Commit 6100dda7 authored by Alexey Kardashevskiy's avatar Alexey Kardashevskiy Committed by Gerd Hoffmann
Browse files

xhci: Avoid DMA when ERSTBA is set to zero 



The existing XHCI code reads the Event Ring Segment Table Base Address
Register (ERSTBA) every time when it is changed. However zero is its
default state so one would think that zero there means it is not in use.

This adds a check for ERSTBA in addition to the existing check for
the Event Ring Segment Table Size Register (ERSTSZ).

Signed-off-by: default avatarAlexey Kardashevskiy <aik@ozlabs.ru>
Message-id: 20170911065606.40600-1-aik@ozlabs.ru
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 619c200f

hw/usb/hcd-xhci.c

+2 −2
Original line number Diff line number Diff line
@@ -811,8 +811,9 @@ static void xhci_er_reset(XHCIState *xhci, int v) 
{

    XHCIInterrupter *intr = &xhci->intr[v];

    XHCIEvRingSeg seg;

    dma_addr_t erstba = xhci_addr64(intr->erstba_low, intr->erstba_high);



    if (intr->erstsz == 0) {

    if (intr->erstsz == 0 || erstba == 0) {

        /* disabled */

        intr->er_start = 0;

        intr->er_size = 0;
@@ -824,7 +825,6 @@ static void xhci_er_reset(XHCIState *xhci, int v) 
        xhci_die(xhci);

        return;

    }

    dma_addr_t erstba = xhci_addr64(intr->erstba_low, intr->erstba_high);

    pci_dma_read(PCI_DEVICE(xhci), erstba, &seg, sizeof(seg));

    le32_to_cpus(&seg.addr_low);

    le32_to_cpus(&seg.addr_high);