Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Received-SPF: Pass (protection.outlook.com: domain of cadence.com designates
 158.140.1.148 as permitted sender) receiver=protection.outlook.com;
 client-ip=158.140.1.148; helo=sjmaillnx2.cadence.com; pr=C
From:   Pawel Laszczak <pawell@cadence.com>
To:     <peter.chen@kernel.org>
CC:     <linux-usb@vger.kernel.org>, <gregkh@linuxfoundation.org>,
        <felipe.balbi@linux.intel.com>, <rogerq@kernel.org>,
        <a-govindraju@ti.com>, <linux-kernel@vger.kernel.org>,
        Pawel Laszczak <pawell@cadence.com>, <stable@vger.kernel.org>
Subject: [PATCH] usb: cdns3: remove fetched trb from cache before dequeuing
Date:   Tue, 15 Nov 2022 05:00:39 -0500
Message-ID: <20221115100039.441295-1-pawell@cadence.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
X-CrossPremisesHeadersFilteredBySendConnector: maileu5.global.cadence.com
X-OrganizationHeadersPreserved: maileu5.global.cadence.com
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DM6NAM12FT105:EE_|BN7PR07MB4452:EE_
X-MS-Office365-Filtering-Correlation-Id: 86137b61-7887-4322-d19a-08dac6f05048
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: pl/LRFOByxDNg7lBQF6+rYERWpN2C+EtLVumVyG8bcCh/9o9hGknuYEEHUayMXdZUcSAkDjYDFxofhf3HxMqlSvGqOm+5f38Dia9lhQiJQyFNuyabmm/ez1GtWi+m/6YtfRQbjjdjPdhHXilqiDnTgwPWLLFW3mGicnTpGw8SzRUaF5Ol2qB/gzCMwtz9pqCPSx1x89XEmn+w59JKIUV/ycf3v2CiDWtUKhOphKX1nMsmIqysMPts0iQysV3dRrDbFsrzu28ESdAGsbxyDHmekKf3be7BRx+mfhcobFmV6V8RCzLR2E3QdutS1NuI2bS+HfZ63XDFUg4n044QBmj8imYlocnfrPDY9vHhMLz8P4Dy6tqIed2TV3M+s0CIVA8LUPQaSRx9T0mnRcC5n+L9+NoDWsGdQx35GkgBZ1WNJ1lPJ5xxemlSSDydPImh6WhgM9AfFKH9Vclq81P4UHNqGDcFq4mrzbMvFXmJm23SCu4mkJJYNjSIEiG2ezHD5yRh1yutwXOSTPX2cv9ALFDbY41O59Fv93m8MEv2MFLLo1xTUk5ZaPpIPXeHCNAJUggl3+eKrvq4w5nWHSeJovb9egyzEJqsECnPgiF/rW3KPoAhoRDGzBAwMx4cC8g6FAWZQJGpFVIl5mL42URoY7FFjPpjwHeiv1kzXkgrluNZZNA2BBfxBOP+TQb+RnMaNueFLGbejHOtQRefS95DznBLAi/Y4Z9rO5+izUBKbOziVlMoZtEWNObCGjWwEqKIVzDz5E7Tt9+MIhEFMKCfcu+og==
X-Forefront-Antispam-Report: CIP:158.140.1.148;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:sjmaillnx2.cadence.com;PTR:unknown.Cadence.COM;CAT:NONE;SFS:(13230022)(4636009)(346002)(39860400002)(376002)(136003)(396003)(36092001)(451199015)(36840700001)(40470700004)(46966006)(26005)(6666004)(54906003)(6916009)(42186006)(316002)(356005)(7636003)(70206006)(70586007)(478600001)(4326008)(8676002)(426003)(2616005)(41300700001)(1076003)(186003)(336012)(83380400001)(2906002)(8936002)(36860700001)(82740400003)(36756003)(82310400005)(86362001)(40460700003)(5660300002)(47076005)(40480700001);DIR:OUT;SFP:1101;
X-OriginatorOrg: cadence.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Nov 2022 10:01:06.6653
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 86137b61-7887-4322-d19a-08dac6f05048
X-MS-Exchange-CrossTenant-Id: d36035c5-6ce6-4662-a3dc-e762e61ae4c9
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=d36035c5-6ce6-4662-a3dc-e762e61ae4c9;Ip=[158.140.1.148];Helo=[sjmaillnx2.cadence.com]
X-MS-Exchange-CrossTenant-AuthSource: DM6NAM12FT105.eop-nam12.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR07MB4452
X-Proofpoint-ORIG-GUID: SJi4N7HLStuEwCj4_lg2jWZZUYttU19Y
X-Proofpoint-GUID: SJi4N7HLStuEwCj4_lg2jWZZUYttU19Y
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.219,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-11-15_05,2022-11-15_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=outbound_check_notspam policy=outbound_check score=0 malwarescore=0
 lowpriorityscore=0 impostorscore=0 spamscore=0 phishscore=0
 mlxlogscore=590 mlxscore=0 adultscore=0 priorityscore=1501 clxscore=1011
 bulkscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2210170000 definitions=main-2211150069
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE,
        SPF_NONE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

After doorbell DMA fetches the TRB. If during dequeuing request
driver changes NORMAL TRB to LINK TRB but doesn't delete it from
controller cache then controller will handle cached TRB and packet
can be lost.

The example scenario for this issue looks like:
1. queue request - set doorbell
2. dequeue request
3. send OUT data packet from host
4. Device will accept this packet which is unexpected
5. queue new request - set doorbell
6. Device lost the expected packet.

By setting DFLUSH controller clears DRDY bit and stop DMA transfer.

Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
cc: <stable@vger.kernel.org>
Signed-off-by: Pawel Laszczak <pawell@cadence.com>
---
 drivers/usb/cdns3/cdns3-gadget.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index 5adcb349718c..ccfaebca6faa 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -2614,6 +2614,7 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep,
 	u8 req_on_hw_ring = 0;
 	unsigned long flags;
 	int ret = 0;
+	int val;
 
 	if (!ep || !request || !ep->desc)
 		return -EINVAL;
@@ -2649,6 +2650,13 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep,
 
 	/* Update ring only if removed request is on pending_req_list list */
 	if (req_on_hw_ring && link_trb) {
+		/* Stop DMA */
+		writel(EP_CMD_DFLUSH, &priv_dev->regs->ep_cmd);
+
+		/* wait for DFLUSH cleared */
+		readl_poll_timeout_atomic(&priv_dev->regs->ep_cmd, val,
+					  !(val & EP_CMD_DFLUSH), 1, 1000);
+
 		link_trb->buffer = cpu_to_le32(TRB_BUFFER(priv_ep->trb_pool_dma +
 			((priv_req->end_trb + 1) * TRB_SIZE)));
 		link_trb->control = cpu_to_le32((le32_to_cpu(link_trb->control) & TRB_CYCLE) |
@@ -2660,6 +2668,10 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep,
 
 	cdns3_gadget_giveback(priv_ep, priv_req, -ECONNRESET);
 
+	req = cdns3_next_request(&priv_ep->pending_req_list);
+	if (req)
+		cdns3_rearm_transfer(priv_ep, 1);
+
 not_found:
 	spin_unlock_irqrestore(&priv_dev->lock, flags);
 	return ret;
-- 
2.25.1