Commit 340ba5f9 authored by David Brownell's avatar David Brownell Committed by Greg Kroah-Hartman

USB: ehci potential oops fix on ARC/TDI cores

Kernel bugzilla entry #9569 reports a potential OOPS in some code
supporting the integrated root hub TT support used on ARC/TDI
derived cores.  (This seems to have been a longstanding issue.)

This patch cleans up usage of urb->dev->tt to avoid that potential
oops and also fixes some overly long lines.
Signed-off-by: default avatarDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent e96ffe2f
...@@ -198,7 +198,8 @@ static int qtd_copy_status ( ...@@ -198,7 +198,8 @@ static int qtd_copy_status (
/* if async CSPLIT failed, try cleaning out the TT buffer */ /* if async CSPLIT failed, try cleaning out the TT buffer */
if (status != -EPIPE if (status != -EPIPE
&& urb->dev->tt && !usb_pipeint (urb->pipe) && urb->dev->tt
&& !usb_pipeint(urb->pipe)
&& ((token & QTD_STS_MMF) != 0 && ((token & QTD_STS_MMF) != 0
|| QTD_CERR(token) == 0) || QTD_CERR(token) == 0)
&& (!ehci_is_TDI(ehci) && (!ehci_is_TDI(ehci)
...@@ -211,6 +212,9 @@ static int qtd_copy_status ( ...@@ -211,6 +212,9 @@ static int qtd_copy_status (
urb->dev->ttport, urb->dev->devnum, urb->dev->ttport, urb->dev->devnum,
usb_pipeendpoint (urb->pipe), token); usb_pipeendpoint (urb->pipe), token);
#endif /* DEBUG */ #endif /* DEBUG */
/* REVISIT ARC-derived cores don't clear the root
* hub TT buffer in this way...
*/
usb_hub_tt_clear_buffer (urb->dev, urb->pipe); usb_hub_tt_clear_buffer (urb->dev, urb->pipe);
} }
} }
...@@ -638,6 +642,7 @@ qh_make ( ...@@ -638,6 +642,7 @@ qh_make (
u32 info1 = 0, info2 = 0; u32 info1 = 0, info2 = 0;
int is_input, type; int is_input, type;
int maxp = 0; int maxp = 0;
struct usb_tt *tt = urb->dev->tt;
if (!qh) if (!qh)
return qh; return qh;
...@@ -661,8 +666,9 @@ qh_make ( ...@@ -661,8 +666,9 @@ qh_make (
* For control/bulk requests, the HC or TT handles these. * For control/bulk requests, the HC or TT handles these.
*/ */
if (type == PIPE_INTERRUPT) { if (type == PIPE_INTERRUPT) {
qh->usecs = NS_TO_US (usb_calc_bus_time (USB_SPEED_HIGH, is_input, 0, qh->usecs = NS_TO_US(usb_calc_bus_time(USB_SPEED_HIGH,
hb_mult (maxp) * max_packet (maxp))); is_input, 0,
hb_mult(maxp) * max_packet(maxp)));
qh->start = NO_FRAME; qh->start = NO_FRAME;
if (urb->dev->speed == USB_SPEED_HIGH) { if (urb->dev->speed == USB_SPEED_HIGH) {
...@@ -680,7 +686,6 @@ qh_make ( ...@@ -680,7 +686,6 @@ qh_make (
goto done; goto done;
} }
} else { } else {
struct usb_tt *tt = urb->dev->tt;
int think_time; int think_time;
/* gap is f(FS/LS transfer times) */ /* gap is f(FS/LS transfer times) */
...@@ -736,10 +741,8 @@ qh_make ( ...@@ -736,10 +741,8 @@ qh_make (
/* set the address of the TT; for TDI's integrated /* set the address of the TT; for TDI's integrated
* root hub tt, leave it zeroed. * root hub tt, leave it zeroed.
*/ */
if (!ehci_is_TDI(ehci) if (tt && tt->hub != ehci_to_hcd(ehci)->self.root_hub)
|| urb->dev->tt->hub != info2 |= tt->hub->devnum << 16;
ehci_to_hcd(ehci)->self.root_hub)
info2 |= urb->dev->tt->hub->devnum << 16;
/* NOTE: if (PIPE_INTERRUPT) { scheduler sets c-mask } */ /* NOTE: if (PIPE_INTERRUPT) { scheduler sets c-mask } */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment