[Qemu-devel] [PATCH] ehci: catch invalid qTD earlier - avoid reset

[David Ahern]

Catch invalid qTD earlier.


Signed-off-by: David Ahern <daah...@cisco.com>
---
 hw/usb-ehci.c |   12 +++++-------
 1 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/hw/usb-ehci.c b/hw/usb-ehci.c
index 53ee1fb..47f3a54 100644
--- a/hw/usb-ehci.c
+++ b/hw/usb-ehci.c
@@ -838,11 +838,6 @@ static int ehci_qh_do_overlay(EHCIState *ehci, EHCIqh *qh, 
EHCIqtd *qtd)
     int eps;
     int reload;
 
-    if (ehci->qtdaddr < 0x1000) {
-        fprintf(stderr, "invalid address for qTD. resetting\n");
-        return USB_RET_PROCERR;
-    }
-
     // remember values in fields to preserve in qh after overlay
 
     dtoggle = qh->token & QTD_TOKEN_DTOGGLE;
@@ -1455,6 +1450,7 @@ static int ehci_state_advqueue(EHCIState *ehci, int 
async, int *state)
      * want data and alt-next qTD is valid
      */
     if (((ehci->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
+        (ehci->qh.altnext_qtd > 0x1000) &&
         (NLPTR_TBIT(ehci->qh.altnext_qtd) == 0)) {
         DPRINTF_ST("ADVQUEUE: goto alt next qTD. "
                    "curr 0x%08x next 0x%08x alt 0x%08x (next qh %x)\n",
@@ -1466,8 +1462,10 @@ static int ehci_state_advqueue(EHCIState *ehci, int 
async, int *state)
     /*
      *  next qTD is valid
      */
-    } else if (NLPTR_TBIT(ehci->qh.next_qtd) == 0) {
-        DPRINTF_ST("ADVQUEUE: next qTD. curr 0x%08x next 0x%08x alt 0x%08x 
(next qh %x)\n",
+    } else if ((ehci->qh.next_qtd > 0x1000) && 
+               (NLPTR_TBIT(ehci->qh.next_qtd) == 0)) {
+        DPRINTF_ST("ADVQUEUE: next qTD. "
+                   "curr 0x%08x next 0x%08x alt 0x%08x (next qh %x)\n",
                    ehci->qh.current_qtd, ehci->qh.altnext_qtd, 
                    ehci->qh.next_qtd, ehci->qh.next);
         ehci->qtdaddr = ehci->qh.next_qtd;
-- 
1.7.1.1