aboutsummaryrefslogtreecommitdiff
path: root/hw/usb
AgeCommit message (Collapse)AuthorFilesLines
2022-09-01scsi: Add buf_len parameter to scsi_req_new()John Millikin2-3/+4
When a SCSI command is received from the guest, the CDB length implied by the first byte might exceed the number of bytes the guest sent. In this case scsi_req_new() will read uninitialized data, causing unpredictable behavior. Adds the buf_len parameter to scsi_req_new() and plumbs it through the call stack. Signed-off-by: John Millikin <john@john-millikin.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1127 Message-Id: <20220817053458.698416-1-john@john-millikin.com> [Fill in correct length for adapters other than ESP. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-08-16hw/usb/hcd-xhci: Fix unbounded loop in xhci_ring_chain_length() (CVE-2020-14394)Thomas Huth1-4/+19
The loop condition in xhci_ring_chain_length() is under control of the guest, and additionally the code does not check for failed DMA transfers (e.g. if reaching the end of the RAM), so the loop there could run for a very long time or even forever. Fix it by checking the return value of dma_memory_read() and by introducing a maximum loop length. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/646 Message-Id: <20220804131300.96368-1-thuth@redhat.com> Reviewed-by: Mauro Matteo Cascella <mcascell@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-08-01misc: fix commonly doubled up wordsDaniel P. Berrangé1-1/+1
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20220707163720.1421716-5-berrange@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-07-19usb/hcd-xhci: check slotid in xhci_wakeup_endpoint()Mauro Matteo Cascella1-1/+2
This prevents an OOB read (followed by an assertion failure in xhci_kick_ep) when slotid > xhci->numslots. Reported-by: Soul Chen <soulchen8650@gmail.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Message-Id: <20220705174734.2348829-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-07-01hw: canokey: Remove HS support as not compliant to the specMkfsSion1-1/+0
Canokey core currently using 16 bytes as maximum packet size for control endpoint, but to run the device in high-speed a 64 bytes maximum packet size is required according to USB 2.0 specification. Since we don't acutally need to run the device in high-speed, simply don't assign high member in USBDesc. When canokey-qemu is used with xhci, xhci would drive canokey in high speed mode, since the bcdUSB in canokey-core is 2.1, yet canokey-core set bMaxPacketSize0 to be 16, this is out of the spec as the spec said that ``The allowable maximum control transfer data payload sizes...for high-speed devices, it is 64 bytes''. In this case, usb device validation in Windows 10 LTSC 2021 as the guest would fail. It would complain USB\DEVICE_DESCRIPTOR_VALIDATION_FAILURE. Note that bcdUSB only identifies the spec version the device complies, but it has no indication of its speed. So it is allowed for the device to run in FS but comply the 2.1 spec. To solve the issue we decided to just drop the high speed support. This only affects usb-ehci as usb-ehci would complain speed mismatch when FS device is attached to a HS port. That's why the .high member was initialized in the first place. Meanwhile, xhci is not affected as it works well with FS device. Since everyone is now using xhci, it does no harm to most users. Suggested-by: Hongren (Zenithal) Zheng <i@zenithal.me> Signed-off-by: YuanYang Meng <mkfssion@mkfssion.com> Reviewed-by: Hongren (Zenithal) Zheng <i@zenithal.me> Message-Id: <20220625142138.19363-1-mkfssion@mkfssion.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-07-01hw/usb/canokey: fix compatibility of qemu-xhciHongren (Zenithal) Zheng1-0/+23
XHCI wont poll interrupt IN endpoint if NAKed, and needs wakeup Suggested-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Hongren (Zenithal) Zheng <i@zenithal.me> Message-Id: <YqcqSHNpI7sXRNpZ@Sun> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-07-01hw/usb/canokey: Fix CCID ZLPHongren (Zenithal) Zheng1-4/+3
CCID could send zero-length packet (ZLP) if we invoke two data_in, two packets would be concated and we could not distinguish them. The CANOKEY_EMU_EP_CTAPHID is imported from canokey-qemu.h Reported-by: MkfsSion <myychina28759@gmail.com> Signed-off-by: Hongren (Zenithal) Zheng <i@zenithal.me> Message-Id: <YqcqGz0s3+LE42ms@Sun> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-14usbredir: avoid queuing hello packet on snapshot restoreJoelle van Dyne1-1/+2
