ehci: Fix interrupt packet MULT handling

There are several issues with our handling of the MULT epcap field
of interrupt qhs, which this patch fixes.

1) When we don't execute a transaction because of the transaction counter
being 0, p->async stays EHCI_ASYNC_NONE, and the next time we process the
same qtd we hit an assert in ehci_state_fetchqtd because of this. Even though
I believe that this is caused by 3 below, this patch still removes the assert,
as that can still happen without 3, when multiple packets are queued for the
same interrupt ep.

2) We only *check* the transaction counter from ehci_state_execute, any
packets queued up by fill_queue bypass this check. This is fixed by not calling
fill_queue for interrupt packets.

3) Some versions of Windows set the MULT field of the qh to 0, which is a
clear violation of the EHCI spec, but still they do it. This means that we
will never execute a qtd for these, making interrupt ep-s on USB-2 devices
not work, and after recent changes, triggering 1).

So far we've stored the transaction counter in our copy of the mult field,
but with this beginnig at 0 already when dealing with these version of windows
this won't work. So this patch adds a transact_ctr field to our qh struct,
and sets this to the MULT field value on fetchqh. When the MULT field value
is 0, we set it to 4. Assuming that windows gets way with setting it to 0,
by the actual hardware going horizontal on a 1 -> 0 transition, which will
give it 4 transactions (MULT goes from 0 - 3).

Note that we cannot stop on detecting the 1 -> 0 transition, as our decrement
of the transaction counter, and checking for it are done in 2 different places.

