| From 7369090a9fb57c3fc705ce355d2e4523a5a24716 Mon Sep 17 00:00:00 2001 |
| From: Felipe Balbi <felipe.balbi@linux.intel.com> |
| Date: Tue, 31 Jan 2017 13:24:54 +0200 |
| Subject: usb: dwc3: gadget: make Set Endpoint Configuration macros safe |
| |
| From: Felipe Balbi <felipe.balbi@linux.intel.com> |
| |
| commit 7369090a9fb57c3fc705ce355d2e4523a5a24716 upstream. |
| |
| Some gadget drivers are bad, bad boys. We notice |
| that ADB was passing bad Burst Size which caused top |
| bits of param0 to be overwritten which confused DWC3 |
| when running this command. |
| |
| In order to avoid future issues, we're going to make |
| sure values passed by macros are always safe for the |
| controller. Note that ADB still needs a fix to *not* |
| pass bad values. |
| |
| Reported-by: Mohamed Abbas <mohamed.abbas@intel.com> |
| Sugested-by: Adam Andruszak <adam.andruszak@intel.com> |
| Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/dwc3/gadget.h | 14 +++++++------- |
| 1 file changed, 7 insertions(+), 7 deletions(-) |
| |
| --- a/drivers/usb/dwc3/gadget.h |
| +++ b/drivers/usb/dwc3/gadget.h |
| @@ -28,23 +28,23 @@ struct dwc3; |
| #define gadget_to_dwc(g) (container_of(g, struct dwc3, gadget)) |
| |
| /* DEPCFG parameter 1 */ |
| -#define DWC3_DEPCFG_INT_NUM(n) ((n) << 0) |
| +#define DWC3_DEPCFG_INT_NUM(n) (((n) & 0x1f) << 0) |
| #define DWC3_DEPCFG_XFER_COMPLETE_EN (1 << 8) |
| #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN (1 << 9) |
| #define DWC3_DEPCFG_XFER_NOT_READY_EN (1 << 10) |
| #define DWC3_DEPCFG_FIFO_ERROR_EN (1 << 11) |
| #define DWC3_DEPCFG_STREAM_EVENT_EN (1 << 13) |
| -#define DWC3_DEPCFG_BINTERVAL_M1(n) ((n) << 16) |
| +#define DWC3_DEPCFG_BINTERVAL_M1(n) (((n) & 0xff) << 16) |
| #define DWC3_DEPCFG_STREAM_CAPABLE (1 << 24) |
| -#define DWC3_DEPCFG_EP_NUMBER(n) ((n) << 25) |
| +#define DWC3_DEPCFG_EP_NUMBER(n) (((n) & 0x1f) << 25) |
| #define DWC3_DEPCFG_BULK_BASED (1 << 30) |
| #define DWC3_DEPCFG_FIFO_BASED (1 << 31) |
| |
| /* DEPCFG parameter 0 */ |
| -#define DWC3_DEPCFG_EP_TYPE(n) ((n) << 1) |
| -#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) ((n) << 3) |
| -#define DWC3_DEPCFG_FIFO_NUMBER(n) ((n) << 17) |
| -#define DWC3_DEPCFG_BURST_SIZE(n) ((n) << 22) |
| +#define DWC3_DEPCFG_EP_TYPE(n) (((n) & 0x3) << 1) |
| +#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) (((n) & 0x7ff) << 3) |
| +#define DWC3_DEPCFG_FIFO_NUMBER(n) (((n) & 0x1f) << 17) |
| +#define DWC3_DEPCFG_BURST_SIZE(n) (((n) & 0xf) << 22) |
| #define DWC3_DEPCFG_DATA_SEQ_NUM(n) ((n) << 26) |
| /* This applies for core versions earlier than 1.94a */ |
| #define DWC3_DEPCFG_IGN_SEQ_NUM (1 << 31) |