diff mbox

[2/2] Respond a set address command with CC_PARAMETER_ERROR, if the speed field of the input context is not valid.

Message ID 1351240148-13723-3-git-send-email-mail@sebastianbauer.info
State New
Headers show

Commit Message

Sebastian Bauer Oct. 26, 2012, 8:29 a.m. UTC 
---
 hw/usb/hcd-xhci.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

Comments

Gerd Hoffmann Oct. 26, 2012, 12:05 p.m. UTC | #1 
Looks ok, but please add the description & spec reference from the cover
letter to the commit message.

thanks,
  Gerd
diff mbox

Patch

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 4c81dcc..b556b6e 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -1841,6 +1841,7 @@  static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid,
     uint32_t ictl_ctx[2];
     uint32_t slot_ctx[4];
     uint32_t ep0_ctx[5];
+    uint32_t speed;
     int i;
     TRBCCode res;
 
@@ -1884,6 +1885,15 @@  static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid,
         return CC_USB_TRANSACTION_ERROR;
     }
 
+    /* Check for validness of the input contexts, see 6.2.2.1 */
+    speed = (slot_ctx[0] >> 20) & 0xf;
+    if (speed != uport->dev->speed + 1)
+    {
+        fprintf(stderr,"xhci: invalid device speed in slot context for slot %u (expected %d, got %d).\n",
+                slotid, uport->dev->speed+1, speed);
+        return CC_PARAMETER_ERROR;
+    }
+
     for (i = 0; i < MAXSLOTS; i++) {
         if (xhci->slots[i].uport == uport) {
             fprintf(stderr, "xhci: port %s already assigned to slot %d\n",