On Thu, Dec 19, 2002 at 05:11:32PM -0800, Matthew Dillon wrote:
> I found another couple of bugs, this time in OHCI's DMA
> buffer chaining code.
Great.
> A patch for this with additional debugging code is
> included below (for current). There are two bugs.
> I do not know if -stable is effected.
>
> First, the calculation of dataphysend is totally bogus.
> You can just take the physical address and add (len - 1)
> to it. You have to take the virtual address, add len - 1
> to it, and convert it to a physical address. I can
> crash my machine simply by doing a
>
> 'newfs -f 1024 -b 8192 /dev/da2s1a'
>
> On the disk-on-key USB device.
>
> Second, I believe the OpenBSD and NetBSD code is broken.
> The range can be one or two pages, but the remaining bytes
> may be less then one page and this has to be taken into
> account.
The NetBSD code is already different:
1.48 (augustss 15-Sep-99): /* The OHCI hardware can handle at
most one page crossing. */
1.48 (augustss 15-Sep-99): if (OHCI_PAGE(dataphys) == dataphysend
||
1.48 (augustss 15-Sep-99): OHCI_PAGE(dataphys) +
OHCI_PAGE_SIZE == dataphysend) {
1.48 (augustss 15-Sep-99): /* we can handle it in this TD
*/
1.48 (augustss 15-Sep-99): curlen = len;
1.48 (augustss 15-Sep-99): } else {
1.48 (augustss 15-Sep-99): /* must use multiple TDs, fill
as much as possible. */
1.120 (augustss 03-Feb-02): curlen = 2 * OHCI_PAGE_SIZE -
1.48 (augustss 15-Sep-99): (dataphys &
(OHCI_PAGE_SIZE-1));
1.78 (augustss 20-Mar-00): /* the length must be a
multiple of the max size */
1.78 (augustss 20-Mar-00): curlen -= curlen %
UGETW(opipe->pipe.endpoint->edesc->wMaxPacketSize);
1.78 (augustss 20-Mar-00): #ifdef DIAGNOSTIC
1.78 (augustss 20-Mar-00): if (curlen == 0)
1.128 (provos 27-Sep-02): panic("ohci_alloc_std:
curlen == 0");
1.78 (augustss 20-Mar-00): #endif
1.48 (augustss 15-Sep-99): }
To bad we did not catch it.
--
B.Walter COSMO-Project http://www.cosmo-project.de
[EMAIL PROTECTED] Usergroup [EMAIL PROTECTED]
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-current" in the body of the message
