From patchwork Sat Nov 17 11:11:50 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans de Goede X-Patchwork-Id: 199830 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 8C0BA2C008F for ; Sat, 17 Nov 2012 22:10:39 +1100 (EST) Received: from localhost ([::1]:50124 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TZgIH-0004WZ-3S for incoming@patchwork.ozlabs.org; Sat, 17 Nov 2012 06:10:37 -0500 Received: from eggs.gnu.org ([208.118.235.92]:35251) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TZgHf-0002u1-KN for qemu-devel@nongnu.org; Sat, 17 Nov 2012 06:10:02 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TZgHc-0005Ic-IR for qemu-devel@nongnu.org; Sat, 17 Nov 2012 06:09:59 -0500 Received: from mx1.redhat.com ([209.132.183.28]:8905) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TZgHc-0005IS-Ai for qemu-devel@nongnu.org; Sat, 17 Nov 2012 06:09:56 -0500 Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id qAHB9tkp032001 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Sat, 17 Nov 2012 06:09:55 -0500 Received: from shalem.localdomain.com (vpn1-5-33.ams2.redhat.com [10.36.5.33]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id qAHB9pMG011978; Sat, 17 Nov 2012 06:09:54 -0500 From: Hans de Goede To: Gerd Hoffmann Date: Sat, 17 Nov 2012 12:11:50 +0100 Message-Id: <1353150711-24795-3-git-send-email-hdegoede@redhat.com> In-Reply-To: <1353150711-24795-1-git-send-email-hdegoede@redhat.com> References: <1353150711-24795-1-git-send-email-hdegoede@redhat.com> X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: Hans de Goede , qemu-devel@nongnu.org Subject: [Qemu-devel] [PATCH 2/3] uhci: Don't allow the guest to set port-enabled when there is no dev connected X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org It is possible for device disconnect and the guest trying to reset the port (because of USB xact errors prior to the disconnect getting signaled) to race, when we hit this race, the guest will write the port-control register with its pre-disconnect value + the reset bit set, after which we have a disconnected device with its port-enabled bit set in its port-control register, which is no good :) Signed-off-by: Hans de Goede --- hw/usb/hcd-uhci.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c index ef32633..078be2a 100644 --- a/hw/usb/hcd-uhci.c +++ b/hw/usb/hcd-uhci.c @@ -556,6 +556,10 @@ static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val) } } port->ctrl &= UHCI_PORT_READ_ONLY; + /* enabled may only be set if a device is connected */ + if (!(port->ctrl & UHCI_PORT_CCS)) { + val &= ~UHCI_PORT_EN; + } port->ctrl |= (val & ~UHCI_PORT_READ_ONLY); /* some bits are reset when a '1' is written to them */ port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);