aboutsummaryrefslogtreecommitdiff
path: root/hw/usb/hcd-xhci.c
AgeCommit message (Collapse)Author
2019-06-12Include qemu/module.h where needed, drop it from qemu-common.hMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190523143508.25387-4-armbru@redhat.com> [Rebased with conflicts resolved automatically, except for hw/usb/dev-hub.c hw/misc/exynos4210_rng.c hw/misc/bcm2835_rng.c hw/misc/aspeed_scu.c hw/display/virtio-vga.c hw/arm/stm32f205_soc.c; ui/cocoa.m fixed up]
2019-05-03hw/usb: avoid format truncation warning when formatting port nameDaniel P. Berrangé
hw/usb/hcd-xhci.c: In function ‘usb_xhci_realize’: hw/usb/hcd-xhci.c:3339:66: warning: ‘%d’ directive output may be truncated writing between 1 and 10 bytes into a region of size 5 [-Wformat-trunca\ tion=] 3339 | snprintf(port->name, sizeof(port->name), "usb2 port #%d", i+1); | ^~ hw/usb/hcd-xhci.c:3339:54: note: directive argument in the range [1, 2147483647] 3339 | snprintf(port->name, sizeof(port->name), "usb2 port #%d", i+1); | ^~~~~~~~~~~~~~~ The xhci code formats the port name into a fixed length buffer which is only large enough to hold port numbers upto 5 digits in decimal representation. We're never going to have a port number that large, so aserting the port number is sensible is sufficient to tell GCC the formatted string won't be truncated. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20190412121626.19829-5-berrange@redhat.com> [ kraxel: also s/int/unsigned int/ to tell gcc they can't go negative. ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-05-02usb/xhci: avoid trigger assertion if guest write wrong epidLongpeng
we found the following core in our environment: 0 0x00007fc6b06c2237 in raise () 1 0x00007fc6b06c3928 in abort () 2 0x00007fc6b06bb056 in __assert_fail_base () 3 0x00007fc6b06bb102 in __assert_fail () 4 0x0000000000702e36 in xhci_kick_ep (...) 5 0x000000000047897a in memory_region_write_accessor (...) 6 0x000000000047767f in access_with_adjusted_size (...) 7 0x000000000047944d in memory_region_dispatch_write (...) (mr=mr@entry=0x7fc6a0138df0, addr=addr@entry=156, data=1648892416, size=size@entry=4, attrs=attrs@entry=...) 8 0x000000000042df17 in address_space_write_continue (...) 10 0x000000000043084d in address_space_rw (...) 11 0x000000000047451b in kvm_cpu_exec (cpu=cpu@entry=0x1ab11b0) 12 0x000000000045dcf5 in qemu_kvm_cpu_thread_fn (arg=0x1ab11b0) 13 0x0000000000870631 in qemu_thread_start (args=args@entry=0x1acfb50) 14 0x00000000008959a7 in thread_entry_for_hotfix (pthread_cb=<optimized out>) 15 0x00007fc6b0a60dd5 in start_thread () 16 0x00007fc6b078a59d in clone () (gdb) f 5 5 0x000000000047897a in memory_region_write_accessor (...) 529 mr->ops->write(mr->opaque, addr, tmp, size); (gdb) p /x tmp $9 = 0x62481a00 <-- last byte 0x00 is @epid xhci_doorbell_write() already check the upper bound of @slotid an @epid, it also need to check the lower bound. Cc: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Longpeng <longpeng2@huawei.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 1556605301-44112-1-git-send-email-longpeng2@huawei.com [ kraxel: fixed typo in subject line ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-02-20xhci: check device is not NULL before calling usb_ep_get()Liam Merwick
Signed-off-by: Liam Merwick <liam.merwick@oracle.com> Message-id: 1549460216-25808-4-git-send-email-liam.merwick@oracle.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-02-20xhci: add asserts to help with static code analysisLiam Merwick
Most callers of xhci_port_update() and xhci_wakeup() pass in a pointer to an array entry and can never be NULL but add two defensive asserts to protect against future changes (e.g. adding a new port speed, etc.) adding a path through xhci_lookup_port() that could result in the return of a NULL XHCIPort. Signed-off-by: Liam Merwick <liam.merwick@oracle.com> Message-id: 1549460216-25808-3-git-send-email-liam.merwick@oracle.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-01-30usb: implement XHCI underrun/overrun eventsYuri Benditovich
Implement underrun/overrun events of isochronous endpoints according to XHCI spec (4.10.3.1) Guest software restarts data streaming when receives these events. The XHCI reports these events using interrupter assigned to the slot (as these events do not have TRB), so current commit adds the field of assigned interrupter to the XHCISlot structure. Guest software assigns interrupter to the slot on 'Address Device' and 'Evaluate Context' commands. Signed-off-by: Yuri Benditovich <yuri.benditovich@janustech.com> Message-id: 20190128200444.5128-3-yuri.benditovich@janustech.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-01-30usb: XHCI shall not halt isochronous endpointsYuri Benditovich
