aboutsummaryrefslogtreecommitdiffstats
path: root/hw
diff options
context:
space:
mode:
authorGerd Hoffmann <kraxel@redhat.com>2012-02-27 11:23:08 +0100
committerGerd Hoffmann <kraxel@redhat.com>2012-02-27 13:37:36 +0100
commitaa0568ff2559d7717f4684af6a83d0bd1a125f56 (patch)
treefd18c44ba6d8dfbf6a569821a600438aac51630d /hw
parent808aeb98ffd9265da55a9ad3fceb86a7ac77107b (diff)
usb-ehci: sanity-check iso xfers
This patch adds a sanity check to itd processing to make sure the endpoint addressed by the guest is actually an iso endpoint. Also verify that usb drivers don't return USB_RET_ASYNC which is illegal for iso xfers. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw')
-rw-r--r--hw/usb-ehci.c16
1 files changed, 10 insertions, 6 deletions
diff --git a/hw/usb-ehci.c b/hw/usb-ehci.c
index b9da26ada..048eb7663 100644
--- a/hw/usb-ehci.c
+++ b/hw/usb-ehci.c
@@ -1459,12 +1459,16 @@ static int ehci_process_itd(EHCIState *ehci,
dev = ehci_find_device(ehci, devaddr);
ep = usb_ep_get(dev, pid, endp);
- usb_packet_setup(&ehci->ipacket, pid, ep);
- usb_packet_map(&ehci->ipacket, &ehci->isgl);
-
- ret = usb_handle_packet(dev, &ehci->ipacket);
-
- usb_packet_unmap(&ehci->ipacket);
+ if (ep->type == USB_ENDPOINT_XFER_ISOC) {
+ usb_packet_setup(&ehci->ipacket, pid, ep);
+ usb_packet_map(&ehci->ipacket, &ehci->isgl);
+ ret = usb_handle_packet(dev, &ehci->ipacket);
+ assert(ret != USB_RET_ASYNC);
+ usb_packet_unmap(&ehci->ipacket);
+ } else {
+ DPRINTF("ISOCH: attempt to addess non-iso endpoint\n");
+ ret = USB_RET_NAK;
+ }
qemu_sglist_destroy(&ehci->isgl);
#if 0