Branch: refs/heads/master Home: https://github.com/qemu/qemu Commit: 05f43d44e4bc26611ce25fd7d726e483f73363ce https://github.com/qemu/qemu/commit/05f43d44e4bc26611ce25fd7d726e483f73363ce Author: Gerd Hoffmann <kra...@redhat.com> Date: 2016-10-12 (Wed, 12 Oct 2016)
Changed paths: M hw/usb/hcd-xhci.c Log Message: ----------- xhci: limit the number of link trbs we are willing to process Needed to avoid we run in circles forever in case the guest builds an endless loop with link trbs. Reported-by: Li Qiang <liqiang...@360.cn> Tested-by: P J P <ppan...@redhat.com> Signed-off-by: Gerd Hoffmann <kra...@redhat.com> Message-id: 1476096382-7981-1-git-send-email-kra...@redhat.com Commit: 1fe163feeb31cbd20e2ace071f34141892c8e06b https://github.com/qemu/qemu/commit/1fe163feeb31cbd20e2ace071f34141892c8e06b Author: Gerd Hoffmann <kra...@redhat.com> Date: 2016-10-12 (Wed, 12 Oct 2016) Changed paths: M hw/usb/hcd-xhci.c Log Message: ----------- xhci: decouple EV_QUEUE from TD_QUEUE EV_QUEUE must not change because an array of that size is part of live migration data. Hard-code current value there, so we can touch TD_QUEUE without breaking live migration. Signed-off-by: Gerd Hoffmann <kra...@redhat.com> Message-id: 1474965172-30321-3-git-send-email-kra...@redhat.com Commit: 7512b13dd7f77c3e93a5b856eddf78378bddcc7f https://github.com/qemu/qemu/commit/7512b13dd7f77c3e93a5b856eddf78378bddcc7f Author: Gerd Hoffmann <kra...@redhat.com> Date: 2016-10-12 (Wed, 12 Oct 2016) Changed paths: M hw/usb/hcd-xhci.c Log Message: ----------- xhci: drop unused comp_xfer field Signed-off-by: Gerd Hoffmann <kra...@redhat.com> Message-id: 1474965172-30321-4-git-send-email-kra...@redhat.com Commit: 94b037f2a451b3dc855f9f2c346e5049a361bd55 https://github.com/qemu/qemu/commit/94b037f2a451b3dc855f9f2c346e5049a361bd55 Author: Gerd Hoffmann <kra...@redhat.com> Date: 2016-10-12 (Wed, 12 Oct 2016) Changed paths: M hw/usb/hcd-xhci.c Log Message: ----------- xhci: use linked list for transfers xhci has a fixed number of 24 (TD_QUEUE) XHCITransfer structs per endpoint, which turns out to be a problem for usb3 devices with 32 (or more) bulk streams. xhci re-checks the trb rings on every finished transfer to make sure it'll pick up any pending work. But that scheme breaks in case the first transfer of a ring can't be started because we ran out of XHCITransfer structs already. So remove static XHCITransfer array from XHCIEPContext. Use a linked list instead, and allocate/free XHCITransfer as needed. Add helper functions to allocate & initialize and to cleanup & release XHCITransfer structs. That also simplifies trb management, we never have to realloc XHCITransfer->trbs because we don't reuse XHCITransfer structs any more. New dynamic limit for in-flight xhci transfers per endpoint is number-of-streams + 16. Signed-off-by: Gerd Hoffmann <kra...@redhat.com> Message-id: 1474965172-30321-5-git-send-email-kra...@redhat.com Commit: 5612564ea9cf5b9636438a1b58ae9a2ab6ca16ae https://github.com/qemu/qemu/commit/5612564ea9cf5b9636438a1b58ae9a2ab6ca16ae Author: Gerd Hoffmann <kra...@redhat.com> Date: 2016-10-12 (Wed, 12 Oct 2016) Changed paths: M hw/usb/hcd-xhci.c Log Message: ----------- xhci: drop XHCITransfer->xhci Use XHCITransfer->epctx->xhci instead. Signed-off-by: Gerd Hoffmann <kra...@redhat.com> Message-id: 1474965172-30321-6-git-send-email-kra...@redhat.com Commit: 3a533ee8fda6457ddc85d3c5dfeff037a808fcb3 https://github.com/qemu/qemu/commit/3a533ee8fda6457ddc85d3c5dfeff037a808fcb3 Author: Gerd Hoffmann <kra...@redhat.com> Date: 2016-10-12 (Wed, 12 Oct 2016) Changed paths: M hw/usb/hcd-xhci.c Log Message: ----------- xhci: add & use xhci_kick_epctx() xhci_kick_epctx is a xhci_kick_ep variant which takes an XHCIEPContext as input instead of slotid and epid. So in case we have a XHCIEPContext at hand at the callsite we can just pass it directly. Signed-off-by: Gerd Hoffmann <kra...@redhat.com> Message-id: 1474965172-30321-7-git-send-email-kra...@redhat.com Commit: d6fcb2936f9bacf3ad696e957e229ee2aadc0d0d https://github.com/qemu/qemu/commit/d6fcb2936f9bacf3ad696e957e229ee2aadc0d0d Author: Gerd Hoffmann <kra...@redhat.com> Date: 2016-10-12 (Wed, 12 Oct 2016) Changed paths: M hw/usb/hcd-xhci.c Log Message: ----------- xhci: drop XHCITransfer->{slotid,epid} We can use XHCITransfer->epctx->{slotid,epid} instead. Signed-off-by: Gerd Hoffmann <kra...@redhat.com> Message-id: 1474965172-30321-8-git-send-email-kra...@redhat.com Commit: 070eeef9e0821fbaeda7002de4ee61b5b4015fa6 https://github.com/qemu/qemu/commit/070eeef9e0821fbaeda7002de4ee61b5b4015fa6 Author: Gerd Hoffmann <kra...