aboutsummaryrefslogtreecommitdiff
path: root/hw/usb/hcd-ohci.c
AgeCommit message (Collapse)Author
2024-06-21hw/usb/hcd-ohci: Fix ohci_service_td: accept zero-length TDs where CBP=BE+1David Hubbard
This changes the way the ohci emulation handles a Transfer Descriptor with "Buffer End" set to "Current Buffer Pointer" - 1, specifically in the case of a zero-length packet. The OHCI spec 4.3.1.2 Table 4-2 specifies td.cbp to be zero for a zero-length packet. Peter Maydell tracked down commit 1328fe0c32 (hw: usb: hcd-ohci: check len and frame_number variables) where qemu started checking this according to the spec. What this patch does is loosen the qemu ohci implementation to allow a zero-length packet if td.be (Buffer End) is set to td.cbp - 1, and with a non-zero td.cbp value. The spec is unclear whether this is valid or not -- it is not the clearly documented way to send a zero length TD (which is CBP=BE=0), but it isn't specifically forbidden. Actual hw seems to be ok with it. Does any OS rely on this behavior? There have been no reports to qemu-devel of this problem. This is attempting to have qemu behave like actual hardware, but this is just a minor change. With a tiny OS[1] that boots and executes a test, the issue can be seen: * OS that sends USB requests to a USB mass storage device but sends td.cbp = td.be + 1 * qemu 4.2 * qemu HEAD (4e66a0854) * Actual OHCI controller (hardware) Command line: qemu-system-x86_64 -m 20 \ -device pci-ohci,id=ohci \ -drive if=none,format=raw,id=d,file=testmbr.raw \ -device usb-storage,bus=ohci.0,drive=d \ --trace "usb_*" --trace "ohci_*" -D qemu.log Results are: qemu 4.2 | qemu HEAD | actual HW -----------+------------+----------- works fine | ohci_die() | works fine Tip: if the flags "-serial pty -serial stdio" are added to the command line the test will output USB requests like this: Testing qemu HEAD: > Free mem 2M ohci port2 conn FS > setup { 80 6 0 1 0 0 8 0 } > ED info=80000 { mps=8 en=0 d=0 } tail=c20920 > td0 c20880 nxt=c20960 f2000000 setup cbp=c20900 be=c20907 > td1 c20960 nxt=c20980 f3140000 in cbp=c20908 be=c2090f > td2 c20980 nxt=c20920 f3080000 out cbp=c20910 be=c2090f ohci20 host err > usb stopped And in qemu.log: usb_ohci_iso_td_bad_cc_overrun ISO_TD start_offset=0x00c20910 > next_offset=0x00c2090f Testing qemu 4.2: > Free mem 2M ohci port2 conn FS > setup { 80 6 0 1 0 0 8 0 } > ED info=80000 { mps=8 en=0 d=0 } tail=620920 > td0 620880 nxt=620960 f2000000 setup cbp=620900 be=620907 cbp=0 be=620907 > td1 620960 nxt=620980 f3140000 in cbp=620908 be=62090f cbp=0 be=62090f > td2 620980 nxt=620920 f3080000 out cbp=620910 be=62090f cbp=0 be=62090f > rx { 12 1 0 2 0 0 0 8 } > setup { 0 5 1 0 0 0 0 0 } tx {} > ED info=80000 { mps=8 en=0 d=0 } tail=620880 > td0 620920 nxt=620960 f2000000 setup cbp=620900 be=620907 cbp=0 be=620907 > td1 620960 nxt=620880 f3100000 in cbp=620908 be=620907 cbp=0 be=620907 > setup { 80 6 0 1 0 0 12 0 } > ED info=80001 { mps=8 en=0 d=1 } tail=620960 > td0 620880 nxt=6209c0 f2000000 setup cbp=620920 be=620927 cbp=0 be=620927 > td1 6209c0 nxt=6209e0 f3140000 in cbp=620928 be=620939 cbp=0 be=620939 > td2 6209e0 nxt=620960 f3080000 out cbp=62093a be=620939 cbp=0 be=620939 > rx { 12 1 0 2 0 0 0 8 f4 46 1 0 0 0 1 2 3 1 } > setup { 80 6 0 2 0 0 0 1 } > ED info=80001 { mps=8 en=0 d=1 } tail=620880 > td0 620960 nxt=6209a0 f2000000 setup cbp=620a20 be=620a27 cbp=0 be=620a27 > td1 6209a0 nxt=6209c0 f3140004 in cbp=620a28 be=620b27 cbp=620a48 be=620b27 > td2 6209c0 nxt=620880 f3080000 out cbp=620b28 be=620b27 cbp=0 be=620b27 > rx { 9 2 20 0 1 1 4 c0 0 9 4 0 0 2 8 6 50 0 7 5 81 2 40 0 0 7 5 2 2 40 0 0 } > setup { 0 9 1 0 0 0 0 0 } tx {} > ED info=80001 { mps=8 en=0 d=1 } tail=620900 > td0 620880 nxt=620940 f2000000 setup cbp=620a00 be=620a07 cbp=0 be=620a07 > td1 620940 nxt=620900 f3100000 in cbp=620a08 be=620a07 cbp=0 be=620a07 [1] The OS disk image has been emailed to philmd@linaro.org, mjt@tls.msk.ru, and kraxel@redhat.com: * testCbpOffBy1.img.xz * sha256: f87baddcb86de845de12f002c698670a426affb40946025cc32694f9daa3abed Signed-off-by: David Hubbard <dmamfmgm@gmail.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-05-31hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUTDavid Hubbard
