From 1adc3498eae4c1584aea015f8e769ae8239c2c72 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Fri, 21 Sep 2012 18:57:31 -0300
Subject: [RHEL6 qemu-kvm PATCH 10/23] ehci: fix td writeback

RH-Author: Hans de Goede <hdegoede@redhat.com>
Message-id: <1348253864-3050-10-git-send-email-hdegoede@redhat.com>
Patchwork-id: 42187
O-Subject: [RHEL-6.4 qemu-kvm PATCH 09/22] ehci: fix td writeback
Bugzilla: 805172
RH-Acked-by: Uri Lublin <uril@redhat.com>
RH-Acked-by: Arnon Gilboa <agilboa@redhat.com>
RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>

From: Gerd Hoffmann <kraxel@redhat.com>

Only write back the dwords the hc is supposed to update.  Should not
make a difference in theory as the guest must not touch the td while
it is active to avoid races.  But it is still more correct.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Upstream commit: 4ed1c57a64992d84376b446b0c60edff2486681b
Conflicts: hw/usb-ehci.c
---
 hw/usb-ehci.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
---
 hw/usb-ehci.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/usb-ehci.c b/hw/usb-ehci.c
index 39b8869..e5f6c78 100644
--- a/hw/usb-ehci.c
+++ b/hw/usb-ehci.c
@@ -1911,12 +1911,14 @@ out:
 
 static int ehci_state_writeback(EHCIQueue *q, int async)
 {
+    uint32_t *qtd, addr;
     int again = 0;
 
     /*  Write back the QTD from the QH area */
     ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), (EHCIqtd*) &q->qh.next_qtd);
-    put_dwords(NLPTR_GET(q->qtdaddr),(uint32_t *) &q->qh.next_qtd,
-                sizeof(EHCIqtd) >> 2);
+    qtd = (uint32_t *) &q->qh.next_qtd;
+    addr = NLPTR_GET(q->qtdaddr);
+    put_dwords(addr + 2 * sizeof(uint32_t), qtd + 2, 2);
 
     /*
      * EHCI specs say go horizontal here.
-- 
1.7.11.4

