Skip to contentSkip to conversation

usb: uhci: Look up queue by address, not token

PATCH In review Jan Kiszka 2 participants 2 messages Nov 15, 2012

lore
Share & tools
lore

Jan Kiszka

author
#0 lore raw

PATCH 1/1 usb: uhci: Look up queue by address, not token

The queue token is insufficient to identify if a TD belongs to it. What we need is the QH address.

This fixes the case where the guest issues multiple asynchronous requests for the same EP.

Signed-off-by Jan Kiszka <[email protected]>

---

I'm not 100% this still fulfills the aim of "Verify queue has not been changed by guest". On the other hand, the current code looks quite wrong to me after studying the spec for a while.

 hw/usb/hcd-uhci.c |    7 +++----
 1 files changed, 3 insertions(+), 4 deletions(-)
hw/usb/hcd-uhci.c +3 -4
index f4b555a..1434a3a 100644
@@ -227,13 +227,12 @@ static void uhci_queue_free(UHCIQueue *queue, const char *reason)
     g_free(queue);
 }
 
-static UHCIQueue *uhci_queue_find(UHCIState *s, UHCI_TD *td)
+static UHCIQueue *uhci_queue_find(UHCIState *s, uint32_t qh_addr)
 {
-    uint32_t token = uhci_queue_token(td);
     UHCIQueue *queue;
 
     QTAILQ_FOREACH(queue, &s->queues, next) {
-        if (queue->token == token) {
+        if (queue->qh_addr == qh_addr) {
             return queue;
         }
     }

@@ -841,7 +840,7 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
     }
 
     if (q == NULL) {
-        q = uhci_queue_find(s, td);
+        q = uhci_queue_find(s, qh_addr);
         if (q && !uhci_queue_verify(q, qh_addr, td, td_addr, queuing)) {
             uhci_queue_free(q, "guest re-used qh");
             q = NULL;
Signature · 1 line
1.7.3.4
#1 lore raw

hw/usb/hcd-uhci.c static void uhci_queue_free(UHCIQueue *queue, const char *reason) · line 235

Quoted 2 lines · Jan Kiszka
hw/usb/hcd-uhci.c +1 -1
-        if (queue->token == token) {
+        if (queue->qh_addr == qh_addr) {

Patch added to usb patch queue.

thanks,
Gerd