OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

ehci: writeback_async_complete_packet: verify qh and qtd

Browse Source 
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Hans de Goede 2012-12-14 14:35:26 +01:00 committed by Gerd Hoffmann
parent 190d849249
commit 2b3de6ada5
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
hw/usb/hcd-ehci.c
View File

@ -192,6 +192,7 @@ static int ehci_state_executing(EHCIQueue *q);
static int ehci_state_writeback(EHCIQueue *q);
static int ehci_state_advqueue(EHCIQueue *q);
static int ehci_fill_queue(EHCIPacket *p);
static void ehci_free_packet(EHCIPacket *p);
static const char *nr2str(const char **n, size_t len, uint32_t nr)
{
@ -516,8 +517,21 @@ static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd)
static void ehci_writeback_async_complete_packet(EHCIPacket *p)
{
EHCIQueue *q = p->queue;
EHCIqtd qtd;
EHCIqh qh;
int state;
/* Verify the qh + qtd, like we do when going through fetchqh & fetchqtd */
get_dwords(q->ehci, NLPTR_GET(q->qhaddr),
(uint32_t *) &qh, sizeof(EHCIqh) >> 2);
get_dwords(q->ehci, NLPTR_GET(q->qtdaddr),
(uint32_t *) &qtd, sizeof(EHCIqtd) >> 2);
if (!ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) {
p->async = EHCI_ASYNC_INITIALIZED;
ehci_free_packet(p);
return;
}
state = ehci_get_state(q->ehci, q->async);
ehci_state_executing(q);
ehci_state_writeback(q); /* Frees the packet! */