status(struct dwc3 *dwc)
+{
+	unsigned int direction = !dwc->ep0_expect_in;
+
+	if (dwc->ep0state != EP0_STATUS_PHASE)
+		return;
+
+	dwc->delayed_status = false;
+	__dwc3_ep0_do_control_status(dwc, dwc->eps[direction]);
+}
+
 static void dwc3_ep0_end_control_data(struct dwc3 *dwc, struct dwc3_ep *dep)
 {
 	struct dwc3_gadget_ep_cmd_params params;
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index fcd0df1e7d3f..8c89444efd9f 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1764,6 +1764,19 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
 			return 0;
 		}
 
+		dwc3_stop_active_transfer(dep, true, true);
+
+		list_for_each_entry_safe(req, tmp, &dep->started_list, list)
+			dwc3_gadget_move_cancelled_request(req);
+
+		if (dep->flags & DWC3_EP_END_TRANSFER_PENDING) {
+			dep->flags |= DWC3_EP_PENDING_CLEAR_STALL;
+			return 0;
+		}
+
+		dep->flags &= ~DWC3_EP_DELAY_START;
+		dwc3_gadget_ep_cleanup_cancelled_requests(dep);
+
 		ret = dwc3_send_clear_stall_ep_cmd(dep);
 		if (ret) {
 			dev_err(dwc->dev, "failed to clear STALL on %s\n",
@@ -1772,16 +1785,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
 		}
 
 		dep->flags &= ~(DWC3_EP_STALL | DWC3_EP_WEDGE);
-
-		dwc3_stop_active_transfer(dep, true, true);
-
-		list_for_each_entry_safe(req, tmp, &dep->started_list, list)
-			dwc3_gadget_move_cancelled_request(req);
-
-		if (!(dep->flags & DWC3_EP_END_TRANSFER_PENDING)) {
-			dep->flags &= ~DWC3_EP_DELAY_START;
-			dwc3_gadget_ep_cleanup_cancelled_requests(dep);
-		}
 	}
 
 	return ret;
@@ -2927,6 +2930,26 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc,
 			dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING;
 			dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
 			dwc3_gadget_ep_cleanup_cancelled_requests(dep);
+
+			if (dep->flags & DWC3_EP_PENDING_CLEAR_STALL) {
+				struct dwc3 *dwc = dep->dwc;
+
+				dep->flags &= ~DWC3_EP_PENDING_CLEAR_STALL;
+				if (dwc3_send_clear_stall_ep_cmd(dep)) {
+					struct usb_ep *ep0 = &dwc->eps[0]->endpoint;
+
+					dev_err(dwc->dev, "failed to clear STALL on %s\n",
+						dep->name);
+					if (dwc->delayed_status)
+						__dwc3_gadget_ep0_set_halt(ep0, 1);
+					return;
+				}
+
+				dep->flags &= ~(DWC3_EP_STALL | DWC3_EP_WEDGE);
+				if (dwc->delayed_status)
+					dwc3_ep0_send_delayed_status(dwc);
+			}
+
 			if ((dep->flags & DWC3_EP_DELAY_START) &&
 			    !usb_endpoint_xfer_isoc(dep->endpoint.desc))
 				__dwc3_gadget_kick_transfer(dep);
diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h
index bd85eb7fa9ef..a7791cb827c4 100644
--- a/drivers/usb/dwc3/gadget.h
+++ b/drivers/usb/dwc3/gadget.h
@@ -113,6 +113,7 @@ int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value);
 int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request,
 		gfp_t gfp_flags);
 int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol);
+void dwc3_ep0_send_delayed_status(struct dwc3 *dwc);
 
 /**
  * dwc3_gadget_ep_get_transfer_index - Gets transfer index from HW
-- 
2.11.0

[PATCH 3/3] usb: dwc3: gadget: Refactor ep command completion

[Thinh Nguyen]

Refactor END_TRANSFER command completion handling and move it outside of
the switch statement to its own function. This makes it cleaner and
consistent with other event handler functions. No functional change
here.

Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
---
 drivers/usb/dwc3/gadget.c | 71 +++++++++++++++++++++++++----------------------
 1 file changed, 38 insertions(+), 33 deletions(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 8c89444efd9f..cd68c5070084 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2829,6 +2829,43 @@ static void dwc3_gadget_endpoint_transfer_not_ready(struct dwc3_ep *dep,
 	(void) __dwc3_gadget_start_isoc(dep);
 }
 
+static void dwc3_gadget_endpoint_command_complete(struct dwc3_ep *dep,
+		const struct dwc3_event_depevt *event)
+{
+	u8 cmd = DEPEVT_PARAMETER_CMD(event->parameters);
+
+	if (cmd != DWC3_DEPCMD_ENDTRANSFER)
+		return;
+
+	dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING;
+	dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
+	dwc3_gadget_ep_cleanup_cancelled_requests(dep);
+
+	if (dep->flags & DWC3_EP_PENDING_CLEAR_STALL) {
+		struct dwc3 *dwc = dep->dwc;
+
+		dep->flags &= ~DWC3_EP_PENDING_CLEAR_STALL;
+		if (dwc3_send_clear_stall_ep_cmd(dep)) {
+			struct usb_ep *ep0 = &dwc->eps[0]->endpoint;
+
+			dev_err(dwc->dev, "failed to clear STALL on %s\n", dep->name);
+			if (dwc->delayed_status)
+				__dwc3_gadget_ep0_set_halt(ep0, 1);
+			return;
+		}
+
+		dep->flags &= ~(DWC3_EP_STALL | DWC3_EP_WEDGE);
+		if (dwc->delayed_status)
+			dwc3_ep0_send_delayed_status(dwc);
+	}
+
+	if ((dep->flags & DWC3_EP_DELAY_START) &&
+	    !usb_endpoint_xfer_isoc(dep->endpoint.desc))
+		__dwc3_gadget_kick_transfer(dep);
+
+	dep->flags &= ~DWC3_EP_DELAY_START;
+}
+
 static void dwc3_gadget_endpoint_stream_event(struct dwc3_ep *dep,
 		const struct dwc3_event_depevt *event)
 {
@@ -2898,7 +2935,6 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc,
 {
 	struct dwc3_ep		*dep;
 	u8			epnum = event->endpoint_number;
-	u8			cmd;
 
 	dep = dwc->eps[epnum];
 
@@ -2924,38 +2960,7 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc,
 		dwc3_gadget_endpoint_transfer_not_ready(dep, event);
 		break;
 	case DWC3_DEPEVT_EPCMDCMPLT:
-		cmd = DEPEVT_PARAMETER_CMD(event->parameters);
-
-		if (cmd == DWC3_DEPCMD_ENDTRANSFER) {
-			dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING;
-			dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
-			dwc3_gadget_ep_cleanup_cancelled_requests(dep);
-
-			if (dep->flags & DWC3_EP_PENDING_CLEAR_STALL) {
-				struct dwc3 *dwc = dep->dwc;
-
-				dep->flags &= ~DWC3_EP_PENDING_CLEAR_STALL;
-				if (dwc3_send_clear_stall_ep_cmd(dep)) {
-					struct usb_ep *ep0 = &dwc->eps[0]->endpoint;
-
-					dev_err(dwc->dev, "failed to clear STALL on %s\n",
-						dep->name);
-					if (dwc->delayed_status)
-						__dwc3_gadget_ep0_set_halt(ep0, 1);
-					return;
-				}
-
-				dep->flags &= ~(DWC3_EP_STALL | DWC3_EP_WEDGE);
-				if (dwc->delayed_status)
-					dwc3_ep0_send_delayed_status(dwc);
-			}
-
-			if ((dep->flags & DWC3_EP_DELAY_START) &&
-			    !usb_endpoint_xfer_isoc(dep->endpoint.desc))
-				__dwc3_gadget_kick_transfer(dep);
-
-			dep->flags &= ~DWC3_EP_DELAY_START;
-		}
+		dwc3_gadget_endpoint_command_complete(dep, event);
 		break;
 	case DWC3_DEPEVT_XFERCOMPLETE:
 		dwc3_gadget_endpoint_transfer_complete(dep, event);
-- 
2.11.0

Re: [PATCH 0/3] usb: dwc3: gadget: Fix halt/clear_stall handling

[Thinh Nguyen]

Hi Felipe,

Thinh Nguyen wrote:
> This series fixes a couple of driver issues handling ClearFeature(halt)
> request:
>
> 1) A function driver often uses set_halt() to reject a class driver protocol
> command. After set_halt(), the endpoint will be stalled. It can queue new
> requests while the endpoint is stalled. However, dwc3 currently drops those
> requests after CLEAR_STALL. The driver should only drop started requests. Keep
> the pending requests in the pending list to resume and process them after the
> host issues ClearFeature(Halt) to the endpoint.
>
> 2) DWC3 should issue CLEAR_STALL command _after_ END_TRANSFER command completes.
>
>
> Thinh Nguyen (3):
>   usb: dwc3: gadget: Resume pending requests after CLEAR_STALL
>   usb: dwc3: gadget: END_TRANSFER before CLEAR_STALL command

Since you're picking the fix patches for RC cycle, can you pick up these
2 patches of this series also? We can leave the refactoring patch in
this series for v5.10.

