diff options
| author | Stefan Sperling <stsp@cvs.openbsd.org> | 2017-09-01 16:01:28 +0000 |
|---|---|---|
| committer | Stefan Sperling <stsp@cvs.openbsd.org> | 2017-09-01 16:01:28 +0000 |
| commit | 30f9742d615f1ee7aa35f7fe3c4cfa5d29783ffa (patch) | |
| tree | 845cde405430b71b64a56ba2e25c455d33a6477c | |
| parent | c5a5d8b493c17ada1ac295f858281aa77c0f31da (diff) | |
Fix a remaining length miscalculation in xhci(4).
Each TRB contains a remaining TD size, which allows hardware to tell whether
additional TRBs follow within the current transfer without reading ahead.
The length of the first TRB was subtracted from the total length before
calculating the remaining TD sizes. This is wrong because remaining TD sizes
are relative to the size of the entire transfer, including the first TRB.
Our current USB code does not trigger this bug because there is no code in
upper layers yet which triggers use of multiple TRBs per transfer.
ok mpi@
| -rw-r--r-- | sys/dev/usb/xhci.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/usb/xhci.c b/sys/dev/usb/xhci.c index 44c21a2b004..79e930c9159 100644 --- a/sys/dev/usb/xhci.c +++ b/sys/dev/usb/xhci.c @@ -1,4 +1,4 @@ -/* $OpenBSD: xhci.c,v 1.74 2017/07/30 19:24:18 kettenis Exp $ */ +/* $OpenBSD: xhci.c,v 1.75 2017/09/01 16:01:27 stsp Exp $ */ /* * Copyright (c) 2014-2015 Martin Pieuchot @@ -2571,7 +2571,7 @@ xhci_device_generic_start(struct usbd_xfer *xfer) /* We'll do the first TRB once we're finished with the chain. */ trb0 = xhci_xfer_get_trb(sc, xfer, &toggle0, (ntrb == 1)); - remain = xfer->length - len0; + remain = xfer->length; paddr += len0; len = min(remain, XHCI_TRB_MAXSIZE); |