Re: [PATCH 3/3] usb: dwc2: gadget: make descriptors visible before the endpoint is enabled

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] usb: dwc2: gadget: dwc2_gadget_desc_visible() skipped when
  isoc ring is full
--

commit ff96d0bc699669e80418e1239ed82d2f723a61f0
Author: Vadim Yuzifovich <vadim@yuzi.co>

usb: dwc2: gadget: make descriptors visible before the endpoint is enabled

This commit adds dwc2_gadget_desc_visible() to read back the last written
DMA descriptor between two full memory barriers before enabling an endpoint
in descriptor DMA mode.

> diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
> index 046b5b04503bd..fe37250fec6c7 100644
> --- a/drivers/usb/dwc2/gadget.c
> +++ b/drivers/usb/dwc2/gadget.c

[ ... ]

> @@ -1021,6 +1044,9 @@ static void dwc2_gadget_start_isoc_ddma(struct dwc2_hsotg_ep *hs_ep)
>  	depctl = hs_ep->dir_in ? DIEPCTL(index) : DOEPCTL(index);
>  	dma_reg = hs_ep->dir_in ? DIEPDMA(index) : DOEPDMA(index);
>  
> +	if (hs_ep->next_desc)
> +		dwc2_gadget_desc_visible(&hs_ep->desc_list[hs_ep->next_desc - 1]);

[Severity: Medium]
Does this skip dwc2_gadget_desc_visible() when the isochronous descriptor
ring is full?

dwc2_gadget_start_isoc_ddma() returns early when hs_ep->queue is empty, so
at least one descriptor is always filled.  When MAX_DMA_DESC_NUM_HS_ISOC or
more requests are queued, dwc2_gadget_fill_isoc_desc() fills all 256
descriptors and wraps hs_ep->next_desc back to 0:

drivers/usb/dwc2/gadget.c:dwc2_gadget_fill_isoc_desc() {
    ...
	/* Update index of last configured entry in the chain */
	hs_ep->next_desc++;
	if (hs_ep->next_desc >= MAX_DMA_DESC_NUM_HS_ISOC)
		hs_ep->next_desc = 0;

	return 0;
}

When hs_ep->next_desc wraps to 0, the if (hs_ep->next_desc) check skips
dwc2_gadget_desc_visible() instead of reading back
hs_ep->desc_list[MAX_DMA_DESC_NUM_HS_ISOC - 1], leaving the descriptor
writes in flight when the endpoint is enabled and allowing the BNA error to
occur.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115185335.782678-1-vadim@yuzi.co?part=3