This changes the ohci validation to not assert if invalid data is fed to the ohci controller. The poc in https://bugs.launchpad.net/qemu/+bug/1907042 and migrated to bug #303 does the following to feed it a SETUP pid (valid) at an EndPt of 1 (invalid - all SETUP pids must be addressed to EndPt 0): uint32_t MaxPacket = 64; uint32_t TDFormat = 0; uint32_t Skip = 0; uint32_t Speed = 0; uint32_t Direction = 0; /* #define OHCI_TD_DIR_SETUP 0 */ uint32_t EndPt = 1; uint32_t FuncAddress = 0; ed->attr = (MaxPacket << 16) | (TDFormat << 15) | (Skip << 14) | (Speed << 13) | (Direction << 11) | (EndPt << 7) | FuncAddress; ed->tailp = /*TDQTailPntr= */ 0; ed->headp = ((/*TDQHeadPntr= */ &td[0]) & 0xfffffff0) | (/* ToggleCarry= */ 0 << 1); ed->next_ed = (/* NextED= */ 0 & 0xfffffff0) qemu-fuzz also caught the same issue in #1510. They are both fixed by this patch. With a tiny OS[1] that boots and executes the poc the repro shows the issue: * OS that sends USB requests to a USB mass storage device but sends a SETUP with EndPt = 1 * qemu 6.2.0 (Debian 1:6.2+dfsg-2ubuntu6.19) * qemu HEAD (4e66a0854) * Actual OHCI controller (hardware) Command line: qemu-system-x86_64 -m 20 \ -device pci-ohci,id=ohci \ -drive if=none,format=raw,id=d,file=testmbr.raw \ -device usb-storage,bus=ohci.0,drive=d \ --trace "usb_*" --trace "ohci_*" -D qemu.log Results are: qemu 6.2.0 | qemu HEAD | actual HW ------------+-----------+---------------- assertion | assertion | sets stall bit The assertion message is: > qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed. > Aborted (core dumped) Tip: if the flags "-serial pty -serial stdio" are added to the command line the poc outputs its USB requests like this: > Free mem 2M ohci port0 conn FS > setup { 80 6 0 1 0 0 8 0 } > ED info=80000 { mps=8 en=0 d=0 } tail=c20920 > td0 c20880 nxt=c20960 f2000000 setup cbp=c20900 be=c20907 cbp=0 be=c20907 > td1 c20960 nxt=c20980 f3140000 in cbp=c20908 be=c2090f cbp=0 be=c2090f > td2 c20980 nxt=c20920 f3080000 out cbp=0 be=0 cbp=0 be=0 > rx { 12 1 0 2 0 0 0 8 } > setup { 0 5 1 0 0 0 0 0 } tx {} > ED info=80000 { mps=8 en=0 d=0 } tail=c20880 > td0 c20920 nxt=c20960 f2000000 setup cbp=c20900 be=c20907 cbp=0 be=c20907 > td1 c20960 nxt=c20880 f3100000 in cbp=0 be=0 cbp=0 be=0 > setup { 80 6 0 1 0 0 12 0 } > ED info=80081 { mps=8 en=0 d=1 } tail=c20960 > td0 c20880 nxt=c209c0 f2000000 setup cbp=c20920 be=c20927 > td1 c209c0 nxt=c209e0 f3140000 in cbp=c20928 be=c20939 > td2 c209e0 nxt=c20960 f3080000 out cbp=0 be=0qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed. > Aborted (core dumped) [1] The OS disk image has been emailed to philmd@linaro.org, mjt@tls.msk.ru, and kraxel@redhat.com: * testBadSetup.img.xz * sha256: 045b43f4396de02b149518358bf8025d5ba11091e86458875339fc649e6e5ac6 Signed-off-by: David Hubbard <dmamfmgm@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: authorship and signed-off-by tag names fixed up as per on-list agreement] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-02-27hw/usb: extract sysbus-ohci to a separate filePaolo Bonzini
Split the sysbus version to a separate file so that it is not included in PCI-only machines, and adjust Kconfig for machines that do need sysbus-ohci. The copyrights are based on the time and employer of balrog and Paul Brook's contributions. While adjusting the SM501 dependency, move it to the right place instead of keeping it in the R4D machine. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240223124406.234509-10-pbonzini@redhat.com> [PMD: Rename some functions using 'ohci_sysbus_' prefix] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-12-30hw/usb: Constify VMStateRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231221031652.119827-59-richard.henderson@linaro.org>
2023-08-31hw/usb: spelling fixesMichael Tokarev
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20230823065335.1919380-14-mjt@tls.msk.ru> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-05-25usb/ohci: Set pad to 0 after frame updatePaolo Bonzini
When the OHCI controller's framenumber is incremented, HccaPad1 register should be set to zero (Ref OHCI Spec 4.4) ReactOS uses hccaPad1 to determine if the OHCI hardware is running, consequently it fails this check in current qemu master. Signed-off-by: Ryan Wendland <wendland@live.com.au> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1048 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-03-08hw/usb/ohci: Implement resume on connection status changeBALATON Zoltan
