RE: [PATCH 3/3] usb: dwc3: ep0: improve handling of unaligned OUT requests

2017-04-12 Thread Felipe Balbi 

Hi,

David Laight  writes:
> From: Felipe Balbi
>> David Laight  writes:
>> >> > From: Felipe Balbi
>> >> >> Sent: 07 April 2017 12:37
>> >> >> Just like we did for all other endpoint types, let's rely on a chained
>> >> >> TRB pointing to ep0_bounce_addr in order to align transfer size. This
>> >> >> will make the code simpler.
>> >> > ...
>> >> >
>> >> > Is the dwc3 similar enough to xhci to have an 'immediate data' bit?
>> >> > If so the aligning data could come from the 8 byte 'address' field.
>> >>
>> >> you mean like patch 1 in this very series?
>> >>
>> >> https://marc.info/?i=20170407113655.27569-1-felipe.ba...@linux.intel.com
>> >
>> > Not exactly, that seems to be using the trb memory itself as the buffer.
>> > I'm guessing that can only work for 'read' TRB.
>> >
>> > If you look at the xhci docs (eg table 71 in section 6.4.1.2.1 of the rev 
>> > 1.0
>> > copy I have) bit 6 of the last word is 'IDT'.
>> > So 8 bytes of data are put into the bpl/bph fields - not a pointer at all.
>> 
>> Right, it works similarly for DWC3 :-) However, instead of IDT we just
>> set BPH/BPL to the address of the TRB itself.
>
> Ah, not quite...
>
> You are setting BPH/BPL to point to BPH/BPL rather than the TRB.
> This works for 'read' type transactions because the pointer isn't
> needed after the data has been written.

right, note that the address passed in _is_ the address of the TRB, but
I *know* only 8 bytes will be used, thus only BPH/BPL get overwritten

This is documented in DWC3 databook.

> For short writes you'd need additional buffer memory somewhere.
> Could be allocated after the TRB array.

For that I have a single 1024 byte throw-away buffer that *all*
endpoints use. I don't care about the data that goes there (there should
never be *any* data there, actually), I'm just interested in guarateeing
that a faulty host will never cause a buffer overflow.

-- 
balbi


signature.asc
Description: PGP signature

RE: [PATCH 3/3] usb: dwc3: ep0: improve handling of unaligned OUT requests

2017-04-12 Thread David Laight 
From: Felipe Balbi
> David Laight  writes:
> >> > From: Felipe Balbi
> >> >> Sent: 07 April 2017 12:37
> >> >> Just like we did for all other endpoint types, let's rely on a chained
> >> >> TRB pointing to ep0_bounce_addr in order to align transfer size. This
> >> >> will make the code simpler.
> >> > ...
> >> >
> >> > Is the dwc3 similar enough to xhci to have an 'immediate data' bit?
> >> > If so the aligning data could come from the 8 byte 'address' field.
> >>
> >> you mean like patch 1 in this very series?
> >>
> >> https://marc.info/?i=20170407113655.27569-1-felipe.ba...@linux.intel.com
> >
> > Not exactly, that seems to be using the trb memory itself as the buffer.
> > I'm guessing that can only work for 'read' TRB.
> >
> > If you look at the xhci docs (eg table 71 in section 6.4.1.2.1 of the rev 
> > 1.0
> > copy I have) bit 6 of the last word is 'IDT'.
> > So 8 bytes of data are put into the bpl/bph fields - not a pointer at all.
> 
> Right, it works similarly for DWC3 :-) However, instead of IDT we just
> set BPH/BPL to the address of the TRB itself.

Ah, not quite...

You are setting BPH/BPL to point to BPH/BPL rather than the TRB.
This works for 'read' type transactions because the pointer isn't
needed after the data has been written.

For short writes you'd need additional buffer memory somewhere.
Could be allocated after the TRB array.

David

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

RE: [PATCH 3/3] usb: dwc3: ep0: improve handling of unaligned OUT requests

2017-04-12 Thread Felipe Balbi 

Hi,

David Laight  writes:
>> > From: Felipe Balbi
>> >> Sent: 07 April 2017 12:37
>> >> Just like we did for all other endpoint types, let's rely on a chained
>> >> TRB pointing to ep0_bounce_addr in order to align transfer size. This
>> >> will make the code simpler.
>> > ...
>> >
>> > Is the dwc3 similar enough to xhci to have an 'immediate data' bit?
>> > If so the aligning data could come from the 8 byte 'address' field.
>> 
>> you mean like patch 1 in this very series?
>> 
>> https://marc.info/?i=20170407113655.27569-1-felipe.ba...@linux.intel.com
>
> Not exactly, that seems to be using the trb memory itself as the buffer.
> I'm guessing that can only work for 'read' TRB.
>
> If you look at the xhci docs (eg table 71 in section 6.4.1.2.1 of the rev 1.0
> copy I have) bit 6 of the last word is 'IDT'.
> So 8 bytes of data are put into the bpl/bph fields - not a pointer at all.

