Commit af8f9e86 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge tag 'usb-fixes-v5.10-rc5' of... 

Merge tag 'usb-fixes-v5.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-linus

Peter writes:

Two bugs for Cadence USB3 gadget driver
- TD_SIZE entry at descriptor is error for multiple-trb use case
- Possible use uninitialized variables

* tag 'usb-fixes-v5.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb:
  usb: cdns3: gadget: calculate TD_SIZE based on TD
  usb: cdns3: gadget: initialize link_trb as NULL
parents 09162bc3 40252dd7

drivers/usb/cdns3/gadget.c

+14 −12
Original line number Diff line number Diff line
@@ -1114,7 +1114,7 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, 
	struct cdns3_device *priv_dev = priv_ep->cdns3_dev;

	struct cdns3_request *priv_req;

	struct cdns3_trb *trb;

	struct cdns3_trb *link_trb;

	struct cdns3_trb *link_trb = NULL;

	dma_addr_t trb_dma;

	u32 togle_pcs = 1;

	int sg_iter = 0;
@@ -1193,10 +1193,20 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, 


	/* set incorrect Cycle Bit for first trb*/

	control = priv_ep->pcs ? 0 : TRB_CYCLE;

	trb->length = 0;

	if (priv_dev->dev_ver >= DEV_VER_V2) {

		u16 td_size;



		td_size = DIV_ROUND_UP(request->length,

				       priv_ep->endpoint.maxpacket);

		if (priv_dev->gadget.speed == USB_SPEED_SUPER)

			trb->length = TRB_TDL_SS_SIZE(td_size);

		else

			control |= TRB_TDL_HS_SIZE(td_size);

	}



	do {

		u32 length;

		u16 td_size = 0;



		/* fill TRB */

		control |= TRB_TYPE(TRB_NORMAL);
@@ -1208,20 +1218,12 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep, 
			length = request->length;

		}



		if (likely(priv_dev->dev_ver >= DEV_VER_V2))

			td_size = DIV_ROUND_UP(length,

					       priv_ep->endpoint.maxpacket);

		else if (priv_ep->flags & EP_TDLCHK_EN)

		if (priv_ep->flags & EP_TDLCHK_EN)

			total_tdl += DIV_ROUND_UP(length,

					       priv_ep->endpoint.maxpacket);



		trb->length = cpu_to_le32(TRB_BURST_LEN(priv_ep->trb_burst_size) |

		trb->length |= cpu_to_le32(TRB_BURST_LEN(priv_ep->trb_burst_size) |

					TRB_LEN(length));

		if (priv_dev->gadget.speed == USB_SPEED_SUPER)

			trb->length |= cpu_to_le32(TRB_TDL_SS_SIZE(td_size));

		else

			control |= TRB_TDL_HS_SIZE(td_size);



		pcs = priv_ep->pcs ? TRB_CYCLE : 0;



		/*

CRA Git | Maintained and supported by SUSTech CRA and CCSE