summary refs log tree commit diff stats
path: root/hw/usb/hcd-xhci.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* hw/usb/hcd-xhci: Unmap canceled packetAkihiko Odaki2025-04-251-6/+7
| | | | | | | | | | | | | When the Stop Endpoint Command is received, packets running asynchronously are canceled and then all packets are cleaned up. Packets running asynchronously hold the DMA mapping so cleaning the packets leak the mapping. Remove the mapping after canceling packets to fix the leak. Fixes: 62c6ae04cf43 ("xhci: Initial xHCI implementation") Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250418-xhc-v1-1-bb32dab6a67e@daynix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* qom: Have class_init() take a const data argumentPhilippe Mathieu-Daudé2025-04-251-1/+1
| | | | | | | | | | Mechanical change using gsed, then style manually adapted to pass checkpatch.pl script. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250424194905.82506-4-philmd@linaro.org>
* hw/usb/hcd-xhci-pci: Adds property for disabling mapping in IRQ modePhil Dennis-Jordan2025-03-041-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | This change addresses an edge case that trips up macOS guest drivers for PCI based XHCI controllers. The guest driver would attempt to schedule events to XHCI event rings 1 and 2 even when using PCI pin-based interrupts. Interrupts would therefore be dropped, and events only handled on timeout. So, in addition to disabling interrupter mapping if numintrs is 1, a callback is added to xhci to check whether interrupter mapping should be enabled. The PCI XHCI device type now provides an implementation of this callback if the new "conditional-intr-mapping" property is enabled. (default: disabled) When enabled, interrupter mapping is only enabled when MSI-X or MSI is active. This means that when using pin-based interrupts, events are only submitted to interrupter 0 regardless of selected target. This allows the macOS guest drivers to work with the device in those configurations. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2705 Message-ID: <20241227121336.25838-6-phil@philjordan.eu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* hw/usb/hcd-xhci-pci: Use event ring 0 if mapping unsupportedPhil Dennis-Jordan2025-01-131-0/+4
| | | | | | | | | | | | | | | | | The XHCI specification, section 4.17.1 specifies that "If the Number of Interrupters (MaxIntrs) field is greater than 1, then Interrupter Mapping shall be supported." and "If Interrupter Mapping is not supported, the Interrupter Target field shall be ignored by the xHC and all Events targeted at Interrupter 0." QEMU's XHCI device has so far not specially addressed this case, so we add a check to xhci_event() to redirect to event ring and interrupt 0 if mapping is disabled. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20241227121336.25838-4-phil@philjordan.eu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* hw/usb/hcd-xhci: Unimplemented/guest error logging for port MMIOPhil Dennis-Jordan2024-12-311-3/+22
| | | | | | | | | | | | | | The XHCI device code uses tracing rather than logging on various code paths that are so far unimplemented. In some cases, these code paths actually indicate faulty guest software. This patch switches instances in the read and write handlers for the port MMIO region to use qemu_log_mask() with LOG_UNIMP or LOG_GUEST_ERROR, as appropriate in each case. Signed-off-by: Phil Dennis-Jordan <phil@philjordan.eu> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20241227121336.25838-5-phil@philjordan.eu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* include/hw/qdev-properties: Remove DEFINE_PROP_END_OF_LISTRichard Henderson2024-12-191-1/+0
| | | | | | | | | | | | | | Now that all of the Property arrays are counted, we can remove the terminator object from each array. Update the assertions in device_class_set_props to match. With struct Property being 88 bytes, this was a rather large form of terminator. Saves 30k from qemu-system-aarch64. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Lei Yang <leiyang@redhat.com> Link: https://lore.kernel.org/r/20241218134251.4724-21-richard.henderson@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/usb: Constify all PropertyRichard Henderson2024-12-151-1/+1
| | | | | Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* hw: Use device_class_set_legacy_reset() instead of opencodingPeter Maydell2024-09-131-1/+1
| | | | | | | | | | | | | Use device_class_set_legacy_reset() instead of opencoding an assignment to DeviceClass::reset. This change was produced with: spatch --macro-file scripts/cocci-macro-file.h \ --sp-file scripts/coccinelle/device-reset.cocci \ --keep-comments --smpl-spacing --in-place --dir hw Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240830145812.1967042-8-peter.maydell@linaro.org
* hw/usb/hcd-xhci: Remove XHCI_FLAG_SS_FIRST flagPhilippe Mathieu-Daudé2024-06-191-34/+8
| | | | | | | | | | | | XHCI_FLAG_SS_FIRST was only used by the pc-i440fx-2.0 machine, which got removed. Remove it and simplify various functions in hcd-xhci.c. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20240617071118.60464-5-philmd@linaro.org>
* hw/usb: Constify VMStateRichard Henderson2023-12-301-6/+6
| | | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231221031652.119827-59-richard.henderson@linaro.org>
* hw/usb: Silence compiler warnings in USB code when compiling with -WshadowThomas Huth2023-10-061-5/+5
| | | | | | | | | | Rename variables or remove nested definitions where it makes sense, so that we can finally compile the USB code with "-Wshadow", too. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20231004130822.113343-1-thuth@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Markus Armbruster <armbru@redhat.com>
* hw/usb/hcd-xhci: Avoid variable-length array in xhci_get_port_bandwidth()Peter Maydell2023-08-311-6/+4
| | | | | | | | | | | | | | | | | In xhci_get_port_bandwidth(), we use a variable-length array to construct the buffer to send back to the guest. Avoid the VLA by using dma_memory_set() to directly request the memory system to fill the guest memory with a string of '80's. The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20230824164818.2652452-1-peter.maydell@linaro.org>
* hw/usb/hcd-xhci.c: spelling: tranferMichael Tokarev2022-11-231-1/+1
| | | | | | | | | Fixes: effaf5a240e03020f4ae953e10b764622c3e87cc Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> Message-Id: <20221105114851.306206-1-mjt@msgid.tls.msk.ru> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hcd-xhci: drop operation with secondary stream arrays enabledQiang Liu2022-09-271-1/+3
| | | | | | | | | | | | | The abort() in xhci_find_stream() can be triggered via enabling the secondary stream arrays by setting linear stream array (LSA) bit (in endpoint context) to 0. We may show warnings and drop this operation. Fixes: 024426acc0a2 ("usb-xhci: usb3 streams") Reported-by: Qiang Liu <cyruscyliu@gmail.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1192 Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> Message-Id: <20220904125926.2141607-1-cyruscyliu@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/usb/hcd-xhci: Check whether DMA accesses failThomas Huth2022-09-231-16/+48
| | | | | | | | | | | If a guest sets up bad descriptors, it could force QEMU to access non-existing memory regions. Thus we should check the return value of dma_memory_read/write() to make sure that these errors don't go unnoticed. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20220817160016.49752-1-thuth@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/usb/hcd-xhci: Fix unbounded loop in xhci_ring_chain_length() (CVE-2020-14394)Thomas Huth2022-08-161-4/+19
| | | | | | | | | | | | | | | The loop condition in xhci_ring_chain_length() is under control of the guest, and additionally the code does not check for failed DMA transfers (e.g. if reaching the end of the RAM), so the loop there could run for a very long time or even forever. Fix it by checking the return value of dma_memory_read() and by introducing a maximum loop length. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/646 Message-Id: <20220804131300.96368-1-thuth@redhat.com> Reviewed-by: Mauro Matteo Cascella <mcascell@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* usb/hcd-xhci: check slotid in xhci_wakeup_endpoint()Mauro Matteo Cascella2022-07-191-1/+2
| | | | | | | | | | This prevents an OOB read (followed by an assertion failure in xhci_kick_ep) when slotid > xhci->numslots. Reported-by: Soul Chen <soulchen8650@gmail.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Message-Id: <20220705174734.2348829-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/usb: pacify xhciwmi.exe warningDenis V. Lunev2022-03-041-1/+1
| | | | | | | | | | | | | | | | | | | | xhciwmi.exe is used inside Windows 2022 SVVP tests. This tool called as 'xhciwmi.exe --verify' reports that 'The firmware loaded on this controller has known bugs and/or compatibility issues'. This is just a warning but there is no particular sense to ignore it. This patch just pacifies the tool. There is a big question whether this change should be put using machine type mechanics, but at my opinion this would be an overkill. Signed-off-by: Denis V. Lunev <den@openvz.org> Tested-by: Pavel Polozov <pavel.polozov@virtuozzo.com> CC: Yan Vugenfirer <yvugenfi@redhat.com> CC: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com> Message-Id: <20211223095443.130276-1-den@openvz.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* pci: Let ld*_pci_dma() take MemTxAttrs argumentPhilippe Mathieu-Daudé2021-12-311-0/+1
| | | | | | | | | | Let devices specify transaction attributes when calling ld*_pci_dma(). Keep the default MEMTXATTRS_UNSPECIFIED in the few callers. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211223115554.3155328-22-philmd@redhat.com>
* dma: Let ld*_dma() propagate MemTxResultPhilippe Mathieu-Daudé2021-12-311-3/+4
| | | | | | | | | | | | dma_memory_read() returns a MemTxResult type. Do not discard it, return it to the caller. Update the few callers. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211223115554.3155328-19-philmd@redhat.com>
* dma: Let ld*_dma() take MemTxAttrs argumentPhilippe Mathieu-Daudé2021-12-311-3/+3
| | | | | | | | | | | Let devices specify transaction attributes when calling ld*_dma(). Keep the default MEMTXATTRS_UNSPECIFIED in the few callers. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211223115554.3155328-17-philmd@redhat.com>
* dma: Let dma_memory_read/write() take MemTxAttrs argumentPhilippe Mathieu-Daudé2021-12-301-7/+11
| | | | | | | | | | | | | | | | | | | | | | | | | Let devices specify transaction attributes when calling dma_memory_read() or dma_memory_write(). Patch created mechanically using spatch with this script: @@ expression E1, E2, E3, E4; @@ ( - dma_memory_read(E1, E2, E3, E4) + dma_memory_read(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED) | - dma_memory_write(E1, E2, E3, E4) + dma_memory_write(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED) ) Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20211223115554.3155328-6-philmd@redhat.com>
* hw/usb: hcd-xhci-pci: Fix spec violation of IP flag for MSI/MSI-XRuimei Yan2021-05-281-2/+6
| | | | | | | | | | | | | | | | | | | | | | | Per xHCI spec v1.2 chapter 4.17.5 page 296: If MSI or MSI-X interrupts are enabled, Interrupt Pending (IP) shall be cleared automatically when the PCI dword write generated by the interrupt assertion is complete. Currently QEMU does not clear the IP flag in the MSI / MSI-X mode. This causes subsequent spurious interrupt to be delivered to guests. To solve this, we change the xhci intr_raise() hook routine to have a bool return value that is passed to its caller (the xhci core), with true indicating that IP should be self-cleared. Fixes: 62c6ae04cf43 ("xhci: Initial xHCI implementation") Fixes: 4c47f800631a ("xhci: add msix support") Signed-off-by: Ruimei Yan <ruimei.yan@windriver.com> [bmeng: move IP clear codes from xhci pci to xhci core] Signed-off-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20210521024224.2277634-2-bmeng.cn@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* Remove superfluous timer_del() callsPeter Maydell2021-01-081-1/+0
| | | | | | | | | | | | This commit is the result of running the timer-del-timer-free.cocci script on the whole source tree. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Corey Minyard <cminyard@mvista.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20201215154107.3255-4-peter.maydell@linaro.org