Right, it works similarly for DWC3 :-) However, instead of IDT we just
set BPH/BPL to the address of the TRB itself.

If I were to guess, it was made this way because peripheral controllers
don't send SETUP packets, only receive them from a host.

-- 
balbi


signature.asc
Description: PGP signature

RE: [PATCH 3/3] usb: dwc3: ep0: improve handling of unaligned OUT requests

2017-04-12 Thread Felipe Balbi 

Hi,

David Laight  writes:
> From: Felipe 
>> Sent: 12 April 2017 06:57
>> Felipe Balbi  writes:
>> >> From: Felipe Balbi
>> >>> Sent: 07 April 2017 12:37
>> >>> Just like we did for all other endpoint types, let's rely on a chained
>> >>> TRB pointing to ep0_bounce_addr in order to align transfer size. This
>> >>> will make the code simpler.
>> >> ...
>> >>
>> >> Is the dwc3 similar enough to xhci to have an 'immediate data' bit?
>> >> If so the aligning data could come from the 8 byte 'address' field.
>> >
>> > you mean like patch 1 in this very series?
>> 
>> Oh no, you mean for the remaining bytes for alignment. Well, 8 bytes
>> might not be enough to align anything, right? :-)
>> 
>> Besides, "aligned" here refers to length not memory address :-) OUT
>> transfers on dwc3 need to have their length setup so that it is
>> divisible by wMaxPacketSize of the endpoint in question.
>
> Hardware engineers seem to be making things that appear to be useful,
> but in practise are almost to program for.
>
> I might be mixing up what is fixing what...
>
> I was thinking of the borked hardware than can only dma from aligned
> addresses.

oh, DWC3 doesn't have that limitation. That's DWC2 :-) USB2-only IP from
same company. DWC3 has USB3.1 GEN1 and GEN2 versions ;-)

-- 
balbi


signature.asc
Description: PGP signature

RE: [PATCH 3/3] usb: dwc3: ep0: improve handling of unaligned OUT requests

2017-04-12 Thread David Laight 
From: Felipe 
> Sent: 12 April 2017 06:57
> Felipe Balbi  writes:
> >> From: Felipe Balbi
> >>> Sent: 07 April 2017 12:37
> >>> Just like we did for all other endpoint types, let's rely on a chained
> >>> TRB pointing to ep0_bounce_addr in order to align transfer size. This
> >>> will make the code simpler.
> >> ...
> >>
> >> Is the dwc3 similar enough to xhci to have an 'immediate data' bit?
> >> If so the aligning data could come from the 8 byte 'address' field.
> >
> > you mean like patch 1 in this very series?
> 
> Oh no, you mean for the remaining bytes for alignment. Well, 8 bytes
> might not be enough to align anything, right? :-)
> 
> Besides, "aligned" here refers to length not memory address :-) OUT
> transfers on dwc3 need to have their length setup so that it is
> divisible by wMaxPacketSize of the endpoint in question.

Hardware engineers seem to be making things that appear to be useful,
but in practise are almost to program for.

I might be mixing up what is fixing what...

I was thinking of the borked hardware than can only dma from aligned
addresses.

David


--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

RE: [PATCH 3/3] usb: dwc3: ep0: improve handling of unaligned OUT requests

2017-04-12 Thread David Laight 
From: Felipe Balbi
> Sent: 12 April 2017 06:55
> David Laight  writes:
> 
> > From: Felipe Balbi
> >> Sent: 07 April 2017 12:37
> >> Just like we did for all other endpoint types, let's rely on a chained
> >> TRB pointing to ep0_bounce_addr in order to align transfer size. This
> >> will make the code simpler.
> > ...
> >
> > Is the dwc3 similar enough to xhci to have an 'immediate data' bit?
> > If so the aligning data could come from the 8 byte 'address' field.
> 
> you mean like patch 1 in this very series?
> 
> https://marc.info/?i=20170407113655.27569-1-felipe.ba...@linux.intel.com

Not exactly, that seems to be using the trb memory itself as the buffer.
I'm guessing that can only work for 'read' TRB.

