aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/usb
diff options
context:
space:
mode:
authorDavid Brownell <dbrownell@users.sourceforge.net>2008-06-14 02:59:54 -0400
committerGreg Kroah-Hartman <gregkh@suse.de>2008-07-03 21:20:36 -0400
commit29c8f6a727a683b5988877dd80dbdefd49e64a51 (patch)
treea4be2521cf03591dd220156f4f0a92f3c49f4f89 /drivers/usb
parent056761e55c8687ddf3db14226213f2e8dc2689bc (diff)
USB: ohci - record data toggle after unlink
This patch fixes a problem with OHCI where canceling bulk or interrupt URBs may lose track of the right data toggle. This seems to be a longstanding bug, possibly dating back to the Linux 2.4 kernel, which stayed hidden because (a) about half the time the data toggle bit was correct; (b) canceling such URBs is unusual; and (c) the few drivers which cancel these URBs either [1] do it only as part of shutting down, or [2] have fault recovery logic, which recovers. For those transfer types, the toggle is normally written back into the ED when each TD is retired. But canceling bypasses the mechanism used to retire TDs ... so on average, half the time the toggle bit will be invalid after cancelation. The fix is simple: the toggle state of any canceled TDs are propagated back to the ED in the finish_unlinks function. (Issue found by leonidv11@gmail.com ...) Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Cc: Leonid <leonidv11@gmail.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb')
-rw-r--r--drivers/usb/host/ohci-q.c12
1 files changed, 12 insertions, 0 deletions
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index 9c9f3b59186f..9b547407c934 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -952,6 +952,7 @@ rescan_this:
952 struct urb *urb; 952 struct urb *urb;
953 urb_priv_t *urb_priv; 953 urb_priv_t *urb_priv;
954 __hc32 savebits; 954 __hc32 savebits;
955 u32 tdINFO;
955 956
956 td = list_entry (entry, struct td, td_list); 957 td = list_entry (entry, struct td, td_list);
957 urb = td->urb; 958 urb = td->urb;
@@ -966,6 +967,17 @@ rescan_this:
966 savebits = *prev & ~cpu_to_hc32 (ohci, TD_MASK); 967 savebits = *prev & ~cpu_to_hc32 (ohci, TD_MASK);
967 *prev = td->hwNextTD | savebits; 968 *prev = td->hwNextTD | savebits;
968 969
970 /* If this was unlinked, the TD may not have been
971 * retired ... so manually save the data toggle.
972 * The controller ignores the value we save for
973 * control and ISO endpoints.
974 */
975 tdINFO = hc32_to_cpup(ohci, &td->hwINFO);
976 if ((tdINFO & TD_T) == TD_T_DATA0)
977 ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_C);
978 else if ((tdINFO & TD_T) == TD_T_DATA1)
979 ed->hwHeadP |= cpu_to_hc32(ohci, ED_C);
980
969 /* HC may have partly processed this TD */ 981 /* HC may have partly processed this TD */
970 td_done (ohci, urb, td); 982 td_done (ohci, urb, td);
971 urb_priv->td_cnt++; 983 urb_priv->td_cnt++;