aboutsummaryrefslogtreecommitdiff
path: root/hw/usb/hcd-xhci.c
AgeCommit message (Collapse)Author
2017-02-06xhci: fix event queue IRQ handlingGerd Hoffmann
The qemu xhci emulation doesn't handle the ERDP_EHB flag correctly. When the host adapter queues a new event the ERDP_EHB flag is set. The flag is cleared (via w1c) by the guest when it updates the ERDP (event ring dequeue pointer) register to notify the host adapter which events it has fetched. An IRQ must be raised in case the ERDP_EHB flag flips from clear to set. If the flag is set already (which implies there are events queued up which are not yet processed by the guest) xhci must *not* raise a IRQ. Qemu got that wrong and raised an IRQ on every event, thereby generating spurious interrupts in case we've queued events faster than the guest processed them. This patch fixes that. With that change in place we also have to check ERDP updates, to see whenever the guest has fetched all queued events. In case there are still pending events set ERDP_EHB and raise an IRQ again, to make sure the events don't linger unseen forever. The linux kernel driver and the microsoft windows driver (shipped with win8+) can deal with the spurious interrupts without problems. The renesas windows driver (v2.1.39) which can be used on older windows versions is quite upset though. It does spurious ERDP updates now and then (not every time, seems we must hit a race window for this to happen), which in turn makes the qemu xhci emulation think the event ring is full. Things go south from here ... tl;dr: This is the "fix xhci on win7" patch. Cc: M.Cerveny@computer.org Cc: 1373228@bugs.launchpad.net Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486104705-13761-1-git-send-email-kraxel@redhat.com
2017-02-06xhci: guard xhci_kick_epctx against recursive callsGerd Hoffmann
Track xhci_kick_epctx processing being active in a variable. Check the variable before calling xhci_kick_epctx from xhci_kick_ep. Add an assert to make sure we don't call recursively into xhci_kick_epctx. Cc: 1653384@bugs.launchpad.net Fixes: 94b037f2a451b3dc855f9f2c346e5049a361bd55 Reported-by: Fabian Lesniak <fabian@lesniak-it.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486035372-3621-1-git-send-email-kraxel@redhat.com Message-id: 1485790607-31399-5-git-send-email-kraxel@redhat.com
2017-02-06xhci: don't kick in xhci_submit and xhci_fire_ctl_transferGerd Hoffmann
xhci_submit and xhci_fire_ctl_transfer are is called from xhci_kick_epctx processing loop only, so there is no need to call xhci_kick_epctx make sure processing continues. Also eecursive calls into xhci_kick_epctx can cause trouble. Drop the xhci_kick_epctx calls. Cc: 1653384@bugs.launchpad.net Fixes: 94b037f2a451b3dc855f9f2c346e5049a361bd55 Reported-by: Fabian Lesniak <fabian@lesniak-it.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485790607-31399-4-git-send-email-kraxel@redhat.com
2017-02-06xhci: rename xhci_complete_packet to xhci_try_complete_packetGerd Hoffmann
Make clear that this isn't guaranteed to actually complete the transfer, the usb packet can still be in flight after calling that function. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485790607-31399-3-git-send-email-kraxel@redhat.com
2017-02-06xhci: only free completed transfersGerd Hoffmann
Most callsites check already, one was missed. Cc: 1653384@bugs.launchpad.net Fixes: 94b037f2a451b3dc855f9f2c346e5049a361bd55 Reported-by: Fabian Lesniak <fabian@lesniak-it.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485790607-31399-2-git-send-email-kraxel@redhat.com
2017-02-01pci: Convert msix_init() to Error and fix callersCao jin
msix_init() reports errors with error_report(), which is wrong when it's used in realize(). The same issue was fixed for msi_init() in commit 1108b2f. In order to make the API change as small as possible, leave the return value check to later patch. For some devices(like e1000e, vmxnet3, nvme) who won't fail because of msix_init's failure, suppress the error report by passing NULL error object. Bonus: add comment for msix_init. CC: Jiri Pirko <jiri@resnulli.us> CC: Gerd Hoffmann <kraxel@redhat.com> CC: Dmitry Fleytman <dmitry@daynix.com> CC: Jason Wang <jasowang@redhat.com> CC: Michael S. Tsirkin <mst@redhat.com> CC: Hannes Reinecke <hare@suse.de> CC: Paolo Bonzini <pbonzini@redhat.com> CC: Alex Williamson <alex.williamson@redhat.com> CC: Markus Armbruster <armbru@redhat.com> CC: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-01hcd-xhci: check & correct param before using itCao jin
