aboutsummaryrefslogtreecommitdiff
path: root/hw/usb
AgeCommit message (Collapse)Author
2020-10-21usb/xhci: fixup xhci kconfig depsGerd Hoffmann
USB_XHCI does not depend on PCI any more. USB_XHCI_SYSBUS must select USB_XHCI not USB. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Message-id: 20201020074844.5304-5-kraxel@redhat.com
2020-10-21usb/xhci: add xhci_sysbus_build_aml() helperGerd Hoffmann
The helper generates an acpi dsdt device entry for the xhci sysbus device. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20201020074844.5304-4-kraxel@redhat.com
2020-10-21usb/xhci: add include/hw/usb/xhci.h header fileGerd Hoffmann
Move a bunch of defines which might be needed outside core xhci code to that place. Add XHCI_ prefixes to avoid name clashes. No functional change. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Message-id: 20201020074844.5304-3-kraxel@redhat.com
2020-10-19hw/usb/hcd-dwc2: fix divide-by-zero in dwc2_handle_packet()Mauro Matteo Cascella
Check the value of mps to avoid potential divide-by-zero later in the function. Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest from crashing the QEMU process on the host. Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Paul Zimmerman <pauldzim@gmail.com> Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com> Reported-by: Xingwei Lin <linyi.lxw@antfin.com> Message-id: 20201015075957.268823-1-mcascell@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-10-19usb/hcd-ehci: Fix error handling on missing device for iTDAnthony PERARD
The EHCI Host Controller emulation attempt to locate the device associated with a periodic isochronous transfer description (iTD) and when this fail the host controller is reset. But according the EHCI spec 1.0 section 5.15.2.4 Host System Error, the host controller is supposed to reset itself only when it failed to communicate with the Host (Operating System), like when there's an error on the PCI bus. If a transaction fails, there's nothing in the spec that say to reset the host controller. This patch rework the error path so that the host controller can keep working when the OS setup a bogus transaction, it also revert to the behavior of the EHCI emulation to before commits: e94682f1fe ("ehci: check device is not NULL before calling usb_ep_get()") 7011baece2 ("usb: remove unnecessary NULL device check from usb_ep_get()") The issue has been found while trying to passthrough a USB device to a Windows Server 2012 Xen guest via "usb-ehci", which prevent the USB device from working in Windows. ("usb-ehci" alone works, windows only setup this weird periodic iTD to device 127 endpoint 15 when the USB device is passthrough.) Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Message-id: 20201014104106.2962640-1-anthony.perard@citrix.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-10-19usb: hcd-dwc2: change assert()s to qemu_log_mask(LOG_GUEST_ERROR...)Paul Zimmerman
Change several assert()s to qemu_log_mask(LOG_GUEST_ERROR...), to prevent the guest from causing Qemu to assert. Also fix up several existing qemu_log_mask()s to include the function name in the message. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200920021449.830-1-pauldzim@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-09-28hw/usb: Use lock guard macrosAmey Narkhede
Use qemu LOCK_GUARD macros from "qemu/lockable.h" in hw/usb/ccid-card-emulated.c, saves manual unlock calls. Signed-off-by: Amey Narkhede <ameynarkhede03@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200923134327.576139-1-ameynarkhede03@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-09-28usb: hcd-xhci-sysbus: Attach xhci to sysbus deviceSai Pavan Boddu
Use XHCI as sysbus device, add memory region property to get the address space instance for dma read/write. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Message-id: 1600957256-6494-5-git-send-email-sai.pavan.boddu@xilinx.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-09-28usb/hcd-xhci: Split pci wrapper for xhci base modelSai Pavan Boddu