According to the XHCI spec (4.10.2) the controller never halts isochronous endpoints. This commit prevent stop of isochronous streaming when sporadic errors status received from backends. Signed-off-by: Yuri Benditovich <yuri.benditovich@janustech.com> Message-id: 20190128200444.5128-2-yuri.benditovich@janustech.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-07-03xhci: fix guest-triggerable assertGerd Hoffmann
Set xhci into error state instead of throwing a core dump. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20180702162752.29233-1-kraxel@redhat.com
2018-02-08pci: removed the is_express field since a uniform interface was insertedYoni Bettan
according to Eduardo Habkost's commit fd3b02c889 all PCIEs now implement INTERFACE_PCIE_DEVICE so we don't need is_express field anymore. Devices that implements only INTERFACE_PCIE_DEVICE (is_express == 1) or devices that implements only INTERFACE_CONVENTIONAL_PCI_DEVICE (is_express == 0) where not affected by the change. The only devices that were affected are those that are hybrid and also had (is_express == 1) - therefor only: - hw/vfio/pci.c - hw/usb/hcd-xhci.c - hw/xen/xen_pt.c For those 3 I made sure that QEMU_PCI_CAP_EXPRESS is on in instance_init() Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Yoni Bettan <ybettan@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-12-05pci: Eliminate redundant PCIDevice::bus pointerDavid Gibson
The bus pointer in PCIDevice is basically redundant with QOM information. It's always initialized to the qdev_get_parent_bus(), the only difference is the type. Therefore this patch eliminates the field, instead creating a pci_get_bus() helper to do the type mangling to derive it conveniently from the QOM Device object underneath. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com>
2017-10-15pci: Add interface names to hybrid PCI devicesEduardo Habkost
The following devices support both PCI Express and Conventional PCI, by including special code to handle the QEMU_PCI_CAP_EXPRESS flag and/or conditional pcie_endpoint_cap_init() calls: * vfio-pci (is_express=1, but legacy PCI handled by vfio_populate_device()) * vmxnet3 (is_express=0, but PCIe handled by vmxnet3_realize()) * pvscsi (is_express=0, but PCIe handled by pvscsi_realize()) * virtio-pci (is_express=0, but PCIe handled by virtio_pci_dc_realize(), and additional legacy PCI code at virtio_pci_realize()) * base-xhci (is_express=1, but pcie_endpoint_cap_init() call is conditional on pci_bus_is_express(dev->bus) * Note that xhci does not clear QEMU_PCI_CAP_EXPRESS like the other hybrid devices Cc: Dmitry Fleytman <dmitry@daynix.com> Cc: Jason Wang <jasowang@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Alex Williamson <alex.williamson@redhat.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-09-13xhci: Avoid DMA when ERSTBA is set to zeroAlexey Kardashevskiy
The existing XHCI code reads the Event Ring Segment Table Base Address Register (ERSTBA) every time when it is changed. However zero is its default state so one would think that zero there means it is not in use. This adds a check for ERSTBA in addition to the existing check for the Event Ring Segment Table Size Register (ERSTSZ). Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Message-id: 20170911065606.40600-1-aik@ozlabs.ru Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-07-03pci: Fix the wrong assertion.Mao Zhongyi
pci_add_capability returns a strictly positive value on success, correct asserts. Cc: dmitry@daynix.com Cc: jasowang@redhat.com Cc: kraxel@redhat.com Cc: alex.williamson@redhat.com Cc: armbru@redhat.com Cc: marcel@redhat.com Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-06-12xhci: only update dequeue ptr on completed transfersGerd Hoffmann
The dequeue pointer should only be updated in case the transfer is actually completed. If we update it for inflight transfers we will not pick them up again after migration, which easily triggers with HID devices as they typically have a pending transfer, waiting for user input to happen. Fixes: 243afe858b95765b98d16a1f0dd50dca262858ad Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1451631 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Laurent Vivier <lvivier@redhat.com> Message-id: 20170608074122.32099-1-kraxel@redhat.com
2017-05-29xhci: split into multiple filesGerd Hoffmann