When launching QEMU with "-loadvm", usbredir_create_parser() should avoid setting up the hello packet (just as with "-incoming". On the latest version of libusbredir, usbredirparser_unserialize() will return error if the parser is not "pristine." Signed-off-by: Joelle van Dyne <j@getutm.app> Message-Id: <20220507041850.98716-1-j@getutm.app> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-14hw/usb/hcd-ehci: fix writeback orderArnout Engelen1-1/+4
The 'active' bit passes control over a qTD between the guest and the controller: set to 1 by guest to enable execution by the controller, and the controller sets it to '0' to hand back control to the guest. ehci_state_writeback write two dwords to main memory using DMA: the third dword of the qTD (containing dt, total bytes to transfer, cpage, cerr and status) and the fourth dword of the qTD (containing the offset). This commit makes sure the fourth dword is written before the third, avoiding a race condition where a new offset written into the qTD by the guest after it observed the status going to go to '0' gets overwritten by a 'late' DMA writeback of the previous offset. This race condition could lead to 'cpage out of range (5)' errors, and reproduced by: ./qemu-system-x86_64 -enable-kvm -bios $SEABIOS/bios.bin -m 4096 -device usb-ehci -blockdev driver=file,read-only=on,filename=/home/aengelen/Downloads/openSUSE-Tumbleweed-DVD-i586-Snapshot20220428-Media.iso,node-name=iso -device usb-storage,drive=iso,bootindex=0 -chardev pipe,id=shell,path=/tmp/pipe -device virtio-serial -device virtconsole,chardev=shell -device virtio-rng-pci -serial mon:stdio -nographic (press a key, select 'Installation' (2), and accept the default values. On my machine the 'cpage out of range' is reproduced while loading the Linux Kernel about once per 7 attempts. With the fix in this commit it no longer fails) This problem was previously reported as a seabios problem in https://mail.coreboot.org/hyperkitty/list/seabios@seabios.org/thread/OUTHT5ISSQJGXPNTUPY3O5E5EPZJCHM3/ and as a nixos CI build failure in https://github.com/NixOS/nixpkgs/issues/170803 Signed-off-by: Arnout Engelen <arnout@bzzt.net> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-14meson: Add CanoKeyHongren (Zenithal) Zheng2-0/+10
Signed-off-by: Hongren (Zenithal) Zheng <i@zenithal.me> Message-Id: <YoY6YRD6cxH21mms@Sun> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-14hw/usb/canokey: Add trace eventsHongren (Zenithal) Zheng2-0/+29
Signed-off-by: Hongren (Zenithal) Zheng <i@zenithal.me> Message-Id: <YoY6RoDKQIxSkFwL@Sun> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-14hw/usb: Add CanoKey ImplementationHongren (Zenithal) Zheng2-0/+369
This commit added a new emulated device called CanoKey to QEMU. CanoKey implements platform independent features in canokey-core https://github.com/canokeys/canokey-core, and leaves the USB implementation to the platform. In this commit the USB part was implemented in QEMU using QEMU's USB APIs, therefore the emulated CanoKey can communicate with the guest OS using USB. Signed-off-by: Hongren (Zenithal) Zheng <i@zenithal.me> Message-Id: <YoY6Mgph6f6Hc/zI@Sun> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-06modules: introduces module_kconfig directiveJose R. Ziviani4-0/+4
module_kconfig is a new directive that should be used with module_obj whenever that module depends on the Kconfig to be enabled. When the module is enabled in Kconfig we are sure that its dependencies will be enabled as well, thus the module will be loaded without any problem. The correct way to use module_kconfig is by passing the Kconfig option to module_kconfig (or the *config-devices.mak without CONFIG_). Signed-off-by: Jose R. Ziviani <jziviani@suse.de> Signed-off-by: Dario Faggioli <dfaggioli@suse.com> Message-Id: <165369002370.5857.12150544416563557322.stgit@work> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-05-11Clean up header guards that don't match their file nameMarkus Armbruster1-2/+2
Header guard symbols should match their file name to make guard collisions less likely. Cleaned up with scripts/clean-header-guards.pl, followed by some renaming of new guard symbols picked by the script to better ones. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20220506134911.2856099-2-armbru@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [Change to generated file ebpf/rss.bpf.skeleton.h backed out]
2022-04-06Remove qemu-common.h include from most unitsMarc-André Lureau1-1/+0
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220323155743.1585078-33-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-04-06include: move C/util-related declarations to cutils.hMarc-André Lureau3-3/+3
