- 10 12月, 2018 1 次提交
-
-
由 Gerd Hoffmann 提交于
The token field contains the (guest-filled) state of the qtd, which indicates whenever the other fields are valid or not. So make sure we read the token first, otherwise we may end up with an stale next pointer: (1) ehci reads next (2) guest writes next (3) guest writes token (4) ehci reads token (5) ehci operates with stale next. Typical effect is that qemu doesn't notice that the guest appends new qtds to the end of the queue. Looks like the usb device stopped responding. Linux can recover from that, but leaves a message in the kernel log that it did reset the usb device in question. Signed-off-by: NGerd Hoffmann <kraxel@redhat.com> Message-id: 20181126100836.8805-1-kraxel@redhat.com
-
- 03 7月, 2018 1 次提交
-
-
由 Sebastian Bauer 提交于
Fetching qtd with the NULL address most likely makes no sense so from now on, we handle it this case similarly as if the terminate (T) bit is not set, which is already an exception as according to section 3.6 of the EHCI spec there is no T bit defined for the current_qtd field. The spec is a bit vague on how an EHCI driver should initialize these fields: "The general operational model is that the host controller can detect whether the overlay area contains a description of an active transfer" (p. 49). QEMU primarily uses the QTD_TOKEN_ACTIVE bit of the queue header to infer the activity state but there are other ways conceivable. This change allows QEMU to boot further into AmigaOS. The public available version of the EHCI driver recycles queue heads in some rare conditions but only clears the current_qtd field but not the status field. This works with many available EHCI PCI cards but e.g., not with the Freescale USB controller's found on the P5040. On the emulated EHCI controller of QEMU the consequence is that some garbage was read in, which resulted in a reset of the controller. This change fixes the problem. Signed-off-by: NSebastian Bauer <mail@sebastianbauer.info> Tested-by: NBALATON Zoltan <balaton@eik.bme.hu> Message-id: 20180625222718.4488-1-mail@sebastianbauer.info Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 27 9月, 2017 1 次提交
-
-
由 Dr. David Alan Gilbert 提交于
Modify the pre_save method on VMStateDescription to return an int rather than void so that it potentially can fail. Changed zillions of devices to make them return 0; the only case I've made it return non-0 is hw/intc/s390_flic_kvm.c that already had an error_report/return case. Note: If you add an error exit in your pre_save you must emit an error_report to say why. Signed-off-by: NDr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20170925112917.21340-2-dgilbert@redhat.com> Reviewed-by: NPeter Xu <peterx@redhat.com> Reviewed-by: NCornelia Huck <cohuck@redhat.com> Reviewed-by: NJuan Quintela <quintela@redhat.com> Signed-off-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
-
- 19 9月, 2017 1 次提交
-
-
由 Alistair Francis 提交于
Convert all the single line uses of fprintf(stderr, "warning:"..."\n"... to use warn_report() instead. This helps standardise on a single method of printing warnings to the user. All of the warnings were changed using this command: find ./* -type f -exec sed -i \ 's|fprintf(.*".*warning[,:] \(.*\)\\n"\(.*\));|warn_report("\1"\2);|Ig' \ {} + Some of the lines were manually edited to reduce the line length to below 80 charecters. The #include lines were manually updated to allow the code to compile. Signed-off-by: NAlistair Francis <alistair.francis@xilinx.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Max Reitz <mreitz@redhat.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: Michael Roth <mdroth@linux.vnet.ibm.com> Cc: James Hogan <james.hogan@imgtec.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Yongbok Kim <yongbok.kim@imgtec.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: NMarkus Armbruster <armbru@redhat.com> Reviewed-by: James Hogan <james.hogan@imgtec.com> [mips] Message-Id: <ae8f8a7f0a88ded61743dff2adade21f8122a9e7.1505158760.git.alistair.francis@xilinx.com> Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
-
- 17 7月, 2017 1 次提交
-
-
由 Gerd Hoffmann 提交于
Reported-by: NPeter Maydell <peter.maydell@linaro.org> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com> Reviewed-by: NPeter Maydell <peter.maydell@linaro.org> Message-id: 20170703111549.10924-1-kraxel@redhat.com Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 13 6月, 2017 1 次提交
-
-
由 Gerd Hoffmann 提交于
Can happen with usb-storage devices: ehci_work_bh calls usb-storage, usb-storage calls into block layer, block layer may run BHs. Add a simple bool and just do nothing in case we figure ehci_work_bh is active. Signed-off-by: NGerd Hoffmann <kraxel@redhat.com> Message-id: 20170612073109.25930-1-kraxel@redhat.com