usb_xhci_realize() corrects invalid values of property "intrs" automatically, but the uncorrected value is passed to msi_init(), which chokes on invalid values. Delay that until after the correction. Resources allocated by usb_xhci_init() are leaked when msi_init() fails. Fix by calling it after msi_init(). CC: Gerd Hoffmann <kraxel@redhat.com> CC: Markus Armbruster <armbru@redhat.com> CC: Marcel Apfelbaum <marcel@redhat.com> CC: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-01-24PCI/migration merge vmstate_pci_device and vmstate_pcie_deviceDr. David Alan Gilbert
The vmstate_pci_device and vmstate_pcie_devices differ just in the size of one buffer; combine the two using a _TEST macro. I think this is safe as long as everywhere which currently uses either of these two uses the right type. One thing that concerns me is that some places use pci_device_load/save which does some irq mangling, but others just use the VMSTATE_PCI_DEVICE macro - how are they getting the same irq mangling? This passes a smoke test migrate of: ./x86_64-softmmu/qemu-system-x86_64 -M pc,accel=kvm -m 1024 ./littlefed20.img -device e1000e -device virtio-net -device e1000 -device virtio-rng -device megasas -device megasas-gen2 -device ioh3420 -device nec-usb-xhci to an unmodified qemu. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20161214195829.18241-1-dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2016-10-12xhci: make xhci_epid_to_usbep accept XHCIEPContextGerd Hoffmann
All callsites have a XHCIEPContext pointer anyway, so we can just pass it directly instead of fiddeling with slotid and epid. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-9-git-send-email-kraxel@redhat.com
2016-10-12xhci: drop XHCITransfer->{slotid,epid}Gerd Hoffmann
We can use XHCITransfer->epctx->{slotid,epid} instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-8-git-send-email-kraxel@redhat.com
2016-10-12xhci: add & use xhci_kick_epctx()Gerd Hoffmann
xhci_kick_epctx is a xhci_kick_ep variant which takes an XHCIEPContext as input instead of slotid and epid. So in case we have a XHCIEPContext at hand at the callsite we can just pass it directly. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-7-git-send-email-kraxel@redhat.com
2016-10-12xhci: drop XHCITransfer->xhciGerd Hoffmann
Use XHCITransfer->epctx->xhci instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-6-git-send-email-kraxel@redhat.com
2016-10-12xhci: use linked list for transfersGerd Hoffmann
xhci has a fixed number of 24 (TD_QUEUE) XHCITransfer structs per endpoint, which turns out to be a problem for usb3 devices with 32 (or more) bulk streams. xhci re-checks the trb rings on every finished transfer to make sure it'll pick up any pending work. But that scheme breaks in case the first transfer of a ring can't be started because we ran out of XHCITransfer structs already. So remove static XHCITransfer array from XHCIEPContext. Use a linked list instead, and allocate/free XHCITransfer as needed. Add helper functions to allocate & initialize and to cleanup & release XHCITransfer structs. That also simplifies trb management, we never have to realloc XHCITransfer->trbs because we don't reuse XHCITransfer structs any more. New dynamic limit for in-flight xhci transfers per endpoint is number-of-streams + 16. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-5-git-send-email-kraxel@redhat.com
2016-10-12xhci: drop unused comp_xfer fieldGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-4-git-send-email-kraxel@redhat.com
2016-10-12xhci: decouple EV_QUEUE from TD_QUEUEGerd Hoffmann
EV_QUEUE must not change because an array of that size is part of live migration data. Hard-code current value there, so we can touch TD_QUEUE without breaking live migration. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1474965172-30321-3-git-send-email-kraxel@redhat.com
2016-10-12xhci: limit the number of link trbs we are willing to processGerd Hoffmann
Needed to avoid we run in circles forever in case the guest builds an endless loop with link trbs. Reported-by: Li Qiang <liqiang6-s@360.cn> Tested-by: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1476096382-7981-1-git-send-email-kraxel@redhat.com
2016-09-13usb:xhci:fix memory leak in usb_xhci_exitLi Qiang
