In usb-linux.c:usb_host_handle_control, we pass a 1024-byte buffer and
length to the kernel. However, the length was provided by the caller
of dev->handle_packet, and is not checked, so the kernel might provide
too much data and overflow our buffer.
For example, hw/usb-uhci.c could set the length to 2047.
hw/usb-ohci.c looks like it might go up to 4096 or 8192.
This causes a qemu crash, as reported here:
http://www.mail-archive.com/kvm@vger.kernel.org/msg18447.html
This patch increases the usb-linux.c buffer size to 2048 to fix the
specific device reported, and adds a check to avoid the overflow in
any case.
Signed-off-by: Jim Paris <jim@jtan.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Move usb code from vl.c to usb-bus.c and make it use the new data
structures added by qdev conversion. qemu usb core should be able
to handle multiple USB busses just fine now (untested though).
Kill some usb_*_init() legacy functions, use usb_create_simple()
instead.
Kill some FIXMEs added by the first qdev/usb patch.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* Add USBBus.
* Add USBDeviceInfo, move device callbacks here.
* Add usb-qdev helper functions.
* Switch drivers to qdev.
TODO:
* make the rest of qemu aware of usb busses and kill the FIXMEs
added by this patch.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Scanning for devices via /sys/bus/usb/devices/ and using them via the
/dev/bus/usb/<bus>/<device> character devices is the prefered method
on modern kernels, so try that first.
When using SELinux and libvirt, qemu will have access to /sys/bus/usb
but not /proc/bus/usb, so although the current code will work just
fine, it will generate SELinux AVC warnings.
See also:
https://bugzilla.redhat.com/508326
Reported-by: Daniel Berrange <berrange@redhat.com>
Signed-off-by: Mark McLoughlin <markmc@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Add in a workaround to allow the usb serial devices to work with the
usb pass through mechanism. The ioctl() to request an alternate
interface will always return < 0 for a usb-serial device based on the
kernel driver. This means there is no alternate interface end point.
This was fully tested with a pl2303 usb serial device.
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Refactor the monitor API and prepare it for decoupled terminals:
term_print functions are renamed to monitor_* and all monitor services
gain a new parameter (mon) that will once refer to the monitor instance
the output is supposed to appear on. However, the argument remains
unused for now. All monitor command callbacks are also extended by a mon
parameter so that command handlers are able to pass an appropriate
reference to monitor output services.
For the case that monitor outputs so far happen without clearly
identifiable context, the global variable cur_mon is introduced that
shall once provide a pointer either to the current active monitor (while
processing commands) or to the default one. On the mid or long term,
those use case will be obsoleted so that this variable can be removed
again.
Due to the broad usage of the monitor interface, this patch mostly deals
with converting users of the monitor API. A few of them are already
extended to pass 'mon' from the command handler further down to internal
functions that invoke monitor_printf.
At this chance, monitor-related prototypes are moved from console.h to
a new monitor.h. The same is done for the readline API.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6711 c046a42c-6fe2-441c-8c8c-71466251a162
If the first case does not succeed, then the usb scanning code will leak file
descriptors on every scan.
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5509 c046a42c-6fe2-441c-8c8c-71466251a162
Make "host:" usb devices work again on systems that have the
file /proc/bus/usb/devices. This was broken in r5441 due to
incorrect logic for the USB_FS_SYS case in usb_host_scan().
Signed-off-by: Bjorn Danielsson <bdq@dax.nu>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5507 c046a42c-6fe2-441c-8c8c-71466251a162
This patch adds support for host USB devices discovered via:
/sys/bus/usb/devices/* and opened from /dev/bus/usb/*/*
/dev/bus/usb/devices and opened from /dev/bus/usb/*/*
in addition to the existing discovery via:
/proc/bus/usb/devices and opened from /proc/bus/usb/*/*
Signed-off-by: TJ <linux@tjworld.net>
Signed-off-by: Anthony Liguori <aliguori>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5441 c046a42c-6fe2-441c-8c8c-71466251a162
They are unsafe. The current code is correct, but to be safer, we should pass
an explicit size.
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5290 c046a42c-6fe2-441c-8c8c-71466251a162
This patch adds support for removing USB devices by host address.
Which is usefull for things like libvirtd because there is no easy way to
find guest USB address of the host device.
In other words you can now do:
usb_add host:3.5
...
usb_del host:3.5
Before the patch 'usb_del' did not support 'host:' notation.
