[U-Boot] [PATCH] USB: sync Queue Element Transfer Descriptor against EHCI spec

[Wolfgang Denk]

Appendix B "EHCI 64-Bit Data Structures" of the "Enhanced Host
Controller Interface Specification for Universal Serial Bus" (Rev.
1.0, March 12, 2002) defines additional fields which were missing in
U-Boot's struct qTD; as these are also present in recent versions of
struct ehci_qtd in the Linux kernel, we add them here, too.

This fixes some nasty memory corruption problems.

Reported-by: Dan Lykowski <lykowdk at gmail.com>
See http://permalink.gmane.org/gmane.comp.boot-loaders.u-boot/76942

Signed-off-by: Wolfgang Denk <wd at denx.de>
Cc: Remy Bohmer <linux at bohmer.net>
Cc: Dan Lykowski <lykowdk at gmail.com>
Cc: Stefano Babic <sbabic at denx.de>
Tested-by: Stefano Babic <sbabic at denx.de>
---

Dear Remy,

this patch goes back to an old posting by Dan Lykowski.

Unfortunately Dan never submitted a patch, so this went unfixed until
now, when the bug bit Stefano...

Best regards,

Wolfgang


 drivers/usb/host/ehci-hcd.c |    1 +
 drivers/usb/host/ehci.h     |   14 +++++++++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 37d056e..f44fc4e 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -288,6 +288,7 @@ static int ehci_td_buffer(struct qTD *td, void *buf, size_t sz)
 	idx = 0;
 	while (idx < 5) {
 		td->qt_buffer[idx] = cpu_to_hc32(addr);
+		td->qt_buffer_hi[idx] = 0;
 		next = (addr + 4096) & ~4095;
 		delta = next - addr;
 		if (delta >= sz)
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 6fae8ba..d3aa55b 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -166,12 +166,16 @@ struct usb_linux_config_descriptor {
 
 /* Queue Element Transfer Descriptor (qTD). */
 struct qTD {
-	uint32_t qt_next;
+	/* this part defined by EHCI spec */
+	uint32_t qt_next;		/* see EHCI 3.5.1 */
 #define	QT_NEXT_TERMINATE	1
-	uint32_t qt_altnext;
-	uint32_t qt_token;
-	uint32_t qt_buffer[5];
-};
+	uint32_t qt_altnext;		/* see EHCI 3.5.2 */
+	uint32_t qt_token;		/* see EHCI 3.5.3 */
+	uint32_t qt_buffer[5];		/* see EHCI 3.5.4 */
+	uint32_t qt_buffer_hi[5];	/* Appendix B */
+	/* pad struct for 32 byte alignment */
+	uint32_t unused[3];
+} __attribute__ ((aligned (32)));
 
 /* Queue Head (QH). */
 struct QH {
-- 
1.7.2.3