-
- 29 5月, 2017 2 次提交
-
-
由 Gerd Hoffmann 提交于
ehci registers ehci_frame_timer as both timer and bottom half, which turned out to be a bad idea as it can be called as bottom half then while it is running as timer, and it isn't prepared to handle recursive calls. Change the timer func to just schedule the bottom half to avoid this. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1449609Signed-off-by: NGerd Hoffmann <kraxel@redhat.com> Message-id: 20170519120428.25981-1-kraxel@redhat.com
-
由 Gerd Hoffmann 提交于
In case the frame timer doesn't run for a while due to the host being busy skipped_uframes can become big enough that UFRAME_TIMER_NS * skipped_uframes overflows. Which in turn throws off all subsequent ehci frame timer calculations. Reported-by: N李林 <8610_28@163.com> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com> Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20170515104543.32044-1-kraxel@redhat.com
-
- 21 2月, 2017 1 次提交
-
-
由 Li Qiang 提交于
In usb_ehci_init function, it initializes 's->ipacket', but there is no corresponding function to free this. As the ehci can be hotplug and unplug, this will leak host memory leak. In order to make the hierarchy clean, we should add a ehci pci finalize function, then call the clean function in ehci device. Signed-off-by: NLi Qiang <liqiang6-s@360.cn> Message-id: 589a85b8.3c2b9d0a.b8e6.1434@mx.google.com Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 10 11月, 2016 1 次提交
-
-
由 Li Qiang 提交于
In ehci_init_transfer function, if the 'cpage' is bigger than 4, it doesn't free the 'p->sgl' once allocated previously thus leading a memory leak issue. This patch avoid this. Signed-off-by: NLi Qiang <liqiang6-s@360.cn> Message-id: 5821c0f4.091c6b0a.e0c92.e811@mx.google.com Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 08 10月, 2016 1 次提交
-
-
由 Li Qiang 提交于
While processing isochronous transfer descriptors(iTD), if the page select(PG) field value is out of bands it will return. In this situation the ehci's sg list is not freed thus leading to a memory leak issue. This patch avoid this. Signed-off-by: NLi Qiang <liqiang6-s@360.cn> Reviewed-by: NThomas Huth <thuth@redhat.com> Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
-
- 02 8月, 2016 1 次提交
-
-
由 Evgeny Yakovlev 提交于
ehci_update_frindex takes time linearly proportional to a number of uframes to calculate new frame index and raise FLR interrupts, which is a problem for large amounts of uframes. If we experience large delays between echi timer callbacks (i.e. because other periodic handlers have taken a lot of time to complete) we get a lot of skipped frames which then delay ehci timer callback more and this leads to deadlocking the system when ehci schedules next callback to be too soon. Observable behaviour is qemu consuming 100% host CPU time while guest is unresponsive. This misbehavior could happen for a while and QEMU does not get out from this state automatically without the patch. This change makes ehci_update_frindex execute in constant time. Signed-off-by: NEvgeny Yakovlev <eyakovlev@virtuozzo.com> Signed-off-by: NDenis V. Lunev <den@openvz.org> Message-id: 1469638520-32706-1-git-send-email-den@openvz.org CC: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 19 4月, 2016 2 次提交
-
-
由 Gerd Hoffmann 提交于
This reverts commit 156a2e4d. Breaks FreeBSD. Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
由 Gerd Hoffmann 提交于
Commit "156a2e4d ehci: make idt processing more robust" tries to avoid a DoS by the guest (create a circular iTD queue and let qemu ehci emulation run in circles forever). Unfortunately this has two problems: First it misses the case of siTDs, and second it reportedly breaks FreeBSD. So lets go for a different approach: just count the number of iTDs and siTDs we have seen per frame and apply a limit. That should really catch all cases now. Reported-by: N杜少博 <dushaobo@360.cn> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 23 3月, 2016 2 次提交
-
-
由 Rutuja Shah 提交于
This patch replaces get_ticks_per_sec() calls with the macro NANOSECONDS_PER_SECOND. Also, as there are no callers, get_ticks_per_sec() is then removed. This replacement improves the readability and understandability of code. For example, timer_mod(fdctrl->result_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + (get_ticks_per_sec() / 50)); NANOSECONDS_PER_SECOND makes it obvious that qemu_clock_get_ns matches the unit of the expression on the right side of the plus. Signed-off-by: NRutuja Shah <rutu.shah.26@gmail.com> Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
-