Moved structs and defines to hcd-xhci.h. Move nec controller variant to hcd-xhci-nec.c. No functional changes. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170517103313.8459-1-kraxel@redhat.com
2017-05-12xhci: relax link checkLadi Prosek
The strict td link limit added by commit "05f43d4 xhci: limit the number of link trbs we are willing to process" causes problems with Windows guests. Let's raise the limit. This change is analogous to: commit ab6b1105a2259c7072905887f71caa850ce63190 Author: Gerd Hoffmann <kraxel@redhat.com> Date: Tue Mar 7 09:40:18 2017 +0100 ohci: relax link check Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 20170512102100.22675-1-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-05-12xhci: fix loggingLadi Prosek
slotid and epid were deleted from XHCITransfer in commit d6fcb29. Also deleting one unused forward declaration. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 20170511125314.24549-2-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-03xhci: flush dequeue pointer to endpoint contextGerd Hoffmann
When done processing a endpoint ring we must update the dequeue pointer in the endpoint context in guest memory. This is needed to make sure the guest has a correct view of things and also to make live migration work properly, because xhci post_load restores alot of the state from xhci data structures in guest memory. Add xhci_set_ep_state() call to do that. The recursive calls stopped by commit ddb603ab6c981c1d67cb42266fc700c33e5b2d8f had the (unintentional) side effect to hiding this bug. xhci_set_ep_state() was called before processing, to set the state to running, which updated the dequeue pointer too. Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20170331102521.29253-1-kraxel@redhat.com
2017-02-23xhci: properties cleanupGerd Hoffmann
Split xhci properties into common and nec specific. Move the backward compat flags to nec, so the new qemu-xhci devices doesn't carry on the compatibiity stuff. Move the msi/msix switches too and just enable msix for qemu-xhci. Also move the intrs and slots properties. Wasn't a great idea to make them configurable in the first place, nobody needs this. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1487663432-10410-1-git-send-email-kraxel@redhat.com
2017-02-21xhci: drop via vendor command handlingGerd Hoffmann
Seems pretty pointless, we don't emulate an via xhci controller. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486382139-30630-5-git-send-email-kraxel@redhat.com
2017-02-21xhci: fix nec vendor quirk handlingGerd Hoffmann
Only the TYPE_NEC_XHCI controller will have the nec vendor quirks. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486382139-30630-4-git-send-email-kraxel@redhat.com
2017-02-21xhci: add qemu xhci controllerGerd Hoffmann
Turn existing TYPE_XHCI into an abstract base class. Create two child classes, TYPE_NEC_XHCI (same name as old xhci controller) and TYPE_QEMU_XHCI (using an ID from our namespace). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Message-id: 1486382139-30630-3-git-send-email-kraxel@redhat.com
2017-02-21xhci: drop ER_FULL_HACK workaroundGerd Hoffmann
The nec/renesas driver problems have finally been debugged and root caused, see commit "7da76e1 xhci: fix event queue IRQ handling". It's pretty clear now that (a) The whole "driver can't handle ring full" story is most likely wrong. (b) The ER_FULL_HACK workaround based on the false assumtion doesn't much. It avoids the driver crashing (without commit 7da76e1), but it doesn't make usb work. (c) With 7da76e1 applied it doesn't trigger any more. So, lets kill it. Or, to be exact, lets almost kill it. Some data fields are kept unused in the state struct, for live migration backward compatibility. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486382139-30630-2-git-send-email-kraxel@redhat.com
2017-02-21xhci: apply limits to loopsGerd Hoffmann
Limits should be big enough that normal guest should not hit it. Add a tracepoint to log them, just in case. Also, while being at it, log the existing link trb limit too. Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486383669-6421-1-git-send-email-kraxel@redhat.com
2017-02-06xhci: fix event queue IRQ handlingGerd Hoffmann
