[PATCH 1/2] hw/usb/hcd-ehci: idle the schedule after a failed descriptor read

[Junjie Cao <junjie.cao@linux.dev>]

Since get_dwords() started checking the DMA result, a failed descriptor
read raises HSE, clears Run/Stop and makes the state function return
without advancing.  That leaves the schedule in WAITLISTHEAD, FETCHQH,
FETCHSITD or FETCHQTD, none of which ehci_advance_async_state() or
ehci_advance_periodic_state() accept: the next frame hits their
g_assert_not_reached().

A guest gets there by pointing ASYNCLISTADDR, a QH's next qTD or a
frame list entry at an address outside guest memory; QEMU aborts on the
second frame.

Return the schedule to EST_ACTIVE at those four sites, so the next pass
sees Run/Stop clear and tears it down the way a stopped schedule is.
The iTD and fill-queue reads already take the existing controller-reset
path on error and are left alone.

Fixes: 2b2a0e4f465a ("hw/usb/hcd-ehci: Check for DMA errors in get_dwords()/put_dwords()")
Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
---
 hw/usb/hcd-ehci.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index f371e567f3..938707043f 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -330,6 +330,15 @@ static int ehci_get_state(EHCIState *s, int async)
     return async ? s->astate : s->pstate;
 }
 
+/*
+ * get_dwords() has raised HSE and cleared Run/Stop.  Park the schedule
+ * in EST_ACTIVE so the next advance pass idles it instead of asserting.
+ */
+static void ehci_abandon_pass(EHCIState *ehci, int async)
+{
+    ehci_set_state(ehci, async, EST_ACTIVE);
+}
+
 static void ehci_set_fetch_addr(EHCIState *s, int async, uint64_t addr)
 {
     if (async) {
@@ -1600,6 +1609,7 @@ static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
     for (i = 0; i < MAX_QH; i++) {
         if (!get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh,
                         ehci_qh_dwords(ehci))) {
+            ehci_abandon_pass(ehci, async);
             return 0;
         }
         ehci_trace_qh(NULL, NLPTR_GET(entry), &qh);
@@ -1703,6 +1713,7 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
     memset(&qh, 0, sizeof(qh));
     if (!get_dwords(ehci, NLPTR_GET(q->qhaddr),
                     (uint32_t *) &qh, ehci_qh_dwords(ehci))) {
+        ehci_abandon_pass(ehci, async);
         q = NULL;
         goto out;
     }
@@ -1807,6 +1818,7 @@ static int ehci_state_fetchsitd(EHCIState *ehci, int async)
 
     if (!get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd,
                     sizeof(EHCIsitd) >> 2)) {
+        ehci_abandon_pass(ehci, async);
         return 0;
     }
     ehci_trace_sitd(ehci, entry, &sitd);
@@ -1867,6 +1879,7 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
 
     addr = NLPTR_GET(q->qtdaddr);
     if (!get_dwords(q->ehci, addr +  8, &qtd.token,   1)) {
+        ehci_abandon_pass(q->ehci, q->async);
         return 0;
     }
     barrier();
@@ -1878,6 +1891,7 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
         (q->ehci->caps_64bit_addr &&
          !get_dwords(q->ehci, addr + offsetof(EHCIqtd, bufptr_hi),
                      qtd.bufptr_hi, ARRAY_SIZE(qtd.bufptr_hi)))) {
+        ehci_abandon_pass(q->ehci, q->async);
         return 0;
     }
     ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
-- 
2.43.0