* Merge remote-tracking branch ↵Peter Maydell2020-11-161-1/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/huth-gitlab/tags/pull-request-2020-11-15' into staging Fix Lesser GPL license versions (should be "2.1" and not "2") # gpg: Signature made Sun 15 Nov 2020 16:20:10 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/huth-gitlab/tags/pull-request-2020-11-15: (26 commits) nomaintainer: Fix Lesser GPL version number test: Fix LGPL information in the file headers tests/acceptance: Fix LGPL information in the file headers tests/migration: Fix LGPL information in the file headers sparc tcg cpus: Fix Lesser GPL version number e1000e: Fix Lesser GPL version number x86 hvf cpus: Fix Lesser GPL version number nvdimm: Fix Lesser GPL version number w32: Fix Lesser GPL version number tpm: Fix Lesser GPL version number overall/alpha tcg cpus|hppa: Fix Lesser GPL version number overall usermode...: Fix Lesser GPL version number migration: Fix Lesser GPL version number parallel nor flash: Fix Lesser GPL version number arm tcg cpus: Fix Lesser GPL version number x86 tcg cpus: Fix Lesser GPL version number linux user: Fix Lesser GPL version number usb: Fix Lesser GPL version number tricore tcg cpus: Fix Lesser GPL version number xtensa tcg cpus: Fix Lesser GPL version number ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * usb: Fix Lesser GPL version numberChetan Pant2020-11-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | There is no "version 2" of the "Lesser" General Public License. It is either "GPL version 2.0" or "Lesser GPL version 2.1". This patch replaces all occurrences of "Lesser GPL version 2" with "Lesser GPL version 2.1" in comment section. Signed-off-by: Chetan Pant <chetan4windows@gmail.com> Message-Id: <20201023122332.19369-1-chetan4windows@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* | xhci: move sanity checksGerd Hoffmann2020-11-161-2/+5
| | | | | | | | | | | | | | | | | | | | | | The v variable goes negative for reg < 0x20. Reorder the code to first sanity check then calculate v and assign intr to make sanity checkers happy. Buglink: https://bugs.launchpad.net/qemu/+bug/1902112 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201105134112.25119-7-kraxel@redhat.com
* | xhci: fix guest triggerable assertGerd Hoffmann2020-11-161-1/+3
|/ | | | | | | | | | We didn't start any work yet so we can just return at that point instead of asserting. Buglink: https://bugs.launchpad.net/qemu/+bug/1883732 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201105134112.25119-6-kraxel@redhat.com
* usb/xhci: add include/hw/usb/xhci.h header fileGerd Hoffmann2020-10-211-18/+16
| | | | | | | | | | Move a bunch of defines which might be needed outside core xhci code to that place. Add XHCI_ prefixes to avoid name clashes. No functional change. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Message-id: 20201020074844.5304-3-kraxel@redhat.com
* usb/hcd-xhci: Split pci wrapper for xhci base modelSai Pavan Boddu2020-09-281-172/+42
| | | | | | | | | | | This patch sets the base to use xhci as sysbus model, for which pci specific hooks are moved to hcd-xhci-pci.c. As a part of this requirment msi/msix interrupts handling is moved under XHCIPCIState. Made required changes for qemu-xhci-nec. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Message-id: 1600957256-6494-4-git-send-email-sai.pavan.boddu@xilinx.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* usb/hcd-xhci: Move qemu-xhci device to hcd-xhci-pci.cSai Pavan Boddu2020-09-281-31/+2
| | | | | | | | | Move pci specific devices to new file. This set the environment to move all pci specific hooks in hcd-xhci.c to hcd-xhci-pci.c. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Message-id: 1600957256-6494-3-git-send-email-sai.pavan.boddu@xilinx.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* usb/hcd-xhci: Make dma read/writes hooks pci freeSai Pavan Boddu2020-09-281-13/+11
