From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:45557) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TsZ1B-0004DP-8e for qemu-devel@nongnu.org; Tue, 08 Jan 2013 08:15:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TsZ17-0002d6-7b for qemu-devel@nongnu.org; Tue, 08 Jan 2013 08:15:01 -0500 Received: from mx1.redhat.com ([209.132.183.28]:14087) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TsZ16-0002cf-UE for qemu-devel@nongnu.org; Tue, 08 Jan 2013 08:14:57 -0500 Received: from int-mx12.intmail.prod.int.phx2.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.25]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r08DEuPH024621 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Tue, 8 Jan 2013 08:14:56 -0500 From: Gerd Hoffmann Date: Tue, 8 Jan 2013 14:14:25 +0100 Message-Id: <1357650894-16982-4-git-send-email-kraxel@redhat.com> In-Reply-To: <1357650894-16982-1-git-send-email-kraxel@redhat.com> References: <1357650894-16982-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PATCH 03/32] ehci: Verify guest does not change the token of inflight qtd-s List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Hans de Goede , Gerd Hoffmann From: Hans de Goede This is not allowed, except for clearing active on cancellation, so don't warn when the new token does not have its active bit set. This unifies the cancellation path for modified qtd-s, and prepares ehci_verify_qtd to be used ad an extra check inside ehci_writeback_async_complete_packet(). Signed-off-by: Hans de Goede Signed-off-by: Gerd Hoffmann --- hw/usb/hcd-ehci.c | 10 ++++------ 1 files changed, 4 insertions(+), 6 deletions(-) diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index 0d31597..04301ce 100644 --- a/hw/usb/hcd-ehci.c +++ b/hw/usb/hcd-ehci.c @@ -461,6 +461,7 @@ static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd) (p->queue->async && !NLPTR_TBIT(p->qtd.next) && (p->qtd.next != qtd->next)) || (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) || + p->qtd.token != qtd->token || p->qtd.bufptr[0] != qtd->bufptr[0]) { return false; } else { @@ -1793,7 +1794,9 @@ static int ehci_state_fetchqtd(EHCIQueue *q) if (p != NULL) { if (!ehci_verify_qtd(p, &qtd)) { ehci_cancel_queue(q); - ehci_trace_guest_bug(q->ehci, "guest updated active QH or qTD"); + if (qtd.token & QTD_TOKEN_ACTIVE) { + ehci_trace_guest_bug(q->ehci, "guest updated active qTD"); + } p = NULL; } else { p->qtd = qtd; @@ -1802,11 +1805,6 @@ static int ehci_state_fetchqtd(EHCIQueue *q) } if (!(qtd.token & QTD_TOKEN_ACTIVE)) { - if (p != NULL) { - /* transfer canceled by guest (clear active) */ - ehci_cancel_queue(q); - p = NULL; - } ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); } else if (p != NULL) { switch (p->async) { -- 1.7.1