If the xhci uses msix, it doesn't free the corresponding memory, thus leading a memory leak. This patch avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 57d7d2e0.d4301c0a.d13e9.9a55@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-09-13xhci: Fix remainder field for TR_SETUP completion event.Hans Petter Selasky
Previously the code would incorrectly report the remainder as 8 bytes. A remainder of 0 bytes should be reported when the SETUP packet is successfully transferred. Found using FreeBSD's XHCI driver. Signed-off-by: Hans Petter Selasky <hps@selasky.org> [ kraxel: codestyle fixup ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-07-20xhci: Fix possible side effect from assert()Alexey Kardashevskiy
A static analysis tool called BEAM detected possible side effect from assert() calling a helper which may change an XHCI ring after every call. This moves xhci_ring_fetch() out of assert() so it will be called with and without enabled debug. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Message-id: 1468812548-31868-1-git-send-email-aik@ozlabs.ru Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-07-12nec-usb-xhci: set the device state to USB_STATE_DEFAULTZhang Shuaiyi
This patch is a rough fix to "hw/usb/core.c:401: usb_handle_packet: Assertion `dev->state == 3' failed.". Qemu will crash when a usb3 device redirect to Windows7 VM via nec-usb-xhci. In extensible-host-controler-interface-usb-xhci.pdf P94(4.6.5 Address Device): • If the Block Set Address Request (BSR) flag = ‘1’ • If the slot is in the Enabled state: ... • Set the Slot State in the Output Slot Context to Default. BSR = ‘1’: Enabled state to Default state; BSR = ‘0’: Default state to Addressed state. Try to call usb_device_reset to set device state to USB_STATE_DEFAULT in xhci_address_slot wether bsr is zero. Signed-off-by: Zhang Shuaiyi <zhang_syi@massclouds.com> Message-id: 1467258640-11921-1-git-send-email-zhang_syi@massclouds.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-07-05pci: Convert msi_init() to Error and fix callers to check itCao jin
msi_init() reports errors with error_report(), which is wrong when it's used in realize(). Fix by converting it to Error. Fix its callers to handle failure instead of ignoring it. For those callers who don't handle the failure, it might happen: when user want msi on, but he doesn't get what he want because of msi_init fails silently. cc: Gerd Hoffmann <kraxel@redhat.com> cc: John Snow <jsnow@redhat.com> cc: Dmitry Fleytman <dmitry@daynix.com> cc: Jason Wang <jasowang@redhat.com> cc: Michael S. Tsirkin <mst@redhat.com> cc: Hannes Reinecke <hare@suse.de> cc: Paolo Bonzini <pbonzini@redhat.com> cc: Alex Williamson <alex.williamson@redhat.com> cc: Markus Armbruster <armbru@redhat.com> cc: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Hannes Reinecke <hare@suse.com>
2016-07-05usb xhci: change msi/msix property typeCao jin
>From bit to enum OnOffAuto cc: Gerd Hoffmann <kraxel@redhat.com> cc: Michael S. Tsirkin <mst@redhat.com> cc: Markus Armbruster <armbru@redhat.com> cc: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-05-11usb:xhci: no DMA on HC resetRoman Kagan
This patch is a rough fix to a memory corruption we are observing when running VMs with xhci USB controller and OVMF firmware. Specifically, on the following call chain xhci_reset xhci_disable_slot xhci_disable_ep xhci_set_ep_state QEMU overwrites guest memory using stale guest addresses. This doesn't happen when the guest (firmware) driver sets up xhci for the first time as there are no slots configured yet. However when the firmware hands over the control to the OS some slots and endpoints are already set up with their context in the guest RAM. Now the OS' driver resets the controller again and xhci_set_ep_state then reads and writes that memory which is now owned by the OS. As a quick fix, skip calling xhci_set_ep_state in xhci_disable_ep if the device context base address array pointer is zero (indicating we're in the HC reset and no DMA is possible). Cc: qemu-stable@nongnu.org Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Message-id: 1462384435-1034-1-git-send-email-rkagan@virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-03-18usb: fix unbounded stack warning for xhci_dma_write_u32sPeter Xu
All the callers for xhci_dma_write_u32s() are using mostly 5 * uint32_t in len. To avoid unbound stack warning for the function, make it statically allocated, and assert when it's not big enough in the future. Signed-off-by: Peter Xu <peterx@redhat.com> Message-id: 1457661106-9569-1-git-send-email-peterx@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-01-29usb: Clean up includesPeter Maydell