----
Syntax for specifying auto connect filters has been improved.
Old syntax was
host:bus.dev
host:pid:vid
New syntax is
host:auto:bus.dev[:pid:vid]
In both the cases any attribute can be set to "*".
New syntax is more flexible and lets you do things like
host:3.*:5533:* /* grab any device on bus 3 with vendor id 5533 */
It's now possible to remove auto filters. For example:
usb_del host:auto:3.*:5533:*
Active filters are printed after all host devices in 'info usb' output.
Which now looks like this:
Device 1.1, speed 480 Mb/s
Hub: USB device 1d6b:0002, EHCI Host Controller
Device 1.4, speed 480 Mb/s
Class 00: USB device 1058:0704, External HDD
Auto filters:
Device 3.* ID *:*
Signed-off-by: Max Krasnyansky <maxk@kernel.org>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5205 c046a42c-6fe2-441c-8c8c-71466251a162
USB is 99.8% async now :). 0.2% is the three control requests that
we need to execute synchronously. We could off-load that to a thread
or something but it's not worth the pain since those requests are
performed only during device initialization (ie when device is
connected to the VM).
The change is a bit bigger than I wanted due to the fact that generic
handle_packet()/handle_control() interface was not designed for
async transactions. So I ended up adding custom handle_packet()
code to usb-linux. We can make that generic if/when some other
component needs it.
Signed-off-by: Max Krasnyansky <maxk@kernel.org>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5204 c046a42c-6fe2-441c-8c8c-71466251a162
Addressing Anthony's comments regarding printf and stuff.
Anthony, if you you want I can fold this commit and resend
the original patch.
Signed-off-by: Max Krasnyansky <maxk@kernel.org>
Signed-off-by: AnthonY Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5053 c046a42c-6fe2-441c-8c8c-71466251a162
On top of my previous USB patchset.
Async completion handler can detect device disconnects without polling.
We do not need the timer anymore.
Signed-off-by: Max Krasnyansky <maxk@kernel.org>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5052 c046a42c-6fe2-441c-8c8c-71466251a162
This is a follow up to the async UHCI patch. Both BULK and ISOC transactions
are now fully asynchrounous. I left CONTROL synchronous for now, ideally
we want it to be async too and it should not be that hard to do now.
This patch obviously requires UHCI patch. The combo has been tested with
various devices. See the UHCI patch description for list of the devices.
Most of the testing was done with the KVM flavor of QEMU.
Signed-off-by: Max Krasnyansky <maxk@kernel.org>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5051 c046a42c-6fe2-441c-8c8c-71466251a162
QEMU can now automatically grab host USB devices that match the filter.
For now I just extended 'host:X.Y' and 'host:VID:PID' syntax to handle
wildcards. So for example if you do something like
usb_add host:5.*
QEMU will automatically grab any non-hub device with host address 5.*.
Same with the 'host:PID:*', we grab any device that matches PID.
Filtering itself is very generic so we can probably add more elaborate
syntax like 'host:BUS.ADDR:VID:PID'. So that we can do 'host:5.*:6000:*'.
Anyway, it's implemented using a periodic timer that scans host devices
and grabs those that match the filter. Timer is started when the first
filter is added.
We now keep the list of all host devices that we grabbed to make sure that
we do not grab the same device twice.
btw It's currently possible to grab the same host device more than once.
ie You can just do "usb_add host:1.1" more than once, which of course does
not work. So this patch fixes that issue too.
Along with auto disconnect patch that I send a minute ago the setup is very
seamless now. You can just allocate some usb ports to the VMs and plug/unplug
devices at any time.
Signed-off-by: Max Krasnyansky <maxk@kernel.org>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5048 c046a42c-6fe2-441c-8c8c-71466251a162
I got really annoyed by the fact that you have to manually do
usb_del in the monitor when host device is unplugged and decided
to fix it :)
Basically we now automatically remove guest USB device
when the actual host device is disconnected.
At first I've extended set_fd_handlerX() stuff to support checking
for exceptions on fds. But unfortunately usbfs code does not wake up
user-space process when device is removed, which means we need a
timer to periodically check if device is still there. So I removed
fd exception stuff and implemented it with the timer.
Signed-off-by: Max Krasnyansky <maxk@kernel.org>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5047 c046a42c-6fe2-441c-8c8c-71466251a162
