DWC3 programming guide mentions that when operating in USB2.0 speeds,
if GUSB2PHYCFG[6] or GUSB2PHYCFG[8] is set, it must be cleared prior
to issuing commands and may be set again  after the command completes.
But currently while issuing EndXfer command without CmdIOC set, we
wait for 1ms after GUSB2PHYCFG is restored. This results in cases
where EndXfer command doesn't get completed and causes SMMU faults
since requests are unmapped afterwards. Hence restore GUSB2PHYCFG
after waiting for EndXfer command completion.

Cc: stable@vger.kernel.org
Fixes: 1d26ba0944d3 ("usb: dwc3: Wait unconditionally after issuing EndXfer command")
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
---
 drivers/usb/dwc3/gadget.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 291bc549935b..50772d611582 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -438,6 +438,10 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned int cmd,
 			dwc3_gadget_ep_get_transfer_index(dep);
 	}
 
+	if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_ENDTRANSFER &&
+	    !(cmd & DWC3_DEPCMD_CMDIOC))
+		mdelay(1);
+
 	if (saved_config) {
 		reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
 		reg |= saved_config;
@@ -1715,12 +1719,10 @@ static int __dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool int
 	WARN_ON_ONCE(ret);
 	dep->resource_index = 0;
 
-	if (!interrupt) {
-		mdelay(1);
+	if (!interrupt)
 		dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
-	} else if (!ret) {
+	else if (!ret)
 		dep->flags |= DWC3_EP_END_TRANSFER_PENDING;
-	}
 
 	dep->flags &= ~DWC3_EP_DELAY_STOP;
 	return ret;
-- 
2.25.1

On Tue, Sep 24, 2024, Prashanth K wrote:
> DWC3 programming guide mentions that when operating in USB2.0 speeds,
> if GUSB2PHYCFG[6] or GUSB2PHYCFG[8] is set, it must be cleared prior
> to issuing commands and may be set again  after the command completes.
> But currently while issuing EndXfer command without CmdIOC set, we
> wait for 1ms after GUSB2PHYCFG is restored. This results in cases
> where EndXfer command doesn't get completed and causes SMMU faults
> since requests are unmapped afterwards. Hence restore GUSB2PHYCFG
> after waiting for EndXfer command completion.
> 
> Cc: stable@vger.kernel.org
> Fixes: 1d26ba0944d3 ("usb: dwc3: Wait unconditionally after issuing EndXfer command")
> Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
> ---
>  drivers/usb/dwc3/gadget.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index 291bc549935b..50772d611582 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -438,6 +438,10 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned int cmd,
>  			dwc3_gadget_ep_get_transfer_index(dep);
>  	}
>  
> +	if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_ENDTRANSFER &&
> +	    !(cmd & DWC3_DEPCMD_CMDIOC))
> +		mdelay(1);
> +
>  	if (saved_config) {
>  		reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
>  		reg |= saved_config;
> @@ -1715,12 +1719,10 @@ static int __dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool int
>  	WARN_ON_ONCE(ret);
>  	dep->resource_index = 0;
>  
> -	if (!interrupt) {
> -		mdelay(1);
> +	if (!interrupt)
>  		dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
> -	} else if (!ret) {
> +	else if (!ret)
>  		dep->flags |= DWC3_EP_END_TRANSFER_PENDING;
> -	}
>  
>  	dep->flags &= ~DWC3_EP_DELAY_STOP;
>  	return ret;
> -- 
> 2.25.1
> 

Looks good to me!

Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>

Thanks for the fix,
Thinh

On 24-09-24 03:02 pm, Prashanth K wrote:
> DWC3 programming guide mentions that when operating in USB2.0 speeds,
> if GUSB2PHYCFG[6] or GUSB2PHYCFG[8] is set, it must be cleared prior
> to issuing commands and may be set again  after the command completes.
> But currently while issuing EndXfer command without CmdIOC set, we
> wait for 1ms after GUSB2PHYCFG is restored. This results in cases
> where EndXfer command doesn't get completed and causes SMMU faults
> since requests are unmapped afterwards. Hence restore GUSB2PHYCFG
> after waiting for EndXfer command completion.
> 
> Cc: stable@vger.kernel.org
> Fixes: 1d26ba0944d3 ("usb: dwc3: Wait unconditionally after issuing EndXfer command")
> Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
> ---
>  drivers/usb/dwc3/gadget.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index 291bc549935b..50772d611582 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -438,6 +438,10 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned int cmd,
>  			dwc3_gadget_ep_get_transfer_index(dep);
>  	}
>  
> +	if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_ENDTRANSFER &&
> +	    !(cmd & DWC3_DEPCMD_CMDIOC))
> +		mdelay(1);
> +
>  	if (saved_config) {
>  		reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
>  		reg |= saved_config;
> @@ -1715,12 +1719,10 @@ static int __dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool int
>  	WARN_ON_ONCE(ret);
>  	dep->resource_index = 0;
>  
> -	if (!interrupt) {
> -		mdelay(1);
> +	if (!interrupt)
>  		dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
> -	} else if (!ret) {
> +	else if (!ret)
>  		dep->flags |= DWC3_EP_END_TRANSFER_PENDING;
> -	}
>  
>  	dep->flags &= ~DWC3_EP_DELAY_STOP;
>  	return ret;

Hi Thinh,

In case you have missed, can you please review this?

Thanks in advance,
Prashanth K

On Tue, Oct 08, 2024, Prashanth K wrote:
> 
> Hi Thinh,
> 
> In case you have missed, can you please review this?
> 
> Thanks in advance,
> Prashanth K


Sorry I missed this. I'll take a look now.

Thanks for the reminder,
Thinh