In xhci_xfer_tdsize() makes sure we do not forget to count packets with
a size inferior as UE_GET_SIZE(mps). This is only really used by the
isoc code, so the remaining calculation can now be corrected.
While here use UE_GET_SIZE() coherently and howmany() where it applies.
Finally remove a KASSERT() that can be triggered by a driver trusting
a badly crafter device descriptor.
Index: xhci.c
===================================================================
RCS file: /cvs/src/sys/dev/usb/xhci.c,v
retrieving revision 1.79
diff -u -p -r1.79 xhci.c
--- xhci.c 26 Apr 2018 10:19:31 -0000 1.79
+++ xhci.c 26 Apr 2018 15:38:42 -0000
@@ -2488,7 +2488,7 @@ xhci_xfer_tdsize(struct usbd_xfer *xfer,
if (len == 0)
return XHCI_TRB_TDREM(0);
- npkt = (remain - len) / mps;
+ npkt = howmany(remain - len, UE_GET_SIZE(mps));
if (npkt > 31)
npkt = 31;
@@ -2630,7 +2630,7 @@ xhci_device_generic_start(struct usbd_xf
return (USBD_IOERROR);
/* How many TRBs do we need for this transfer? */
- ntrb = (xfer->length + XHCI_TRB_MAXSIZE - 1) / XHCI_TRB_MAXSIZE;
+ ntrb = howmany(xfer->length, XHCI_TRB_MAXSIZE);
/* If the buffer crosses a 64k boundary, we need one more. */
len0 = XHCI_TRB_MAXSIZE - (paddr & (XHCI_TRB_MAXSIZE - 1));
@@ -2641,7 +2641,7 @@ xhci_device_generic_start(struct usbd_xf
/* If we need to append a zero length packet, we need one more. */
if ((xfer->flags & USBD_FORCE_SHORT_XFER || xfer->length == 0) &&
- (xfer->length % mps == 0))
+ (xfer->length % UE_GET_SIZE(mps) == 0))
ntrb++;
if (xp->free_trbs < ntrb)
@@ -2781,14 +2781,12 @@ xhci_device_isoc_start(struct usbd_xfer
/* We'll do the first TRB once we're finished with the chain. */
trb0 = xhci_xfer_get_trb(sc, xfer, &toggle0, (ntrb == 1));
- remain = xfer->length;
+ remain = xfer->length - len0;
paddr += len0;
/* Chain more TRBs if needed. */
for (i = ntrb - 1; i > 0; i--) {
len = xfer->frlengths[ntrb - i];
-
- KASSERT(len <= UGETW(ed->wMaxPacketSize));
/* Next (or Last) TRB. */
trb = xhci_xfer_get_trb(sc, xfer, &toggle, (i == 1));