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-20-git-send-email-peter.maydell@linaro.org
2015-11-06usb: Use g_new() & friends where that makes obvious senseMarkus Armbruster
g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer, for two reasons. One, it catches multiplication overflowing size_t. Two, it returns T * rather than void *, which lets the compiler catch more type errors. This commit only touches allocations with size arguments of the form sizeof(T). Same Coccinelle semantic patch as in commit b45c03f. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-09-11maint: avoid useless "if (foo) free(foo)" patternDaniel P. Berrange
The free() and g_free() functions both happily accept NULL on any platform QEMU builds on. As such putting a conditional 'if (foo)' check before calls to 'free(foo)' merely serves to bloat the lines of code. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-07-17Revert "xhci: set timer to retry xfers"Gerd Hoffmann
This reverts commit 4e8cfbe1143d8384387595b500212d7a7f11aeae. We should not poll via timer, and with ccid being fixed to properly notify us about pending transfers we don't have to. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-05-11Merge remote-tracking branch ↵Peter Maydell
'remotes/mjt/tags/pull-trivial-patches-2015-05-09' into staging trivial patches for 2015-05-09 # gpg: Signature made Fri May 8 22:58:42 2015 BST using RSA key ID A4C3D7DB # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" * remotes/mjt/tags/pull-trivial-patches-2015-05-09: docs: update BLOCK_IMAGE_CORRUPTED documentation glib-compat.h: change assert to g_assert Remove various unused functions sheepdog: fix resource leak with sd_snapshot_create xhci: remove unused code Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-05-08xhci: remove unused codeGonglei
Value from xfer->packet.ep is assigned to ep here, but that stored value is not used before it is overwritten. Remove it. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-05-08xhci: fix events for setup trb.Gerd Hoffmann
When we find a IOC bit set on a setup trb and therefore queue an event, that should not stop events being generated for following data trbs. So clear the 'reported' flag. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-05-08Revert "xhci: generate a Transfer Event for each Transfer TRB with the IOC ↵Gerd Hoffmann
bit set" This makes xhci generate multiple short packet events in case of multi-trb transfers. Which is wrong. We need to fix this in a different way. This reverts commit aa6857891df614c620e6e9fc4bc4af6e0e49cafd. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-05-08xhci: set timer to retry xfersGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-09Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pci, pc, virtio fixes and cleanups A bunch of fixes all over the place. All of ACPI refactoring has been merged. Legacy pci commands have been dropped. virtio header cleanup initial patches from virtio-1.0 branch Signed-off-by: Michael S. Tsirkin <mst@redhat.com> * remotes/mst/tags/for_upstream: (130 commits) acpi: drop unused code aml-build: comment fix acpi-build: fix typo in comment acpi: update generated files vhost user:support vhost user nic for non msi guests aml-build: fix build for glib < 2.22 acpi: update generated files Makefile.target: binary depends on config-devices acpi-test-data: update after pci rewrite acpi, mem-hotplug: use PC_DIMM_SLOT_PROP in acpi_memory_plug_cb(). pci-hotplug-old: Has been dead for five major releases, bury pci: Give a few helpers internal linkage acpi: make build_*() routines static to aml-build.c pc: acpi: remove not used anymore ssdt-[misc|pcihp].hex.generated blobs pc: acpi-build: drop template patching and create PCI bus tree dynamically tests: ACPI: update pc/SSDT.bridge due to new alg of PCI tree creation pc: acpi-build: simplify PCI bus tree generation tests: add ACPI blobs for qemu with bridge cases tests: bios-tables-test: add support for testing bridges tests: ACPI test blobs update due to PCI0._CRS changes ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Conflicts: hw/pci/pci-hotplug-old.c
2015-03-03xhci: generate a Transfer Event for each Transfer TRB with the IOC bit setLaszlo Ersek
