mirror of https://github.com/xemu-project/xemu.git
0dbe4768b9
In order to keep track of the alternate setting that should be used for a given interface, the USBDevice struct keeps an array of alternate setting values, which is indexed by the interface number. In usb_host_set_interface, when this array is updated, usb_host_ep_update is called as a result. However, when usb_host_ep_update accesses the active libusb_config_descriptor, it indexes udev->altsetting with the loop variable, rather than the interface number. With the simple trace backend enable, this behavior can be seen: [...] usb_xhci_xfer_start 0.440 pid=1215 xfer=0x5596a4b85930 slotid=0x1 epid=0x1 streamid=0x0 usb_packet_state_change 1.703 pid=1215 bus=0x1 port=b'1' ep=0x0 p=0x5596a4b85938 o=b'undef' n=b'setup' usb_host_req_control 2.269 pid=1215 bus=0x1 addr=0x5 p=0x5596a4b85938 req=0x10b value=0x1 index=0xd usb_host_set_interface 0.449 pid=1215 bus=0x1 addr=0x5 interface=0xd alt=0x1 usb_host_parse_config 2542.648 pid=1215 bus=0x1 addr=0x5 value=0x2 active=0x1 usb_host_parse_interface 1.804 pid=1215 bus=0x1 addr=0x5 num=0xc alt=0x0 active=0x1 usb_host_parse_endpoint 2.012 pid=1215 bus=0x1 addr=0x5 ep=0x2 dir=b'in' type=b'int' active=0x1 usb_host_parse_interface 1.598 pid=1215 bus=0x1 addr=0x5 num=0xd alt=0x0 active=0x1 usb_host_req_emulated 3.593 pid=1215 bus=0x1 addr=0x5 p=0x5596a4b85938 status=0x0 usb_packet_state_change 2.550 pid=1215 bus=0x1 port=b'1' ep=0x0 p=0x5596a4b85938 o=b'setup' n=b'complete' usb_xhci_xfer_success 4.298 pid=1215 xfer=0x5596a4b85930 bytes=0x0 [...] In particular, it is seen that although usb_host_set_interface sets the alternate setting of interface 0xd to 0x1, usb_host_ep_update uses 0x0 as the alternate setting due to using the incorrect index to udev->altsetting. Fix this problem by getting the interface number from the active libusb_config_descriptor, and then using that as the index to udev->altsetting. Signed-off-by: Nick Rosbrook <rosbrookn@ainfosec.com> Message-Id: <20210201213021.500277-1-rosbrookn@ainfosec.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| bus.c | ||
| ccid-card-emulated.c | ||
| ccid-card-passthru.c | ||
| ccid.h | ||
| chipidea.c | ||
| combined-packet.c | ||
| core.c | ||
| desc-msos.c | ||
| desc.c | ||
| desc.h | ||
| dev-audio.c | ||
| dev-hid.c | ||
| dev-hub.c | ||
| dev-mtp.c | ||
| dev-network.c | ||
| dev-serial.c | ||
| dev-smartcard-reader.c | ||
| dev-storage.c | ||
| dev-uas.c | ||
| dev-wacom.c | ||
| hcd-dwc2.c | ||
| hcd-dwc2.h | ||
| hcd-dwc3.c | ||
| hcd-ehci-pci.c | ||
| hcd-ehci-sysbus.c | ||
| hcd-ehci.c | ||
| hcd-ehci.h | ||
| hcd-musb.c | ||
| hcd-ohci-pci.c | ||
| hcd-ohci.c | ||
| hcd-ohci.h | ||
| hcd-uhci.c | ||
| hcd-xhci-nec.c | ||
| hcd-xhci-pci.c | ||
| hcd-xhci-pci.h | ||
| hcd-xhci-sysbus.c | ||
| hcd-xhci-sysbus.h | ||
| hcd-xhci.c | ||
| hcd-xhci.h | ||
| host-libusb.c | ||
| host-stub.c | ||
| host.h | ||
| imx-usb-phy.c | ||
| libhw.c | ||
| meson.build | ||
| pcap.c | ||
| quirks-ftdi-ids.h | ||
| quirks-pl2303-ids.h | ||
| quirks.c | ||
| quirks.h | ||
| redirect.c | ||
| trace-events | ||
| trace.h | ||
| tusb6010.c | ||
| u2f-emulated.c | ||
| u2f-passthru.c | ||
| u2f.c | ||
| u2f.h | ||
| xen-usb.c | ||
| xlnx-usb-subsystem.c | ||
| xlnx-versal-usb2-ctrl-regs.c | ||