The qemu xhci emulation doesn't handle the ERDP_EHB flag correctly. When the host adapter queues a new event the ERDP_EHB flag is set. The flag is cleared (via w1c) by the guest when it updates the ERDP (event ring dequeue pointer) register to notify the host adapter which events it has fetched. An IRQ must be raised in case the ERDP_EHB flag flips from clear to set. If the flag is set already (which implies there are events queued up which are not yet processed by the guest) xhci must *not* raise a IRQ. Qemu got that wrong and raised an IRQ on every event, thereby generating spurious interrupts in case we've queued events faster than the guest processed them. This patch fixes that. With that change in place we also have to check ERDP updates, to see whenever the guest has fetched all queued events. In case there are still pending events set ERDP_EHB and raise an IRQ again, to make sure the events don't linger unseen forever. The linux kernel driver and the microsoft windows driver (shipped with win8+) can deal with the spurious interrupts without problems. The renesas windows driver (v2.1.39) which can be used on older windows versions is quite upset though. It does spurious ERDP updates now and then (not every time, seems we must hit a race window for this to happen), which in turn makes the qemu xhci emulation think the event ring is full. Things go south from here ... tl;dr: This is the "fix xhci on win7" patch. Cc: M.Cerveny@computer.org Cc: 1373228@bugs.launchpad.net Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486104705-13761-1-git-send-email-kraxel@redhat.com
2017-02-06xhci: guard xhci_kick_epctx against recursive callsGerd Hoffmann
Track xhci_kick_epctx processing being active in a variable. Check the variable before calling xhci_kick_epctx from xhci_kick_ep. Add an assert to make sure we don't call recursively into xhci_kick_epctx. Cc: 1653384@bugs.launchpad.net Fixes: 94b037f2a451b3dc855f9f2c346e5049a361bd55 Reported-by: Fabian Lesniak <fabian@lesniak-it.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486035372-3621-1-git-send-email-kraxel@redhat.com Message-id: 1485790607-31399-5-git-send-email-kraxel@redhat.com
2017-02-06xhci: don't kick in xhci_submit and xhci_fire_ctl_transferGerd Hoffmann
xhci_submit and xhci_fire_ctl_transfer are is called from xhci_kick_epctx processing loop only, so there is no need to call xhci_kick_epctx make sure processing continues. Also eecursive calls into xhci_kick_epctx can cause trouble. Drop the xhci_kick_epctx calls. Cc: 1653384@bugs.launchpad.net Fixes: 94b037f2a451b3dc855f9f2c346e5049a361bd55 Reported-by: Fabian Lesniak <fabian@lesniak-it.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485790607-31399-4-git-send-email-kraxel@redhat.com
2017-02-06xhci: rename xhci_complete_packet to xhci_try_complete_packetGerd Hoffmann
Make clear that this isn't guaranteed to actually complete the transfer, the usb packet can still be in flight after calling that function. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485790607-31399-3-git-send-email-kraxel@redhat.com
2017-02-06xhci: only free completed transfersGerd Hoffmann
Most callsites check already, one was missed. Cc: 1653384@bugs.launchpad.net Fixes: 94b037f2a451b3dc855f9f2c346e5049a361bd55 Reported-by: Fabian Lesniak <fabian@lesniak-it.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485790607-31399-2-git-send-email-kraxel@redhat.com
2017-02-01pci: Convert msix_init() to Error and fix callersCao jin
msix_init() reports errors with error_report(), which is wrong when it's used in realize(). The same issue was fixed for msi_init() in commit 1108b2f. In order to make the API change as small as possible, leave the return value check to later patch. For some devices(like e1000e, vmxnet3, nvme) who won't fail because of msix_init's failure, suppress the error report by passing NULL error object. Bonus: add comment for msix_init. CC: Jiri Pirko <jiri@resnulli.us> CC: Gerd Hoffmann <kraxel@redhat.com> CC: Dmitry Fleytman <dmitry@daynix.com> CC: Jason Wang <jasowang@redhat.com> CC: Michael S. Tsirkin <mst@redhat.com> CC: Hannes Reinecke <hare@suse.de> CC: Paolo Bonzini <pbonzini@redhat.com> CC: Alex Williamson <alex.williamson@redhat.com> CC: Markus Armbruster <armbru@redhat.com> CC: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-01hcd-xhci: check & correct param before using itCao jin
usb_xhci_realize() corrects invalid values of property "intrs" automatically, but the uncorrected value is passed to msi_init(), which chokes on invalid values. Delay that until after the correction. Resources allocated by usb_xhci_init() are leaked when msi_init() fails. Fix by calling it after msi_init(). CC: Gerd Hoffmann <kraxel@redhat.com> CC: Markus Armbruster <armbru@redhat.com> CC: Marcel Apfelbaum <marcel@redhat.com> CC: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-01-24PCI/migration merge vmstate_pci_device and vmstate_pcie_deviceDr. David Alan Gilbert