由 Markus Armbruster 提交于
Commit 57cb38b3 included qapi/error.h into qemu/osdep.h to get the Error typedef. Since then, we've moved to include qemu/osdep.h everywhere. Its file comment explains: "To avoid getting into possible circular include dependencies, this file should not include any other QEMU headers, with the exceptions of config-host.h, compiler.h, os-posix.h and os-win32.h, all of which are doing a similar job to this file and are under similar constraints." qapi/error.h doesn't do a similar job, and it doesn't adhere to similar constraints: it includes qapi-types.h. That's in excess of 100KiB of crap most .c files don't actually need. Add the typedef to qemu/typedefs.h, and include that instead of qapi/error.h. Include qapi/error.h in .c files that need it and don't get it now. Include qapi-types.h in qom/object.h for uint16List. Update scripts/clean-includes accordingly. Update it further to match reality: replace config.h by config-target.h, add sysemu/os-posix.h, sysemu/os-win32.h. Update the list of includes in the qemu/osdep.h comment quoted above similarly. This reduces the number of objects depending on qapi/error.h from "all of them" to less than a third. Unfortunately, the number depending on qapi-types.h shrinks only a little. More work is needed for that one. Signed-off-by: NMarkus Armbruster <armbru@redhat.com> [Fix compilation without the spice devel packages. - Paolo] Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
-
- 18 3月, 2016 1 次提交
-
-
由 Prasad J Pandit 提交于
USB Ehci emulation supports host controller capability registers. But its mmio '.write' function was missing, which lead to a null pointer dereference issue. Add a do nothing 'ehci_caps_write' definition to avoid it; Do nothing because capability registers are Read Only(RO). Reported-by: NZuozhi Fzz <zuozhi.fzz@alibaba-inc.com> Signed-off-by: NPrasad J Pandit <pjp@fedoraproject.org> Message-id: 1454072434-16045-1-git-send-email-ppandit@redhat.com Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 02 2月, 2016 2 次提交
-
-
由 Gerd Hoffmann 提交于
After clearing the status register we also have to update the irq line status. Otherwise a irq which happends to be pending at reset time causes a interrupt storm. And the guest can't stop as the status register doesn't indicate any pending interrupt. Both NetBSD and FreeBSD hang on shutdown because of that. Cc: qemu-stable@nongnu.org Reported-by: NAndrey Korolyov <andrey@xdel.ru> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com> Message-id: 1453203884-4125-1-git-send-email-kraxel@redhat.com
-
由 Prasad J Pandit 提交于
While processing isochronous transfer descriptors(iTD), the page select(PG) field value could lead to an OOB read access. Add check to avoid it. Reported-by: NQinghao Tang <luodalongde@gmail.com> Signed-off-by: NPrasad J Pandit <pjp@fedoraproject.org> Message-id: 1453233406-12165-1-git-send-email-ppandit@redhat.com Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 29 1月, 2016 1 次提交
-
-
由 Peter Maydell 提交于
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: NPeter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-20-git-send-email-peter.maydell@linaro.org
-
- 15 12月, 2015 1 次提交
-
-
由 Gerd Hoffmann 提交于
Make ehci_process_itd return an error in case we didn't do any actual iso transfer because we've found no active transaction. That'll avoid ehci happily run in circles forever if the guest builds a loop out of idts. This is CVE-2015-8558. Cc: qemu-stable@nongnu.org Reported-by: NQinghao Tang <luodalongde@gmail.com> Tested-by: NP J P <ppandit@redhat.com> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 03 11月, 2015 1 次提交
-
-
由 Gerd Hoffmann 提交于
When a device is detached, clear the suspend bit (PORTSC_SUSPEND) in the port status register. The specs are not *that* clear what is supposed to happen in case a suspended device is unplugged. But the enable bit (PORTSC_PED) is cleared, and the specs mention setting suspend with enable being unset is undefined behavior. So clearing them both looks reasonable, and it actually fixes the reported bug. https://bugzilla.redhat.com/show_bug.cgi?id=1268879 Cc: Hans de Goede <hdegoede@redhat.com> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com> Reviewed-by: NHans de Goede <hdegoede@redhat.com> Message-id: 1445413462-18004-1-git-send-email-kraxel@redhat.com
-
- 21 7月, 2015 1 次提交
-
-
由 Stefan Hajnoczi 提交于
Commit e0cf11f3 ("timer: Use a single definition of NSEC_PER_SEC for the whole codebase") renamed NANOSECONDS_PER_SECOND to NSEC_PER_SEC. On Mac OS X there is a <dispatch/time.h> system header which also defines NSEC_PER_SEC. This causes compiler warnings. Let's use the old name instead. It's longer but it doesn't clash. Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com> Message-id: 1436364609-7929-1-git-send-email-stefanha@redhat.com Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
