Commit 05f43d44 authored by Gerd Hoffmann's avatar Gerd Hoffmann
Browse files

xhci: limit the number of link trbs we are willing to process 



Needed to avoid we run in circles forever in case the guest builds
an endless loop with link trbs.

Reported-by: default avatarLi Qiang <liqiang6-s@360.cn>
Tested-by: default avatarP J P <ppandit@redhat.com>
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
Message-id: 1476096382-7981-1-git-send-email-kraxel@redhat.com
parent 6b39b063

hw/usb/hcd-xhci.c

+10 −0
Original line number Diff line number Diff line
@@ -54,6 +54,8 @@ 
 * to the specs when it gets them */

#define ER_FULL_HACK



#define TRB_LINK_LIMIT  4



#define LEN_CAP         0x40

#define LEN_OPER        (0x400 + 0x10 * MAXPORTS)

#define LEN_RUNTIME     ((MAXINTRS + 1) * 0x20)
@@ -1000,6 +1002,7 @@ static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb, 
                               dma_addr_t *addr)

{

    PCIDevice *pci_dev = PCI_DEVICE(xhci);

    uint32_t link_cnt = 0;



    while (1) {

        TRBType type;
@@ -1026,6 +1029,9 @@ static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb, 
            ring->dequeue += TRB_SIZE;

            return type;

        } else {

            if (++link_cnt > TRB_LINK_LIMIT) {

                return 0;

            }

            ring->dequeue = xhci_mask64(trb->parameter);

            if (trb->control & TRB_LK_TC) {

                ring->ccs = !ring->ccs;
@@ -1043,6 +1049,7 @@ static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring) 
    bool ccs = ring->ccs;

    /* hack to bundle together the two/three TDs that make a setup transfer */

    bool control_td_set = 0;

    uint32_t link_cnt = 0;



    while (1) {

        TRBType type;
@@ -1058,6 +1065,9 @@ static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring) 
        type = TRB_TYPE(trb);



        if (type == TR_LINK) {

            if (++link_cnt > TRB_LINK_LIMIT) {

                return -length;

            }

            dequeue = xhci_mask64(trb.parameter);

            if (trb.control & TRB_LK_TC) {

                ccs = !ccs;