This patch sets the base to use xhci as sysbus model, for which pci specific hooks are moved to hcd-xhci-pci.c. As a part of this requirment msi/msix interrupts handling is moved under XHCIPCIState. Made required changes for qemu-xhci-nec. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Message-id: 1600957256-6494-4-git-send-email-sai.pavan.boddu@xilinx.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-09-28usb/hcd-xhci: Move qemu-xhci device to hcd-xhci-pci.cSai Pavan Boddu
Move pci specific devices to new file. This set the environment to move all pci specific hooks in hcd-xhci.c to hcd-xhci-pci.c. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Message-id: 1600957256-6494-3-git-send-email-sai.pavan.boddu@xilinx.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-09-28usb/hcd-xhci: Make dma read/writes hooks pci freeSai Pavan Boddu
This patch starts making the hcd-xhci.c pci free, as part of this restructuring dma read/writes are handled without passing pci object. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1600957256-6494-2-git-send-email-sai.pavan.boddu@xilinx.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-09-22Merge remote-tracking branch 'remotes/kraxel/tags/usb-20200921-pull-request' ↵Peter Maydell
into staging usb: fix u2f build usb: fix ohci oob access and loop issues # gpg: Signature made Mon 21 Sep 2020 09:58:06 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/usb-20200921-pull-request: hw: usb: hcd-ohci: check for processed TD before retire hw: usb: hcd-ohci: check len and frame_number variables usb: fix u2f build Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-09-21hw: usb: hcd-ohci: check for processed TD before retirePrasad J Pandit
While servicing OHCI transfer descriptors(TD), ohci_service_iso_td retires a TD if it has passed its time frame. It does not check if the TD was already processed once and holds an error code in TD_CC. It may happen if the TD list has a loop. Add check to avoid an infinite loop condition. Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Message-id: 20200915182259.68522-3-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-09-21hw: usb: hcd-ohci: check len and frame_number variablesPrasad J Pandit
While servicing the OHCI transfer descriptors(TD), OHCI host controller derives variables 'start_addr', 'end_addr', 'len' etc. from values supplied by the host controller driver. Host controller driver may supply values such that using above variables leads to out-of-bounds access issues. Add checks to avoid them. AddressSanitizer: stack-buffer-overflow on address 0x7ffd53af76a0 READ of size 2 at 0x7ffd53af76a0 thread T0 #0 ohci_service_iso_td ../hw/usb/hcd-ohci.c:734 #1 ohci_service_ed_list ../hw/usb/hcd-ohci.c:1180 #2 ohci_process_lists ../hw/usb/hcd-ohci.c:1214 #3 ohci_frame_boundary ../hw/usb/hcd-ohci.c:1257 #4 timerlist_run_timers ../util/qemu-timer.c:572 #5 qemu_clock_run_timers ../util/qemu-timer.c:586 #6 qemu_clock_run_all_timers ../util/qemu-timer.c:672 #7 main_loop_wait ../util/main-loop.c:527 #8 qemu_main_loop ../softmmu/vl.c:1676 #9 main ../softmmu/main.c:50 Reported-by: Gaoning Pan <pgn@zju.edu.cn> Reported-by: Yongkang Jia <j_kangel@163.com> Reported-by: Yi Ren <yunye.ry@alibaba-inc.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20200915182259.68522-2-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-09-21usb: fix u2f buildGerd Hoffmann
Just use qemu_open_old() for a quick fix, switch to better error handling left for another day. Fixes: 448058aa99aa ("util: rename qemu_open() to qemu_open_old()") Cc: César Belley <cesar.belley@lse.epita.fr> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-id: 20200918110122.9121-1-kraxel@redhat.com
2020-09-18Use OBJECT_DECLARE_SIMPLE_TYPE when possibleEduardo Habkost
This converts existing DECLARE_INSTANCE_CHECKER usage to OBJECT_DECLARE_SIMPLE_TYPE when possible. $ ./scripts/codeconverter/converter.py -i \ --pattern=AddObjectDeclareSimpleType $(git grep -l '' -- '*.[ch]') Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Acked-by: Paul Durrant <paul@xen.org> Message-Id: <20200916182519.415636-6-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-09-18Use OBJECT_DECLARE_TYPE when possibleEduardo Habkost