If you look at the xhci docs (eg table 71 in section 6.4.1.2.1 of the rev 1.0
copy I have) bit 6 of the last word is 'IDT'.
So 8 bytes of data are put into the bpl/bph fields - not a pointer at all.

David

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

RE: [PATCH 3/3] usb: dwc3: ep0: improve handling of unaligned OUT requests

2017-04-11 Thread Felipe Balbi 

Hi,

Felipe Balbi  writes:
>> From: Felipe Balbi
>>> Sent: 07 April 2017 12:37
>>> Just like we did for all other endpoint types, let's rely on a chained
>>> TRB pointing to ep0_bounce_addr in order to align transfer size. This
>>> will make the code simpler.
>> ...
>>
>> Is the dwc3 similar enough to xhci to have an 'immediate data' bit?
>> If so the aligning data could come from the 8 byte 'address' field.
>
> you mean like patch 1 in this very series?

Oh no, you mean for the remaining bytes for alignment. Well, 8 bytes
might not be enough to align anything, right? :-)

Besides, "aligned" here refers to length not memory address :-) OUT
transfers on dwc3 need to have their length setup so that it is
divisible by wMaxPacketSize of the endpoint in question.

-- 
balbi


signature.asc
Description: PGP signature

RE: [PATCH 3/3] usb: dwc3: ep0: improve handling of unaligned OUT requests

2017-04-11 Thread Felipe Balbi 
David Laight  writes:

> From: Felipe Balbi
>> Sent: 07 April 2017 12:37
>> Just like we did for all other endpoint types, let's rely on a chained
>> TRB pointing to ep0_bounce_addr in order to align transfer size. This
>> will make the code simpler.
> ...
>
> Is the dwc3 similar enough to xhci to have an 'immediate data' bit?
> If so the aligning data could come from the 8 byte 'address' field.

you mean like patch 1 in this very series?

https://marc.info/?i=20170407113655.27569-1-felipe.ba...@linux.intel.com

-- 
balbi


signature.asc
Description: PGP signature

RE: [PATCH 3/3] usb: dwc3: ep0: improve handling of unaligned OUT requests

2017-04-11 Thread David Laight 
From: Felipe Balbi
> Sent: 07 April 2017 12:37
> Just like we did for all other endpoint types, let's rely on a chained
> TRB pointing to ep0_bounce_addr in order to align transfer size. This
> will make the code simpler.
...

Is the dwc3 similar enough to xhci to have an 'immediate data' bit?
If so the aligning data could come from the 8 byte 'address' field.

David

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 3/3] usb: dwc3: ep0: improve handling of unaligned OUT requests

