USB: dwc3: core.c: Add SW workaround for DRD device buffer overflow issue
When Host sends Vendor Device test request to device, USB core writes
Vendor device test event into event buffer which might cause buffer
overflow due to HW bug. This could lead to memory corruption. Hence
allocate 8 bytes more for event buffer than reported to controller
through GEVNTSIZE register.
CRs-Fixed: 493717
Change-Id: I42cf3af709021ec201288aec9cca5f3af473bf3c
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index fab5219..04da6f8 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -241,7 +241,13 @@
for (i = 0; i < num; i++) {
struct dwc3_event_buffer *evt;
- evt = dwc3_alloc_one_event_buffer(dwc, length);
+ /*
+ * As SW workaround, allocate 8 bytes more than size of event
+ * buffer given to USB Controller to avoid possible memory
+ * corruption caused by event buffer overflow when Hw writes
+ * Vendor Device test event which could be of 12 bytes.
+ */
+ evt = dwc3_alloc_one_event_buffer(dwc, (length + 8));
if (IS_ERR(evt)) {
dev_err(dwc->dev, "can't allocate event buffer\n");
return PTR_ERR(evt);
@@ -276,7 +282,7 @@
dwc3_writel(dwc->regs, DWC3_GEVNTADRHI(n),
upper_32_bits(evt->dma));
dwc3_writel(dwc->regs, DWC3_GEVNTSIZ(n),
- evt->length & 0xffff);
+ (evt->length - 8) & 0xffff);
dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(n), 0);
}