@redhat.com> Date: 2016-10-12 (Wed, 12 Oct 2016) Changed paths: M hw/usb/hcd-xhci.c Log Message: ----------- xhci: make xhci_epid_to_usbep accept XHCIEPContext All callsites have a XHCIEPContext pointer anyway, so we can just pass it directly instead of fiddeling with slotid and epid. Signed-off-by: Gerd Hoffmann <kra...@redhat.com> Message-id: 1474965172-30321-9-git-send-email-kra...@redhat.com Commit: 0136464d10f1fd9393a8125f2c552ef24f3e592c https://github.com/qemu/qemu/commit/0136464d10f1fd9393a8125f2c552ef24f3e592c Author: Gerd Hoffmann <kra...@redhat.com> Date: 2016-10-12 (Wed, 12 Oct 2016) Changed paths: M hw/usb/desc.c Log Message: ----------- usb: fix serial generator snprintf return value is *not* the number of chars written into the buffer, but the number of chars needed. So in case the buffer is too small you can go alloc a bigger one and try again. But that also means you can't simply use the return value for the next snprintf call without checking beforehand that things did actually fit. Problem is that usb_desc_create_serial didn't perform that check, so a loooong path string (can happen with deep pci-bridge nesting) results in the third snprintf call smashing the stack. Fix this by throwing out all the snpintf calls and use g_strdup_printf instead. https://bugzilla.redhat.com/show_bug.cgi?id=1381630 Reported-by: Thomas Huth <th...@redhat.com> Signed-off-by: Gerd Hoffmann <kra...@redhat.com> Reviewed-by: Thomas Huth <th...@redhat.com> Reviewed-by: Eric Blake <ebl...@redhat.com> Message-id: 1475659998-22045-1-git-send-email-kra...@redhat.com Commit: 6998b6c7c77e22d386fb8792365e668351d22f91 https://github.com/qemu/qemu/commit/6998b6c7c77e22d386fb8792365e668351d22f91 Author: Vijay Kumar B <vijayku...@zilogic.com> Date: 2016-10-12 (Wed, 12 Oct 2016) Changed paths: M hw/usb/hcd-ohci.c Log Message: ----------- usb: Fix incorrect default DMA offset. The default DMA offset is set to 3. When the property is not set by the consumer, the default causes DMA access to be shifted by 3 bytes. In PXA, this results in incorrect DMA access, leading to error notification in the USB controller driver. A better default would be 0, so that there is no offset, when the consumer does not specify one. Signed-off-by: Vijay Kumar B. <vijayku...@zilogic.com> Reviewed-by: Deepak S. <dee...@zilogic.com> Message-id: 1475060958-7760-1-git-send-email-vijayku...@zilogic.com Signed-off-by: Gerd Hoffmann <kra...@redhat.com> Commit: d5c42857d6b0c35028897df8dfc3749eba6f6de3 https://github.com/qemu/qemu/commit/d5c42857d6b0c35028897df8dfc3749eba6f6de3 Author: Hans de Goede <hdego...@redhat.com> Date: 2016-10-12 (Wed, 12 Oct 2016) Changed paths: M hw/usb/redirect.c Log Message: ----------- usb-redir: allocate buffers before waking up the host adapter Needed to make sure usb redirection is prepared to actually handle the callback from the usb host adapter. Without this interrupt endpoints don't work on xhci. Note: On ehci the usb_wakeup() call only schedules a BH for the actual work, which hides this bug because the allocation happens before ehci calls back even without this patch. Signed-off-by: Hans de Goede <hdego...@redhat.com> Message-id: 1476096313-7730-1-git-send-email-kra...@redhat.com Signed-off-by: Gerd Hoffmann <kra...@redhat.com> Commit: c264a8807299852fc45562768ae60ccc886cea91 https://github.com/qemu/qemu/commit/c264a8807299852fc45562768ae60ccc886cea91 Author: Peter Maydell <peter.mayd...@linaro.org> Date: 2016-10-12 (Wed, 12 Oct 2016) Changed paths: M hw/usb/desc.c M hw/usb/hcd-ohci.c M hw/usb/hcd-xhci.c M hw/usb/redirect.c Log Message: ----------- Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20161012-1' into staging various usb bugfixes some xhci cleanups # gpg: Signature made Wed 12 Oct 2016 13:38:27 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kra...@redhat.com>" # gpg: aka "Gerd Hoffmann <g...@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kra...@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-usb-20161012-1: usb-redir: allocate buffers before waking up the host adapter usb: Fix incorrect default DMA offset. usb: fix serial generator xhci: make xhci_epid_to_usbep accept XHCIEPContext xhci: drop XHCITransfer->{slotid,epid} xhci: add & use xhci_kick_epctx() xhci: drop XHCITransfer->xhci xhci: use linked list for transfers xhci: drop unused comp_xfer field xhci: decouple EV_QUEUE from TD_QUEUE xhci: limit the number of link trbs we are willing to process Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Compare: https://github.com/qemu/qemu/compare/ae4b28ace955...c264a8807299