[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 04/11] xhci: apply limits to loops
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 04/11] xhci: apply limits to loops |
Date: |
Tue, 21 Feb 2017 08:16:18 +0100 |
Limits should be big enough that normal guest should not hit it.
Add a tracepoint to log them, just in case. Also, while being
at it, log the existing link trb limit too.
Reported-by: 李强 <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden
---
hw/usb/hcd-xhci.c | 15 ++++++++++++++-
hw/usb/trace-events | 1 +
2 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 54b3901..f3f9579 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -54,6 +54,8 @@
#define ER_FULL_HACK
#define TRB_LINK_LIMIT 4
+#define COMMAND_LIMIT 256
+#define TRANSFER_LIMIT 256
#define LEN_CAP 0x40
#define LEN_OPER (0x400 + 0x10 * MAXPORTS)
@@ -1032,6 +1034,7 @@ static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing
*ring, XHCITRB *trb,
return type;
} else {
if (++link_cnt > TRB_LINK_LIMIT) {
+ trace_usb_xhci_enforced_limit("trb-link");
return 0;
}
ring->dequeue = xhci_mask64(trb->parameter);
@@ -2150,6 +2153,7 @@ static void xhci_kick_epctx(XHCIEPContext *epctx,
unsigned int streamid)
XHCIRing *ring;
USBEndpoint *ep = NULL;
uint64_t mfindex;
+ unsigned int count = 0;
int length;
int i;
@@ -2262,6 +2266,10 @@ static void xhci_kick_epctx(XHCIEPContext *epctx,
unsigned int streamid)
epctx->retry = xfer;
break;
}
+ if (count++ > TRANSFER_LIMIT) {
+ trace_usb_xhci_enforced_limit("transfers");
+ break;
+ }
}
epctx->kick_active--;
@@ -2734,7 +2742,7 @@ static void xhci_process_commands(XHCIState *xhci)
TRBType type;
XHCIEvent event = {ER_COMMAND_COMPLETE, CC_SUCCESS};
dma_addr_t addr;
- unsigned int i, slotid = 0;
+ unsigned int i, slotid = 0, count = 0;
DPRINTF("xhci_process_commands()\n");
if (!xhci_running(xhci)) {
@@ -2848,6 +2856,11 @@ static void xhci_process_commands(XHCIState *xhci)
}
event.slotid = slotid;
xhci_event(xhci, &event, 0);
+
+ if (count++ > COMMAND_LIMIT) {
+ trace_usb_xhci_enforced_limit("commands");
+ return;
+ }
}
}
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index fdd1d29..0c323d4 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -174,6 +174,7 @@ usb_xhci_xfer_retry(void *xfer) "%p"
usb_xhci_xfer_success(void *xfer, uint32_t bytes) "%p: len %d"
usb_xhci_xfer_error(void *xfer, uint32_t ret) "%p: ret %d"
usb_xhci_unimplemented(const char *item, int nr) "%s (0x%x)"
+usb_xhci_enforced_limit(const char *item) "%s"
# hw/usb/desc.c
usb_desc_device(int addr, int len, int ret) "dev %d query device, len %d, ret
%d"
--
1.8.3.1
- [Qemu-devel] [PULL 00/11] usb patch queue, Gerd Hoffmann, 2017/02/21
- [Qemu-devel] [PULL 07/11] xhci: fix nec vendor quirk handling, Gerd Hoffmann, 2017/02/21
- [Qemu-devel] [PULL 03/11] usb: ohci: limit the number of link eds, Gerd Hoffmann, 2017/02/21
- [Qemu-devel] [PULL 06/11] xhci: add qemu xhci controller, Gerd Hoffmann, 2017/02/21
- [Qemu-devel] [PULL 05/11] xhci: drop ER_FULL_HACK workaround, Gerd Hoffmann, 2017/02/21
- [Qemu-devel] [PULL 01/11] usb: ehci: fix memory leak in ehci, Gerd Hoffmann, 2017/02/21
- [Qemu-devel] [PULL 04/11] xhci: apply limits to loops,
Gerd Hoffmann <=
- [Qemu-devel] [PULL 10/11] usb-ccid: move header size check, Gerd Hoffmann, 2017/02/21
- [Qemu-devel] [PULL 09/11] usb-ccid: better bulk_out error handling, Gerd Hoffmann, 2017/02/21
- [Qemu-devel] [PULL 08/11] xhci: drop via vendor command handling, Gerd Hoffmann, 2017/02/21
- [Qemu-devel] [PULL 02/11] usb: ohci: fix error return code in servicing iso td, Gerd Hoffmann, 2017/02/21
- [Qemu-devel] [PULL 11/11] usb-ccid: add check message size checks, Gerd Hoffmann, 2017/02/21
- Re: [Qemu-devel] [PULL 00/11] usb patch queue, Peter Maydell, 2017/02/21