Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e24f90d7 authored by Wesley Cheng's avatar Wesley Cheng Committed by Greg Kroah-Hartman
Browse files

usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC unbind 



[ Upstream commit 8217f07a50236779880f13e87f99224cd9117f83 ]

There is a race present where the DWC3 runtime resume runs in parallel
to the UDC unbind sequence.  This will eventually lead to a possible
scenario where we are enabling the run/stop bit, without a valid
composition defined.

Thread#1 (handling UDC unbind):
usb_gadget_remove_driver()
-->usb_gadget_disconnect()
  -->dwc3_gadget_pullup(0)
--> continue UDC unbind sequence
-->Thread#2 is running in parallel here

Thread#2 (handing next cable connect)
__dwc3_set_mode()
  -->pm_runtime_get_sync()
    -->dwc3_gadget_resume()
      -->dwc->gadget_driver is NOT NULL yet
      -->dwc3_gadget_run_stop(1)
      --> _dwc3gadget_start()
...

Fix this by tracking the pullup disable routine, and avoiding resuming
of the DWC3 gadget.  Once the UDC is re-binded, that will trigger the
pullup enable routine, which would handle enabling the DWC3 gadget.

Acked-by: default avatarFelipe Balbi <balbi@kernel.org>
Signed-off-by: default avatarWesley Cheng <wcheng@codeaurora.org>
Link: https://lore.kernel.org/r/20210917021852.2037-1-wcheng@codeaurora.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 040f2dbd2010 ("usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop")
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 85371aad

drivers/usb/dwc3/core.h

+2 −0
Original line number Original line Diff line number Diff line
@@ -994,6 +994,7 @@ struct dwc3_scratchpad_array { 
 * @tx_max_burst_prd: max periodic ESS transmit burst size

 * @tx_max_burst_prd: max periodic ESS transmit burst size

 * @hsphy_interface: "utmi" or "ulpi"

 * @hsphy_interface: "utmi" or "ulpi"

 * @connected: true when we're connected to a host, false otherwise

 * @connected: true when we're connected to a host, false otherwise

 * @softconnect: true when gadget connect is called, false when disconnect runs

 * @delayed_status: true when gadget driver asks for delayed status

 * @delayed_status: true when gadget driver asks for delayed status

 * @ep0_bounced: true when we used bounce buffer

 * @ep0_bounced: true when we used bounce buffer

 * @ep0_expect_in: true when we expect a DATA IN transfer

 * @ep0_expect_in: true when we expect a DATA IN transfer
@@ -1196,6 +1197,7 @@ struct dwc3 { 
	const char		*hsphy_interface;

	const char		*hsphy_interface;





	unsigned		connected:1;

	unsigned		connected:1;

	unsigned		softconnect:1;

	unsigned		delayed_status:1;

	unsigned		delayed_status:1;

	unsigned		ep0_bounced:1;

	unsigned		ep0_bounced:1;

	unsigned		ep0_expect_in:1;

	unsigned		ep0_expect_in:1;

drivers/usb/dwc3/gadget.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -2015,7 +2015,7 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) 
	int			ret;

	int			ret;





	is_on = !!is_on;

	is_on = !!is_on;



	dwc->softconnect = is_on;

	/*

	/*

	 * Per databook, when we want to stop the gadget, if a control transfer

	 * Per databook, when we want to stop the gadget, if a control transfer

	 * is still in process, complete it and get the core into setup phase.

	 * is still in process, complete it and get the core into setup phase.
@@ -3791,7 +3791,7 @@ int dwc3_gadget_resume(struct dwc3 *dwc) 
{

{

	int			ret;

	int			ret;





	if (!dwc->gadget_driver)

	if (!dwc->gadget_driver || !dwc->softconnect)

		return 0;

		return 0;





	ret = __dwc3_gadget_start(dwc);

	ret = __dwc3_gadget_start(dwc);