Reported-by: Shawn Starr <shawn.starr@rogers.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
1 file changed
tree: 8deb6f010c205b8d2737f86ebfc4f4d1a8707e2a
  1. audio/
  2. block/
  3. bsd-user/
  4. default-configs/
  5. docs/
  6. fpu/
  7. fsdev/
  8. gdb-xml/
  9. hw/
  10. include/
  11. libcacard/
  12. linux-headers/
  13. linux-user/
  14. net/
  15. pc-bios/
  16. qapi/
  17. qga/
  18. QMP/
  19. qom/
  20. roms/
  21. scripts/
  22. slirp/
  23. sysconfigs/
  24. target-alpha/
  25. target-arm/
  26. target-cris/
  27. target-i386/
  28. target-lm32/
  29. target-m68k/
  30. target-microblaze/
  31. target-mips/
  32. target-openrisc/
  33. target-ppc/
  34. target-s390x/
  35. target-sh4/
  36. target-sparc/
  37. target-unicore32/
  38. target-xtensa/
  39. tcg/
  40. tests/
  41. trace/
  42. ui/
  43. .exrc
  44. .gitignore
  45. .gitmodules
  46. .mailmap
  47. a.out.h
  48. acl.c
  49. acl.h
  50. aes.c
  51. aes.h
  52. aio.c
  53. alpha-dis.c
  54. alpha.ld
  55. arch_init.c
  56. arch_init.h
  57. arm-dis.c
  58. arm.ld
  59. async.c
  60. balloon.c
  61. balloon.h
  62. bitmap.c
  63. bitmap.h
  64. bitops.c
  65. bitops.h
  66. block-migration.c
  67. block-migration.h
  68. block.c
  69. block.h
  70. block_int.h
  71. blockdev.c
  72. blockdev.h
  73. bswap.h
  74. bt-host.c
  75. bt-host.h
  76. bt-vhci.c
  77. buffered_file.c
  78. buffered_file.h
  79. cache-utils.c
  80. cache-utils.h
  81. Changelog
  82. cmd.c
  83. cmd.h
  84. CODING_STYLE
  85. compatfd.c
  86. compatfd.h
  87. compiler.h
  88. config.h
  89. configure
  90. console.c
  91. console.h
  92. COPYING
  93. COPYING.LIB
  94. coroutine-gthread.c
  95. coroutine-sigaltstack.c
  96. coroutine-ucontext.c
  97. coroutine-win32.c
  98. cpu-all.h
  99. cpu-common.h
  100. cpu-defs.h
  101. cpu-exec.c
  102. cpus.c
  103. cpus.h
  104. cputlb.c
  105. cputlb.h
  106. cris-dis.c
  107. cursor.c
  108. cursor_hidden.xpm
  109. cursor_left_ptr.xpm
  110. cutils.c
  111. def-helper.h
  112. device_tree.c
  113. device_tree.h
  114. dis-asm.h
  115. disas.c
  116. disas.h
  117. dma-helpers.c
  118. dma.h
  119. dump-stub.c
  120. dump.c
  121. dump.h
  122. elf.h
  123. envlist.c
  124. envlist.h
  125. error.c
  126. error.h
  127. event_notifier.c
  128. event_notifier.h
  129. exec-all.h
  130. exec-memory.h
  131. exec-obsolete.h
  132. exec.c
  133. gdbstub.c
  134. gdbstub.h
  135. gen-icount.h
  136. HACKING
  137. hmp-commands.hx
  138. hmp.c
  139. hmp.h
  140. host-utils.c
  141. host-utils.h
  142. hppa-dis.c
  143. hppa.ld
  144. i386-dis.c
  145. i386.ld
  146. ia64-dis.c
  147. ia64.ld
  148. input.c
  149. int128.h
  150. iohandler.c
  151. ioport.c
  152. ioport.h
  153. iorange.h
  154. iov.c
  155. iov.h
  156. json-lexer.c
  157. json-lexer.h
  158. json-parser.c
  159. json-parser.h
  160. json-streamer.c
  161. json-streamer.h
  162. kvm-all.c
  163. kvm-stub.c
  164. kvm.h
  165. libfdt_env.h
  166. LICENSE
  167. linux-aio.c
  168. lm32-dis.c
  169. m68k-dis.c
  170. m68k.ld
  171. main-loop.c
  172. main-loop.h
  173. MAINTAINERS
  174. Makefile
  175. Makefile.dis
  176. Makefile.hw
  177. Makefile.objs
  178. Makefile.target
  179. Makefile.user
  180. memory.c
  181. memory.h
  182. memory_mapping-stub.c
  183. memory_mapping.c
  184. memory_mapping.h
  185. microblaze-dis.c
  186. migration-exec.c
  187. migration-fd.c
  188. migration-tcp.c
  189. migration-unix.c
  190. migration.c
  191. migration.h
  192. mips-dis.c
  193. mips.ld
  194. module.c
  195. module.h
  196. monitor.c
  197. monitor.h
  198. nbd.c
  199. nbd.h
  200. net.c
  201. net.h
  202. notify.c
  203. notify.h
  204. os-posix.c
  205. os-win32.c
  206. osdep.c
  207. osdep.h
  208. oslib-posix.c
  209. oslib-win32.c
  210. page_cache.c
  211. path.c
  212. pci-ids.txt
  213. pflib.c
  214. pflib.h
  215. poison.h
  216. posix-aio-compat.c
  217. ppc-dis.c
  218. ppc.ld
  219. ppc64.ld
  220. qapi-schema-guest.json
  221. qapi-schema-test.json
  222. qapi-schema.json
  223. qbool.c
  224. qbool.h
  225. qdict-test-data.txt
  226. qdict.c
  227. qdict.h
  228. qemu-aio.h
  229. qemu-barrier.h
  230. qemu-bridge-helper.c
  231. qemu-char.c
  232. qemu-char.h
  233. qemu-common.h
  234. qemu-config.c
  235. qemu-config.h
  236. qemu-coroutine-int.h
  237. qemu-coroutine-io.c
  238. qemu-coroutine-lock.c
  239. qemu-coroutine-sleep.c
  240. qemu-coroutine.c
  241. qemu-coroutine.h
  242. qemu-doc.texi
  243. qemu-error.c
  244. qemu-error.h
  245. qemu-file.h
  246. qemu-ga.c
  247. qemu-img-cmds.hx
  248. qemu-img.c
  249. qemu-img.texi
  250. qemu-io.c
  251. qemu-lock.h
  252. qemu-log.c
  253. qemu-log.h
  254. qemu-nbd.c
  255. qemu-nbd.texi
  256. qemu-objects.h
  257. qemu-option-internal.h
  258. qemu-option.c
  259. qemu-option.h
  260. qemu-options-wrapper.h
  261. qemu-options.h
  262. qemu-options.hx
  263. qemu-os-posix.h
  264. qemu-os-win32.h
  265. qemu-progress.c
  266. qemu-queue.h
  267. qemu-seccomp.c
  268. qemu-seccomp.h
  269. qemu-sockets.c
  270. qemu-tech.texi
  271. qemu-thread-posix.c
  272. qemu-thread-posix.h
  273. qemu-thread-win32.c
  274. qemu-thread-win32.h
  275. qemu-thread.h
  276. qemu-timer-common.c
  277. qemu-timer.c
  278. qemu-timer.h
  279. qemu-tls.h
  280. qemu-tool.c
  281. qemu-user.c
  282. qemu-x509.h
  283. qemu-xattr.h
  284. qemu.sasl
  285. qemu_socket.h
  286. qerror.c
  287. qerror.h
  288. qfloat.c
  289. qfloat.h
  290. qint.c
  291. qint.h
  292. qjson.c
  293. qjson.h
  294. qlist.c
  295. qlist.h
  296. qmp-commands.hx
  297. qmp.c
  298. qobject.h
  299. qstring.c
  300. qstring.h
  301. qtest.c
  302. qtest.h
  303. range.h
  304. readline.c
  305. readline.h
  306. README
  307. rules.mak
  308. s390-dis.c
  309. s390.ld
  310. savevm.c
  311. sh4-dis.c
  312. softmmu-semi.h
  313. softmmu_defs.h
  314. softmmu_exec.h
  315. softmmu_header.h
  316. softmmu_template.h
  317. sparc-dis.c
  318. sparc.ld
  319. sparc64.ld
  320. spice-qemu-char.c
  321. sysemu.h
  322. targphys.h
  323. tcg-runtime.c
  324. tci-dis.c
  325. tci.c
  326. thunk.c
  327. thunk.h
  328. TODO
  329. trace-events
  330. translate-all.c
  331. uboot_image.h
  332. user-exec.c
  333. VERSION
  334. version.rc
  335. vgafont.h
  336. vl.c
  337. vmstate.h
  338. x86_64.ld
  339. xen-all.c
  340. xen-mapcache.c
  341. xen-mapcache.h
  342. xen-stub.c