From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:37396)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1aVgmN-00035C-TN
	for qemu-devel@nongnu.org; Tue, 16 Feb 2016 09:39:04 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1aVgmK-0001N0-Ko
	for qemu-devel@nongnu.org; Tue, 16 Feb 2016 09:39:03 -0500
Received: from mx1.redhat.com ([209.132.183.28]:47718)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1aVgmK-0001Ms-Fa
	for qemu-devel@nongnu.org; Tue, 16 Feb 2016 09:39:00 -0500
Message-ID: <1455633538.7504.111.camel@redhat.com>
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Tue, 16 Feb 2016 15:38:58 +0100
In-Reply-To: <33183CC9F5247A488A2544077AF19020B02E0EF7@SZXEMA503-MBS.china.huawei.com>
References: <1455541449-5008-1-git-send-email-arei.gonglei@huawei.com>
	<1455630843.7504.100.camel@redhat.com>
	<33183CC9F5247A488A2544077AF19020B02E0EF7@SZXEMA503-MBS.china.huawei.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0
Subject: Re: [Qemu-devel] [PATCH v2] usb: drop active assert when pid is
	invalid
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: "Gonglei (Arei)" <arei.gonglei@huawei.com>
Cc: "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>, "Huangpeng (Peter)" <peter.huangpeng@huawei.com>

  Hi,

> > When clearing RS in cmd we should also set HALTED in status I think.

> Actually, uhci_frame_timer() had done this work.
>=20
> if (!(s->cmd & UHCI_CMD_RS)) {
>         /* Full stop */
>         trace_usb_uhci_schedule_stop();
>         qemu_del_timer(s->frame_timer);
>         uhci_async_cancel_all(s);
>         /* set hchalted bit in status - UHCI11D 2.1.2 */
>         s->status |=3D UHCI_STS_HCHALTED;
>         return;
>     }

Ok, all fine then.

> =20
> > How do we reach the assert above?  Maybe it is enough to move this pid
>=20
> > check to the start of the uhci_handle_td function to avoid triggering
>=20
> > the assert?
>=20
> >=20
>=20
> If Qemu read a wrong td, and then get a wrong pid, assertion will be reac=
hed.
> I thought that method, but I gave up as more complicated.

I think if we avoid calling usb_packet_setup with an invalid pid things
should work fine.  So checking whenever the pid is valid as very first
thing in uhci_handle_td() should work, no?

cheers,
  Gerd