[Qemu-devel] what is the USB 'maxframes' parameter for and what is its maximum value?

[Peter Maydell]

Hi; I've been idly looking through our fairly small number of
remaining Coverity issues, and one of them is in hw/usb/hcd-ehci.c:
in ehci_work_bh() we do:
        if (uframes > (ehci->maxframes * 8)) {

but if maxframes is very large then the multiply will overflow
a 32-bit integer. (CID 1375885)

We could shut up Coverity by forcing a 64-bit multiply, but that
doesn't really seem like the right approach -- maxframes is a
user-settable parameter whose default is 128 and values as big
as 2^30 seem like they probably aren't valid. So perhaps we should
handle this by having the device sanity-check the user-provided
value at startup.

Unfortunately there doesn't seem to be any documentation on what
the 'maxframes' property is for or what its valid values are.
Digging through git history this was added in commit 16a2dee6b98
whose commit message briefly says it's the upper limit for how many
frames we process at once, but I'm not familiar enough with
USB to be able to translate that into what the valid range
might be.

thanks
-- PMM