2983660f65
CVE-2013-4377: Fix crash when unplugging virtio devices (bz #1012633, bz #1012641) Fix 'new snapshot' slowness after the first snap (bz #988436) Fix 9pfs xattrs on kernel 3.11 (bz #1013676) CVE-2013-4344: buffer overflow in scsi_target_emulate_report_luns (bz #1015274, bz #1007330)
68 lines
2.4 KiB
Diff
68 lines
2.4 KiB
Diff
From b6d163fdd8131285a01fe46e6afdba727e4df9ca Mon Sep 17 00:00:00 2001
|
|
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
Date: Mon, 9 Sep 2013 10:18:17 +0200
|
|
Subject: [PATCH] ehci: save device pointer in EHCIState
|
|
|
|
We'll need a pointer to the actual pci/sysbus device,
|
|
stick a pointer to it into the EHCIState struct.
|
|
|
|
https://bugzilla.redhat.com/show_bug.cgi?id=1005495
|
|
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
(cherry picked from commit adbecc89731cf3e0ae656d50ea9fa58c589c4bdc)
|
|
|
|
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
|
|
---
|
|
hw/usb/hcd-ehci.c | 7 +++----
|
|
hw/usb/hcd-ehci.h | 1 +
|
|
2 files changed, 4 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
|
|
index 010a0d0..e9fb20c 100644
|
|
--- a/hw/usb/hcd-ehci.c
|
|
+++ b/hw/usb/hcd-ehci.c
|
|
@@ -1241,13 +1241,11 @@ static int ehci_init_transfer(EHCIPacket *p)
|
|
{
|
|
uint32_t cpage, offset, bytes, plen;
|
|
dma_addr_t page;
|
|
- USBBus *bus = &p->queue->ehci->bus;
|
|
- BusState *qbus = BUS(bus);
|
|
|
|
cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE);
|
|
bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES);
|
|
offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK;
|
|
- qemu_sglist_init(&p->sgl, qbus->parent, 5, p->queue->ehci->as);
|
|
+ qemu_sglist_init(&p->sgl, p->queue->ehci->device, 5, p->queue->ehci->as);
|
|
|
|
while (bytes > 0) {
|
|
if (cpage > 4) {
|
|
@@ -1486,7 +1484,7 @@ static int ehci_process_itd(EHCIState *ehci,
|
|
return -1;
|
|
}
|
|
|
|
- qemu_sglist_init(&ehci->isgl, DEVICE(ehci), 2, ehci->as);
|
|
+ qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as);
|
|
if (off + len > 4096) {
|
|
/* transfer crosses page border */
|
|
uint32_t len2 = off + len - 4096;
|
|
@@ -2529,6 +2527,7 @@ void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
|
|
|
|
s->frame_timer = qemu_new_timer_ns(vm_clock, ehci_frame_timer, s);
|
|
s->async_bh = qemu_bh_new(ehci_frame_timer, s);
|
|
+ s->device = dev;
|
|
|
|
qemu_register_reset(ehci_reset, s);
|
|
qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
|
|
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
|
|
index 15a28e8..065c9fa 100644
|
|
--- a/hw/usb/hcd-ehci.h
|
|
+++ b/hw/usb/hcd-ehci.h
|
|
@@ -255,6 +255,7 @@ typedef QTAILQ_HEAD(EHCIQueueHead, EHCIQueue) EHCIQueueHead;
|
|
|
|
struct EHCIState {
|
|
USBBus bus;
|
|
+ DeviceState *device;
|
|
qemu_irq irq;
|
|
MemoryRegion mem;
|
|
AddressSpace *as;
|