The vmstate_pci_device and vmstate_pcie_devices differ just in the size of one buffer; combine the two using a _TEST macro. I think this is safe as long as everywhere which currently uses either of these two uses the right type. One thing that concerns me is that some places use pci_device_load/save which does some irq mangling, but others just use the VMSTATE_PCI_DEVICE macro - how are they getting the same irq mangling? This passes a smoke test migrate of: ./x86_64-softmmu/qemu-system-x86_64 -M pc,accel=kvm -m 1024 ./littlefed20.img -device e1000e -device virtio-net -device e1000 -device virtio-rng -device megasas -device megasas-gen2 -device ioh3420 -device nec-usb-xhci to an unmodified qemu. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20161214195829.18241-1-dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2016-10-12xhci: make xhci_epid_to_usbep accept XHCIEPContextGerd Hoffmann
All callsites have a XHCIEPContext pointer anyway, so we can just pass it directly instead of fiddeling with slotid and epid. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-9-git-send-email-kraxel@redhat.com
2016-10-12xhci: drop XHCITransfer->{slotid,epid}Gerd Hoffmann
We can use XHCITransfer->epctx->{slotid,epid} instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-8-git-send-email-kraxel@redhat.com
2016-10-12xhci: add & use xhci_kick_epctx()Gerd Hoffmann
xhci_kick_epctx is a xhci_kick_ep variant which takes an XHCIEPContext as input instead of slotid and epid. So in case we have a XHCIEPContext at hand at the callsite we can just pass it directly. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-7-git-send-email-kraxel@redhat.com
2016-10-12xhci: drop XHCITransfer->xhciGerd Hoffmann
Use XHCITransfer->epctx->xhci instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-6-git-send-email-kraxel@redhat.com
2016-10-12xhci: use linked list for transfersGerd Hoffmann
xhci has a fixed number of 24 (TD_QUEUE) XHCITransfer structs per endpoint, which turns out to be a problem for usb3 devices with 32 (or more) bulk streams. xhci re-checks the trb rings on every finished transfer to make sure it'll pick up any pending work. But that scheme breaks in case the first transfer of a ring can't be started because we ran out of XHCITransfer structs already. So remove static XHCITransfer array from XHCIEPContext. Use a linked list instead, and allocate/free XHCITransfer as needed. Add helper functions to allocate & initialize and to cleanup & release XHCITransfer structs. That also simplifies trb management, we never have to realloc XHCITransfer->trbs because we don't reuse XHCITransfer structs any more. New dynamic limit for in-flight xhci transfers per endpoint is number-of-streams + 16. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-5-git-send-email-kraxel@redhat.com
2016-10-12xhci: drop unused comp_xfer fieldGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-4-git-send-email-kraxel@redhat.com
2016-10-12xhci: decouple EV_QUEUE from TD_QUEUEGerd Hoffmann
EV_QUEUE must not change because an array of that size is part of live migration data. Hard-code current value there, so we can touch TD_QUEUE without breaking live migration. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-3-git-send-email-kraxel@redhat.com
2016-10-12xhci: limit the number of link trbs we are willing to processGerd Hoffmann
Needed to avoid we run in circles forever in case the guest builds an endless loop with link trbs. Reported-by: Li Qiang <liqiang6-s@360.cn> Tested-by: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1476096382-7981-1-git-send-email-kraxel@redhat.com
2016-09-13usb:xhci:fix memory leak in usb_xhci_exitLi Qiang
If the xhci uses msix, it doesn't free the corresponding memory, thus leading a memory leak. This patch avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 57d7d2e0.d4301c0a.d13e9.9a55@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-09-13xhci: Fix remainder field for TR_SETUP completion event.Hans Petter Selasky
Previously the code would incorrectly report the remainder as 8 bytes. A remainder of 0 bytes should be reported when the SETUP packet is successfully transferred. Found using FreeBSD's XHCI driver. Signed-off-by: Hans Petter Selasky <hps@selasky.org> [ kraxel: codestyle fixup ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-07-20xhci: Fix possible side effect from assert()Alexey Kardashevskiy
