diff options
| author | Nicolas Boichat <drinkcat@google.com> | 2016-12-08 10:25:27 +0800 |
|---|---|---|
| committer | ChromeOS Commit Bot <chromeos-commit-bot@chromium.org> | 2016-12-09 07:13:14 +0000 |
| commit | a93464581f2b4db7a81db1c61ec933a5c46c8b99 (patch) | |
| tree | d5b7bb6e7cdd6da222e37e764d2eb3e7b6bed475 | |
| parent | 87d3bc6264bbd7cfef02a65094315ee2cec24097 (diff) | |
| download | chrome-ec-a93464581f2b4db7a81db1c61ec933a5c46c8b99.tar.gz | |
tcpci_tcpm_get_message: TCPC_REG_RX_BYTE_CNT includes header
From TCPC spec:
"""
RECEIVE_BYTE_COUNT: Indicates number of bytes in this register
that are not stale. The TCPM should read the first RECEIVE_BYTE_COUNT
bytes in this register. This is the number of bytes in the
RX_BUFFER_DATA_OBJECTS plus three (for the RX_BUF_FRAME_TYPE and
RX_BUF_HEADER).
"""
We were always reading 3 bytes too many. This is an issue if we
receive a packet followed by a hard reset, as the register value
will be set back to 0, but TCPC_REG_RX_HDR may contain a valid
header, leading to corrupted packets being passed down the stack.
Also update usb_pd_tcpc to match the specification.
BRANCH=none
BUG=chrome-os-partner:60575
TEST=elm FW as of 65fb80d (later version include a fix that would
hide this issue), cherry-pick this patch, connect j5create
adapter, then HDMI, then power => no crash
Change-Id: I9ed8f3b500d5733ec7563e31246505e0b8bd48bb
Previous-Reviewed-on: https://chromium-review.googlesource.com/417442
(cherry picked from commit 19cf3cb8952a89bc70bcd5376b44e019b7117aef)
Reviewed-on: https://chromium-review.googlesource.com/418101
Reviewed-by: Nicolas Boichat <drinkcat@chromium.org>
Commit-Queue: Nicolas Boichat <drinkcat@chromium.org>
Tested-by: Nicolas Boichat <drinkcat@chromium.org>
Trybot-Ready: Nicolas Boichat <drinkcat@chromium.org>
| -rw-r--r-- | common/usb_pd_tcpc.c | 2 | ||||
| -rw-r--r-- | driver/tcpm/tcpci.c | 11 |
2 files changed, 11 insertions, 2 deletions
diff --git a/common/usb_pd_tcpc.c b/common/usb_pd_tcpc.c index 644f27dcd1..2219534af8 100644 --- a/common/usb_pd_tcpc.c +++ b/common/usb_pd_tcpc.c @@ -1235,7 +1235,7 @@ static int tcpc_i2c_read(int port, int reg, uint8_t *payload) payload[1] = (pd[port].alert_mask >> 8) & 0xff; return 2; case TCPC_REG_RX_BYTE_CNT: - payload[0] = 4 * + payload[0] = 3 + 4 * PD_HEADER_CNT(pd[port].rx_head[pd[port].rx_buf_tail]); return 1; case TCPC_REG_RX_HDR: diff --git a/driver/tcpm/tcpci.c b/driver/tcpm/tcpci.c index 057230a6d9..607dc71063 100644 --- a/driver/tcpm/tcpci.c +++ b/driver/tcpm/tcpci.c @@ -146,8 +146,16 @@ int tcpci_tcpm_get_message(int port, uint32_t *payload, int *head) rv = tcpc_read(port, TCPC_REG_RX_BYTE_CNT, &cnt); - rv |= tcpc_read16(port, TCPC_REG_RX_HDR, (int *)head); + /* RX_BYTE_CNT includes 3 bytes for frame type and header */ + if (rv != EC_SUCCESS || cnt < 3) { + *head = 0; + rv = EC_ERROR_UNKNOWN; + goto clear; + } + + rv = tcpc_read16(port, TCPC_REG_RX_HDR, (int *)head); + cnt = cnt - 3; if (rv == EC_SUCCESS && cnt > 0) { tcpc_lock(port, 1); rv = tcpc_xfer(port, @@ -156,6 +164,7 @@ int tcpci_tcpm_get_message(int port, uint32_t *payload, int *head) tcpc_lock(port, 0); } +clear: /* Read complete, clear RX status alert bit */ tcpc_write16(port, TCPC_REG_ALERT, TCPC_REG_ALERT_RX_STATUS); |