This converts existing DECLARE_OBJ_CHECKERS usage to OBJECT_DECLARE_TYPE when possible. $ ./scripts/codeconverter/converter.py -i \ --pattern=AddObjectDeclareType $(git grep -l '' -- '*.[ch]') Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Acked-by: Paul Durrant <paul@xen.org> Message-Id: <20200916182519.415636-5-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-09-16util: rename qemu_open() to qemu_open_old()Daniel P. Berrangé
We want to introduce a new version of qemu_open() that uses an Error object for reporting problems and make this it the preferred interface. Rename the existing method to release the namespace for the new impl. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2020-09-12Merge remote-tracking branch ↵Peter Maydell
'remotes/stsquad/tags/pull-testing-fixes-100920-1' into staging Various misc and testing fixes: - Expand CODING_STYLE.rst a little more - usb-host build fix - allow check-softfloat unit tests without TCG - simplify mips imm_branch so compiler isn't confused - mark ppc64abi32 for deprecation - more compiler soothing in pch_rev_id - allow acceptance to skip missing binaries - more a bunch of plugins to contrib # gpg: Signature made Thu 10 Sep 2020 10:51:05 BST # gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44 # gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [full] # Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44 * remotes/stsquad/tags/pull-testing-fixes-100920-1: plugins: move the more involved plugins to contrib tests/acceptance: Add Test.fetch_asset(cancel_on_missing=True) tests: bump avocado version hw/i386: make explicit clearing of pch_rev_id configure: don't enable ppc64abi32-linux-user by default docs/system/deprecated: mark ppc64abi32-linux-user for deprecation target/mips: simplify gen_compute_imm_branch logic tests/meson.build: fp tests don't need CONFIG_TCG usb-host: restrict workaround to new libusb versions CODING_STYLE.rst: flesh out our naming conventions. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-09-12Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier2/tags/trivial-branch-for-5.2-pull-request' into staging trivial patches pull request 20200911 # gpg: Signature made Fri 11 Sep 2020 20:32:27 BST # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/trivial-branch-for-5.2-pull-request: target/i386/kvm: Add missing fallthrough comment util/hexdump: Reorder qemu_hexdump() arguments util/hexdump: Convert to take a void pointer argument hw/arm/pxa2xx: Add missing fallthrough comment target/i386/kvm: Rename host_tsx_blacklisted() as host_tsx_broken() test-vmstate: remove unnecessary code in match_interval_mapping_node hw: hyperv: vmbus: Fix 32bit compilation kconfig: fix comment referring to old Makefiles meson.build: tweak sdl-image error message hw/net/e1000e: Remove duplicated write handler for FLSWDATA register hw/net/e1000e: Remove overwritten read handler for STATUS register Makefile: Skip the meson subdir in cscope/TAGS/ctags Makefile: Drop extra phony cscope hw/gpio/max7310: Replace disabled printf() by qemu_log_mask(UNIMP) hw/gpio/omap_gpio: Replace fprintf() by qemu_log_mask(GUEST_ERROR) hw/acpi/tco: Remove unused definitions hw/isa/isa-bus: Replace hw_error() by assert() hw/mips/fuloong2e: Convert pointless error message to an assert() Signed-off-by: Peter Maydell <peter.maydell@linaro.org> # Conflicts: # net/colo-compare.c
2020-09-11util/hexdump: Reorder qemu_hexdump() argumentsPhilippe Mathieu-Daudé
qemu_hexdump()'s pointer to the buffer and length of the buffer are closely related arguments but are widely separated in the argument list order (also, the format of <stdio.h> function prototypes is usually to have the FILE* argument coming first). Reorder the arguments as "fp, prefix, buf, size" which is more logical. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20200822180950.1343963-3-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2020-09-11util/hexdump: Convert to take a void pointer argumentPhilippe Mathieu-Daudé
Most uses of qemu_hexdump() do not take an array of char as input, forcing use of cast. Since we can use this helper to dump any kind of buffer, use a pointer to void argument instead. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20200822180950.1343963-2-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2020-09-11Merge remote-tracking branch ↵Peter Maydell
