OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

uhci: Detect guest td re-use

Browse Source 
A td can be reused by the guest in a different queue, before we notice
the original queue has been unlinked. So search for tds by addr only, detect
guest td reuse, and cancel the original queue, this is necessary to keep our
packet ids unique.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Hans de Goede 2012-10-24 18:31:16 +02:00 committed by Gerd Hoffmann
parent 66a08cbe6a
commit 8c75a899f8
1 changed files with 16 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
hw/usb/hcd-uhci.c
View File

@ -319,28 +319,18 @@ static void uhci_async_cancel_all(UHCIState *s)
}
}
static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t td_addr,
UHCI_TD *td)
static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t td_addr)
{
uint32_t token = uhci_queue_token(td);
UHCIQueue *queue;
UHCIAsync *async;
QTAILQ_FOREACH(queue, &s->queues, next) {
if (queue->token == token) {
break;
QTAILQ_FOREACH(async, &queue->asyncs, next) {
if (async->td_addr == td_addr) {
return async;
}
}
}
if (queue == NULL) {
return NULL;
}
QTAILQ_FOREACH(async, &queue->asyncs, next) {
if (async->td_addr == td_addr) {
return async;
}
}
return NULL;
}
@ -805,11 +795,21 @@ out:
static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
UHCI_TD *td, uint32_t td_addr, uint32_t *int_mask)
{
UHCIAsync *async;
int len = 0, max_len;
bool spd;
bool queuing = (q != NULL);
uint8_t pid = td->token & 0xff;
UHCIAsync *async = uhci_async_find_td(s, td_addr);
if (async) {
if (uhci_queue_verify(async->queue, qh_addr, td, td_addr, queuing)) {
assert(q == NULL || q == async->queue);
q = async->queue;
} else {
uhci_queue_free(async->queue, "guest re-used pending td");
async = NULL;
}
}
if (q == NULL) {
q = uhci_queue_find(s, td);
@ -831,7 +831,6 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
return TD_RESULT_NEXT_QH;
}
async = uhci_async_find_td(s, td_addr, td);
if (async) {
/* Already submitted */
async->queue->valid = 32;