diff options
| author | Jack Pham <jackp@codeaurora.org> | 2015-03-06 17:58:21 -0800 |
|---|---|---|
| committer | David Keitel <dkeitel@codeaurora.org> | 2016-03-22 11:06:42 -0700 |
| commit | 0071b357da5fbad68189ca7a47cde5a6bdb75e33 (patch) | |
| tree | a4abec750976599537d522e03f374887437d3520 | |
| parent | 4e32ea8f3b6aed0d9479355342deb63434fe2950 (diff) | |
usb: dwc3: gadget: Fix calculation of request.actual for SG
When a request completes, cleanup_done_trbs() tries to calculate
request.actual by subtracting the TRB remainder from the original
request.length, but does not account for scatter-gather requests
that queued multiple TRBs. In this case, the request.length field
may be used by the function to keep track of the aggregate length
of all the provided SG entries, and thus will produce an incorrect
request.actual. Instead, for scatter-gather, to find the pre-transfer
buffer length of each TRB, get the length field of each SG entry.
Then the number of bytes transfered can be correctly determined as
the difference between that and the bytes remaining in the TRB.
Change-Id: I4c197462ce5b804c9d684240e95c35b532976220
Signed-off-by: Jack Pham <jackp@codeaurora.org>
| -rw-r--r-- | drivers/usb/dwc3/gadget.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 46a0bfcf8f60..ac6304c3eae0 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2044,7 +2044,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc) /* -------------------------------------------------------------------------- */ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, - struct dwc3_request *req, struct dwc3_trb *trb, + struct dwc3_request *req, struct dwc3_trb *trb, unsigned length, const struct dwc3_event_depevt *event, int status) { unsigned int count; @@ -2109,7 +2109,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, * should receive and we simply bounce the request back to the * gadget driver for further processing. */ - req->request.actual += req->request.length - count; + req->request.actual += length - count; if (s_pkt) return 1; if ((event->status & DEPEVT_STATUS_LST) && @@ -2129,6 +2129,7 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep, struct dwc3_trb *trb; unsigned int slot; unsigned int i; + unsigned int trb_len; int ret; do { @@ -2147,8 +2148,13 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep, slot %= DWC3_TRB_NUM; trb = &dep->trb_pool[slot]; + if (req->request.num_mapped_sgs) + trb_len = sg_dma_len(&req->request.sg[i]); + else + trb_len = req->request.length; + ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb, - event, status); + trb_len, event, status); if (ret) break; } while (++i < req->request.num_mapped_sgs); |