[PATCH] usb: dwc3: Use _io functions on dma coherent memory

[PATCH] usb: dwc3: Use _io functions on dma coherent memory

[Sascha Hauer]

On both ARM and ARM64 we map DMA coherent memory the same as IO memory.
This has the effect that unaligned accesses are not possible on DMA
coherent memory. The dwc3 gadget driver uses memset() and memcpy() on
that memory which may generate unaligned accesses and result in data
aborts. Use memcpy_fromio() and memset_io() instead which are desgined
to work on IO space and thus do not generate unaligned accesses.
The alternative would be to map DMA coherent memory as MT_NORMAL_NC
instead of MT_DEVICE_nGnRnE, but that require us to add memory
barriers to drivers which we currently do not have. SO instead of
risking regressions in drivers we take the easy way out and avoid
unaligned accesses in the dwc3 driver.

In this concrete case the dwc3 driver generated unaligned accesses
on a Rockchip RK3568 ARM64 system. The driver copies data out of the
receive queue. In my case first 4 bytes were copied, both source and
target were aligned. The second access then copied more data beginning
at the place where the first memcpy stopped. On this 4byte aligned
address memcpy generated an 8byte read access which resulted in a data
abort. On an ARM32 system this might not be a problem as that place,
while not 8byte aligned, is still 4byte aligned, enough for a 32bit
system.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/usb/dwc3/gadget.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index f416acc999..49deaf4d98 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -643,14 +643,14 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep, unsigned int action)
 		/* Initialize the TRB ring */
 		dep->trb_dequeue = 0;
 		dep->trb_enqueue = 0;
-		memset(dep->trb_pool, 0,
+		memset_io(dep->trb_pool, 0,
 		       sizeof(struct dwc3_trb) * DWC3_TRB_NUM);
 
 		/* Link TRB. The HWO bit is never reset */
 		trb_st_hw = &dep->trb_pool[0];
 
 		trb_link = &dep->trb_pool[DWC3_TRB_NUM - 1];
-		memset(trb_link, 0, sizeof(*trb_link));
+		memset_io(trb_link, 0, sizeof(*trb_link));
 
 		trb_link->bpl = lower_32_bits(dwc3_trb_dma_offset(dep,
 								 trb_st_hw));
@@ -2908,10 +2908,10 @@ static void dwc3_gadget_poll(struct usb_gadget * g)
 	buf = xzalloc(count);
 
 	amount = min(count, evt->length - evt->lpos);
-	memcpy(buf, evt->buf + evt->lpos, amount);
+	memcpy_fromio(buf, evt->buf + evt->lpos, amount);
 
 	if (amount < count)
-		memcpy(buf + amount, evt->buf, count - amount);
+		memcpy_fromio(buf + amount, evt->buf, count - amount);
 
 	evt->lpos = (evt->lpos + count) % evt->length;
 
-- 
2.29.2


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox