From 0ab6d12ffde7e9235a1b9d79437f5bdda5d80cf1 Mon Sep 17 00:00:00 2001 From: Stefan Weil Date: Wed, 16 Mar 2016 21:17:19 +0100 Subject: [PATCH 1/6] usb: Fix compilation for Windows Mingw-w64 does not provide sys/ioctl.h and Linux builds don't need it, so remove that include statement. ERROR is defined by wingdi.h (included via windows.h). Undefine it before it is redefined to avoid a compiler warning / error. Signed-off-by: Stefan Weil Message-id: 1458159439-32322-1-git-send-email-sw@weilnetz.de Signed-off-by: Gerd Hoffmann --- hw/usb/redirect.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c index 38a539311b..cbcc218183 100644 --- a/hw/usb/redirect.c +++ b/hw/usb/redirect.c @@ -34,12 +34,14 @@ #include "qemu/iov.h" #include "sysemu/char.h" -#include #include #include #include "hw/usb.h" +/* ERROR is defined below. Remove any previous definition. */ +#undef ERROR + #define MAX_ENDPOINTS 32 #define NO_INTERFACE_INFO 255 /* Valid interface_count always <= 32 */ #define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f)) From 182b391e797508deba9704cf580325e99260d8c8 Mon Sep 17 00:00:00 2001 From: Peter Xu Date: Fri, 11 Mar 2016 09:51:46 +0800 Subject: [PATCH 2/6] usb: fix unbounded stack warning for xhci_dma_write_u32s All the callers for xhci_dma_write_u32s() are using mostly 5 * uint32_t in len. To avoid unbound stack warning for the function, make it statically allocated, and assert when it's not big enough in the future. Signed-off-by: Peter Xu Message-id: 1457661106-9569-1-git-send-email-peterx@redhat.com Signed-off-by: Gerd Hoffmann --- hw/usb/hcd-xhci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index 44b6f8c03d..bcde8a2f48 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -698,11 +698,13 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci, dma_addr_t addr, uint32_t *buf, size_t len) { int i; - uint32_t tmp[len / sizeof(uint32_t)]; + uint32_t tmp[5]; + uint32_t n = len / sizeof(uint32_t); assert((len % sizeof(uint32_t)) == 0); + assert(n <= ARRAY_SIZE(tmp)); - for (i = 0; i < (len / sizeof(uint32_t)); i++) { + for (i = 0; i < n; i++) { tmp[i] = cpu_to_le32(buf[i]); } pci_dma_write(PCI_DEVICE(xhci), addr, tmp, len); From e3d60bc7c6f26b889686ab91f7062f6a79df2494 Mon Sep 17 00:00:00 2001 From: Peter Xu Date: Thu, 10 Mar 2016 10:35:24 +0800 Subject: [PATCH 3/6] usb: fix unbound stack usage for usb_mtp_add_str Use heap instead of stack. Signed-off-by: Peter Xu Signed-off-by: Gerd Hoffmann --- hw/usb/dev-mtp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 7391783193..62fb7cd518 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -718,7 +718,7 @@ static void usb_mtp_add_wstr(MTPData *data, const wchar_t *str) static void usb_mtp_add_str(MTPData *data, const char *str) { uint32_t len = strlen(str)+1; - wchar_t wstr[len]; + wchar_t *wstr = g_new(wchar_t, len); size_t ret; ret = mbstowcs(wstr, str, len); @@ -727,6 +727,8 @@ static void usb_mtp_add_str(MTPData *data, const char *str) } else { usb_mtp_add_wstr(data, wstr); } + + g_free(wstr); } static void usb_mtp_add_time(MTPData *data, time_t time) From f34d57d359bb539c482a69f2732bf05787127ed4 Mon Sep 17 00:00:00 2001 From: Peter Xu Date: Wed, 9 Mar 2016 14:07:20 +0800 Subject: [PATCH 4/6] usb: fix unbound stack warning for inotify_watchfn Signed-off-by: Peter Xu Reviewed-by: Paolo Bonzini Message-id: 1457503640-31473-1-git-send-email-peterx@redhat.com Signed-off-by: Gerd Hoffmann --- hw/usb/dev-mtp.