[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 08/26] ehci: Verify a queue's ep direction does not
From: |
Hans de Goede |
Subject: |
[Qemu-devel] [PATCH 08/26] ehci: Verify a queue's ep direction does not change |
Date: |
Fri, 14 Dec 2012 14:35:29 +0100 |
ehci_fill_queue assumes that there is a one on one relationship between an ep
and a qh, this patch adds a check to ensure this.
Note I don't expect this to ever trigger, this is just something I noticed
the guest might do while working on other stuff. The only way this check can
trigger is if a guest mixes in and out qtd-s in a single qh for a non
control ep.
Signed-off-by: Hans de Goede <address@hidden>
---
hw/usb/hcd-ehci.c | 19 +++++++++++++++++++
hw/usb/hcd-ehci.h | 1 +
2 files changed, 20 insertions(+)
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index dae414a..5d314a0 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -527,6 +527,19 @@ static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd)
}
}
+static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd)
+{
+ int ep = get_field(q->qh.epchar, QH_EPCHAR_EP);
+ int pid = ehci_get_pid(qtd);
+
+ /* Note the pid changing is normal for ep 0 (the control ep) */
+ if (q->last_pid && ep != 0 && pid != q->last_pid) {
+ return false;
+ } else {
+ return true;
+ }
+}
+
/* Finish executing and writeback a packet outside of the regular
fetchqh -> fetchqtd -> execute -> writeback cycle */
static void ehci_writeback_async_complete_packet(EHCIPacket *p)
@@ -634,6 +647,7 @@ static int ehci_reset_queue(EHCIQueue *q)
packets = ehci_cancel_queue(q);
q->dev = NULL;
q->qtdaddr = 0;
+ q->last_pid = 0;
return packets;
}
@@ -1368,6 +1382,7 @@ static int ehci_execute(EHCIPacket *p, const char *action)
}
p->pid = ehci_get_pid(&p->qtd);
+ p->queue->last_pid = p->pid;
endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP);
ep = usb_ep_get(p->queue->dev, p->pid, endp);
@@ -1883,6 +1898,10 @@ static int ehci_fill_queue(EHCIPacket *p)
if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
break;
}
+ if (!ehci_verify_pid(q, &qtd)) {
+ ehci_trace_guest_bug(q->ehci, "guest queued token with wrong pid");
+ break;
+ }
p = ehci_alloc_packet(q);
p->qtdaddr = qtdaddr;
p->qtd = qtd;
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 772870b..3c888a6 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -246,6 +246,7 @@ struct EHCIQueue {
EHCIqh qh; /* copy of current QH (being worked on) */
uint32_t qhaddr; /* address QH read from */
uint32_t qtdaddr; /* address QTD read from */
+ int last_pid; /* pid of last packet executed */
USBDevice *dev;
QTAILQ_HEAD(pkts_head, EHCIPacket) packets;
};
--
1.8.0.1
- [Qemu-devel] [PATCH 00/26] usb: Hans' pending qemu usb patches, Hans de Goede, 2012/12/14
- [Qemu-devel] [PATCH 01/26] ehci: Add a ehci_writeback_async_complete_packet helper function, Hans de Goede, 2012/12/14
- [Qemu-devel] [PATCH 02/26] ehci: Add ehci_verify_qh and ehci_verify_qtd helper functions, Hans de Goede, 2012/12/14
- [Qemu-devel] [PATCH 03/26] ehci: Verify guest does not change the token of inflight qtd-s, Hans de Goede, 2012/12/14
- [Qemu-devel] [PATCH 05/26] ehci: writeback_async_complete_packet: verify qh and qtd, Hans de Goede, 2012/12/14
- [Qemu-devel] [PATCH 06/26] ehci: Verify qtd for async completed packets, Hans de Goede, 2012/12/14
- [Qemu-devel] [PATCH 04/26] ehci: Move get / put_dwords upwards, Hans de Goede, 2012/12/14
- [Qemu-devel] [PATCH 08/26] ehci: Verify a queue's ep direction does not change,
Hans de Goede <=
- [Qemu-devel] [PATCH 07/26] ehci: Add an ehci_get_pid helper function, Hans de Goede, 2012/12/14
- [Qemu-devel] [PATCH 09/26] ehci: Use uframe precision for interrupt threshold checking, Hans de Goede, 2012/12/14
- Re: [Qemu-devel] [PATCH 09/26] ehci: Use uframe precision for interrupt threshold checking, Gerd Hoffmann, 2012/12/17
- Re: [Qemu-devel] [PATCH 09/26] ehci: Use uframe precision for interrupt threshold checking, Hans de Goede, 2012/12/17
- Re: [Qemu-devel] [PATCH 09/26] ehci: Use uframe precision for interrupt threshold checking, Gerd Hoffmann, 2012/12/17
- Re: [Qemu-devel] [PATCH 09/26] ehci: Use uframe precision for interrupt threshold checking, Hans de Goede, 2012/12/17
- Re: [Qemu-devel] [PATCH 09/26] ehci: Use uframe precision for interrupt threshold checking, Gerd Hoffmann, 2012/12/17
- Re: [Qemu-devel] [PATCH 09/26] ehci: Use uframe precision for interrupt threshold checking, Hans de Goede, 2012/12/18
- Re: [Qemu-devel] [PATCH 09/26] ehci: Use uframe precision for interrupt threshold checking, Gerd Hoffmann, 2012/12/18
- Re: [Qemu-devel] [PATCH 09/26] ehci: Use uframe precision for interrupt threshold checking, Hans de Goede, 2012/12/18