Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1c11a172 authored by Vivek Gautam's avatar Vivek Gautam Committed by Sarah Sharp
Browse files

usb: xhci: Fix TRB transfer length macro used for Event TRB. 



Use proper macro while extracting TRB transfer length from
Transfer event TRBs. Adding a macro EVENT_TRB_LEN (bits 0:23)
for the same, and use it instead of TRB_LEN (bits 0:16) in
case of event TRBs.

This patch should be backported to kernels as old as 2.6.31, that
contain the commit b10de142 "USB: xhci:
Bulk transfer support".  This patch will have issues applying to older
kernels.

Signed-off-by: default avatarVivek gautam <gautam.vivek@samsung.com>
Signed-off-by: default avatarSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org
parent bafcaf6d

drivers/usb/host/xhci-ring.c

+12 −12
Original line number Diff line number Diff line
@@ -2029,8 +2029,8 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, 
		if (event_trb != ep_ring->dequeue &&

				event_trb != td->last_trb)

			td->urb->actual_length =

				td->urb->transfer_buffer_length

				- TRB_LEN(le32_to_cpu(event->transfer_len));

				td->urb->transfer_buffer_length -

				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));

		else

			td->urb->actual_length = 0;
@@ -2062,7 +2062,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td, 
		/* Maybe the event was for the data stage? */

			td->urb->actual_length =

				td->urb->transfer_buffer_length -

				TRB_LEN(le32_to_cpu(event->transfer_len));

				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));

			xhci_dbg(xhci, "Waiting for status "

					"stage event\n");

			return 0;
@@ -2098,7 +2098,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td, 
	/* handle completion code */

	switch (trb_comp_code) {

	case COMP_SUCCESS:

		if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {

		if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {

			frame->status = 0;

			break;

		}
@@ -2143,7 +2143,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td, 
				len += TRB_LEN(le32_to_cpu(cur_trb->generic.field[2]));

		}

		len += TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -

			TRB_LEN(le32_to_cpu(event->transfer_len));

			EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));



		if (trb_comp_code != COMP_STOP_INVAL) {

			frame->actual_length = len;
@@ -2201,7 +2201,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td, 
	case COMP_SUCCESS:

		/* Double check that the HW transferred everything. */

		if (event_trb != td->last_trb ||

				TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {

		    EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {

			xhci_warn(xhci, "WARN Successful completion "

					"on short TX\n");

			if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
@@ -2229,18 +2229,18 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td, 
				"%d bytes untransferred\n",

				td->urb->ep->desc.bEndpointAddress,

				td->urb->transfer_buffer_length,

				TRB_LEN(le32_to_cpu(event->transfer_len)));

				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));

	/* Fast path - was this the last TRB in the TD for this URB? */

	if (event_trb == td->last_trb) {

		if (TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {

		if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {

			td->urb->actual_length =

				td->urb->transfer_buffer_length -

				TRB_LEN(le32_to_cpu(event->transfer_len));

				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));

			if (td->urb->transfer_buffer_length <

					td->urb->actual_length) {

				xhci_warn(xhci, "HC gave bad length "

						"of %d bytes left\n",

					  TRB_LEN(le32_to_cpu(event->transfer_len)));

					  EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));

				td->urb->actual_length = 0;

				if (td->urb->transfer_flags & URB_SHORT_NOT_OK)

					*status = -EREMOTEIO;
@@ -2282,7 +2282,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td, 
		if (trb_comp_code != COMP_STOP_INVAL)

			td->urb->actual_length +=

				TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -

				TRB_LEN(le32_to_cpu(event->transfer_len));

				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));

	}



	return finish_td(xhci, td, event_trb, event, ep, status, false);
@@ -2370,7 +2370,7 @@ static int handle_tx_event(struct xhci_hcd *xhci, 
	 * transfer type

	 */

	case COMP_SUCCESS:

		if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)

		if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)

			break;

		if (xhci->quirks & XHCI_TRUST_TX_LENGTH)

			trb_comp_code = COMP_SHORT_TX;

drivers/usb/host/xhci.h

+4 −0
Original line number Diff line number Diff line
@@ -972,6 +972,10 @@ struct xhci_transfer_event { 
	__le32	flags;

};



/* Transfer event TRB length bit mask */

/* bits 0:23 */

#define	EVENT_TRB_LEN(p)		((p) & 0xffffff)



/** Transfer Event bit fields **/

#define	TRB_TO_EP_ID(p)	(((p) >> 16) & 0x1f)