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220323155743.1585078-22-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-04hw/usb/redirect.c: Stop using qemu_oom_check()Peter Maydell1-3/+14
qemu_oom_check() is a function which essentially says "if you pass me a NULL pointer then print a message then abort()". On POSIX systems the message includes strerror(errno); on Windows it includes the GetLastError() error value printed as an integer. Other than in the implementation of qemu_memalign(), we use this function only in hw/usb/redirect.c, for three checks: * on a call to usbredirparser_create() * on a call to usberedirparser_serialize() * on a call to malloc() The usbredir library API functions make no guarantees that they will set errno on errors, let alone that they might set the Windows-specific GetLastError string. malloc() is documented as setting errno, not GetLastError -- and in any case the only thing it might set errno to is ENOMEM. So qemu_oom_check() isn't the right thing for any of these. Replace them with straightforward error-checking code. This will allow us to get rid of qemu_oom_check(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220226180723.1706285-2-peter.maydell@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-04usb/ohci: Don't use packet from OHCIState for isochronous transfersBALATON Zoltan1-33/+38
Since isochronous transfers cannot be handled async (the function returns error in that case) we don't need to remember the packet. Avoid using the usb_packet field in OHCIState (as that can be a waiting async packet on another endpoint) and allocate and use a local USBPacket for the iso transfer instead. After this we don't have to care if we're called from a completion callback or not so we can drop that parameter as well. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <bf523d40f8088a84383cb00ffd2e6e82fa47790d.1643117600.git.balaton@eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-04usb/ohci: Merge ohci_async_cancel_device() into ohci_child_detach()BALATON Zoltan1-9/+4
These two do the same and only used once so no need to have two functions, simplify by merging them. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <5fc8ba0bbf55703014d22dd06ab2f9eabaf370bf.1643117600.git.balaton@eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-04usb/ohci: Move USBPortOps related functions togetherBALATON Zoltan1-104/+101
This also allows removing two forward declarations Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <9fd730375c4cad0b11163631660d68711d3fc13f.1643117600.git.balaton@eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-04usb/ohci: Move cancelling async packet to ohci_stop_endpoints()BALATON Zoltan1-8/+4
This is always done before calling this function so remove duplicated code and do it within the function at one place. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <ce766722506bfd7145cccbec750692ff57072280.1643117600.git.balaton@eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-04usb/ohci: Move trace point and log ep number to help debuggingBALATON Zoltan2-8/+8
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <4e3a05a64b5029a88654eab9a873fb45ac80b1a7.1643117600.git.balaton@eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-04hw/usb/dev-mtp: create directories with a+x mode maskVolker Rümelin1-2/+2
Current code creates directories with mode 0644. Even the creator can't create files in the new directory. Set all x mode flags in variable mask and clear all x mode flags in function open() to preserve the current open mode. Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20220122140619.7514-1-vr_qemu@t-online.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-04hw/usb: pacify xhciwmi.exe warningDenis V. Lunev1-1/+1
xhciwmi.exe is used inside Windows 2022 SVVP tests. This tool called as 'xhciwmi.exe --verify' reports that 'The firmware loaded on this controller has known bugs and/or compatibility issues'. This is just a warning but there is no particular sense to ignore it. This patch just pacifies the tool. There is a big question whether this change should be put using machine type mechanics, but at my opinion this would be an overkill. Signed-off-by: Denis V. Lunev <den@openvz.org> Tested-by: Pavel Polozov <pavel.polozov@virtuozzo.com> CC: Yan Vugenfirer <yvugenfi@redhat.com> CC: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com> Message-Id: <20211223095443.130276-1-den@openvz.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-02-22Merge remote-tracking branch ↵Peter Maydell1-3/+3
