Re: [Qemu-devel] usb-ohci: td.cbp incorrectly updated near page end

2012-01-06 Thread Gerd Hoffmann
On 12/22/11 10:34, Andriy Gapon wrote: > The current code that updates the cbp value after a transfer looks like this: > td.cbp += ret; > if ((td.cbp & 0xfff) + ret > 0xfff) { > > because the 'ret' value is effectively added twice the check may fire too > early > when the overflow hasn't ha

Re: [Qemu-devel] usb-ohci: td.cbp incorrectly updated near page end

2011-12-30 Thread Stefan Hajnoczi
On Thu, Dec 22, 2011 at 11:34:30AM +0200, Andriy Gapon wrote: > > The current code that updates the cbp value after a transfer looks like this: > td.cbp += ret; > if ((td.cbp & 0xfff) + ret > 0xfff) { > > because the 'ret' value is effectively added twice the check may fire too > early > w

[Qemu-devel] usb-ohci: td.cbp incorrectly updated near page end

2011-12-22 Thread Andriy Gapon
The current code that updates the cbp value after a transfer looks like this: td.cbp += ret; if ((td.cbp & 0xfff) + ret > 0xfff) { because the 'ret' value is effectively added twice the check may fire too early when the overflow hasn't happened yet. Below is one of the possible changes t