At the moment, when the XHCI driver in edk2 (MdeModulePkg/Bus/Pci/XhciDxe/XhciDxe.inf) runs on QEMU, with the options -device nec-usb-xhci -device usb-kbd it crashes with: ASSERT MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c(1759): TrsRing != ((void*) 0) The crash hits in the following edk2 call sequence (all files under MdeModulePkg/Bus/): UsbEnumerateNewDev() [Usb/UsbBusDxe/UsbEnumer.c] UsbBuildDescTable() [Usb/UsbBusDxe/UsbDesc.c] UsbGetDevDesc() [Usb/UsbBusDxe/UsbDesc.c] UsbCtrlGetDesc(USB_REQ_GET_DESCRIPTOR) [Usb/UsbBusDxe/UsbDesc.c] UsbCtrlRequest() [Usb/UsbBusDxe/UsbDesc.c] UsbHcControlTransfer() [Usb/UsbBusDxe/UsbUtility.c] XhcControlTransfer() [Pci/XhciDxe/Xhci.c] XhcCreateUrb() [Pci/XhciDxe/XhciSched.c] XhcCreateTransferTrb() [Pci/XhciDxe/XhciSched.c] XhcExecTransfer() [Pci/XhciDxe/XhciSched.c] XhcCheckUrbResult() [Pci/XhciDxe/XhciSched.c] // // look for TRB_TYPE_DATA_STAGE event [1] // // // Store a copy of the device descriptor, as the hub device // needs this info to configure endpoint. [2] // UsbSetConfig() [Usb/UsbBusDxe/UsbDesc.c] UsbCtrlRequest(USB_REQ_SET_CONFIG) [Usb/UsbBusDxe/UsbDesc.c] UsbHcControlTransfer() [Usb/UsbBusDxe/UsbUtility.c] XhcControlTransfer() [Pci/XhciDxe/Xhci.c] XhcSetConfigCmd() [Pci/XhciDxe/XhciSched.c] XhcInitializeEndpointContext() [Pci/XhciDxe/XhciSched.c] // // allocate transfer ring for the endpoint [3] // USBKeyboardDriverBindingStart() [Usb/UsbKbDxe/EfiKey.c] UsbIoAsyncInterruptTransfer() [Usb/UsbBusDxe/UsbBus.c] UsbHcAsyncInterruptTransfer() [Usb/UsbBusDxe/UsbUtility.c] XhcAsyncInterruptTransfer() [Pci/XhciDxe/Xhci.c] XhcCreateUrb() [Pci/XhciDxe/Xhci.c] XhcCreateTransferTrb() [Pci/XhciDxe/XhciSched.c] XhcSyncTrsRing() [Pci/XhciDxe/XhciSched.c] ASSERT (TrsRing != NULL) [4] UsbEnumerateNewDev() in the USB bus driver issues a GET_DESCRIPTOR request, in order to determine the number of configurations that the endpoint supports. The requests consists of three stages (three TRBs), setup, data, and status. The length of the response is determined in [1], namely from the transfer event that the host controller generates in response to the request's middle stage (ie. the data stage). If the length of the answer is correct (a full GET_DESCRIPTOR request takes 18 bytes), then the XHCI driver that underlies the USB bus driver "snoops" (caches) the descriptor data for later [2]. Later, the USB bus driver sends a SET_CONFIG request. The underlying XHCI driver allocates a transfer ring for the endpoint, relying on the data snooped and cached in step [2]. Finally, the USB keyboard driver submits an asynchronous interrupt transfer to manage the keyboard. As part of this it asserts [4] that the ring has been allocated in step [3]. And this ASSERT() fires. The root cause can be found in the way QEMU handles the initial GET_DESCRIPTOR request. Again, that request consists of three stages (TRBs, Transfer Request Blocks), "setup", "data", and "status". The XhcCreateTransferTrb() function sets the IOC ("Interrupt on Completion") flag in each of these TRBs. According to the XHCI specification, the host controller shall generate a Transfer Event in response to *each* individual TRB of the request that had the IOC flag set. This means that QEMU should queue three events: setup, data, and status, for edk2's XHCI driver. However, QEMU only generates two events: - one for the setup (ie. 1st) stage, - another for the status (ie. 3rd) stage. No event is generated for the middle (ie. data) stage. The loop in QEMU's xhci_xfer_report() function runs three times, but due to the "reported" variable, only the first and the last TRBs elicit events, the middle (data stage) results in no event queued. As a consequence: - When handling the GET_DESCRIPTOR request, XhcCheckUrbResult() in [1] does not update the response length from zero. - XhcControlTransfer() thinks that the response is invalid (it has zero length payload instead of 18 bytes), hence [2] is not reached; the device descriptor is not stashed for later, and the number of possible configurations is left at zero. - When handling the SET_CONFIG request, (NumConfigurations == 0) from above prevents the allocation of the endpoint's transfer ring. - When the keyboard driver tries to use the endpoint, the ASSERT() blows up. The solution is to correct the emulation in QEMU, and to generate a transfer event whenever IOC is set in a TRB. The patch replaces !reported && (IOC || foo) == !reported && IOC || !reported && foo with IOC || (!reported && foo) == IOC || !reported && foo which only changes how reported && IOC is handled. (Namely, it now generates an event.) Tested with edk2 built for "qemu-system-aarch64 -M virt" (ie. "ArmVirtualizationQemu.dsc", aka "AAVMF"), and guest Linux. Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-26pci: Trivial device model conversions to realizeMarkus Armbruster