'remotes/lvivier-gitlab/tags/trivial-branch-for-7.0-pull-request' into staging Trivial branch pull request 20220222 # gpg: Signature made Tue 22 Feb 2022 16:16:01 GMT # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/lvivier-gitlab/tags/trivial-branch-for-7.0-pull-request: hid: Implement support for side and extra buttons vdpa: Make ncs autofree qemu-options: fix incorrect description for '-drive index=' hw/nvram: use at24 macro target/rx: Remove unused ENV_OFFSET definition target/avr: Correct AVRCPUClass docstring configure: Disable capstone and slirp in the --without-default-features mode Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-02-22hid: Implement support for side and extra buttonsNoah Bergbauer1-3/+3
Simply set the respective bits and update the descriptor accordingly. Signed-off-by: Noah Bergbauer <noah@statshelix.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20211126140437.79745-1-noah@statshelix.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-02-21Mark remaining global TypeInfo instances as constBernhard Beschow2-2/+2
More than 1k of TypeInfo instances are already marked as const. Mark the remaining ones, too. This commit was created with: git grep -z -l 'static TypeInfo' -- '*.c' | \ xargs -0 sed -i 's/static TypeInfo/static const TypeInfo/' Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Acked-by: Corey Minyard <cminyard@mvista.com> Message-id: 20220117145805.173070-2-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-01-13uas: add missing returnGerd Hoffmann1-0/+1
Otherwise we run the error handling code even for successful requests. Fixes: 13b250b12ad3 ("uas: add stream number sanity checks.") Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211210080659.2537084-1-kraxel@redhat.com>
2022-01-13usb: allow max 8192 bytes for desczhenwei pi2-7/+9
A device of USB video class usually uses larger desc structure, so use larger buffer to avoid failure. (dev-video.c is ready) This is an unlikely code path: 1, during guest startup, guest tries to probe device. 2, run 'lsusb' command in guest(or other similar commands). Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: zhenwei pi <pizhenwei@bytedance.com> Message-Id: <20220112015835.900619-1-pizhenwei@bytedance.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-01-13hw/usb/dev-wacom: add missing HID descriptorDario Binacchi1-1/+71
Linux need to fill up the HID descriptor in order to let the driver be emulated. The descriptor was downloaded from [1]. The patch was tested with evtest tool on top of qemu 5.2.0 with linux kernel 4.19.208. [1] https://github.com/linuxwacom/wacom-hid-descriptors/tree/master/Wacom%20PenPartner Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com> Co-developed-by: Michael Trimarchi <michael@amarulasolutions.com> Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com> Message-Id: <20220112090125.381364-1-dario.binacchi@amarulasolutions.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-12-31pci: Let ld*_pci_dma() take MemTxAttrs argumentPhilippe Mathieu-Daudé1-0/+1
Let devices specify transaction attributes when calling ld*_pci_dma(). Keep the default MEMTXATTRS_UNSPECIFIED in the few callers. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211223115554.3155328-22-philmd@redhat.com>
2021-12-31dma: Let ld*_dma() propagate MemTxResultPhilippe Mathieu-Daudé1-3/+4
dma_memory_read() returns a MemTxResult type. Do not discard it, return it to the caller. Update the few callers. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211223115554.3155328-19-philmd@redhat.com>
2021-12-31dma: Let ld*_dma() take MemTxAttrs argumentPhilippe Mathieu-Daudé1-3/+3
Let devices specify transaction attributes when calling ld*_dma(). Keep the default MEMTXATTRS_UNSPECIFIED in the few callers. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211223115554.3155328-17-philmd@redhat.com>
2021-12-30dma: Let dma_memory_map() take MemTxAttrs argumentPhilippe Mathieu-Daudé1-1/+2
Let devices specify transaction attributes when calling dma_memory_map(). Patch created mechanically using spatch with this script: @@ expression E1, E2, E3, E4; @@ - dma_memory_map(E1, E2, E3, E4) + dma_memory_map(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED) Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20211223115554.3155328-7-philmd@redhat.com>
2021-12-30dma: Let dma_memory_read/write() take MemTxAttrs argumentPhilippe Mathieu-Daudé4-20/+30