If certain bit is set remote wake up should change state from suspended to resume and generate interrupt. There was a todo comment for this, implement that by moving existing resume logic to a function and call that. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <35c4d4ccf2f73e6a87cdbd28fb6a1b33de72ed74.1676916640.git.balaton@eik.bme.hu> [PMD: Have ohci_resume() return a boolean] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-02-27hw/usb/ohci: Fix typoPhilippe Mathieu-Daudé
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <03599fd4db313ac4f651cceb43340109ad6a14b8.1676916640.git.balaton@eik.bme.hu>
2023-02-27hw/usb/ohci: Add trace points for register accessBALATON Zoltan
To help debugging add trace points that print values read from or written to the device's registers. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <1bb4985e5dfc1df5a290e77f76fd827ae3592ab7.1676916640.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-02-27hw/usb/ohci: Move a function next to where it is usedBALATON Zoltan
The ohci_port_set_if_connected() function is only used by ohci_port_set_status(), move next to it to have them at the same place. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <46411d4980ab0fba61ab0d2209a939fdc41eb573.1676916640.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-02-27hw/usb/ohci: Code style fix missing braces and extra parenthesisBALATON Zoltan
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <aaa3ddee99c7677d6cc137f637982e94267b99b6.1676916640.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-02-27hw/usb/ohci: Code style fix white space errorsBALATON Zoltan
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <c9b99b3555dcd03194a8950b810f5e1b4b4bd5d3.1676916640.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-02-27hw/usb/ohci: Code style fix commentsBALATON Zoltan
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <9b0aadedc7c4780fefdc27f14f72ac9003032fbf.1676916639.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-02-27hw/usb/ohci: Use OHCIState type definitionPhilippe Mathieu-Daudé
Forward-define the type first, then use it for the ohci_die() handler. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230220150515.32549-3-philmd@linaro.org>
2022-09-27Merge tag 'kraxel-20220927-pull-request' of https://gitlab.com/kraxel/qemu ↵Stefan Hajnoczi
into staging usb: make usbnet work with xhci. audio: add sndio backend. misc bugfixes for console, xhci, audio, ati-vga and virtio-gpu. # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmMyse8ACgkQTLbY7tPo # cTiLrRAAltoyd++jsmhg2wXuJsfekfec3kOro7T+eSznDWfBRvm7VxJ+gswYBYga # HbEkHjII0yPbOP9WDMhhHx33g2nYdbhDLPKXHdK8MjHTTPxtYP7XmsWkEVpuuzTx # WqeYvGSmUri6QOUz7fd07IhiBT1aQvUQ/vWQ6OhyRVPy41bR8kIbGx3iV0JDxWvz # n3xUZALGLz3QAM0lXRzXPYT9JB/RqdbpMM35HNTpN9/xaZmgFWsyuQXSSm61pTtb # PS+lILDPjgZeYsfsZRyhZaSZrp2f6WOGm1ZdtSM0rvmRKezOzYnG8fm4fqZQLYSj # nrAqUs38sKaM71a3QbpXhDjbv4cpj0K3iSNLmlUq4pgvPiMgwPlgSwwCGlkNDaRo # IA1KON1pMH2A5vvtXEUt5RTkbXxHAAKPdpl5sS6kgbs7dgoKDqzaIPFQELam259Z # 9nbMBqz/d6gm2CFT5ogrY0q511IC5hWtsmbQZkOZeBd5SvhvyJ59DIabFDcw05fG # ixZVapewXYtzFUde2lb8X5qyneUVeGY5D2OJ2uUykHgR2Qz4d3CjXlhnRkLIkMcd # Uu6N1LTkjyuuB86BoTSZxk0iz94OvmyDiXpqwmRaCGcdnTOTj0dKrbRrtHdC2vCo # cBpUAIdyJvDJSm0X8ZWvvv1sMJCAJ7lofFf/P/jUKlacC2ipgXQ= # =QBLK # -----END PGP SIGNATURE----- # gpg: Signature made Tue 27 Sep 2022 04:18:55 EDT # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * tag 'kraxel-20220927-pull-request' of https://gitlab.com/kraxel/qemu: (24 commits) virtio-gpu: update scanout if there is any area covered by the rect hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) audio: remove abort() in audio_bug() Revert "audio: Log context for audio bug" audio: Add sndio backend usbnet: Report link-up via interrupt endpoint in CDC-ECM mode usbnet: Detect short packets as sent by the xHCI controller usbnet: Accept mandatory USB_CDC_SET_ETHERNET_PACKET_FILTER request usbnet: Add missing usb_wakeup() call in usbnet_receive() hcd-xhci: drop operation with secondary stream arrays enabled usb/msd: add usb_msd_fatal_error() and fix guest-triggerable assert usb/msd: move usb_msd_packet_complete() hcd-ohci: Drop ohci_service_iso_td() if ed->head & OHCI_DPTR_MASK is zero hw/usb/hcd-xhci: Check whether DMA accesses fail ui/console: fix three double frees in png_save() ui/vdagent: fix serial reset of guest agent ui/clipboard: reset the serial state on reset ui/vdagent: always reset the clipboard serial on caps ui/clipboard: fix serial priority ui: add some vdagent related traces ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-23hcd-ohci: Drop ohci_service_iso_td() if ed->head & OHCI_DPTR_MASK is zeroQiang Liu
