From 30f9742d615f1ee7aa35f7fe3c4cfa5d29783ffa Mon Sep 17 00:00:00 2001 From: Stefan Sperling Date: Fri, 1 Sep 2017 16:01:28 +0000 Subject: Fix a remaining length miscalculation in xhci(4). Each TRB contains a remaining TD size, which allows hardware to tell whether additional TRBs follow within the current transfer without reading ahead. The length of the first TRB was subtracted from the total length before calculating the remaining TD sizes. This is wrong because remaining TD sizes are relative to the size of the entire transfer, including the first TRB. Our current USB code does not trigger this bug because there is no code in upper layers yet which triggers use of multiple TRBs per transfer. ok mpi@ --- sys/dev/usb/xhci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sys/dev') diff --git a/sys/dev/usb/xhci.c b/sys/dev/usb/xhci.c index 44c21a2b004..79e930c9159 100644 --- a/sys/dev/usb/xhci.c +++ b/sys/dev/usb/xhci.c @@ -1,4 +1,4 @@ -/* $OpenBSD: xhci.c,v 1.74 2017/07/30 19:24:18 kettenis Exp $ */ +/* $OpenBSD: xhci.c,v 1.75 2017/09/01 16:01:27 stsp Exp $ */ /* * Copyright (c) 2014-2015 Martin Pieuchot @@ -2571,7 +2571,7 @@ xhci_device_generic_start(struct usbd_xfer *xfer) /* We'll do the first TRB once we're finished with the chain. */ trb0 = xhci_xfer_get_trb(sc, xfer, &toggle0, (ntrb == 1)); - remain = xfer->length - len0; + remain = xfer->length; paddr += len0; len = min(remain, XHCI_TRB_MAXSIZE); -- cgit v1.2.3