Let devices specify transaction attributes when calling dma_memory_read() or dma_memory_write(). Patch created mechanically using spatch with this script: @@ expression E1, E2, E3, E4; @@ ( - dma_memory_read(E1, E2, E3, E4) + dma_memory_read(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED) | - dma_memory_write(E1, E2, E3, E4) + dma_memory_write(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED) ) Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20211223115554.3155328-6-philmd@redhat.com>
2021-12-30dma: Let dma_memory_rw() take MemTxAttrs argumentPhilippe Mathieu-Daudé1-4/+6
Let devices specify transaction attributes when calling dma_memory_rw(). Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20211223115554.3155328-5-philmd@redhat.com>
2021-11-03Merge remote-tracking branch ↵Richard Henderson1-9/+15
'remotes/berrange/tags/hmp-x-qmp-620-pull-request' into staging Initial conversion of HMP debugging commands to QMP This introduces a new policy that all HMP commands will be converted to have QMP equivalents, marked unstable if no formal QAPI modelling is intended to be done. New unstable commands are added as follows: - HMP "info roms" => QMP "x-query-roms" - HMP "info profile" => QMP "x-query-profile" - HMP "info numa" => QMP "x-query-numa" - HMP "info usb" => QMP "x-query-usb" - HMP "info rdma" => QMP "x-query-rdma" - HMP "info ramblock" => QMP "x-query-ramblock" - HMP "info irq" => QMP "x-query-irq" - HMP "info jit" => QMP "x-query-jit" - HMP "info opcount" => QMP "x-query-opcount" # gpg: Signature made Tue 02 Nov 2021 01:54:28 PM EDT # gpg: using RSA key DAF3A6FDB26B62912D0E8E3FBE86EBB415104FDF # gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>" [full] # gpg: aka "Daniel P. Berrange <berrange@redhat.com>" [full] * remotes/berrange/tags/hmp-x-qmp-620-pull-request: qapi: introduce x-query-opcount QMP command qapi: introduce x-query-jit QMP command qapi: introduce x-query-irq QMP command qapi: introduce x-query-ramblock QMP command qapi: introduce x-query-rdma QMP command qapi: introduce x-query-usb QMP command qapi: introduce x-query-numa QMP command qapi: introduce x-query-profile QMP command qapi: introduce x-query-roms QMP command docs/devel: document expectations for HMP commands in the future docs/devel: add example of command returning unstructured text docs/devel: document expectations for QAPI data modelling for QMP monitor: introduce HumanReadableText and HMP support docs/devel: update error handling guidance for HMP commands docs/devel: tweak headings in monitor command docs docs/devel: rename file for writing monitor commands monitor: make hmp_handle_error return a boolean monitor: remove 'info ioapic' HMP command Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-11-02qapi: introduce x-query-usb QMP commandDaniel P. Berrangé1-9/+15
This is a counterpart to the HMP "info usb" command. It is being added with an "x-" prefix because this QMP command is intended as an adhoc debugging tool and will thus not be modelled in QAPI as fully structured data, nor will it have long term guaranteed stability. The existing HMP command is rewritten to call the QMP command. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2021-11-02hw/usb/vt82c686-uhci-pci: Use ISA instead of PCI interruptsBALATON Zoltan1-0/+13
This device is part of a superio/ISA bridge chip and IRQs from it are routed to an ISA interrupt set by the Interrupt Line PCI config register. Implement this in a vt82c686-uhci-pci specific irq handler Using via_isa_set_irq(). Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <8d7ed385e33a847d8ddc669163a68b5ca57f82ce.1635161629.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-11-02usb/uhci: Replace pci_set_irq with qemu_set_irqBALATON Zoltan2-2/+4
Instead of using pci_set_irq, store the irq in the device state and use it explicitly so variants having different interrupt handling can use their own. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <b39066e03c8731f4197d50bc79b403f797599999.1635161629.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-11-02usb/uhci: Disallow user creating a vt82c686-uhci-pci deviceBALATON Zoltan3-0/+6
Because this device only works as part of VIA superio chips set user creatable to false. Since the class init method is common for UHCI variants introduce a flag in UHCIInfo for this. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <e6abf1f19ca72bbc2d8a5a6aa941edbf87a9845f.1635161629.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-11-02usb/uhci: Misc clean upBALATON Zoltan1-5/+2
