From patchwork Wed May 15 07:29:20 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kuo-Jung Su X-Patchwork-Id: 243908 X-Patchwork-Delegate: marek.vasut@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from theia.denx.de (theia.denx.de [85.214.87.163]) by ozlabs.org (Postfix) with ESMTP id 25E322C00AD for ; Wed, 15 May 2013 17:28:15 +1000 (EST) Received: from localhost (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id 1777D4A044; Wed, 15 May 2013 09:28:09 +0200 (CEST) X-Virus-Scanned: Debian amavisd-new at theia.denx.de Received: from theia.denx.de ([127.0.0.1]) by localhost (theia.denx.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 557R88gjoeNM; Wed, 15 May 2013 09:28:08 +0200 (CEST) Received: from theia.denx.de (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id 1F2124A02F; Wed, 15 May 2013 09:27:54 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id B02D54A025 for ; Wed, 15 May 2013 09:27:51 +0200 (CEST) X-Virus-Scanned: Debian amavisd-new at theia.denx.de Received: from theia.denx.de ([127.0.0.1]) by localhost (theia.denx.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GPktjjyXP-ia for ; Wed, 15 May 2013 09:27:44 +0200 (CEST) X-policyd-weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5 NOT_IN_BL_NJABL=-1.5 (only DNSBL check requested) Received: from mail-pa0-f42.google.com (mail-pa0-f42.google.com [209.85.220.42]) by theia.denx.de (Postfix) with ESMTPS id 4E6EB4A01F for ; Wed, 15 May 2013 09:27:39 +0200 (CEST) Received: by mail-pa0-f42.google.com with SMTP id bj3so1246472pad.29 for ; Wed, 15 May 2013 00:27:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:from:to:cc:subject:date:message-id:x-mailer:in-reply-to :references:in-reply-to:references; bh=6sdiwYoQhtvoY0KLY0H0q0ljTvd1dqPJXStpYzoWEus=; b=jHWdizoH7etwh0TP5GzpV5APMIZEpzIDVnctIEEIlaMXIlsQ/P0WDBoVjnjQqCpvpU dYe13SURmQp9Gu6CiWG5D9mDTqea63gPMDDHHpxbtxxPRyl6GzcmCCg3loGJJPOA/DBE qv4ogUPvd9s63rlSG9p9OHvLB18ggy3KHXj/m1uRYiEICSIaLaE5Obw+VwPu6dDCqmh8 1me8CuotWaWBmz1Rs03jNoJbqHuMIAaLyiRPuXX66LS5xVZJtdje97ajuEKUydU76HN8 M1lpz1U4McJaLj4oZoPkyVpSZjt45GLaICWpJZji2qrZljXRpJrM1SEg8tNdkHzhEUzr uu1w== X-Received: by 10.66.145.98 with SMTP id st2mr2213226pab.24.1368602857534; Wed, 15 May 2013 00:27:37 -0700 (PDT) Received: from localhost.localdomain ([220.132.37.35]) by mx.google.com with ESMTPSA id zy5sm1742613pbb.43.2013.05.15.00.27.35 for (version=TLSv1 cipher=DES-CBC3-SHA bits=168/168); Wed, 15 May 2013 00:27:36 -0700 (PDT) From: Kuo-Jung Su To: u-boot@lists.denx.de Date: Wed, 15 May 2013 15:29:20 +0800 Message-Id: <1368602964-20687-2-git-send-email-dantesu@gmail.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1368602964-20687-1-git-send-email-dantesu@gmail.com> References: <1368602964-20687-1-git-send-email-dantesu@gmail.com> In-Reply-To: <1368498581-19525-2-git-send-email-dantesu@gmail.com> References: <1368498581-19525-2-git-send-email-dantesu@gmail.com> Cc: Marek Vasut , Kuo-Jung Su Subject: [U-Boot] [PATCH v9 1/5] usb: ehci: prevent bad PORTSC register access X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.11 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: u-boot-bounces@lists.denx.de Errors-To: u-boot-bounces@lists.denx.de From: Kuo-Jung Su 1. The 'index' of ehci_submit_root() is not always > 0. e.g. While it gets invoked from usb_get_descriptor(), the 'index' is always a '0'. (See ch.9 of USB2.0) 2. The PORTSC register is not always required, and thus it should only report a port error when necessary. It would cause a port scan failure if the ehci_submit_root() always gets terminated by a port error. Signed-off-by: Kuo-Jung Su CC: Marek Vasut --- Changes for v9: - 1st edition drivers/usb/host/ehci-hcd.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) -- 1.7.9.5 diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c index e0f3e4b..6022049 100644 --- a/drivers/usb/host/ehci-hcd.c +++ b/drivers/usb/host/ehci-hcd.c @@ -616,11 +616,6 @@ ehci_submit_root(struct usb_device *dev, unsigned long pipe, void *buffer, int port = le16_to_cpu(req->index) & 0xff; struct ehci_ctrl *ctrl = dev->controller; - if (port > CONFIG_SYS_USB_EHCI_MAX_ROOT_PORTS) { - printf("The request port(%d) is not configured\n", port - 1); - return -1; - } - status_reg = (uint32_t *)&ctrl->hcor->or_portsc[port - 1]; srclen = 0; debug("req=%u (%#x), type=%u (%#x), value=%u, index=%u\n", @@ -631,6 +626,21 @@ ehci_submit_root(struct usb_device *dev, unsigned long pipe, void *buffer, typeReq = req->request | req->requesttype << 8; switch (typeReq) { + case USB_REQ_GET_STATUS | ((USB_RT_PORT | USB_DIR_IN) << 8): + case USB_REQ_SET_FEATURE | ((USB_DIR_OUT | USB_RT_PORT) << 8): + case USB_REQ_CLEAR_FEATURE | ((USB_DIR_OUT | USB_RT_PORT) << 8): + if (!port || port > CONFIG_SYS_USB_EHCI_MAX_ROOT_PORTS) { + printf("The request port(%d) is not configured\n", port - 1); + return -1; + } + status_reg = (uint32_t *)&ctrl->hcor->or_portsc[port - 1]; + break; + default: + status_reg = NULL; + break; + } + + switch (typeReq) { case DeviceRequest | USB_REQ_GET_DESCRIPTOR: switch (le16_to_cpu(req->value) >> 8) { case USB_DT_DEVICE: