usb: dwc2: Fix DMA cache alignment issues

Insert a padding between data and the stored_xfer_buffer pointer to
ensure they are not on the same cache line.

Otherwise, the stored_xfer_buffer gets corrupted for IN URBs on
non-cache-coherent systems. (In my case: Lantiq xRX200 MIPS)

Fixes: 3bc04e28a030 ("usb: dwc2: host: Get aligned DMA in a more supported way")
Fixes: 56406e017a88 ("usb: dwc2: Fix DMA alignment to start at allocated boundary")
Cc: <stable@vger.kernel.org>
Tested-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Acked-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>

1 files changed, 7 insertions, 3 deletions

diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index 5c51bf5506d1..2192a2873c7c 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -2480,8 +2480,10 @@ static void dwc2_free_dma_aligned_buffer(struct urb *urb)
                 return;
 
         /* Restore urb->transfer_buffer from the end of the allocated area */
-        memcpy(&stored_xfer_buffer, urb->transfer_buffer +
-               urb->transfer_buffer_length, sizeof(urb->transfer_buffer));
+        memcpy(&stored_xfer_buffer,
+               PTR_ALIGN(urb->transfer_buffer + urb->transfer_buffer_length,
+                         dma_get_cache_alignment()),
+               sizeof(urb->transfer_buffer));
 
         if (usb_urb_dir_in(urb)) {
                 if (usb_pipeisoc(urb->pipe))
@@ -2513,6 +2515,7 @@ static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
          * DMA
          */
         kmalloc_size = urb->transfer_buffer_length +
+                (dma_get_cache_alignment() - 1) +
                 sizeof(urb->transfer_buffer);
 
         kmalloc_ptr = kmalloc(kmalloc_size, mem_flags);
@@ -2523,7 +2526,8 @@ static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
          * Position value of original urb->transfer_buffer pointer to the end
          * of allocation for later referencing
          */
-        memcpy(kmalloc_ptr + urb->transfer_buffer_length,
+        memcpy(PTR_ALIGN(kmalloc_ptr + urb->transfer_buffer_length,
+                         dma_get_cache_alignment()),
                &urb->transfer_buffer, sizeof(urb->transfer_buffer));
 
         if (usb_urb_dir_out(urb))