Fix a comment for coding style so subsequent patch will not get checkpatch error and simplify and shorten uhci_update_irq(). Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <b68a57dfcf181e73272b4dc951f8cc6e76b0d182.1635161629.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-09-30qbus: Rename qbus_create_inplace() to qbus_init()Peter Maydell2-3/+2
Rename qbus_create_inplace() to qbus_init(); this is more in line with our usual naming convention for functions that in-place initialize objects. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20210923121153.23754-5-peter.maydell@linaro.org
2021-09-30scsi: Replace scsi_bus_new() with scsi_bus_init(), scsi_bus_init_named()Peter Maydell3-6/+4
The function scsi_bus_new() creates a new SCSI bus; callers can either pass in a name argument to specify the name of the new bus, or they can pass in NULL to allow the bus to be given an automatically generated unique name. Almost all callers want to use the autogenerated name; the only exception is the virtio-scsi device. Taking a name argument that should almost always be NULL is an easy-to-misuse API design -- it encourages callers to think perhaps they should pass in some standard name like "scsi" or "scsi-bus". We don't do this anywhere for SCSI, but we do (incorrectly) do it for other bus types such as i2c. The function name also implies that it will return a newly allocated object, when it in fact does in-place allocation. We more commonly name such functions foo_init(), with foo_new() being the allocate-and-return variant. Replace all the scsi_bus_new() callsites with either: * scsi_bus_init() for the usual case where the caller wants an autogenerated bus name * scsi_bus_init_named() for the rare case where the caller needs to specify the bus name and document that for the _named() version it's then the caller's responsibility to think about uniqueness of bus names. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20210923121153.23754-2-peter.maydell@linaro.org
2021-09-01hw/usb: Fix typo in comments and printCai Huoqing6-12/+12
Fix typo: *informations ==> information *enougth ==> enough *enouth ==> enough *registy ==> registry *releated ==> related *Ouptut ==> Output *manualy ==> manually *Attemping ==> Attempting *contine ==> continue *tranceiver ==> transceiver *Tranceiver ==> Transceiver Signed-off-by: Cai Huoqing <caihuoqing@baidu.com> Message-Id: <20210730012720.2246-1-caihuoqing@baidu.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-09-01uas: add stream number sanity checks.Gerd Hoffmann1-0/+11
The device uses the guest-supplied stream number unchecked, which can lead to guest-triggered out-of-band access to the UASDevice->data3 and UASDevice->status3 fields. Add the missing checks. Fixes: CVE-2021-3713 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reported-by: Chen Zhe <chenzhe@huawei.com> Reported-by: Tan Jingguo <tanjingguo@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210818120505.1258262-2-kraxel@redhat.com>
2021-08-05chardev: mark explicitly first argument as poisonedMarc-André Lureau1-1/+1
Since commit 9894dc0cdcc397ee5b26370bc53da6d360a363c2 "char: convert from GIOChannel to QIOChannel", the first argument to the watch callback can actually be a QIOChannel, which is not a GIOChannel (but a QEMU Object). Even though we never used that pointer, change the callback type to warn the users. Possibly a better fix later, we may want to store the callback and call it from intermediary functions. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2021-07-29usbredir: fix free callGerd Hoffmann1-1/+1
data might point into the middle of a larger buffer, there is a separate free_on_destroy pointer passed into bufp_alloc() to handle that. It is only used in the normal workflow though, not when dropping packets due to the queue being full. Fix that. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/491 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210722072756.647673-1-kraxel@redhat.com>
2021-07-29usb-host: wire up timer for windowsGerd Hoffmann1-1/+32
On windows we can't wait on file descriptors. Poll libusb using a timer instead. Fixes long-standing FIXME. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/431 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20210623085249.1151901-2-kraxel@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-07-22usb: fix usb-host dependency checkGerd Hoffmann1-1/+1
Fixes: 90540f3289 ("configure, meson: convert libusb detection to meson", 2021-06-25) Reported-by: Programmingkid <programmingkidx@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20210721081718.301343-1-kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.1 at 2025-01-17 23:25:03 +0000