| | | | | | | | | | This patch starts making the hcd-xhci.c pci free, as part of this restructuring dma read/writes are handled without passing pci object. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1600957256-6494-2-git-send-email-sai.pavan.boddu@xilinx.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw: xhci: check return value of 'usb_packet_map'Li Qiang2020-08-311-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently we don't check the return value of 'usb_packet_map', this will cause an UAF issue. This is LP#1891341. Following is the reproducer provided in: -->https://bugs.launchpad.net/qemu/+bug/1891341 cat << EOF | ./i386-softmmu/qemu-system-i386 -device nec-usb-xhci \ -trace usb\* -device usb-audio -device usb-storage,drive=mydrive \ -drive id=mydrive,file=null-co://,size=2M,format=raw,if=none \ -nodefaults -nographic -qtest stdio outl 0xcf8 0x80001016 outl 0xcfc 0x3c009f0d outl 0xcf8 0x80001004 outl 0xcfc 0xc77695e writel 0x9f0d000000000040 0xffff3655 writeq 0x9f0d000000002000 0xff2f9e0000000000 write 0x1d 0x1 0x27 write 0x2d 0x1 0x2e write 0x17232 0x1 0x03 write 0x17254 0x1 0x06 write 0x17278 0x1 0x34 write 0x3d 0x1 0x27 write 0x40 0x1 0x2e write 0x41 0x1 0x72 write 0x42 0x1 0x01 write 0x4d 0x1 0x2e write 0x4f 0x1 0x01 writeq 0x9f0d000000002000 0x5c051a0100000000 write 0x34001d 0x1 0x13 write 0x340026 0x1 0x30 write 0x340028 0x1 0x08 write 0x34002c 0x1 0xfe write 0x34002d 0x1 0x08 write 0x340037 0x1 0x5e write 0x34003a 0x1 0x05 write 0x34003d 0x1 0x05 write 0x34004d 0x1 0x13 writeq 0x9f0d000000002000 0xff00010100400009 EOF This patch fixes this. Buglink: https://bugs.launchpad.net/qemu/+bug/1891341 Reported-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Li Qiang <liq3ea@163.com> Message-id: 20200812153139.15146-1-liq3ea@163.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* xhci: fix valid.max_access_size to access address registersLaurent Vivier2020-07-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | QEMU XHCI advertises AC64 (64-bit addressing) but doesn't allow 64-bit mode access in "runtime" and "operational" MemoryRegionOps. Set the max_access_size based on sizeof(dma_addr_t) as AC64 is set. XHCI specs: "If the xHC supports 64-bit addressing (AC64 = ‘1’), then software should write 64-bit registers using only Qword accesses. If a system is incapable of issuing Qword accesses, then writes to the 64-bit address fields shall be performed using 2 Dword accesses; low Dword-first, high-Dword second. If the xHC supports 32-bit addressing (AC64 = ‘0’), then the high Dword of registers containing 64-bit address fields are unused and software should write addresses using only Dword accesses" The problem has been detected with SLOF, as linux kernel always accesses registers using 32-bit access even if AC64 is set and revealed by 5d971f9e6725 ("memory: Revert "memory: accept mismatching sizes in memory_region_access_valid"") Suggested-by: Alexey Kardashevskiy <aik@au1.ibm.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-id: 20200721083322.90651-1-lvivier@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* qdev: set properties with device_class_set_props()Marc-André Lureau2020-01-241-1/+1
| | | | | | | | | | | | | | | | | | | | | The following patch will need to handle properties registration during class_init time. Let's use a device_class_set_props() setter. spatch --macro-file scripts/cocci-macro-file.h --sp-file ./scripts/coccinelle/qdev-set-props.cocci --keep-comments --in-place --dir . @@ typedef DeviceClass; DeviceClass *d; expression val; @@ - d->props = val + device_class_set_props(d, val) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20200110153039.1379601-20-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* xhci: recheck slot statusGerd Hoffmann2020-01-131-3/+12
| | | | | | | | | | | | Factor out slot status check into a helper function. Add an additional check after completing transfers. This is needed in case a guest queues multiple transfers in a row and a device unplug happens while qemu processes them. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1786413 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200107083606.12393-1-kraxel@redhat.com