2017-04-10 Thread Felipe Balbi 

Hi,

Janusz Dziedzic  writes:
> On 7 April 2017 at 13:36, Felipe Balbi  wrote:
>> Just like we did for all other endpoint types, let's rely on a chained
>> TRB pointing to ep0_bounce_addr in order to align transfer size. This
>> will make the code simpler.
>>
>> Signed-off-by: Felipe Balbi 
>> ---
>>  drivers/usb/dwc3/core.h   |  6 +
>>  drivers/usb/dwc3/ep0.c| 65 
>> +--
>>  drivers/usb/dwc3/gadget.c | 50 
>>  3 files changed, 29 insertions(+), 92 deletions(-)
>>
>> diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
>> index 2a2673767ccd..e1958f6237af 100644
>> --- a/drivers/usb/dwc3/core.h
>> +++ b/drivers/usb/dwc3/core.h
>> @@ -43,7 +43,7 @@
>>  #define DWC3_PULL_UP_TIMEOUT   500 /* ms */
>>  #define DWC3_ZLP_BUF_SIZE  1024/* size of a superspeed bulk */
>>  #define DWC3_BOUNCE_SIZE   1024/* size of a superspeed bulk */
>> -#define DWC3_EP0_BOUNCE_SIZE   512
>> +#define DWC3_EP0_SETUP_SIZE512
>>  #define DWC3_ENDPOINTS_NUM 32
>>  #define DWC3_XHCI_RESOURCES_NUM2
>>
>> @@ -763,12 +763,10 @@ struct dwc3_scratchpad_array {
>>   * struct dwc3 - representation of our controller
>>   * @drd_work - workqueue used for role swapping
>>   * @ep0_trb: trb which is used for the ctrl_req
>> - * @ep0_bounce: bounce buffer for ep0
>>   * @zlp_buf: used when request->zero is set
>>   * @setup_buf: used while precessing STD USB requests
>>   * @ep0_trb: dma address of ep0_trb
>>   * @ep0_usb_req: dummy req used while handling STD USB requests
>> - * @ep0_bounce_addr: dma address of ep0_bounce
>>   * @scratch_addr: dma address of scratchbuf
>>   * @ep0_in_setup: one control transfer is completed and enter setup phase
>>   * @lock: for synchronizing
>> @@ -866,13 +864,11 @@ struct dwc3 {
>> struct work_struct  drd_work;
>> struct dwc3_trb *ep0_trb;
>> void*bounce;
>> -   void*ep0_bounce;
>> void*zlp_buf;
>> void*scratchbuf;
>> u8  *setup_buf;
>> dma_addr_t  ep0_trb_addr;
>> dma_addr_t  bounce_addr;
>> -   dma_addr_t  ep0_bounce_addr;
>> dma_addr_t  scratch_addr;
>> struct dwc3_request ep0_usb_req;
>> struct completion   ep0_in_setup;
>> diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
>> index 3ba2309c837f..04249243e4d3 100644
>> --- a/drivers/usb/dwc3/ep0.c
>> +++ b/drivers/usb/dwc3/ep0.c
>> @@ -836,7 +836,6 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
>> struct usb_request  *ur;
>> struct dwc3_trb *trb;
>> struct dwc3_ep  *ep0;
>> -   unsignedtransfer_size = 0;
>> unsignedmaxp;
>> unsignedremaining_ur_length;
>> void*buf;
>> @@ -849,9 +848,7 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
>> ep0 = dwc->eps[0];
>>
>> dwc->ep0_next_event = DWC3_EP0_NRDY_STATUS;
>> -
>> trb = dwc->ep0_trb;
>> -
>> trace_dwc3_complete_trb(ep0, trb);
>>
>> r = next_request(>pending_list);
>> @@ -872,39 +869,17 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
>> remaining_ur_length = ur->length;
>>
>> length = trb->size & DWC3_TRB_SIZE_MASK;
>> -
>> maxp = ep0->endpoint.maxpacket;
>> +   transferred = ur->length - length;
>> +   ur->actual += transferred;
>>
>> if (dwc->ep0_bounced) {
>> -   /*
>> -* Handle the first TRB before handling the bounce buffer if
>> -* the request length is greater than the bounce buffer size
>> -*/
>> -   if (ur->length > DWC3_EP0_BOUNCE_SIZE) {
>> -   transfer_size = ALIGN(ur->length - maxp, maxp);
>> -   transferred = transfer_size - length;
>> -   buf = (u8 *)buf + transferred;
>> -   ur->actual += transferred;
>> -   remaining_ur_length -= transferred;
>> -
>> -   trb++;
>> -   length = trb->size & DWC3_TRB_SIZE_MASK;
>> -
>> -   ep0->trb_enqueue = 0;
>> -   }
>> -
>> -   transfer_size = roundup((ur->length - transfer_size),
>> -   maxp);
>> -
>> -   transferred = min_t(u32, remaining_ur_length,
>> -   transfer_size - length);
>> -   memcpy(buf, dwc->ep0_bounce, transferred);
>> -   } else {
>> -   transferred = ur->length - length;
>> +   trb++;
>> +   trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
>> +

