summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorKuo-Jung Su <dantesu@faraday-tech.com>2013-05-15 15:29:20 +0800
committerMarek Vasut <marex@denx.de>2013-06-12 22:22:51 +0200
commit9c6a9d7c8be40f58cf3faf0a4b8d9d33a21ca4f5 (patch)
tree30b004ad5a8648dfa97778b709fe958e9d16c97b /drivers
parentf6664ba4bcc484a2b924ecfa1052bb729def6685 (diff)
downloadu-boot-imx-9c6a9d7c8be40f58cf3faf0a4b8d9d33a21ca4f5.zip
u-boot-imx-9c6a9d7c8be40f58cf3faf0a4b8d9d33a21ca4f5.tar.gz
u-boot-imx-9c6a9d7c8be40f58cf3faf0a4b8d9d33a21ca4f5.tar.bz2
usb: ehci: prevent bad PORTSC register access
1. The 'index' of ehci_submit_root() is not always > 0. e.g. While it gets invoked from usb_get_descriptor(), the 'index' is always a '0'. (See ch.9 of USB2.0) 2. The PORTSC register is not always required, and thus it should only report a port error when necessary. It would cause a port scan failure if the ehci_submit_root() always gets terminated by a port error. Signed-off-by: Kuo-Jung Su <dantesu@faraday-tech.com> CC: Marek Vasut <marex@denx.de>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/usb/host/ehci-hcd.c20
1 files changed, 15 insertions, 5 deletions
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 445759b..443cc23 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -616,11 +616,6 @@ ehci_submit_root(struct usb_device *dev, unsigned long pipe, void *buffer,
int port = le16_to_cpu(req->index) & 0xff;
struct ehci_ctrl *ctrl = dev->controller;
- if (port > CONFIG_SYS_USB_EHCI_MAX_ROOT_PORTS) {
- printf("The request port(%d) is not configured\n", port - 1);
- return -1;
- }
- status_reg = (uint32_t *)&ctrl->hcor->or_portsc[port - 1];
srclen = 0;
debug("req=%u (%#x), type=%u (%#x), value=%u, index=%u\n",
@@ -631,6 +626,21 @@ ehci_submit_root(struct usb_device *dev, unsigned long pipe, void *buffer,
typeReq = req->request | req->requesttype << 8;
switch (typeReq) {
+ case USB_REQ_GET_STATUS | ((USB_RT_PORT | USB_DIR_IN) << 8):
+ case USB_REQ_SET_FEATURE | ((USB_DIR_OUT | USB_RT_PORT) << 8):
+ case USB_REQ_CLEAR_FEATURE | ((USB_DIR_OUT | USB_RT_PORT) << 8):
+ if (!port || port > CONFIG_SYS_USB_EHCI_MAX_ROOT_PORTS) {
+ printf("The request port(%d) is not configured\n", port - 1);
+ return -1;
+ }
+ status_reg = (uint32_t *)&ctrl->hcor->or_portsc[port - 1];
+ break;
+ default:
+ status_reg = NULL;
+ break;
+ }
+
+ switch (typeReq) {
case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
switch (le16_to_cpu(req->value) >> 8) {
case USB_DT_DEVICE: