[Qemu-devel] [PULL 0/6] usb patch queue

[Qemu-devel] [PULL 0/6] usb patch queue

[Gerd Hoffmann]

  Hi,

The usb patch queue, with coverity fixes.  Also makes xhci
cancel inflight transfers on usb device unplug.

please pull,
  Gerd

The following changes since commit 63fb2590839162afdf14d7c0ee02d460766c0956:

  Merge branch 'target-arm.next' of git://git.linaro.org/people/pmaydell/qemu-arm (2013-01-12 12:47:07 +0000)

are available in the git repository at:


  git://git.kraxel.org/qemu usb.76

for you to fetch changes up to 036078475427f2562c8e505f6bb44dbf5d8cbd95:

  usb-host: Initialize dev->port the obviously safe way (2013-01-14 12:47:11 +0100)

----------------------------------------------------------------
Gerd Hoffmann (3):
      xhci: create xhci_detach_slot helper function
      xhci: call xhci_detach_slot on root port detach too
      xhci: nuke transfe5rs on detach

Markus Armbruster (3):
      ehci: Assert state machine is sane w.r.t. EHCIQueue
      usb-host: Drop superfluous null test from usb_host_auto_scan()
      usb-host: Initialize dev->port the obviously safe way

 hw/usb/hcd-ehci.c   |    4 ++++
 hw/usb/hcd-xhci.c   |   31 +++++++++++++++++++++++++------
 hw/usb/host-linux.c |    4 ++--
 3 files changed, 31 insertions(+), 8 deletions(-)

[Qemu-devel] [PATCH 1/6] xhci: create xhci_detach_slot helper function

[Gerd Hoffmann]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/usb/hcd-xhci.c |   24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 92f2eee..3ff8bc1 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -2198,6 +2198,23 @@ static unsigned int xhci_get_slot(XHCIState *xhci, XHCIEvent *event, XHCITRB *tr
     return slotid;
 }
 
+/* cleanup slot state on usb device detach */
+static void xhci_detach_slot(XHCIState *xhci, USBPort *uport)
+{
+    int slot;
+
+    for (slot = 0; slot < xhci->numslots; slot++) {
+        if (xhci->slots[slot].uport == uport) {
+            break;
+        }
+    }
+    if (slot == xhci->numslots) {
+        return;
+    }
+
+    xhci->slots[slot].uport = NULL;
+}
+
 static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx)
 {
     dma_addr_t ctx;
@@ -2971,13 +2988,8 @@ static void xhci_child_detach(USBPort *uport, USBDevice *child)
 {
     USBBus *bus = usb_bus_from_device(child);
     XHCIState *xhci = container_of(bus, XHCIState, bus);
-    int i;
 
-    for (i = 0; i < xhci->numslots; i++) {
-        if (xhci->slots[i].uport == uport) {
-            xhci->slots[i].uport = NULL;
-        }
-    }
+    xhci_detach_slot(xhci, uport);
 }
 
 static USBPortOps xhci_uport_ops = {
-- 
1.7.9.7

[Qemu-devel] [PATCH 2/6] xhci: call xhci_detach_slot on root port detach too

[Gerd Hoffmann]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/usb/hcd-xhci.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 3ff8bc1..5b2e7f8 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -2957,6 +2957,7 @@ static void xhci_detach(USBPort *usbport)
     XHCIState *xhci = usbport->opaque;
     XHCIPort *port = xhci_lookup_port(xhci, usbport);
 
+    xhci_detach_slot(xhci, usbport);
     xhci_port_update(port, 1);
 }
 
-- 
1.7.9.7

[Qemu-devel] [PATCH 3/6] xhci: nuke transfe5rs on detach

[Gerd Hoffmann]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/usb/hcd-xhci.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 5b2e7f8..5fb0c48 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -1197,6 +1197,7 @@ static int xhci_ep_nuke_xfers(XHCIState *xhci, unsigned int slotid,
             ep = epctx->transfers[xferi].packet.ep;
         }
         killed += xhci_ep_nuke_one_xfer(&epctx->transfers[xferi]);
+        epctx->transfers[xferi].packet.ep = NULL;
         xferi = (xferi + 1) % TD_QUEUE;
     }
     if (ep) {
@@ -2201,7 +2202,7 @@ static unsigned int xhci_get_slot(XHCIState *xhci, XHCIEvent *event, XHCITRB *tr
 /* cleanup slot state on usb device detach */
 static void xhci_detach_slot(XHCIState *xhci, USBPort *uport)
 {
-    int slot;
+    int slot, ep;
 
     for (slot = 0; slot < xhci->numslots; slot++) {
         if (xhci->slots[slot].uport == uport) {
@@ -2212,6 +2213,11 @@ static void xhci_detach_slot(XHCIState *xhci, USBPort *uport)
         return;
     }
 
+    for (ep = 0; ep < 31; ep++) {
+        if (xhci->slots[slot].eps[ep]) {
+            xhci_ep_nuke_xfers(xhci, slot+1, ep+1);
+        }
+    }
     xhci->slots[slot].uport = NULL;
 }
 
-- 
1.7.9.7

[Qemu-devel] [PATCH 4/6] ehci: Assert state machine is sane w.r.t. EHCIQueue

[Gerd Hoffmann]

From: Markus Armbruster <armbru@redhat.com>

Coverity worries the EHCIQueue pointer could be null when we pass it
to functions that reference it.  The state machine ensures it can't be
null then.  Assert that, to hush the checker.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/usb/hcd-ehci.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 320b7e7..7040659 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -2092,18 +2092,22 @@ static void ehci_advance_state(EHCIState *ehci, int async)
             break;
 
         case EST_ADVANCEQUEUE:
+            assert(q != NULL);
             again = ehci_state_advqueue(q);
             break;
 
         case EST_FETCHQTD:
+            assert(q != NULL);
             again = ehci_state_fetchqtd(q);
             break;
 
         case EST_HORIZONTALQH:
+            assert(q != NULL);
             again = ehci_state_horizqh(q);
             break;
 
         case EST_EXECUTE:
+            assert(q != NULL);
             again = ehci_state_execute(q);
             if (async) {
                 ehci->async_stepdown = 0;
-- 
1.7.9.7

[Qemu-devel] [PATCH 5/6] usb-host: Drop superfluous null test from usb_host_auto_scan()

[Gerd Hoffmann]

From: Markus Armbruster <armbru@redhat.com>

Coverity points out that port is later passed to usb_host_open(),
which dereferences it.  It actually can't be null: it always points to
usb_host_scan()'s auto port[].  Drop the superfluous port == NULL
test.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/usb/host-linux.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/usb/host-linux.c b/hw/usb/host-linux.c
index e8e6a42..a498840 100644
--- a/hw/usb/host-linux.c
+++ b/hw/usb/host-linux.c
@@ -1760,7 +1760,7 @@ static int usb_host_auto_scan(void *opaque, int bus_num,
         if (f->addr > 0 && f->addr != addr) {
             continue;
         }
-        if (f->port != NULL && (port == NULL || strcmp(f->port, port) != 0)) {
+        if (f->port != NULL && strcmp(f->port, port) != 0) {
             continue;
         }
 
-- 
1.7.9.7

[Qemu-devel] [PATCH 6/6] usb-host: Initialize dev->port the obviously safe way

[Gerd Hoffmann]

From: Markus Armbruster <armbru@redhat.com>

Coverity worries the strcpy() could overrun the destination.  It
can't, because the source always points to usb_host_scan()'s auto
port[], which has the same size.  Use pstrcpy() anyway, to hush the
checker.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/usb/host-linux.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/usb/host-linux.c b/hw/usb/host-linux.c
index a498840..ad75ce0 100644
--- a/hw/usb/host-linux.c
+++ b/hw/usb/host-linux.c
@@ -1314,7 +1314,7 @@ static int usb_host_open(USBHostDevice *dev, int bus_num,
 
     dev->bus_num = bus_num;
     dev->addr = addr;
-    strcpy(dev->port, port);
+    pstrcpy(dev->port, sizeof(dev->port), port);
     dev->fd = fd;
 
     /* read the device description */
-- 
1.7.9.7

Re: [Qemu-devel] [PULL 0/6] usb patch queue

[Anthony Liguori]

Pulled, thanks.

Regards,

Anthony Liguori

[Qemu-devel] [PULL 0/6] usb patch queue

[Gerd Hoffmann]

  Hi,

Here comes the usb patch queue, with a bugfix collection and a
documentation update.

please pull,
  Gerd

The following changes since commit 76d20ea0f1b26ebd5da2f5fb2fdf3250cde887bb:

  Merge remote-tracking branch 'armbru/tags/pull-qapi-2017-05-04-v3' into staging (2017-05-09 15:49:14 -0400)

are available in the git repository at:

  git://git.kraxel.org/qemu tags/pull-usb-20170512-1

for you to fetch changes up to aa612b364ecbe1dc034efcabb04526f24e56c145:

  hw/usb/dev-serial: Do not try to set vendorid or productid properties (2017-05-12 12:30:23 +0200)

----------------------------------------------------------------
usb: bugfixes, doc update

----------------------------------------------------------------
Gerd Hoffmann (1):
      usb-redir: fix stack overflow in usbredir_log_data

Ladi Prosek (3):
      xhci: fix logging
      usb-hub: clear PORT_STAT_SUSPEND on wakeup
      xhci: relax link check

Thomas Huth (2):
      qemu-doc: Update to use the new way of attaching USB devices
      hw/usb/dev-serial: Do not try to set vendorid or productid properties

 docs/qdev-device-use.txt |  6 ++--
 hw/usb/dev-hub.c         |  1 +
 hw/usb/dev-serial.c      | 24 ++++---------
 hw/usb/hcd-xhci.c        |  9 ++---
 hw/usb/redirect.c        | 13 +------
 qemu-doc.texi            | 91 +++++++++++++++++++++++++++---------------------
 6 files changed, 64 insertions(+), 80 deletions(-)

Re: [Qemu-devel] [PULL 0/6] usb patch queue

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 1706 bytes --]

On Fri, May 12, 2017 at 02:21:52PM +0200, Gerd Hoffmann wrote:
>   Hi,
> 
> Here comes the usb patch queue, with a bugfix collection and a
> documentation update.
> 
> please pull,
>   Gerd
> 
> The following changes since commit 76d20ea0f1b26ebd5da2f5fb2fdf3250cde887bb:
> 
>   Merge remote-tracking branch 'armbru/tags/pull-qapi-2017-05-04-v3' into staging (2017-05-09 15:49:14 -0400)
> 
> are available in the git repository at:
> 
>   git://git.kraxel.org/qemu tags/pull-usb-20170512-1
> 
> for you to fetch changes up to aa612b364ecbe1dc034efcabb04526f24e56c145:
> 
>   hw/usb/dev-serial: Do not try to set vendorid or productid properties (2017-05-12 12:30:23 +0200)
> 
> ----------------------------------------------------------------
> usb: bugfixes, doc update
> 
> ----------------------------------------------------------------
> Gerd Hoffmann (1):
>       usb-redir: fix stack overflow in usbredir_log_data
> 
> Ladi Prosek (3):
>       xhci: fix logging
>       usb-hub: clear PORT_STAT_SUSPEND on wakeup
>       xhci: relax link check
> 
> Thomas Huth (2):
>       qemu-doc: Update to use the new way of attaching USB devices
>       hw/usb/dev-serial: Do not try to set vendorid or productid properties
> 
>  docs/qdev-device-use.txt |  6 ++--
>  hw/usb/dev-hub.c         |  1 +
>  hw/usb/dev-serial.c      | 24 ++++---------
>  hw/usb/hcd-xhci.c        |  9 ++---
>  hw/usb/redirect.c        | 13 +------
>  qemu-doc.texi            | 91 +++++++++++++++++++++++++++---------------------
>  6 files changed, 64 insertions(+), 80 deletions(-)
> 

Thanks, applied to my staging tree:
https://github.com/stefanha/qemu/commits/staging

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 455 bytes --]

[Qemu-devel] [PULL 0/6] usb patch queue

[Gerd Hoffmann]

  Hi,

Here comes the usb patch queue, with a bunch of usb bugixes accumulated
over the last weeks.

If you have anything outstanding usb patches which are not in here,
please resend (exception: the xen host adapter patches which are waiting
for review from xen people).

please pull,
  Gerd

The following changes since commit 6741d38ad0f2405a6e999ebc9550801b01aca479:

  Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2016-03-17 15:59:42 +0000)

are available in the git repository at:


  git://git.kraxel.org/qemu tags/pull-usb-20160321-1

for you to fetch changes up to dff0367cf66f489aa772320fa2937a8cac1ca30d:

  usb: ehci: add capability mmio write function (2016-03-18 14:20:39 +0100)

----------------------------------------------------------------
usb: bugfix collection.

----------------------------------------------------------------
Matthew Fortune (1):
      hw/usb/dev-mtp: Guard inotify usage with CONFIG_INOTIFY1

Peter Xu (3):
      usb: fix unbounded stack warning for xhci_dma_write_u32s
      usb: fix unbound stack usage for usb_mtp_add_str
      usb: fix unbound stack warning for inotify_watchfn

Prasad J Pandit (1):
      usb: ehci: add capability mmio write function

Stefan Weil (1):
      usb: Fix compilation for Windows

 hw/usb/dev-mtp.c  | 29 +++++++++++++++--------------
 hw/usb/hcd-ehci.c |  6 ++++++
 hw/usb/hcd-xhci.c |  6 ++++--
 hw/usb/redirect.c |  4 +++-
 4 files changed, 28 insertions(+), 17 deletions(-)

Re: [Qemu-devel] [PULL 0/6] usb patch queue

[Peter Maydell]

On 21 March 2016 at 11:10, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Here comes the usb patch queue, with a bunch of usb bugixes accumulated
> over the last weeks.
>
> If you have anything outstanding usb patches which are not in here,
> please resend (exception: the xen host adapter patches which are waiting
> for review from xen people).
>
> please pull,
>   Gerd
>
> The following changes since commit 6741d38ad0f2405a6e999ebc9550801b01aca479:
>
>   Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2016-03-17 15:59:42 +0000)
>
> are available in the git repository at:
>
>
>   git://git.kraxel.org/qemu tags/pull-usb-20160321-1
>
> for you to fetch changes up to dff0367cf66f489aa772320fa2937a8cac1ca30d:
>
>   usb: ehci: add capability mmio write function (2016-03-18 14:20:39 +0100)
>
> ----------------------------------------------------------------
> usb: bugfix collection.
>
> ----------------------------------------------------------------

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 0/6] usb patch queue

[Gerd Hoffmann]

  Hi,

Flushing the usb patch queue, there are a few bits sent during the
freeze I didn't feel like merging that close to the release, so
merge them now.  Series reduces the ehci emulation cpu overhead and
allows to connect the usb tablet to ehci.

please pull,
  Gerd

The following changes since commit 16c6c80ac3a772b42a87b77dfdf0fdac7c607b0e:

  Open up 1.4 development branch (2012-12-03 14:08:40 -0600)

are available in the git repository at:
  git://git.kraxel.org/qemu usb.74

Gerd Hoffmann (1):
      add pc-1.4

Hans de Goede (5):
      usb: Call wakeup when data becomes available for all devices with int eps
      usb: Don't allow USB_RET_ASYNC for interrupt packets
      usb: Allow overriding of usb_desc at the device level
      ehci: Lower timer freq when the periodic schedule is idle
      usb-tablet: Allow connecting to ehci

 hw/pc_piix.c         |   24 +++++++++++++-
 hw/usb.h             |    2 +
 hw/usb/bus.c         |    3 ++
 hw/usb/core.c        |    4 ++
 hw/usb/dev-hid.c     |   85 +++++++++++++++++++++++++++++++++++++++++++++++++-
 hw/usb/dev-hub.c     |    2 +
 hw/usb/dev-network.c |    7 ++++
 hw/usb/dev-wacom.c   |    4 ++
 hw/usb/hcd-ehci.c    |   39 +++++++++++++++++++---
 hw/usb/hcd-ehci.h    |    1 +
 hw/usb/host-bsd.c    |    1 +
 hw/usb/host-linux.c  |    1 +
 hw/usb/redirect.c    |    4 ++
 13 files changed, 168 insertions(+), 9 deletions(-)

Re: [Qemu-devel] [PULL 0/6] usb patch queue

[Anthony Liguori]

Gerd Hoffmann <kraxel@redhat.com> writes:

>   Hi,
>
> Flushing the usb patch queue, there are a few bits sent during the
> freeze I didn't feel like merging that close to the release, so
> merge them now.  Series reduces the ehci emulation cpu overhead and
> allows to connect the usb tablet to ehci.
>
> please pull,

Pulled. Thanks.

Regards,

Anthony Liguori

>   Gerd
>
> The following changes since commit 16c6c80ac3a772b42a87b77dfdf0fdac7c607b0e:
>
>   Open up 1.4 development branch (2012-12-03 14:08:40 -0600)
>
> are available in the git repository at:
>   git://git.kraxel.org/qemu usb.74
>
> Gerd Hoffmann (1):
>       add pc-1.4
>
> Hans de Goede (5):
>       usb: Call wakeup when data becomes available for all devices with int eps
>       usb: Don't allow USB_RET_ASYNC for interrupt packets
>       usb: Allow overriding of usb_desc at the device level
>       ehci: Lower timer freq when the periodic schedule is idle
>       usb-tablet: Allow connecting to ehci
>
>  hw/pc_piix.c         |   24 +++++++++++++-
>  hw/usb.h             |    2 +
>  hw/usb/bus.c         |    3 ++
>  hw/usb/core.c        |    4 ++
>  hw/usb/dev-hid.c     |   85 +++++++++++++++++++++++++++++++++++++++++++++++++-
>  hw/usb/dev-hub.c     |    2 +
>  hw/usb/dev-network.c |    7 ++++
>  hw/usb/dev-wacom.c   |    4 ++
>  hw/usb/hcd-ehci.c    |   39 +++++++++++++++++++---
>  hw/usb/hcd-ehci.h    |    1 +
>  hw/usb/host-bsd.c    |    1 +
>  hw/usb/host-linux.c  |    1 +
>  hw/usb/redirect.c    |    4 ++
>  13 files changed, 168 insertions(+), 9 deletions(-)

[Qemu-devel] [PULL 0/6] usb patch queue

[Gerd Hoffmann]

  Hi,

Brings UAS (usb attached scsi) support, fixes and improvements for the
ehci interrupt handling and a little uhci loadvm compatibility bugfix.

please pull,
  Gerd

The following changes since commit 92336855975805d88c7979f53bc05c2d47abab04:

  megasas: disable due to build breakage (2012-07-09 18:16:16 -0500)

are available in the git repository at:
  git://git.kraxel.org/qemu usb.57

Gerd Hoffmann (5):
      usb: add usb attached scsi emulation
      uhci: initialize expire_time when loading v1 vmstate
      ehci: raise irq in the frame timer
      ehci: implement Interrupt Threshold Control support
      ehci: improve expire time calculation

Paolo Bonzini (1):
      scsi: add free_request callback

 docs/usb-storage.txt |   38 +++
 hw/scsi-bus.c        |    5 +
 hw/scsi.h            |    1 +
 hw/usb/Makefile.objs |    1 +
 hw/usb/dev-uas.c     |  779 ++++++++++++++++++++++++++++++++++++++++++++++++++
 hw/usb/hcd-ehci.c    |   91 ++++---
 hw/usb/hcd-uhci.c    |   12 +
 trace-events         |   16 +-
 8 files changed, 909 insertions(+), 34 deletions(-)
 create mode 100644 docs/usb-storage.txt
 create mode 100644 hw/usb/dev-uas.c

[Qemu-devel] [PULL 0/6] usb patch queue.

[Gerd Hoffmann]

  Hi,

This is the usb patch queue, featuring live migration support for
ehci and usb-host.  Also as usual some small bugfixes.

pleae pull,
  Gerd

The following changes since commit 93bfef4c6e4b23caea9d51e1099d06433d8835a4:

  Allow machines to configure the QEMU_VERSION that's exposed via hardware (2012-06-19 13:36:56 -0500)

are available in the git repository at:
  git://git.kraxel.org/qemu usb.54

Gerd Hoffmann (6):
      ehci: add live migration support
      usb: restore USBDevice->attached on vmload
      ehci: tracing improvements
      usb-host: attach only to running guest
      usb-host: live migration support
      uhci: fix uhci_async_cancel_all

 hw/usb/bus.c        |   13 ++++++++
 hw/usb/hcd-ehci.c   |   69 +++++++++++++++++++++++++++++++++++++++-----
 hw/usb/hcd-uhci.c   |    4 +-
 hw/usb/host-linux.c |   79 ++++++++++++++++++++++++++++++++++++++++----------
 trace-events        |    5 ++-
 5 files changed, 142 insertions(+), 28 deletions(-)