Thanks,
Thinh


>   usb: dwc3: gadget: Refactor ep command completion
>
>  drivers/usb/dwc3/core.h   |  1 +
>  drivers/usb/dwc3/ep0.c    | 16 +++++++++
>  drivers/usb/dwc3/gadget.c | 85 +++++++++++++++++++++++++++++++----------------
>  drivers/usb/dwc3/gadget.h |  1 +
>  4 files changed, 75 insertions(+), 28 deletions(-)
>
>
> base-commit: e3ee0e740c3887d2293e8d54a8707218d70d86ca

Re: [PATCH 0/3] usb: dwc3: gadget: Fix halt/clear_stall handling

[Felipe Balbi]

[-- Attachment #1: Type: text/plain, Size: 1204 bytes --]

Thinh Nguyen <Thinh.Nguyen@synopsys.com> writes:

> Hi Felipe,
>
> Thinh Nguyen wrote:
>> This series fixes a couple of driver issues handling ClearFeature(halt)
>> request:
>>
>> 1) A function driver often uses set_halt() to reject a class driver protocol
>> command. After set_halt(), the endpoint will be stalled. It can queue new
>> requests while the endpoint is stalled. However, dwc3 currently drops those
>> requests after CLEAR_STALL. The driver should only drop started requests. Keep
>> the pending requests in the pending list to resume and process them after the
>> host issues ClearFeature(Halt) to the endpoint.
>>
>> 2) DWC3 should issue CLEAR_STALL command _after_ END_TRANSFER command completes.
>>
>>
>> Thinh Nguyen (3):
>>   usb: dwc3: gadget: Resume pending requests after CLEAR_STALL
>>   usb: dwc3: gadget: END_TRANSFER before CLEAR_STALL command
>
> Since you're picking the fix patches for RC cycle, can you pick up these
> 2 patches of this series also? We can leave the refactoring patch in
> this series for v5.10.

just to be sure: you did run these through usbcv and usb3 compliance
suite, right? Which gadget drivers did you use?

-- 
balbi

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]

Re: [PATCH 0/3] usb: dwc3: gadget: Fix halt/clear_stall handling

[Thinh Nguyen]

Felipe Balbi wrote:
> Thinh Nguyen <Thinh.Nguyen@synopsys.com> writes:
>
>> Hi Felipe,
>>
>> Thinh Nguyen wrote:
>>> This series fixes a couple of driver issues handling ClearFeature(halt)
>>> request:
>>>
>>> 1) A function driver often uses set_halt() to reject a class driver protocol
>>> command. After set_halt(), the endpoint will be stalled. It can queue new
>>> requests while the endpoint is stalled. However, dwc3 currently drops those
>>> requests after CLEAR_STALL. The driver should only drop started requests. Keep
>>> the pending requests in the pending list to resume and process them after the
>>> host issues ClearFeature(Halt) to the endpoint.
>>>
>>> 2) DWC3 should issue CLEAR_STALL command _after_ END_TRANSFER command completes.
>>>
>>>
>>> Thinh Nguyen (3):
>>>   usb: dwc3: gadget: Resume pending requests after CLEAR_STALL
>>>   usb: dwc3: gadget: END_TRANSFER before CLEAR_STALL command
>> Since you're picking the fix patches for RC cycle, can you pick up these
>> 2 patches of this series also? We can leave the refactoring patch in
>> this series for v5.10.
> just to be sure: you did run these through usbcv and usb3 compliance
> suite, right? Which gadget drivers did you use?
>

Yes I did for chapter 9, MSC, and UASP CV. I missed this issue because
"stall" was not enabled by default for mass_storage configfs. Without
this fix, mass_storage function won't work with "stall" enabled.

(Note: for UASP CV, it requires many fixes/enhancements in f_tcm and the
target subsystem to work properly.)

Thanks,
Thinh