libpayload: usb: Refactor USB enumeration to fix SuperSpeed devices

This patch represents a major overhaul of the USB enumeration code in
order to make it cleaner and much more robust to weird or malicious
devices. The main improvement is that it correctly parses the USB
descriptors even if there are unknown descriptors interspersed within,
which is perfectly legal and in particular present on all SuperSpeed
devices (due to the SuperSpeed Endpoint Companion Descriptor).

In addition, it gets rid of the really whacky and special cased
get_descriptor() function, which would read every descriptor twice
whether it made sense or not. The new code makes the callers allocate
descriptor memory and only read stuff twice when it's really necessary
(i.e. the device and configuration descriptors).

Finally, it also moves some more responsibilities into the
controller-specific set_address() function in order to make sure things
are initialized at the same stage for all controllers. In the new model
it initializes the device entry (which zeroes the endpoint array), sets
up endpoint 0 (including MPS), sets the device address and finally
returns the whole usbdev_t structure with that address correctly set.

Note that this should make SuperSpeed devices work, but SuperSpeed hubs
are a wholly different story and would require a custom hub driver
(since the hub descriptor and port status formats are different for USB
3.0 ports, and the whole issue about the same hub showing up as two
different devices on two different ports might present additional
challenges). The stack currently just issues a warning and refuses to
initialize this part of the hub, which means that 3.0 devices connected
through a 3.0 hub may not work correctly.

Change-Id: Ie0b82dca23b7a750658ccc1a85f9daae5fbc20e1
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/170666
Reviewed-by: Kees Cook <keescook@chromium.org>
(cherry picked from commit ecec80e062f7efe32a9a17479dcf8cb678a4a98b)
Signed-off-by: Isaac Christensen <isaac.christensen@se-eng.com>
Reviewed-on: http://review.coreboot.org/6780
Tested-by: build bot (Jenkins)

1 files changed, 38 insertions, 33 deletions

diff --git a/payloads/libpayload/drivers/usb/usbhub.c b/payloads/libpayload/drivers/usb/usbhub.c
index 503a9a8528..e12fd92c3f 100644
--- a/payloads/libpayload/drivers/usb/usbhub.c
+++ b/payloads/libpayload/drivers/usb/usbhub.c
@@ -46,67 +46,76 @@
 static int
 usb_hub_port_status_changed(usbdev_t *const dev, const int port)
 {
-	unsigned short buf[2] = { 0, 0 };
-	get_status (dev, port, DR_PORT, 4, buf);
-	if (buf[1] & PORT_CONNECTION)
-		clear_feature (dev, port, SEL_C_PORT_CONNECTION, DR_PORT);
-	return buf[1] & PORT_CONNECTION;
+	unsigned short buf[2];
+	int ret = get_status (dev, port, DR_PORT, sizeof(buf), buf);
+	if (ret >= 0) {
+		ret = buf[1] & PORT_CONNECTION;
+		if (ret)
+			clear_feature (dev, port, SEL_C_PORT_CONNECTION,
+				       DR_PORT);
+	}
+	return ret;
 }
 
 static int
 usb_hub_port_connected(usbdev_t *const dev, const int port)
 {
-	unsigned short buf[2] = { 0, 0 };
-	get_status (dev, port, DR_PORT, 4, buf);
-	return buf[0] & PORT_CONNECTION;
+	unsigned short buf[2];
+	int ret = get_status (dev, port, DR_PORT, sizeof(buf), buf);
+	if (ret >= 0)
+		ret = buf[0] & PORT_CONNECTION;
+	return ret;
 }
 
 static int
 usb_hub_port_in_reset(usbdev_t *const dev, const int port)
 {
-	unsigned short buf[2] = { 0, 0 };
-	get_status (dev, port, DR_PORT, 4, buf);
-	return buf[0] & PORT_RESET;
+	unsigned short buf[2];
+	int ret = get_status (dev, port, DR_PORT, sizeof(buf), buf);
+	if (ret >= 0)
+		ret = buf[0] & PORT_RESET;
+	return ret;
 }
 
 static int
 usb_hub_port_enabled(usbdev_t *const dev, const int port)
 {
-	unsigned short buf[2] = { 0, 0 };
-	get_status (dev, port, DR_PORT, 4, buf);
-	return (buf[0] & PORT_ENABLE) != 0;
+	unsigned short buf[2];
+	int ret = get_status (dev, port, DR_PORT, sizeof(buf), buf);
+	if (ret >= 0)
+		ret = buf[0] & PORT_ENABLE;
+	return ret;
 }
 
 static usb_speed
 usb_hub_port_speed(usbdev_t *const dev, const int port)
 {
-	unsigned short buf[2] = { 0, 0 };
-	get_status (dev, port, DR_PORT, 4, buf);
-	if (buf[0] & PORT_ENABLE) {
+	unsigned short buf[2];
+	int ret = get_status (dev, port, DR_PORT, sizeof(buf), buf);
+	if (ret >= 0 && (buf[0] & PORT_ENABLE)) {
 		/* bit  10  9
 		 *      0   0  full speed
 		 *      0   1  low speed
 		 *      1   0  high speed
 		 *      1   1  super speed (hack, not in spec!)
 		 */
-		return (buf[0] >> 9) & 0x3;
+		ret = (buf[0] >> 9) & 0x3;
 	} else {
-		return -1;
+		ret = -1;
 	}
+	return ret;
 }
 
 static int
 usb_hub_enable_port(usbdev_t *const dev, const int port)
 {
-	set_feature(dev, port, SEL_PORT_POWER, DR_PORT);
-	return 0;
+	return set_feature(dev, port, SEL_PORT_POWER, DR_PORT);
 }
 
 static int
 usb_hub_start_port_reset(usbdev_t *const dev, const int port)
 {
-	set_feature (dev, port, SEL_PORT_RESET, DR_PORT);
-	return 0;
+	return set_feature (dev, port, SEL_PORT_RESET, DR_PORT);
 }
 
 static const generic_hub_ops_t usb_hub_ops = {
@@ -125,17 +134,13 @@ static const generic_hub_ops_t usb_hub_ops = {
 void
 usb_hub_init(usbdev_t *const dev)
 {
-	hub_descriptor_t *const descriptor = (hub_descriptor_t *)
-		get_descriptor(
-			dev,
-			gen_bmRequestType(device_to_host, class_type, dev_recp),
-			0x29, 0, 0);
-	if (!descriptor) {
-		usb_debug("usbhub: ERROR: Failed to fetch hub descriptor\n");
+	hub_descriptor_t desc;	/* won't fit the whole thing, we don't care */
+	if (get_descriptor(dev, gen_bmRequestType(device_to_host, class_type,
+		dev_recp), 0x29, 0, &desc, sizeof(desc)) != sizeof(desc)) {
+		usb_debug("get_descriptor(HUB) failed\n");
+		usb_detach_device(dev->controller, dev->address);
 		return;
 	}
-	const int num_ports = descriptor->bNbrPorts;
-	free(descriptor);
 
-	generic_hub_init(dev, num_ports, &usb_hub_ops);
+	generic_hub_init(dev, desc.bNbrPorts, &usb_hub_ops);
 }