'remotes/ehabkost/tags/machine-next-pull-request' into staging QOM boilerplate cleanup Documentation build fix: * memory: Remove kernel-doc comment marker (Eduardo Habkost) QOM cleanups: * Rename QOM macros for consistency between TYPE_* and type checking constants (Eduardo Habkost) QOM new macros: * OBJECT_DECLARE_* and OBJECT_DEFINE_* macros (Daniel P. Berrangé) * DECLARE_*_CHECKER macros (Eduardo Habkost) Automated QOM boilerplate changes: * Automated changes to use DECLARE_*_CHECKER (Eduardo Habkost * Automated changes to use OBJECT_DECLARE* (Eduardo Habkost) # gpg: Signature made Thu 10 Sep 2020 19:17:49 BST # gpg: using RSA key 5A322FD5ABC4D3DBACCFD1AA2807936F984DC5A6 # gpg: issuer "ehabkost@redhat.com" # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" [full] # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/machine-next-pull-request: (33 commits) virtio-vga: Use typedef name for instance_size vhost-user-vga: Use typedef name for instance_size xilinx_axienet: Use typedef name for instance_size lpc_ich9: Use typedef name for instance_size omap_intc: Use typedef name for instance_size xilinx_axidma: Use typedef name for instance_size tusb6010: Rename TUSB to TUSB6010 pc87312: Rename TYPE_PC87312_SUPERIO to TYPE_PC87312 vfio: Rename PCI_VFIO to VFIO_PCI usb: Rename USB_SERIAL_DEV to USB_SERIAL sabre: Rename SABRE_DEVICE to SABRE rs6000_mc: Rename RS6000MC_DEVICE to RS6000MC filter-rewriter: Rename FILTER_COLO_REWRITER to FILTER_REWRITER esp: Rename ESP_STATE to ESP ahci: Rename ICH_AHCI to ICH9_AHCI vmgenid: Rename VMGENID_DEVICE to TYPE_VMGENID vfio: Rename VFIO_AP_DEVICE_TYPE to TYPE_VFIO_AP_DEVICE dev-smartcard-reader: Rename CCID_DEV_NAME to TYPE_USB_CCID_DEV ap-device: Rename AP_DEVICE_TYPE to TYPE_AP_DEVICE gpex: Fix type checking function name ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-09-10usb-host: restrict workaround to new libusb versionsGerd Hoffmann
Fixes build failures with old kernels (USBDEVFS_GET_SPEED missing), on the assumtion that distros with old kernels also have old libusb. Reported-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200902081445.3291-1-kraxel@redhat.com> Message-Id: <20200909112742.25730-3-alex.bennee@linaro.org>
2020-09-09tusb6010: Rename TUSB to TUSB6010Eduardo Habkost
Make type checking function name consistent with the TYPE_TUSB6010 constant and QOM type name ("tusb6010"). Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Suggested-by: "Daniel P. Berrangé" <berrange@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200903180128.1523959-9-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-09-09usb: Rename USB_SERIAL_DEV to USB_SERIALEduardo Habkost
Make the type checking macro name consistent with the TYPE_* constant. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200902224311.1321159-54-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-09-09dev-smartcard-reader: Rename CCID_DEV_NAME to TYPE_USB_CCID_DEVEduardo Habkost
This will make the type name constant consistent with the name of the type checking macro. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200902224311.1321159-7-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-09-09trace-events: Fix attribution of trace points to sourceMarkus Armbruster
Some trace points are attributed to the wrong source file. Happens when we neglect to update trace-events for code motion, or add events in the wrong place, or misspell the file name. Clean up with help of scripts/cleanup-trace-events.pl. Funnies requiring manual post-processing: * accel/tcg/cputlb.c trace points are in trace-events. * block.c and blockdev.c trace points are in block/trace-events. * hw/block/nvme.c uses the preprocessor to hide its trace point use from cleanup-trace-events.pl. * hw/tpm/tpm_spapr.c uses pseudo trace point tpm_spapr_show_buffer to guard debug code. * include/hw/xen/xen_common.h trace points are in hw/xen/trace-events. * linux-user/trace-events abbreviates a tedious list of filenames to */signal.c. * net/colo-compare and net/filter-rewriter.c use pseudo trace points colo_compare_miscompare and colo_filter_rewriter_debug to guard debug code. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200806141334.3646302-5-armbru@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-09-09Use DECLARE_*CHECKER* macrosEduardo Habkost
