xhci: Count new Max Scratchpad Bufs bits from XHCI 1.1

The 1.1 revision of the XHCI specification added an extra 5 bits to the
Max Scratchpad Bufs field of HCSPARAMS2 that newer controllers make use
of. Not honoring these bits means we're not allocating as many
scratchpad buffers as the controller expects, which means it will
interpret some uninitialized values from the end of the pointer array as
scratchpad buffer pointers.

We just fixed this in libpayload and it seems to apply the same way to
SeaBIOS (I only compile-tested this, though... sorry).

Signed-off-by: Julius Werner <jwerner@chromium.org>

diff --git a/src/hw/usb-xhci.c b/src/hw/usb-xhci.c
index 41a6a3f3e91c982eb4a6c722096ae91bc4939007..7fc13c48c18b12a7c9c27017246af5ff33e4e9a0 100644 (file)
--- a/src/hw/usb-xhci.c
+++ b/src/hw/usb-xhci.c
@@ -465,7 +465,7 @@ configure_xhci(void *data)
     xhci->evts->cs = 1;
 
     reg = readl(&xhci->caps->hcsparams2);
-    u32 spb = reg >> 27;
+    u32 spb = (reg >> 21 & 0x1f) << 5 | reg >> 27;
     if (spb) {
         dprintf(3, "%s: setup %d scratch pad buffers\n", __func__, spb);
         u64 *spba = memalign_high(64, sizeof(*spba) * spb);