|
 |
1b1995d |
From 985b7cfbd45960bb74a13ad8044765a8e35f2251 Mon Sep 17 00:00:00 2001
|
|
|
1b1995d |
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
1b1995d |
Date: Sun, 4 Mar 2012 12:41:11 +0100
|
|
|
1b1995d |
Subject: [PATCH 140/140] usb-ehci: sanity-check iso xfers
|
|
|
1b1995d |
|
|
|
1b1995d |
This patch adds a sanity check to itd processing to make sure the
|
|
|
1b1995d |
endpoint addressed by the guest is actually an iso endpoint. Also
|
|
|
1b1995d |
verify that usb drivers don't return USB_RET_ASYNC which is illegal for
|
|
|
1b1995d |
iso xfers.
|
|
|
1b1995d |
|
|
|
1b1995d |
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
1b1995d |
(Cherry picked from: aa0568ff2559d7717f4684af6a83d0bd1a125f56)
|
|
|
1b1995d |
|
|
|
1b1995d |
[qemu-kvm-1.0: we don't track ep types on RHEL-6 like we do upstream, so we
|
|
|
1b1995d |
cannot check if an itd is pointing to a non iso ep in advance, but we do still
|
|
|
1b1995d |
need to make sure that we never handle an iso xfer async. So check if the
|
|
|
1b1995d |
device does want to handle it async, and if so cancel the xfer and treat it as
|
|
|
1b1995d |
a NAK, like upstream does when the ep type check fails.]
|
|
|
1b1995d |
|
|
|
1b1995d |
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
|
|
|
1b1995d |
---
|
|
|
1b1995d |
hw/usb-ehci.c | 4 ++++
|
|
|
1b1995d |
1 file changed, 4 insertions(+)
|
|
|
1b1995d |
|
|
|
1b1995d |
diff --git a/hw/usb-ehci.c b/hw/usb-ehci.c
|
|
|
1b1995d |
index ad0f6e1..b5d7037 100644
|
|
|
1b1995d |
--- a/hw/usb-ehci.c
|
|
|
1b1995d |
+++ b/hw/usb-ehci.c
|
|
|
1b1995d |
@@ -1485,6 +1485,10 @@ static int ehci_process_itd(EHCIState *ehci,
|
|
|
1b1995d |
itd->transact[i] |= ITD_XACT_BABBLE;
|
|
|
1b1995d |
ehci_record_interrupt(ehci, USBSTS_ERRINT);
|
|
|
1b1995d |
break;
|
|
|
1b1995d |
+ case USB_RET_ASYNC:
|
|
|
1b1995d |
+ /* ISO endpoints are never ASYNC, not an iso endpoint? */
|
|
|
1b1995d |
+ usb_cancel_packet(&ehci->ipacket);
|
|
|
1b1995d |
+ /* Treat this as a NAK (fall through) */
|
|
|
1b1995d |
case USB_RET_NAK:
|
|
|
1b1995d |
/* no data for us, so do a zero-length transfer */
|
|
|
1b1995d |
ret = 0;
|
|
|
1b1995d |
--
|
|
|
1b1995d |
1.7.9.3
|
|
|
1b1995d |
|