Generated using: $ ./scripts/codeconverter/converter.py -i \ --pattern=TypeCheckMacro $(git grep -l '' -- '*.[ch]') Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-Id: <20200831210740.126168-12-ehabkost@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-Id: <20200831210740.126168-13-ehabkost@redhat.com> Message-Id: <20200831210740.126168-14-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-09-09Move QOM typedefs and add missing includesEduardo Habkost
Some typedefs and macros are defined after the type check macros. This makes it difficult to automatically replace their definitions with OBJECT_DECLARE_TYPE. Patch generated using: $ ./scripts/codeconverter/converter.py -i \ --pattern=QOMStructTypedefSplit $(git grep -l '' -- '*.[ch]') which will split "typdef struct { ... } TypedefName" declarations. Followed by: $ ./scripts/codeconverter/converter.py -i --pattern=MoveSymbols \ $(git grep -l '' -- '*.[ch]') which will: - move the typedefs and #defines above the type check macros - add missing #include "qom/object.h" lines if necessary Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-Id: <20200831210740.126168-9-ehabkost@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-Id: <20200831210740.126168-10-ehabkost@redhat.com> Message-Id: <20200831210740.126168-11-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-09-01Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier2/tags/trivial-branch-for-5.2-pull-request' into staging Pull request trivial patches 20200901 # gpg: Signature made Tue 01 Sep 2020 15:08:59 BST # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/trivial-branch-for-5.2-pull-request: (44 commits) docs/system: Fix grammar in documentation main-loop: Fix comment hw/display/vga:Remove redundant statement in vga_draw_graphic() hw/intc: fix default registers value in exynos4210_combiner_read() usb/bus: Remove dead assignment in usb_get_fw_dev_path() vfio/platform: Remove dead assignment in vfio_intp_interrupt() hw/net/virtio-net:Remove redundant statement in virtio_net_rsc_tcp_ctrl_check() hw/virtio/vhost-user:Remove dead assignment in scrub_shadow_regions() target/arm/translate-a64:Remove redundant statement in disas_simd_two_reg_misc_fp16() target/arm/translate-a64:Remove dead assignment in handle_scalar_simd_shli() hw/arm/omap1:Remove redundant statement in omap_clkdsp_read() hw/arm/virt-acpi-build:Remove dead assignment in build_madt() linux-user: Add strace support for printing OFD fcntl operations util/vfio-helpers: Unify trace-events size format hw/net/xilinx_axienet: Remove unused code hw/scsi/scsi-disk: Replace magic '512' value by BDRV_SECTOR_SIZE hw/ide/pci: Replace magic '512' value by BDRV_SECTOR_SIZE hw/ide/atapi: Replace magic '512' value by BDRV_SECTOR_SIZE hw/ide/ahci: Replace magic '512' value by BDRV_SECTOR_SIZE hw/ide/core: Trivial typo fix ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-09-01usb/bus: Remove dead assignment in usb_get_fw_dev_path()Chen Qun
Clang static code analyzer show warning: qemu/hw/usb/bus.c:615:13: warning: Value stored to 'pos' is never read pos += snprintf(fw_path + pos, fw_len - pos, "%s@%lx", Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20200827110311.164316-9-kuhn.chenqun@huawei.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2020-09-01hw: Remove superfluous breaksLiao Pingfang
Remove superfluous breaks, as there is a "return" before them. Signed-off-by: Liao Pingfang <liao.pingfang@zte.com.cn> Signed-off-by: Yi Wang <wang.yi59@zte.com.cn> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <1594631126-36631-1-git-send-email-wang.yi59@zte.com.cn> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2020-08-31usb: fix setup_len init (CVE-2020-14364)Gerd Hoffmann
Store calculated setup_len in a local variable, verify it, and only write it to the struct (USBDevice->setup_len) in case it passed the sanity checks. This prevents other code (do_token_{in,out} functions specifically) from working with invalid USBDevice->setup_len values and overrunning the USBDevice->setup_buf[] buffer. Fixes: CVE-2020-14364 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Message-id: 20200825053636.29648-1-kraxel@redhat.com