A static analysis tool called BEAM detected possible side effect from assert() calling a helper which may change an XHCI ring after every call. This moves xhci_ring_fetch() out of assert() so it will be called with and without enabled debug. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Message-id: 1468812548-31868-1-git-send-email-aik@ozlabs.ru Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-07-12nec-usb-xhci: set the device state to USB_STATE_DEFAULTZhang Shuaiyi
This patch is a rough fix to "hw/usb/core.c:401: usb_handle_packet: Assertion `dev->state == 3' failed.". Qemu will crash when a usb3 device redirect to Windows7 VM via nec-usb-xhci. In extensible-host-controler-interface-usb-xhci.pdf P94(4.6.5 Address Device): • If the Block Set Address Request (BSR) flag = ‘1’ • If the slot is in the Enabled state: ... • Set the Slot State in the Output Slot Context to Default. BSR = ‘1’: Enabled state to Default state; BSR = ‘0’: Default state to Addressed state. Try to call usb_device_reset to set device state to USB_STATE_DEFAULT in xhci_address_slot wether bsr is zero. Signed-off-by: Zhang Shuaiyi <zhang_syi@massclouds.com> Message-id: 1467258640-11921-1-git-send-email-zhang_syi@massclouds.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-07-05pci: Convert msi_init() to Error and fix callers to check itCao jin
msi_init() reports errors with error_report(), which is wrong when it's used in realize(). Fix by converting it to Error. Fix its callers to handle failure instead of ignoring it. For those callers who don't handle the failure, it might happen: when user want msi on, but he doesn't get what he want because of msi_init fails silently. cc: Gerd Hoffmann <kraxel@redhat.com> cc: John Snow <jsnow@redhat.com> cc: Dmitry Fleytman <dmitry@daynix.com> cc: Jason Wang <jasowang@redhat.com> cc: Michael S. Tsirkin <mst@redhat.com> cc: Hannes Reinecke <hare@suse.de> cc: Paolo Bonzini <pbonzini@redhat.com> cc: Alex Williamson <alex.williamson@redhat.com> cc: Markus Armbruster <armbru@redhat.com> cc: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Hannes Reinecke <hare@suse.com>
2016-07-05usb xhci: change msi/msix property typeCao jin
>From bit to enum OnOffAuto cc: Gerd Hoffmann <kraxel@redhat.com> cc: Michael S. Tsirkin <mst@redhat.com> cc: Markus Armbruster <armbru@redhat.com> cc: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-05-11usb:xhci: no DMA on HC resetRoman Kagan
This patch is a rough fix to a memory corruption we are observing when running VMs with xhci USB controller and OVMF firmware. Specifically, on the following call chain xhci_reset xhci_disable_slot xhci_disable_ep xhci_set_ep_state QEMU overwrites guest memory using stale guest addresses. This doesn't happen when the guest (firmware) driver sets up xhci for the first time as there are no slots configured yet. However when the firmware hands over the control to the OS some slots and endpoints are already set up with their context in the guest RAM. Now the OS' driver resets the controller again and xhci_set_ep_state then reads and writes that memory which is now owned by the OS. As a quick fix, skip calling xhci_set_ep_state in xhci_disable_ep if the device context base address array pointer is zero (indicating we're in the HC reset and no DMA is possible). Cc: qemu-stable@nongnu.org Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Message-id: 1462384435-1034-1-git-send-email-rkagan@virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-03-18usb: fix unbounded stack warning for xhci_dma_write_u32sPeter Xu
All the callers for xhci_dma_write_u32s() are using mostly 5 * uint32_t in len. To avoid unbound stack warning for the function, make it statically allocated, and assert when it's not big enough in the future. Signed-off-by: Peter Xu <peterx@redhat.com> Message-id: 1457661106-9569-1-git-send-email-peterx@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-01-29usb: Clean up includesPeter Maydell
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-20-git-send-email-peter.maydell@linaro.org
2015-11-06usb: Use g_new() & friends where that makes obvious senseMarkus Armbruster
g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer, for two reasons. One, it catches multiplication overflowing size_t. Two, it returns T * rather than void *, which lets the compiler catch more type errors. This commit only touches allocations with size arguments of the form sizeof(T). Same Coccinelle semantic patch as in commit b45c03f. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-15 11:59:47 +0000