- 02 7月, 2015 1 次提交
-
-
由 Alberto Garcia 提交于
Signed-off-by: NAlberto Garcia <berto@igalia.com> Message-id: c6e55468856ba0b8f95913c4da111cc0ef266541.1434113783.git.berto@igalia.com Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
-
- 20 3月, 2015 1 次提交
-
-
由 Gonglei 提交于
When hot-unplugging the usb controllers (ehci/uhci), we have to clean all resouce of these devices, involved registered reset handler. Otherwise, it may cause NULL pointer access and/or segmentation fault if we reboot the guest os after hot-unplugging. Let's hook up reset via DeviceClass->reset() and drop the qemu_register_reset() call. Then Qemu will register and unregister the reset handler automatically. Cc: qemu-stable <qemu-stable@nongnu.org> Reported-by: NLidonglin <lidonglin@huawei.com> Signed-off-by: NGonglei <arei.gonglei@huawei.com> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 17 3月, 2015 2 次提交
-
-
由 Markus Armbruster 提交于
The previous commit broke the additional messages explaining the error messages. Improve the error messages, so they don't need explaining so much. Helps QMP users as well, unlike additional explanations. Signed-off-by: NMarkus Armbruster <armbru@redhat.com> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
由 Markus Armbruster 提交于
This loses the messages explaining the error printed with error_printf_unless_qmp(). The next commit will make up for the loss. Signed-off-by: NMarkus Armbruster <armbru@redhat.com> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 26 1月, 2015 1 次提交
-
-
由 Paolo Bonzini 提交于
Old users of VMSTATE_TIMER* are mechanically changed to VMSTATE_TIMER_PTR variants. Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
-
- 23 9月, 2014 1 次提交
-
-
由 Gerd Hoffmann 提交于
Add a flag to EHCIPCIInfo saying whenever the controller supports companions or not. Make sure we only allow registering companions for ehci versions supporting that. Enable pci hotplug for the ehci variants not supporting companions. Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 29 8月, 2014 3 次提交
-
-
由 Gonglei 提交于
Signed-off-by: NGonglei <arei.gonglei@huawei.com> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
由 Gonglei 提交于
cleanup ehci controller resource, both pci and sysbus if they're necessary. Signed-off-by: NGonglei <arei.gonglei@huawei.com> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
由 Gonglei 提交于
since hotunplug the ehci host adapter, we should delete vm_change_state_handler also, so the VMChangeStateEntry should be saved in EHCIState. Signed-off-by: NGonglei <arei.gonglei@huawei.com> Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 15 8月, 2014 1 次提交
-
-
由 Gonglei 提交于
imitate nearby code about using '!value' or 'value == NULL' Signed-off-by: NGonglei <arei.gonglei@huawei.com> Reviewed-by: NEric Blake <eblake@redhat.com> Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
-
- 02 6月, 2014 1 次提交
-
-
由 Gerd Hoffmann 提交于
So we can easily use them in tests. Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 14 5月, 2014 1 次提交
-
-
由 Juan Quintela 提交于
After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: NJuan Quintela <quintela@redhat.com> Acked-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 03 12月, 2013 1 次提交
-
-
由 Stefan Weil 提交于
This reduces the dependencies on trace.h. Only one source file which needs hcd-ehci.h also needs trace.h. Signed-off-by: NStefan Weil <sw@weilnetz.de> Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
-
- 28 11月, 2013 1 次提交
-
-
由 Gerd Hoffmann 提交于
Update portsc register and raise irq in case a suspended port is woken up, so remote wakeup works on our ehci ports. Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 10 9月, 2013 1 次提交
-
-
由 Gerd Hoffmann 提交于
We'll need a pointer to the actual pci/sysbus device, stick a pointer to it into the EHCIState struct. https://bugzilla.redhat.com/show_bug.cgi?id=1005495Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
-
- 31 8月, 2013 1 次提交
-
-
由 Andreas Färber 提交于
To be passed to qbus_create_inplace(). Use DEVICE() cast to avoid a direct parent field access. Reviewed-by: NWenchao Xia <xiawenc@linux.vnet.ibm.com> Signed-off-by: NAndreas Färber <afaerber@suse.de>
-
- 23 8月, 2013 1 次提交
-
-
由 Alex Bligh 提交于
This is an autogenerated patch using scripts/switch-timer-api. Switch the entire code base to using the new timer API. Note this patch may introduce some line length issues. Signed-off-by: NAlex Bligh <alex@alex.org.uk> Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
-