An abort happens in ohci_frame_boundary() when ohci->done is 0 [1]. ``` c static void ohci_frame_boundary(void *opaque) { // ... if (ohci->done_count == 0 && !(ohci->intr_status & OHCI_INTR_WD)) { if (!ohci->done) abort(); <----------------------------------------- [1] ``` This was reported in https://bugs.launchpad.net/qemu/+bug/1911216/, https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg03613.html, and https://gitlab.com/qemu-project/qemu/-/issues/545. I can still reproduce it with the latest QEMU. This happends due to crafted ED with putting ISO_TD at physical address 0. Suppose ed->head & OHCI_DPTR_MASK is 0 [2], and we memset 0 to the phyiscal memory from 0 to sizeof(ohci_iso_td). Then, starting_frame [3] and frame_count [4] are both 0. As we can control the value of ohci->frame_number (0 to 0x1f, suppose 1), we then control the value of relative_frame_number to be 1 [6]. The control flow goes to [7] where ohci->done is 0. Have returned from ohci_service_iso_td(), ohci_frame_boundary() will abort() [1]. ``` c static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed) { // ... addr = ed->head & OHCI_DPTR_MASK; // <--------------------- [2] if (ohci_read_iso_td(ohci, addr, &iso_td)) { // <-------- [3] // ... starting_frame = OHCI_BM(iso_td.flags, TD_SF); // <-------- [4] frame_count = OHCI_BM(iso_td.flags, TD_FC); // <-------- [5] relative_frame_number = USUB(ohci->frame_number, starting_frame); // <-------- [6] if (relative_frame_number < 0) { return 1; } else if (relative_frame_number > frame_count) { // ... ohci->done = addr; // <-------- [7] // ... } ``` As only (afaik) a guest root user can manipulate ED, TD and the physical memory, this assertion failure is not a security bug. The idea to fix this issue is to drop ohci_service_iso_td() if ed->head & OHCI_DPTR_MASK is 0, which is similar to the drop operation for ohci_service_ed_list() when head is 0. Probably, a similar issue is in ohci_service_td(). I drop ohci_service_td() if ed->head & OHCI_DPTR_MASK is 0. Fixes: 7bfe577702 ("OHCI USB isochronous transfers support (Arnon Gilboa)") Reported-by: Gaoning Pan <pgn@zju.edu.cn> Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Qiang Liu <cyruscyliu@gmail.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/545 Buglink: https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg03613.html Buglink: https://bugs.launchpad.net/qemu/+bug/1911216 Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> Message-Id: <20220826051557.119570-1-cyruscyliu@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-22hw/usb/hcd-ohci: Use definition to avoid dynamic stack allocationPhilippe Mathieu-Daudé
The compiler isn't clever enough to figure 'width' is a constant, so help it by using a definitions instead. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20220819153931.3147384-10-peter.maydell@linaro.org
2022-03-04usb/ohci: Don't use packet from OHCIState for isochronous transfersBALATON Zoltan
Since isochronous transfers cannot be handled async (the function returns error in that case) we don't need to remember the packet. Avoid using the usb_packet field in OHCIState (as that can be a waiting async packet on another endpoint) and allocate and use a local USBPacket for the iso transfer instead. After this we don't have to care if we're called from a completion callback or not so we can drop that parameter as well. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <bf523d40f8088a84383cb00ffd2e6e82fa47790d.1643117600.git.balaton@eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-04usb/ohci: Merge ohci_async_cancel_device() into ohci_child_detach()BALATON Zoltan