* xhci: Fix memory leak in xhci_kick_epctx when poweroff GuestOSChen Qun2020-01-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | start vm with libvirt, when GuestOS running, enter poweroff command using the xhci keyboard, then ASAN shows memory leak stack： Direct leak of 80 byte(s) in 5 object(s) allocated from: #0 0xfffd1e6431cb in __interceptor_malloc (/lib64/libasan.so.4+0xd31cb) #1 0xfffd1e107163 in g_malloc (/lib64/libglib-2.0.so.0+0x57163) #2 0xaaad39051367 in qemu_sglist_init /qemu/dma-helpers.c:43 #3 0xaaad3947c407 in pci_dma_sglist_init /qemu/include/hw/pci/pci.h:842 #4 0xaaad3947c407 in xhci_xfer_create_sgl /qemu/hw/usb/hcd-xhci.c:1446 #5 0xaaad3947c407 in xhci_setup_packet /qemu/hw/usb/hcd-xhci.c:1618 #6 0xaaad3948625f in xhci_submit /qemu/hw/usb/hcd-xhci.c:1827 #7 0xaaad3948625f in xhci_fire_transfer /qemu/hw/usb/hcd-xhci.c:1839 #8 0xaaad3948625f in xhci_kick_epctx /qemu/hw/usb/hcd-xhci.c:1991 #9 0xaaad3948f537 in xhci_doorbell_write /qemu/hw/usb/hcd-xhci.c:3158 #10 0xaaad38bcbfc7 in memory_region_write_accessor /qemu/memory.c:483 #11 0xaaad38bc654f in access_with_adjusted_size /qemu/memory.c:544 #12 0xaaad38bd1877 in memory_region_dispatch_write /qemu/memory.c:1482 #13 0xaaad38b1c77f in flatview_write_continue /qemu/exec.c:3167 #14 0xaaad38b1ca83 in flatview_write /qemu/exec.c:3207 #15 0xaaad38b268db in address_space_write /qemu/exec.c:3297 #16 0xaaad38bf909b in kvm_cpu_exec /qemu/accel/kvm/kvm-all.c:2383 #17 0xaaad38bb063f in qemu_kvm_cpu_thread_fn /qemu/cpus.c:1246 #18 0xaaad39821c93 in qemu_thread_start /qemu/util/qemu-thread-posix.c:519 #19 0xfffd1c8378bb (/lib64/libpthread.so.0+0x78bb) #20 0xfffd1c77616b (/lib64/libc.so.6+0xd616b) Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Message-id: 20200110105855.81144-1-kuhn.chenqun@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* xhci: Fix memory leak in xhci_kick_epctxfangying2019-08-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Address Sanitizer shows memory leak in xhci_kick_epctx hw/usb/hcd-xhci.c:1912. A sglist is leaked when a packet is retired and returns USB_RET_NAK status. The leak stack is as bellow: Direct leak of 2688 byte(s) in 168 object(s) allocated from: #0 0xffffae8b11db in __interceptor_malloc (/lib64/libasan.so.4+0xd31db) #1 0xffffae5c9163 in g_malloc (/lib64/libglib-2.0.so.0+0x57163) #2 0xaaaabb6fb3f7 in qemu_sglist_init dma-helpers.c:43 #3 0xaaaabba705a7 in pci_dma_sglist_init include/hw/pci/pci.h:837 #4 0xaaaabba705a7 in xhci_xfer_create_sgl hw/usb/hcd-xhci.c:1443 #5 0xaaaabba705a7 in xhci_setup_packet hw/usb/hcd-xhci.c:1615 #6 0xaaaabba77a6f in xhci_kick_epctx hw/usb/hcd-xhci.c:1912 #7 0xaaaabbdaad27 in timerlist_run_timers util/qemu-timer.c:592 #8 0xaaaabbdab19f in qemu_clock_run_timers util/qemu-timer.c:606 #9 0xaaaabbdab19f in qemu_clock_run_all_timers util/qemu-timer.c:692 #10 0xaaaabbdab9a3 in main_loop_wait util/main-loop.c:524 #11 0xaaaabb6ff5e7 in main_loop vl.c:1806 #12 0xaaaabb1e1453 in main vl.c:4488 Signed-off-by: Ying Fang <fangying1@huawei.com> Message-id: 20190828062535.1573-1-fangying1@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* xhci: Fix memory leak in xhci_address_slotYing Fang2019-08-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Address Sanitizer shows memory leak in xhci_address_slot hw/usb/hcd-xhci.c:2156 and the stack is as bellow: Direct leak of 64 byte(s) in 4 object(s) allocated from: #0 0xffff91c6f5ab in realloc (/lib64/libasan.so.4+0xd35ab) #1 0xffff91987243 in g_realloc (/lib64/libglib-2.0.so.0+0x57243) #2 0xaaaab0b26a1f in qemu_iovec_add util/iov.c:296 #3 0xaaaab07e5ce3 in xhci_address_slot hw/usb/hcd-xhci.c:2156 #4 0xaaaab07e5ce3 in xhci_process_commands hw/usb/hcd-xhci.c:2493 #5 0xaaaab00058d7 in memory_region_write_accessor qemu/memory.c:507 #6 0xaaaab0000d87 in access_with_adjusted_size memory.c:573 #7 0xaaaab000abcf in memory_region_dispatch_write memory.c:1516 #8 0xaaaaaff59947 in flatview_write_continue exec.c:3367 #9 0xaaaaaff59c33 in flatview_write exec.c:3406 #10 0xaaaaaff63b3b in address_space_write exec.c:3496 #11 0xaaaab002f263 in kvm_cpu_exec accel/kvm/kvm-all.c:2288 #12 0xaaaaaffee427 in qemu_kvm_cpu_thread_fn cpus.c:1290 #13 0xaaaab0b1a943 in qemu_thread_start util/qemu-thread-posix.c:502 #14 0xffff908ce8bb in start_thread (/lib64/libpthread.so.0+0x78bb) #15 0xffff908165cb in thread_start (/lib64/libc.so.6+0xd55cb) Cc: zhanghailiang <zhang.zhanghailiang@huawei.com> Signed-off-by: Ying Fang <fangying1@huawei.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Message-id: 20190827080209.2365-1-fangying1@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* xhci: Add No Op CommandHikaru Nishida2019-08-211-0/+3
