From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:38911) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TRfII-0004ji-TF for qemu-devel@nongnu.org; Fri, 26 Oct 2012 04:29:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TRfIB-0006z7-0f for qemu-devel@nongnu.org; Fri, 26 Oct 2012 04:29:30 -0400 Received: from relay2.mail.vrmd.de ([81.28.224.28]:57493) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TRfIA-0006yo-Qb for qemu-devel@nongnu.org; Fri, 26 Oct 2012 04:29:22 -0400 From: Sebastian Bauer Date: Fri, 26 Oct 2012 10:29:08 +0200 Message-Id: <1351240148-13723-3-git-send-email-mail@sebastianbauer.info> In-Reply-To: <1351240148-13723-1-git-send-email-mail@sebastianbauer.info> References: <1351240148-13723-1-git-send-email-mail@sebastianbauer.info> Subject: [Qemu-devel] [PATCH 2/2] Respond a set address command with CC_PARAMETER_ERROR, if the speed field of the input context is not valid. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Sebastian Bauer --- hw/usb/hcd-xhci.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index 4c81dcc..b556b6e 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -1841,6 +1841,7 @@ static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid, uint32_t ictl_ctx[2]; uint32_t slot_ctx[4]; uint32_t ep0_ctx[5]; + uint32_t speed; int i; TRBCCode res; @@ -1884,6 +1885,15 @@ static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid, return CC_USB_TRANSACTION_ERROR; } + /* Check for validness of the input contexts, see 6.2.2.1 */ + speed = (slot_ctx[0] >> 20) & 0xf; + if (speed != uport->dev->speed + 1) + { + fprintf(stderr,"xhci: invalid device speed in slot context for slot %u (expected %d, got %d).\n", + slotid, uport->dev->speed+1, speed); + return CC_PARAMETER_ERROR; + } + for (i = 0; i < MAXSLOTS; i++) { if (xhci->slots[i].uport == uport) { fprintf(stderr, "xhci: port %s already assigned to slot %d\n", -- 1.7.10.4