These two do the same and only used once so no need to have two functions, simplify by merging them. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <5fc8ba0bbf55703014d22dd06ab2f9eabaf370bf.1643117600.git.balaton@eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-04usb/ohci: Move USBPortOps related functions togetherBALATON Zoltan
This also allows removing two forward declarations Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <9fd730375c4cad0b11163631660d68711d3fc13f.1643117600.git.balaton@eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-04usb/ohci: Move cancelling async packet to ohci_stop_endpoints()BALATON Zoltan
This is always done before calling this function so remove duplicated code and do it within the function at one place. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <ce766722506bfd7145cccbec750692ff57072280.1643117600.git.balaton@eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-04usb/ohci: Move trace point and log ep number to help debuggingBALATON Zoltan
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <4e3a05a64b5029a88654eab9a873fb45ac80b1a7.1643117600.git.balaton@eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-12-30dma: Let dma_memory_read/write() take MemTxAttrs argumentPhilippe Mathieu-Daudé
Let devices specify transaction attributes when calling dma_memory_read() or dma_memory_write(). Patch created mechanically using spatch with this script: @@ expression E1, E2, E3, E4; @@ ( - dma_memory_read(E1, E2, E3, E4) + dma_memory_read(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED) | - dma_memory_write(E1, E2, E3, E4) + dma_memory_write(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED) ) Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20211223115554.3155328-6-philmd@redhat.com>
2021-12-30dma: Let dma_memory_rw() take MemTxAttrs argumentPhilippe Mathieu-Daudé
Let devices specify transaction attributes when calling dma_memory_rw(). Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20211223115554.3155328-5-philmd@redhat.com>
2021-03-09Various spelling fixesMichael Tokarev
An assorted set of spelling fixes in various places. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210309111510.79495-1-mjt@msgid.tls.msk.ru> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2020-11-15usb: Fix Lesser GPL version numberChetan Pant
There is no "version 2" of the "Lesser" General Public License. It is either "GPL version 2.0" or "Lesser GPL version 2.1". This patch replaces all occurrences of "Lesser GPL version 2" with "Lesser GPL version 2.1" in comment section. Signed-off-by: Chetan Pant <chetan4windows@gmail.com> Message-Id: <20201023122332.19369-1-chetan4windows@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-09-21hw: usb: hcd-ohci: check for processed TD before retirePrasad J Pandit
While servicing OHCI transfer descriptors(TD), ohci_service_iso_td retires a TD if it has passed its time frame. It does not check if the TD was already processed once and holds an error code in TD_CC. It may happen if the TD list has a loop. Add check to avoid an infinite loop condition. Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Message-id: 20200915182259.68522-3-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-09-21hw: usb: hcd-ohci: check len and frame_number variablesPrasad J Pandit
While servicing the OHCI transfer descriptors(TD), OHCI host controller derives variables 'start_addr', 'end_addr', 'len' etc. from values supplied by the host controller driver. Host controller driver may supply values such that using above variables leads to out-of-bounds access issues. Add checks to avoid them. AddressSanitizer: stack-buffer-overflow on address 0x7ffd53af76a0 READ of size 2 at 0x7ffd53af76a0 thread T0 #0 ohci_service_iso_td ../hw/usb/hcd-ohci.c:734 #1 ohci_service_ed_list ../hw/usb/hcd-ohci.c:1180 #2 ohci_process_lists ../hw/usb/hcd-ohci.c:1214 #3 ohci_frame_boundary ../hw/usb/hcd-ohci.c:1257 #4 timerlist_run_timers ../util/qemu-timer.c:572 #5 qemu_clock_run_timers ../util/qemu-timer.c:586 #6 qemu_clock_run_all_timers ../util/qemu-timer.c:672 #7 main_loop_wait ../util/main-loop.c:527 #8 qemu_main_loop ../softmmu/vl.c:1676 #9 main ../softmmu/main.c:50 Reported-by: Gaoning Pan <pgn@zju.edu.cn> Reported-by: Yongkang Jia <j_kangel@163.com> Reported-by: Yi Ren <yunye.ry@alibaba-inc.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20200915182259.68522-2-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-02-21hw: usb: hcd-ohci: Move OHCISysBusState and TYPE_SYSBUS_OHCI to include fileGuenter Roeck