Convert the device models where initialization obviously can't fail. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
2015-01-26vmstate: accept QEMUTimer in VMSTATE_TIMER*, add VMSTATE_TIMER_PTR*Paolo Bonzini
Old users of VMSTATE_TIMER* are mechanically changed to VMSTATE_TIMER_PTR variants. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-11-11xhci: add sanity checks to xhci_lookup_uportGerd Hoffmann
Also catch xhci_lookup_uport failures in post_load. https://bugzilla.redhat.com/show_bug.cgi?id=1074219 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-10-28xhci: add property to turn on/off streams supportGerd Hoffmann
streams support in usb-redir and usb-host works only with recent enough versions of the support libraries (libusbredir and libusbx). Failure mode is rather unelegant: Any stream usb transfers will throw stall errors. Turning off support for streams in the xhci host controller will work better as the guest can figure beforehand that streams are not going to work. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com>
2014-10-15xhci: remove dead codeGerd Hoffmann
Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb: tag xhci as hotpluggableGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-10xhci PCIe endpoint migration compatibility fixDr. David Alan Gilbert
Add back the PCIe config capabilities on XHCI cards in non-PCIe slots, but only for machine types before 2.1. This fixes a migration incompatibility in the XHCI PCI devices caused by: 058fdcf52cdbf57b67e7 - xhci: add endpoint cap on express bus only Note that in fixing it for compatibility with older QEMUs, it breaks compatibility with existing QEMU 2.1's on older machine types. The status before this patch was (if it used an XHCI adapter): machine type | source qemu any pre-2.1 - FAIL any 2.1... - PASS With this patch: machine type | source qemu any pre-2.1 - PASS pre-2.1 2.1... - FAIL 2.1 2.1... - PASS A test to trigger it is to add '-device nec-usb-xhci,id=xhci,addr=0x12' to the command line. Cc: qemu-stable@nongnu.org Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-08-29usb: add usb host adapters exit traceGonglei
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-08-29usb-xhci: add exit functionGonglei
clean up xhci resource when xhci pci device exit. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-08-29Revert "xhci: Fix number of streams allocated when using streams"Gerd Hoffmann
This reverts commit d063c3112c4cd23a479ee18720c2bd119da2d315. "2 << x" is the same as "2 ^ (x + 1)", so the old code is correct. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-08-29xhci: use (1u << i)Gerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2014-08-29xhci: fix debug print compiling errorGonglei
after commit 003e15a180373048f0c1f4df0bfe303746eb2676 the DPRINTF will broke compiling, adjust its location. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-22vmstate_xhci_event: fix unterminated field listLaszlo Ersek
"vmstate_xhci_event" was introduced in commit 37352df3 ("xhci: add live migration support"), and first released in v1.6.0. The field list in this VMSD is not terminated with the VMSTATE_END_OF_LIST() macro. During normal use (ie. migration), the issue is practically invisible, because the "vmstate_xhci_event" object (with the unterminated field list) is only ever referenced -- via "vmstate_xhci_intr" -- if xhci_er_full() returns true, for the "ev_buffer" test. Since that field_exists() check (apparently) almost always returns false, we almost never traverse "vmstate_xhci_event" during migration, which hides the bug. However, Amit's vmstate checker forces recursion into this VMSD as well, and the lack of VMSTATE_END_OF_LIST() breaks the field list terminator check (field->name != NULL) in dump_vmstate_vmsd(). The result is undefined behavior, which in my case translates to infinite recursion (because the loop happens to overflow into "vmstate_xhci_intr", which then links back to "vmstate_xhci_event"). Add the missing terminator. Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-06-02xhci: order superspeed ports firstGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-06-02xhci: make port reset trace point more verboseGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-04 15:14:51 +0000