2020-08-31usb-host: workaround libusb bugGerd Hoffmann
libusb_get_device_speed() does not work for libusb_wrap_sys_device() devices in v1.0.23. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1871090 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20200824110057.32089-1-kraxel@redhat.com
2020-08-31hw/usb: Add U2F device autoscan to passthru modeCésar Belley
This patch adds an autoscan to let u2f-passthru choose the first U2F device it finds. The autoscan is performed using libudev with an enumeration of all the hidraw devices present on the host. The first device which happens to be a U2F device is taken to do the passtru. Signed-off-by: César Belley <cesar.belley@lse.epita.fr> Message-id: 20200826114209.28821-13-cesar.belley@lse.epita.fr Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-08-31hw/usb: Add U2F device check to passthru modeCésar Belley
This patchs adds a check to verify that the device passed through the hidraw property is a U2F device. The check is done by ensuring that the first values of the report descriptor (USAGE PAGE and USAGE) correspond to those of a U2F device. Signed-off-by: César Belley <cesar.belley@lse.epita.fr> Message-id: 20200826114209.28821-12-cesar.belley@lse.epita.fr Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-08-31meson: Add U2F key to mesonCésar Belley
Signed-off-by: César Belley <cesar.belley@lse.epita.fr> Message-id: 20200826114209.28821-8-cesar.belley@lse.epita.fr [ fixes suggested by paolo ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-08-31hw/usb: Add U2F key emulated modeCésar Belley
This patch adds the U2F key emulated mode. The emulated mode consists of completely emulating the behavior of a U2F device through software part. Libu2f-emu is used for that. The emulated mode is associated with a device inheriting from u2f-key base. To work, an emulated U2F device must have differents elements which can be given in different ways. This is detailed in docs/u2f.txt. The Ephemeral one is the simplest way to configure, it lets the device generate all the elements it needs for a single use of the lifetime of the device: qemu -usb -device u2f-emulated For more information about libu2f-emu see this page: https://github.com/MattGorko/libu2f-emu. Signed-off-by: César Belley <cesar.belley@lse.epita.fr> Message-id: 20200826114209.28821-7-cesar.belley@lse.epita.fr Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-08-31hw/usb: Add U2F key passthru modeCésar Belley
This patch adds the U2F key pass-through mode. The pass-through mode consists of passing all requests made from the guest to the physical security key connected to the host machine and vice versa. In addition, the dedicated pass-through allows to have a U2F security key shared on several guests which is not possible with a simple host device assignment pass-through. The pass-through mode is associated with a device inheriting from u2f-key base. To work, it needs the path to a U2F hidraw, obtained from the Qemu command line, and passed by the user: qemu -usb -device u2f-passthru,hidraw=/dev/hidrawX Autoscan and U2F compatibility checking features are given at the end of the patch series. Signed-off-by: César Belley <cesar.belley@lse.epita.fr> Message-id: 20200826114209.28821-6-cesar.belley@lse.epita.fr Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-08-31hw/usb: Add U2F key base class implementationCésar Belley
This patch adds the U2F key base class implementation. The U2F key base mainly takes care of the HID interfacing with guest. On the one hand, it retrieves the guest U2FHID packets and transmits them to the variant associated according to the mode: pass-through or emulated. On the other hand, it provides the public API used by its variants to send U2FHID packets to the guest. Signed-off-by: César Belley <cesar.belley@lse.epita.fr> Message-id: 20200826114209.28821-5-cesar.belley@lse.epita.fr Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-08-31hw/usb: Add U2F key base classCésar Belley
