From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=43891 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1OXKvC-0004PB-BC for qemu-devel@nongnu.org; Fri, 09 Jul 2010 17:15:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.69) (envelope-from ) id 1OXKvB-0001LU-6I for qemu-devel@nongnu.org; Fri, 09 Jul 2010 17:15:46 -0400 Received: from sj-iport-4.cisco.com ([171.68.10.86]:5448) by eggs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1OXKvA-0001LN-W3 for qemu-devel@nongnu.org; Fri, 09 Jul 2010 17:15:45 -0400 From: David Ahern Date: Fri, 9 Jul 2010 15:17:53 -0600 Message-Id: <1278710273-19639-1-git-send-email-daahern@cisco.com> Subject: [Qemu-devel] [PATCH] ehci: catch invalid qTD earlier - avoid reset List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: jan.kiszka@web.de, David Ahern Catch invalid qTD earlier. Signed-off-by: David Ahern --- hw/usb-ehci.c | 12 +++++------- 1 files changed, 5 insertions(+), 7 deletions(-) diff --git a/hw/usb-ehci.c b/hw/usb-ehci.c index 53ee1fb..47f3a54 100644 --- a/hw/usb-ehci.c +++ b/hw/usb-ehci.c @@ -838,11 +838,6 @@ static int ehci_qh_do_overlay(EHCIState *ehci, EHCIqh *qh, EHCIqtd *qtd) int eps; int reload; - if (ehci->qtdaddr < 0x1000) { - fprintf(stderr, "invalid address for qTD. resetting\n"); - return USB_RET_PROCERR; - } - // remember values in fields to preserve in qh after overlay dtoggle = qh->token & QTD_TOKEN_DTOGGLE; @@ -1455,6 +1450,7 @@ static int ehci_state_advqueue(EHCIState *ehci, int async, int *state) * want data and alt-next qTD is valid */ if (((ehci->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) && + (ehci->qh.altnext_qtd > 0x1000) && (NLPTR_TBIT(ehci->qh.altnext_qtd) == 0)) { DPRINTF_ST("ADVQUEUE: goto alt next qTD. " "curr 0x%08x next 0x%08x alt 0x%08x (next qh %x)\n", @@ -1466,8 +1462,10 @@ static int ehci_state_advqueue(EHCIState *ehci, int async, int *state) /* * next qTD is valid */ - } else if (NLPTR_TBIT(ehci->qh.next_qtd) == 0) { - DPRINTF_ST("ADVQUEUE: next qTD. curr 0x%08x next 0x%08x alt 0x%08x (next qh %x)\n", + } else if ((ehci->qh.next_qtd > 0x1000) && + (NLPTR_TBIT(ehci->qh.next_qtd) == 0)) { + DPRINTF_ST("ADVQUEUE: next qTD. " + "curr 0x%08x next 0x%08x alt 0x%08x (next qh %x)\n", ehci->qh.current_qtd, ehci->qh.altnext_qtd, ehci->qh.next_qtd, ehci->qh.next); ehci->qtdaddr = ehci->qh.next_qtd; -- 1.7.1.1