We need to be able to use OHCISysBusState outside hcd-ohci.c, so move it to its include file. Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com> Message-id: 20200217204812.9857-2-linux@roeck-us.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-01-24qdev: set properties with device_class_set_props()Marc-André Lureau
The following patch will need to handle properties registration during class_init time. Let's use a device_class_set_props() setter. spatch --macro-file scripts/cocci-macro-file.h --sp-file ./scripts/coccinelle/qdev-set-props.cocci --keep-comments --in-place --dir . @@ typedef DeviceClass; DeviceClass *d; expression val; @@ - d->props = val + device_class_set_props(d, val) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20200110153039.1379601-20-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-08-16Include hw/qdev-properties.h lessMarkus Armbruster
In my "build everything" tree, changing hw/qdev-properties.h triggers a recompile of some 2700 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). Many places including hw/qdev-properties.h (directly or via hw/qdev.h) actually need only hw/qdev-core.h. Include hw/qdev-core.h there instead. hw/qdev.h is actually pointless: all it does is include hw/qdev-core.h and hw/qdev-properties.h, which in turn includes hw/qdev-core.h. Replace the remaining uses of hw/qdev.h by hw/qdev-properties.h. While there, delete a few superfluous inclusions of hw/qdev-core.h. Touching hw/qdev-properties.h now recompiles some 1200 objects. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: "Daniel P. Berrangé" <berrange@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20190812052359.30071-22-armbru@redhat.com>
2019-08-16Include hw/hw.h exactly where neededMarkus Armbruster
In my "build everything" tree, changing hw/hw.h triggers a recompile of some 2600 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). The previous commits have left only the declaration of hw_error() in hw/hw.h. This permits dropping most of its inclusions. Touching it now recompiles less than 200 objects. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20190812052359.30071-19-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-08-16Include migration/vmstate.h lessMarkus Armbruster
In my "build everything" tree, changing migration/vmstate.h triggers a recompile of some 2700 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). hw/hw.h supposedly includes it for convenience. Several other headers include it just to get VMStateDescription. The previous commit made that unnecessary. Include migration/vmstate.h only where it's still needed. Touching it now recompiles only some 1600 objects. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20190812052359.30071-16-armbru@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-08-16Include hw/irq.h a lot lessMarkus Armbruster
In my "build everything" tree, changing hw/irq.h triggers a recompile of some 5400 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). hw/hw.h supposedly includes it for convenience. Several other headers include it just to get qemu_irq and.or qemu_irq_handler. Move the qemu_irq and qemu_irq_handler typedefs from hw/irq.h to qemu/typedefs.h, and then include hw/irq.h only where it's still needed. Touching it now recompiles only some 500 objects. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20190812052359.30071-13-armbru@redhat.com>
2019-06-12Include qemu/module.h where needed, drop it from qemu-common.hMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190523143508.25387-4-armbru@redhat.com> [Rebased with conflicts resolved automatically, except for hw/usb/dev-hub.c hw/misc/exynos4210_rng.c hw/misc/bcm2835_rng.c hw/misc/aspeed_scu.c hw/display/virtio-vga.c hw/arm/stm32f205_soc.c; ui/cocoa.m fixed up]
2019-05-02hw/usb/hcd-ohci: Move PCI-related code into a separate fileThomas Huth