This patch adds the specification for the U2F key base class. Used to group the common characteristics, this device class will be inherited by its two variants, corresponding to the two modes: passthrough and emulated This prepares the U2F devices hierarchy which is as follow: USB device -> u2f-key -> {u2f-passthru, u2f-emulated}. Signed-off-by: César Belley <cesar.belley@lse.epita.fr> Message-id: 20200826114209.28821-4-cesar.belley@lse.epita.fr Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-08-31hw/usb: Regroup USB HID protocol valuesCésar Belley
Group some HID values that are used pretty much everywhere when dealing with HID devices. Signed-off-by: César Belley <cesar.belley@lse.epita.fr> Message-id: 20200812094135.20550-2-cesar.belley@lse.epita.fr Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-08-31ehci: drop pointless warn_report for guest bugs.Gerd Hoffmann
We have a tracepoint at the same place which can be enabled if needed. Buglink: https://bugzilla.redhat.com//show_bug.cgi?id=1859236 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200722072613.10390-1-kraxel@redhat.com>
2020-08-31hw: ehci: check return value of 'usb_packet_map'Li Qiang
If 'usb_packet_map' fails, we should stop to process the usb request. Signed-off-by: Li Qiang <liq3ea@163.com> Message-Id: <20200812161727.29412-1-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-08-31hw: ehci: destroy sglist in error pathLi Qiang
This may cause resource leak. Signed-off-by: Li Qiang <liq3ea@163.com> Message-Id: <20200812161712.29361-1-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-08-31hw: xhci: check return value of 'usb_packet_map'Li Qiang
Currently we don't check the return value of 'usb_packet_map', this will cause an UAF issue. This is LP#1891341. Following is the reproducer provided in: -->https://bugs.launchpad.net/qemu/+bug/1891341 cat << EOF | ./i386-softmmu/qemu-system-i386 -device nec-usb-xhci \ -trace usb\* -device usb-audio -device usb-storage,drive=mydrive \ -drive id=mydrive,file=null-co://,size=2M,format=raw,if=none \ -nodefaults -nographic -qtest stdio outl 0xcf8 0x80001016 outl 0xcfc 0x3c009f0d outl 0xcf8 0x80001004 outl 0xcfc 0xc77695e writel 0x9f0d000000000040 0xffff3655 writeq 0x9f0d000000002000 0xff2f9e0000000000 write 0x1d 0x1 0x27 write 0x2d 0x1 0x2e write 0x17232 0x1 0x03 write 0x17254 0x1 0x06 write 0x17278 0x1 0x34 write 0x3d 0x1 0x27 write 0x40 0x1 0x2e write 0x41 0x1 0x72 write 0x42 0x1 0x01 write 0x4d 0x1 0x2e write 0x4f 0x1 0x01 writeq 0x9f0d000000002000 0x5c051a0100000000 write 0x34001d 0x1 0x13 write 0x340026 0x1 0x30 write 0x340028 0x1 0x08 write 0x34002c 0x1 0xfe write 0x34002d 0x1 0x08 write 0x340037 0x1 0x5e write 0x34003a 0x1 0x05 write 0x34003d 0x1 0x05 write 0x34004d 0x1 0x13 writeq 0x9f0d000000002000 0xff00010100400009 EOF This patch fixes this. Buglink: https://bugs.launchpad.net/qemu/+bug/1891341 Reported-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Li Qiang <liq3ea@163.com> Message-id: 20200812153139.15146-1-liq3ea@163.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-08-27hcd-dwc2: Rename USB_*CLASS macros for consistencyEduardo Habkost
Rename the DWC2_CLASS to DWC2_USB_CLASS and DWC2_GET_CLASS to DWC2_USB_GET_CLASS, for consistency with the DWC2_USB macro. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Tested-By: Roman Bolshakov <r.bolshakov@yadro.com> Message-Id: <20200825192110.3528606-15-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-08-21meson: convert hw/usbPaolo Bonzini
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-08-21trace: switch position of headers to what Meson requiresPaolo Bonzini
Meson doesn't enjoy the same flexibility we have with Make in choosing the include path. In particular the tracing headers are using $(build_root)/$(<D). In order to keep the include directives unchanged, the simplest solution is to generate headers with patterns like "trace/trace-audio.h" and place forwarding headers in the source tree such that for example "audio/trace.h" includes "trace/trace-audio.h". This patch is too ugly to be applied to the Makefiles now. It's only a way to separate the changes to the tracing header files from the Meson rewrite of the tracing logic. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-24 11:34:06 +0000