USB: sync Queue Element Transfer Descriptor against EHCI spec

Appendix B "EHCI 64-Bit Data Structures" of the "Enhanced Host
Controller Interface Specification for Universal Serial Bus" (Rev.
1.0, March 12, 2002) defines additional fields which were missing in
U-Boot's struct qTD; as these are also present in recent versions of
struct ehci_qtd in the Linux kernel, we add them here, too.

This fixes some nasty memory corruption problems.

Reported-by: Dan Lykowski <lykowdk@gmail.com>
See http://permalink.gmane.org/gmane.comp.boot-loaders.u-boot/76942

Signed-off-by: Wolfgang Denk <wd@denx.de>
Cc: Remy Bohmer <linux@bohmer.net>
Cc: Dan Lykowski <lykowdk@gmail.com>
Cc: Stefano Babic <sbabic@denx.de>
Tested-by: Stefano Babic <sbabic@denx.de>
This commit is contained in:
Wolfgang Denk 2010-10-19 16:13:15 +02:00
parent d078b7c2ec
commit 3ed16071b0
2 changed files with 10 additions and 5 deletions

View file

@ -288,6 +288,7 @@ static int ehci_td_buffer(struct qTD *td, void *buf, size_t sz)
idx = 0;
while (idx < 5) {
td->qt_buffer[idx] = cpu_to_hc32(addr);
td->qt_buffer_hi[idx] = 0;
next = (addr + 4096) & ~4095;
delta = next - addr;
if (delta >= sz)

View file

@ -166,12 +166,16 @@ struct usb_linux_config_descriptor {
/* Queue Element Transfer Descriptor (qTD). */
struct qTD {
uint32_t qt_next;
/* this part defined by EHCI spec */
uint32_t qt_next; /* see EHCI 3.5.1 */
#define QT_NEXT_TERMINATE 1
uint32_t qt_altnext;
uint32_t qt_token;
uint32_t qt_buffer[5];
};
uint32_t qt_altnext; /* see EHCI 3.5.2 */
uint32_t qt_token; /* see EHCI 3.5.3 */
uint32_t qt_buffer[5]; /* see EHCI 3.5.4 */
uint32_t qt_buffer_hi[5]; /* Appendix B */
/* pad struct for 32 byte alignment */
uint32_t unused[3];
} __attribute__ ((aligned (32)));
/* Queue Head (QH). */
struct QH {