Some machines (like the pxa2xx-based ARM machines) only have a sysbus OHCI controller, but no PCI. With the new Kconfig-style build system, it will soon be possible to create QEMU binaries that only contain such PCI-less machines. However, the two OHCI controllers, for sysbus and for PCI, are currently both located in one file, so the PCI code is still required for linking here. Move the OHCI-PCI device code into a separate file, so that it is possible to use the sysbus OHCI device also without the PCI dependency. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190419075625.24251-3-thuth@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-05-02hw/usb/hcd-ohci: Do not use PCI functions with sysbus devices in ohci_die()Thomas Huth
The ohci_die() function always assumes to be running with a PCI OHCI controller and calls the PCI-specific functions pci_set_word(). However, this function might also get called for the sysbus OHCI devices, so it likely fails in that case. To fix this issue, change the code now, so that there are two implementations now, one for sysbus and one for PCI, and use the right function via a function pointer in the OHCIState structure. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190419075625.24251-2-thuth@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-03-26ohci: don't die on ED_LINK_LIMIT overflowLaurent Vivier
Stop processing the descriptor list instead. The next frame timer tick will resume the work Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1686705 Suggested-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-id: 20190321085212.10796-1-lvivier@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-02-20ohci: check device is not NULL before calling usb_ep_get()Liam Merwick
A call to ohci_find_device() can return NULL if it doesn't find a device matching 'addr' so for the two callers, explicitly check the return value before passing it to usb_ep_get(). Signed-off-by: Liam Merwick <liam.merwick@oracle.com> Message-id: 1549460216-25808-6-git-send-email-liam.merwick@oracle.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-10-29usb: ohci: make num_ports to an unsinged integerLi Qiang
This can avoid setting OCHIState.num_ports to a negative num. Signed-off-by: Li Qiang <liq3ea@gmail.com> Message-id: 1540263618-18344-1-git-send-email-liq3ea@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-10-01ohci: set effectively usb frame rate to 1kHzMiguel GAIO
USB frame rate is slightly lower than 1kHz: ie. ~950Hz. Thus usb-audio device is not able to perform a simple audio playback without underruns on audio backend. eg. "-device pci-ohci,id=ohci -device usb-audio,bus=ohci.0" vs PulseAudio backend. more than 50 underruns are observed per second. Update ohci_sof_time computation, using QEMU_CLOCK_VIRTUAL in ohci_usb_start(), and increment by usb_frame_time in ohci_sof() makes USB frame rate close to 1kHz. This way, no audio underrun are observed during audio playback. Signed-off-by: Miguel GAIO <mgaio35@gmail.com> Message-Id: <20180927151936.3647-1-mgaio35@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-08-21ohci: Clear the interrupt counter for erroneous transfersSebastian Bauer
This is mandated by the ohci specification. It tells at 6.4.4 on page 104 that for transfer descriptors that are retired with an error the done queue interrupt counter is cleared as if the interrupt delay field of the descriptions were zero. Before this change, error conditions were handled similarly to the successful condition which is especially troublesome for control transfers. Some drivers (e.g., the AmigaOS-one) as well as the example code in the spec, set the setup stage with an interrupt delay of seven (which means no interrupt). This is fine under normal conditions, because one usually doesn't want to be notified about the completion of this stage. However, if an error occurs in this stage, these drivers will not get notified with the current implementation. The fix addresses this by following the spec more closely. Also, otherwise, the ability to set interrupt delay to seven would be useless. Note that Linux drivers that I looked at don't seem to be affected as they set six as the interrupt delay presumably for the reason that they won't get notified otherwise. Signed-off-by: Sebastian Bauer <mail@sebastianbauer.info> Message-id: 20180729191928.11254-1-mail@sebastianbauer.info Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-10-15pci: Add INTERFACE_CONVENTIONAL_PCI_DEVICE to Conventional PCI devicesEduardo Habkost
Add INTERFACE_CONVENTIONAL_PCI_DEVICE to all direct subtypes of TYPE_PCI_DEVICE, except: 1) The ones that already have INTERFACE_PCIE_DEVICE set: * base-xhci * e1000e * nvme * pvscsi * vfio-pci * virtio-pci * vmxnet3 2) base-pci-bridge Not all PCI bridges are Conventional PCI devices, so INTERFACE_CONVENTIONAL_PCI_DEVICE is added only to the subtypes that are actually Conventional PCI: * dec-21154-p2p-bridge * i82801b11-bridge * pbm-bridge * pci-bridge The direct subtypes of base-pci-bridge not touched by this patch are: * xilinx-pcie-root: Already marked as PCIe-only. * pcie-pci-bridge: Already marked as PCIe-only. * pcie-port: all non-abstract subtypes of pcie-port are already marked as PCIe-only devices. 3) megasas-base Not all megasas devices are Conventional PCI devices, so the interface names are added to the subclasses registered by megasas_register_types(), according to information in the megasas_devices[] array. "megasas-gen2" already implements INTERFACE_PCIE_DEVICE, so add INTERFACE_CONVENTIONAL_PCI_DEVICE only to "megasas". Acked-by: Alberto Garcia <berto@igalia.com> Acked-by: John Snow <jsnow@redhat.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-09-27ohci: Allow sysbus version to be used as a companionBALATON Zoltan
Some PPC SoCs have an EHCI with OHCI companion USB controller. To emulate this allow the sysbus version of OHCI to be used as a companion. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-08-01trace: add trace_event_get_state_backends()Stefan Hajnoczi
Code that checks dstate is unaware of SystemTap and LTTng UST dstate, so the following trace event will not fire when solely enabled by SystemTap or LTTng UST: if (trace_event_get_state(TRACE_MY_EVENT)) { str = g_strdup_printf("Expensive string to generate ...", ...); trace_my_event(str); g_free(str); } Add trace_event_get_state_backends() to fetch backend dstate. Those backends that use QEMU dstate fetch it as part of generate_h_backend_dstate(). Update existing trace_event_get_state() callers to use trace_event_get_state_backends() instead. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20170731140718.22010-3-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-03-09ohci: relax link checkGerd Hoffmann
The strict td link limit added by commit "95ed569 usb: ohci: limit the number of link eds" causes problems with macos guests. Lets raise the limit. Reported-by: Programmingkid <programmingkidx@gmail.com> Reported-by: Howard Spoelstra <hsp.cat7@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: John Arbuckle <programmingkidx@gmail.com> Message-id: 1488876018-31576-1-git-send-email-kraxel@redhat.com
2017-02-23usb: ohci: fix error return code in servicing tdLi Qiang
It should return 1 if an error occurs when reading td. This will avoid an infinite loop issue in ohci_service_ed_list. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1487760990-115925-1-git-send-email-liqiang6-s@360.cn Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-21usb: ohci: limit the number of link edsLi Qiang
The guest may builds an infinite loop with link eds. This patch limit the number of linked ed to avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 5899a02e.45ca240a.6c373.93c1@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-21usb: ohci: fix error return code in servicing iso tdLi Qiang
It should return 1 if an error occurs when reading iso td. This will avoid an infinite loop issue in ohci_service_ed_list. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 5899ac3e.1033240a.944d5.9a2d@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-10-12usb: Fix incorrect default DMA offset.Vijay Kumar B
The default DMA offset is set to 3. When the property is not set by the consumer, the default causes DMA access to be shifted by 3 bytes. In PXA, this results in incorrect DMA access, leading to error notification in the USB controller driver. A better default would be 0, so that there is no offset, when the consumer does not specify one. Signed-off-by: Vijay Kumar B. <vijaykumar@zilogic.com> Reviewed-by: Deepak S. <deepak@zilogic.com> Message-id: 1475060958-7760-1-git-send-email-vijaykumar@zilogic.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-15 15:54:46 +0000