| | | | | | | | | | | | | | This commit adds No Op Command (23) to xHC for verifying the operation of the Command Ring mechanisms. No Op Command is defined in XHCI spec (4.6.2) and just reports Command Completion Event with Completion Code == Success. Before this commit, No Op Command is not implemented so xHC reports Command Completion Event with Completion Code == TRB Error. This commit fixes this behaviour to report Completion Code correctly. Signed-off-by: Hikaru Nishida <hikarupsp@gmail.com> Message-id: 20190720060427.50457-1-hikarupsp@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* Include hw/qdev-properties.h lessMarkus Armbruster2019-08-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | In my "build everything" tree, changing hw/qdev-properties.h triggers a recompile of some 2700 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). Many places including hw/qdev-properties.h (directly or via hw/qdev.h) actually need only hw/qdev-core.h. Include hw/qdev-core.h there instead. hw/qdev.h is actually pointless: all it does is include hw/qdev-core.h and hw/qdev-properties.h, which in turn includes hw/qdev-core.h. Replace the remaining uses of hw/qdev.h by hw/qdev-properties.h. While there, delete a few superfluous inclusions of hw/qdev-core.h. Touching hw/qdev-properties.h now recompiles some 1200 objects. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: "Daniel P. Berrangé" <berrange@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20190812052359.30071-22-armbru@redhat.com>
* Include hw/hw.h exactly where neededMarkus Armbruster2019-08-161-1/+0
| | | | | | | | | | | | | | | | In my "build everything" tree, changing hw/hw.h triggers a recompile of some 2600 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). The previous commits have left only the declaration of hw_error() in hw/hw.h. This permits dropping most of its inclusions. Touching it now recompiles less than 200 objects. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20190812052359.30071-19-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
* Include migration/vmstate.h lessMarkus Armbruster2019-08-161-0/+1
| | | | | | | | | | | | | | | | | | In my "build everything" tree, changing migration/vmstate.h triggers a recompile of some 2700 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). hw/hw.h supposedly includes it for convenience. Several other headers include it just to get VMStateDescription. The previous commit made that unnecessary. Include migration/vmstate.h only where it's still needed. Touching it now recompiles only some 1600 objects. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20190812052359.30071-16-armbru@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
* Include qemu/module.h where needed, drop it from qemu-common.hMarkus Armbruster2019-06-121-0/+2
| | | | | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190523143508.25387-4-armbru@redhat.com> [Rebased with conflicts resolved automatically, except for hw/usb/dev-hub.c hw/misc/exynos4210_rng.c hw/misc/bcm2835_rng.c hw/misc/aspeed_scu.c hw/display/virtio-vga.c hw/arm/stm32f205_soc.c; ui/cocoa.m fixed up]
* hw/usb: avoid format truncation warning when formatting port nameDaniel P. Berrangé2019-05-031-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | hw/usb/hcd-xhci.c: In function ‘usb_xhci_realize’: hw/usb/hcd-xhci.c:3339:66: warning: ‘%d’ directive output may be truncated writing between 1 and 10 bytes into a region of size 5 [-Wformat-trunca\ tion=] 3339 | snprintf(port->name, sizeof(port->name), "usb2 port #%d", i+1); | ^~ hw/usb/hcd-xhci.c:3339:54: note: directive argument in the range [1, 2147483647] 3339 | snprintf(port->name, sizeof(port->name), "usb2 port #%d", i+1); | ^~~~~~~~~~~~~~~ The xhci code formats the port name into a fixed length buffer which is only large enough to hold port numbers upto 5 digits in decimal representation. We're never going to have a port number that large, so aserting the port number is sensible is sufficient to tell GCC the formatted string won't be truncated. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20190412121626.19829-5-berrange@redhat.com> [ kraxel: also s/int/unsigned int/ to tell gcc they can't go negative. ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* usb/xhci: avoid trigger assertion if guest write wrong epidLongpeng2019-05-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | we found the following core in our environment: 0 0x00007fc6b06c2237 in raise () 1 0x00007fc6b06c3928 in abort () 2 0x00007fc6b06bb056 in __assert_fail_base () 3 0x00007fc6b06bb102 in __assert_fail () 4 0x0000000000702e36 in xhci_kick_ep (...) 5 0x000000000047897a in memory_region_write_accessor (...) 6 0x000000000047767f in access_with_adjusted_size (...) 7 0x000000000047944d in memory_region_dispatch_write (...) (mr=mr@entry=0x7fc6a0138df0, addr=addr@entry=156, data=1648892416, size=size@entry=4, attrs=attrs@entry=...) 8 0x000000000042df17 in address_space_write_continue (...) 10 0x000000000043084d in address_space_rw (...) 11 0x000000000047451b in kvm_cpu_exec (cpu=cpu@entry=0x1ab11b0) 12 0x000000000045dcf5 in qemu_kvm_cpu_thread_fn (arg=0x1ab11b0) 13 0x0000000000870631 in qemu_thread_start (args=args@entry=0x1acfb50) 14 0x00000000008959a7 in thread_entry_for_hotfix (pthread_cb=<optimized out>) 15 0x00007fc6b0a60dd5 in start_thread () 16 0x00007fc6b078a59d in clone () (gdb) f 5 5 0x000000000047897a in memory_region_write_accessor (...) 529 mr->ops->write(mr->opaque, addr, tmp, size); (gdb) p /x tmp $9 = 0x62481a00 <-- last byte 0x00 is @epid xhci_doorbell_write() already check the upper bound of @slotid an @epid, it also need to check the lower bound. Cc: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Longpeng <longpeng2@huawei.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 1556605301-44112-1-git-send-email-longpeng2@huawei.com [ kraxel: fixed typo in subject line ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* xhci: check device is not NULL before calling usb_ep_get()Liam Merwick2019-02-201-2/+2
| | | | | | Signed-off-by: Liam Merwick <liam.merwick@oracle.com> Message-id: 1549460216-25808-4-git-send-email-liam.merwick@oracle.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* xhci: add asserts to help with static code analysisLiam Merwick2019-02-201-0/+2
| | | | | | | | | | | | Most callers of xhci_port_update() and xhci_wakeup() pass in a pointer to an array entry and can never be NULL but add two defensive asserts to protect against future changes (e.g. adding a new port speed, etc.) adding a path through xhci_lookup_port() that could result in the return of a NULL XHCIPort. Signed-off-by: Liam Merwick <liam.merwick@oracle.com> Message-id: 1549460216-25808-3-git-send-email-liam.merwick@oracle.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* usb: implement XHCI underrun/overrun eventsYuri Benditovich2019-01-301-2/+15
| | | | | | | | | | | | | | | Implement underrun/overrun events of isochronous endpoints according to XHCI spec (4.10.3.1) Guest software restarts data streaming when receives these events. The XHCI reports these events using interrupter assigned to the slot (as these events do not have TRB), so current commit adds the field of assigned interrupter to the XHCISlot structure. Guest software assigns interrupter to the slot on 'Address Device' and 'Evaluate Context' commands. Signed-off-by: Yuri Benditovich <yuri.benditovich@janustech.com> Message-id: 20190128200444.5128-3-yuri.benditovich@janustech.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* usb: XHCI shall not halt isochronous endpointsYuri Benditovich2019-01-301-0/+5
| | | | | | | | | | | According to the XHCI spec (4.10.2) the controller never halts isochronous endpoints. This commit prevent stop of isochronous streaming when sporadic errors status received from backends. Signed-off-by: Yuri Benditovich <yuri.benditovich@janustech.com> Message-id: 20190128200444.5128-2-yuri.benditovich@janustech.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>