usb-ohci: td.cbp incorrectly updated near page end
The current code that updates the cbp value after a transfer looks like this: td.cbp += ret; if ((td.cbp & 0xfff) + ret > 0xfff) { <handle page overflow> because the 'ret' value is effectively added twice the check may fire too early when the overflow hasn't happened yet. Below is one of the possible changes that correct the behavior: Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
parent
c75fead66e
commit
fd891c9318
|
@ -1025,10 +1025,10 @@ static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
|
||||||
if (ret == len) {
|
if (ret == len) {
|
||||||
td.cbp = 0;
|
td.cbp = 0;
|
||||||
} else {
|
} else {
|
||||||
td.cbp += ret;
|
|
||||||
if ((td.cbp & 0xfff) + ret > 0xfff) {
|
if ((td.cbp & 0xfff) + ret > 0xfff) {
|
||||||
td.cbp &= 0xfff;
|
td.cbp = (td.be & ~0xfff) + ((td.cbp + ret) & 0xfff);
|
||||||
td.cbp |= td.be & ~0xfff;
|
} else {
|
||||||
|
td.cbp += ret;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
td.flags |= OHCI_TD_T1;
|
td.flags |= OHCI_TD_T1;
|
||||||
|
|
Loading…
Reference in a new issue