86e18cae20
This patch fixes two bugs in the OHCI device where the device writes back data to system memory that should be exclusively under the control of the guest side driver. In OHCI specification Section 5.2.7, it mentioned "In all cases, Host Controller Driver is responsible for the insertion and removal of all Endpoint Descriptors in the various Host Controller Endpoint Descriptor lists". In the ohci_frame_boundary(), ohci_put_hcca() writes the entire hcca back including the interrupt ED lists which should be under driver control. This violates the specification and can race with a host driver updating that list at the same time. In the OHCI Spec Section 4.6, Transfer Descriptor Queue Processing, it mentioned "Since the TD pointed to by TailP is not accessed by the HC, the Host Controller Driver can initialize that TD and link at least one other to it without creating a coherency or synchronization problem". While the function ohci_put_ed() writes the entire endpoint descriptor back including the TailP which should under driver control. This violate the specification and can race with a host driver updating the TD list at the same time. In each case the solution is to make sure we don't write data which is under driver control. Cc: Gerd Hoffman <kraxel@redhat.com> Signed-off-by: Wei Yang <weiyang@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> |
||
|---|---|---|
| .. | ||
| bus.c | ||
| core.c | ||
| desc.c | ||
| desc.h | ||
| dev-audio.c | ||
| dev-bluetooth.c | ||
| dev-hid.c | ||
| dev-hub.c | ||
| dev-network.c | ||
| dev-serial.c | ||
| dev-smartcard-reader.c | ||
| dev-storage.c | ||
| dev-wacom.c | ||
| hcd-ehci.c | ||
| hcd-musb.c | ||
| hcd-ohci.c | ||
| hcd-uhci.c | ||
| hcd-xhci.c | ||
| host-bsd.c | ||
| host-linux.c | ||
| host-stub.c | ||
| libhw.c | ||
| redirect.c | ||