From ab8789987f5e8d09b71e7425f3980b259967e17c Mon Sep 17 00:00:00 2001 From: Laurent Vivier Date: Thu, 21 Mar 2019 09:52:12 +0100 Subject: [PATCH 1/2] ohci: don't die on ED_LINK_LIMIT overflow Stop processing the descriptor list instead. The next frame timer tick will resume the work Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1686705 Suggested-by: Gerd Hoffmann Signed-off-by: Laurent Vivier Message-id: 20190321085212.10796-1-lvivier@redhat.com Signed-off-by: Gerd Hoffmann --- hw/usb/hcd-ohci.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c index 196a9f7200..81cf5ab7a5 100644 --- a/hw/usb/hcd-ohci.c +++ b/hw/usb/hcd-ohci.c @@ -1200,7 +1200,7 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion) if (head == 0) return 0; - for (cur = head; cur; cur = next_ed) { + for (cur = head; cur && link_cnt++ < ED_LINK_LIMIT; cur = next_ed) { if (ohci_read_ed(ohci, cur, &ed)) { trace_usb_ohci_ed_read_error(cur); ohci_die(ohci); @@ -1209,11 +1209,6 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion) next_ed = ed.next & OHCI_DPTR_MASK; - if (++link_cnt > ED_LINK_LIMIT) { - ohci_die(ohci); - return 0; - } - if ((ed.head & OHCI_ED_H) || (ed.flags & OHCI_ED_K)) { uint32_t addr; /* Cancel pending packets for ED that have been paused. */ From 339534d402524d75209df5d287464e17feb6941f Mon Sep 17 00:00:00 2001 From: BALATON Zoltan Date: Mon, 18 Mar 2019 23:34:46 +0100 Subject: [PATCH 2/2] ati-vga: Fix indexed access to video memory Coverity (CID 1399700) found that this was wrong so instead of trying to do it by hand use existing access functions that should work better. Signed-off-by: BALATON Zoltan Message-id: 20190318223842.427CB7456B2@zero.eik.bme.hu Signed-off-by: Gerd Hoffmann --- hw/display/ati.c | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/hw/display/ati.c b/hw/display/ati.c index 8322f52aff..db409be3c9 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -235,12 +235,9 @@ static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size) case MM_DATA ... MM_DATA + 3: /* indexed access to regs or memory */ if (s->regs.mm_index & BIT(31)) { - if (s->regs.mm_index <= s->vga.vram_size - size) { - int i = size - 1; - while (i >= 0) { - val <<= 8; - val |= s->vga.vram_ptr[s->regs.mm_index + i--]; - } + uint32_t idx = s->regs.mm_index & ~BIT(31); + if (idx <= s->vga.vram_size - size) { + val = ldn_le_p(s->vga.vram_ptr + idx, size); } } else { val = ati_mm_read(s, s->regs.mm_index + addr - MM_DATA, size); @@ -434,12 +431,9 @@ static void ati_mm_write(void *opaque, hwaddr addr, case MM_DATA ... MM_DATA + 3: /* indexed access to regs or memory */ if (s->regs.mm_index & BIT(31)) { - if (s->regs.mm_index <= s->vga.vram_size - size) { - int i = 0; - while (i < size) { - s->vga.vram_ptr[s->regs.mm_index + i] = data & 0xff; - data >>= 8; - } + uint32_t idx = s->regs.mm_index & ~BIT(31); + if (idx <= s->vga.vram_size - size) { + stn_le_p(s->vga.vram_ptr + idx, size, data); } } else { ati_mm_write(s, s->regs.mm_index + addr - MM_DATA, data, size);