Re: [PATCH 3/3] usb: dwc3: ep0: improve handling of unaligned OUT requests

2017-04-10 Thread Janusz Dziedzic 
On 7 April 2017 at 13:36, Felipe Balbi  wrote:
> Just like we did for all other endpoint types, let's rely on a chained
> TRB pointing to ep0_bounce_addr in order to align transfer size. This
> will make the code simpler.
>
> Signed-off-by: Felipe Balbi 
> ---
>  drivers/usb/dwc3/core.h   |  6 +
>  drivers/usb/dwc3/ep0.c| 65 
> +--
>  drivers/usb/dwc3/gadget.c | 50 
>  3 files changed, 29 insertions(+), 92 deletions(-)
>
> diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
> index 2a2673767ccd..e1958f6237af 100644
> --- a/drivers/usb/dwc3/core.h
> +++ b/drivers/usb/dwc3/core.h
> @@ -43,7 +43,7 @@
>  #define DWC3_PULL_UP_TIMEOUT   500 /* ms */
>  #define DWC3_ZLP_BUF_SIZE  1024/* size of a superspeed bulk */
>  #define DWC3_BOUNCE_SIZE   1024/* size of a superspeed bulk */
> -#define DWC3_EP0_BOUNCE_SIZE   512
> +#define DWC3_EP0_SETUP_SIZE512
>  #define DWC3_ENDPOINTS_NUM 32
>  #define DWC3_XHCI_RESOURCES_NUM2
>
> @@ -763,12 +763,10 @@ struct dwc3_scratchpad_array {
>   * struct dwc3 - representation of our controller
>   * @drd_work - workqueue used for role swapping
>   * @ep0_trb: trb which is used for the ctrl_req
> - * @ep0_bounce: bounce buffer for ep0
>   * @zlp_buf: used when request->zero is set
>   * @setup_buf: used while precessing STD USB requests
>   * @ep0_trb: dma address of ep0_trb
>   * @ep0_usb_req: dummy req used while handling STD USB requests
> - * @ep0_bounce_addr: dma address of ep0_bounce
>   * @scratch_addr: dma address of scratchbuf
>   * @ep0_in_setup: one control transfer is completed and enter setup phase
>   * @lock: for synchronizing
> @@ -866,13 +864,11 @@ struct dwc3 {
> struct work_struct  drd_work;
> struct dwc3_trb *ep0_trb;
> void*bounce;
> -   void*ep0_bounce;
> void*zlp_buf;
> void*scratchbuf;
> u8  *setup_buf;
> dma_addr_t  ep0_trb_addr;
> dma_addr_t  bounce_addr;
> -   dma_addr_t  ep0_bounce_addr;
> dma_addr_t  scratch_addr;
> struct dwc3_request ep0_usb_req;
> struct completion   ep0_in_setup;
> diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
> index 3ba2309c837f..04249243e4d3 100644
> --- a/drivers/usb/dwc3/ep0.c
> +++ b/drivers/usb/dwc3/ep0.c
> @@ -836,7 +836,6 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
> struct usb_request  *ur;
> struct dwc3_trb *trb;
> struct dwc3_ep  *ep0;
> -   unsignedtransfer_size = 0;
> unsignedmaxp;
> unsignedremaining_ur_length;
> void*buf;
> @@ -849,9 +848,7 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
> ep0 = dwc->eps[0];
>
> dwc->ep0_next_event = DWC3_EP0_NRDY_STATUS;
> -
> trb = dwc->ep0_trb;
> -
> trace_dwc3_complete_trb(ep0, trb);
>
> r = next_request(>pending_list);
> @@ -872,39 +869,17 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
> remaining_ur_length = ur->length;
>
> length = trb->size & DWC3_TRB_SIZE_MASK;
> -
> maxp = ep0->endpoint.maxpacket;
> +   transferred = ur->length - length;
> +   ur->actual += transferred;
>
> if (dwc->ep0_bounced) {
> -   /*
> -* Handle the first TRB before handling the bounce buffer if
> -* the request length is greater than the bounce buffer size
> -*/
> -   if (ur->length > DWC3_EP0_BOUNCE_SIZE) {
> -   transfer_size = ALIGN(ur->length - maxp, maxp);
> -   transferred = transfer_size - length;
> -   buf = (u8 *)buf + transferred;
> -   ur->actual += transferred;
> -   remaining_ur_length -= transferred;
> -
> -   trb++;
> -   length = trb->size & DWC3_TRB_SIZE_MASK;
> -
> -   ep0->trb_enqueue = 0;
> -   }
> -
> -   transfer_size = roundup((ur->length - transfer_size),
> -   maxp);
> -
> -   transferred = min_t(u32, remaining_ur_length,
> -   transfer_size - length);
> -   memcpy(buf, dwc->ep0_bounce, transferred);
> -   } else {
> -   transferred = ur->length - length;
> +   trb++;
> +   trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
> +   ep0->trb_enqueue = 0;
> +   dwc->ep0_bounced = false;
> }
>
> -   ur->actual += transferred;
> -
> if ((epnum & 1) && ur->actual <

[PATCH 3/3] usb: dwc3: ep0: improve handling of unaligned OUT requests

2017-04-07 Thread Felipe Balbi 
Just like we did for all other endpoint types, let's rely on a chained
TRB pointing to ep0_bounce_addr in order to align transfer size. This
will make the code simpler.

Signed-off-by: Felipe Balbi 
---
 drivers/usb/dwc3/core.h   |  6 +
 drivers/usb/dwc3/ep0.c| 65 +--
 drivers/usb/dwc3/gadget.c | 50 
 3 files changed, 29 insertions(+), 92 deletions(-)

diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 2a2673767ccd..e1958f6237af 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -43,7 +43,7 @@
 #define DWC3_PULL_UP_TIMEOUT   500 /* ms */
 #define DWC3_ZLP_BUF_SIZE  1024/* size of a superspeed bulk */
 #define DWC3_BOUNCE_SIZE   1024/* size of a superspeed bulk */
-#define DWC3_EP0_BOUNCE_SIZE   512
+#define DWC3_EP0_SETUP_SIZE512
 #define DWC3_ENDPOINTS_NUM 32
 #define DWC3_XHCI_RESOURCES_NUM2
 
@@ -763,12 +763,10 @@ struct dwc3_scratchpad_array {
  * struct dwc3 - representation of our controller
  * @drd_work - workqueue used for role swapping
  * @ep0_trb: trb which is used for the ctrl_req
- * @ep0_bounce: bounce buffer for ep0
  * @zlp_buf: used when request->zero is set
  * @setup_buf: used while precessing STD USB requests
  * @ep0_trb: dma address of ep0_trb
  * @ep0_usb_req: dummy req used while handling STD USB requests
- * @ep0_bounce_addr: dma address of ep0_bounce
  * @scratch_addr: dma address of scratchbuf
  * @ep0_in_setup: one control transfer is completed and enter setup phase
  * @lock: for synchronizing
@@ -866,13 +864,11 @@ struct dwc3 {
struct work_struct  drd_work;
struct dwc3_trb *ep0_trb;
void*bounce;
-   void*ep0_bounce;
void*zlp_buf;
void*scratchbuf;
u8  *setup_buf;
dma_addr_t  ep0_trb_addr;
dma_addr_t  bounce_addr;
-   dma_addr_t  ep0_bounce_addr;
dma_addr_t  scratch_addr;
struct dwc3_request ep0_usb_req;
struct completion   ep0_in_setup;
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 3ba2309c837f..04249243e4d3 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -836,7 +836,6 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
struct usb_request  *ur;
struct dwc3_trb *trb;
struct dwc3_ep  *ep0;
-   unsignedtransfer_size = 0;
unsignedmaxp;
unsignedremaining_ur_length;
void*buf;
@@ -849,9 +848,7 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
ep0 = dwc->eps[0];
 
dwc->ep0_next_event = DWC3_EP0_NRDY_STATUS;
-
trb = dwc->ep0_trb;
-
trace_dwc3_complete_trb(ep0, trb);
 
r = next_request(>pending_list);
@@ -872,39 +869,17 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
remaining_ur_length = ur->length;
 
length = trb->size & DWC3_TRB_SIZE_MASK;
-
maxp = ep0->endpoint.maxpacket;
+   transferred = ur->length - length;
+   ur->actual += transferred;
 
if (dwc->ep0_bounced) {
-   /*
-* Handle the first TRB before handling the bounce buffer if
-* the request length is greater than the bounce buffer size
-*/
-   if (ur->length > DWC3_EP0_BOUNCE_SIZE) {
-   transfer_size = ALIGN(ur->length - maxp, maxp);
-   transferred = transfer_size - length;
-   buf = (u8 *)buf + transferred;
-   ur->actual += transferred;
-   remaining_ur_length -= transferred;
-
-   trb++;
-   length = trb->size & DWC3_TRB_SIZE_MASK;
-
-   ep0->trb_enqueue = 0;
-   }
-
-   transfer_size = roundup((ur->length - transfer_size),
-   maxp);
-
-   transferred = min_t(u32, remaining_ur_length,
-   transfer_size - length);
-   memcpy(buf, dwc->ep0_bounce, transferred);
-   } else {
-   transferred = ur->length - length;
+   trb++;
+   trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+   ep0->trb_enqueue = 0;
+   dwc->ep0_bounced = false;
}
 
-   ur->actual += transferred;
-
if ((epnum & 1) && ur->actual < ur->length) {
/* for some reason we did not get everything out */
 
@@ -1006,8 +981,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
ret = dwc3_ep0_start_trans(dep);
} else if (!IS_ALIGNED(req->request.length, dep->endpoint.maxpacket)