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 62fb7cd518..01c5e519ac 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -433,12 +433,11 @@ static void inotify_watchfn(void *arg) MTPState *s = arg; ssize_t bytes; /* From the man page: atleast one event can be read */ - int len = sizeof(struct inotify_event) + NAME_MAX + 1; int pos; - char buf[len]; + char buf[sizeof(struct inotify_event) + NAME_MAX + 1]; for (;;) { - bytes = read(s->inotifyfd, buf, len); + bytes = read(s->inotifyfd, buf, sizeof(buf)); pos = 0; if (bytes <= 0) { From 983bff3530782d51c46c8d7c0e17e2a9dfe5fb77 Mon Sep 17 00:00:00 2001 From: Matthew Fortune Date: Tue, 23 Feb 2016 15:44:27 +0000 Subject: [PATCH 5/6] hw/usb/dev-mtp: Guard inotify usage with CONFIG_INOTIFY1 inotify_init1 usage was guarded by a check for linux but does not exist on older distributions like CentOS 5 resulting in build failures. Signed-off-by: Matthew Fortune Message-id: 6D39441BF12EF246A7ABCE6654B023536BB85D4A@hhmail02.hh.imgtec.org Signed-off-by: Gerd Hoffmann --- hw/usb/dev-mtp.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 01c5e519ac..ee2071f3d5 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -14,7 +14,7 @@ #include #include -#ifdef __linux__ +#ifdef CONFIG_INOTIFY1 #include #include "qemu/main-loop.h" #endif @@ -92,7 +92,7 @@ enum { EP_EVENT, }; -#ifdef __linux__ +#ifdef CONFIG_INOTIFY1 typedef struct MTPMonEntry MTPMonEntry; struct MTPMonEntry { @@ -127,7 +127,7 @@ struct MTPObject { char *name; char *path; struct stat stat; -#ifdef __linux__ +#ifdef CONFIG_INOTIFY1 /* inotify watch cookie */ int watchfd; #endif @@ -152,7 +152,7 @@ struct MTPState { uint32_t next_handle; QTAILQ_HEAD(, MTPObject) objects; -#ifdef __linux__ +#ifdef CONFIG_INOTIFY1 /* inotify descriptor */ int inotifyfd; QTAILQ_HEAD(events, MTPMonEntry) events; @@ -400,7 +400,7 @@ static MTPObject *usb_mtp_add_child(MTPState *s, MTPObject *o, return child; } -#ifdef __linux__ +#ifdef CONFIG_INOTIFY1 static MTPObject *usb_mtp_object_lookup_name(MTPObject *parent, char *name, int len) { @@ -592,7 +592,7 @@ static void usb_mtp_object_readdir(MTPState *s, MTPObject *o) if (!dir) { return; } -#ifdef __linux__ +#ifdef CONFIG_INOTIFY1 int watchfd = usb_mtp_add_watch(s->inotifyfd, o->path); if (watchfd == -1) { fprintf(stderr, "usb-mtp: failed to add watch for %s\n", o->path); @@ -996,7 +996,7 @@ static void usb_mtp_command(MTPState *s, MTPControl *c) trace_usb_mtp_op_open_session(s->dev.addr); s->session = c->argv[0]; usb_mtp_object_alloc(s, s->next_handle++, NULL, s->root); -#ifdef __linux__ +#ifdef CONFIG_INOTIFY1 if (usb_mtp_inotify_init(s)) { fprintf(stderr, "usb-mtp: file monitoring init failed\n"); } @@ -1006,7 +1006,7 @@ static void usb_mtp_command(MTPState *s, MTPControl *c) trace_usb_mtp_op_close_session(s->dev.addr); s->session = 0; s->next_handle = 0; -#ifdef __linux__ +#ifdef CONFIG_INOTIFY1 usb_mtp_inotify_cleanup(s); #endif usb_mtp_object_free(s, QTAILQ_FIRST(&s->objects)); @@ -1134,7 +1134,7 @@ static void usb_mtp_handle_reset(USBDevice *dev) trace_usb_mtp_reset(s->dev.addr); -#ifdef __linux__ +#ifdef CONFIG_INOTIFY1 usb_mtp_inotify_cleanup(s); #endif usb_mtp_object_free(s, QTAILQ_FIRST(&s->objects)); @@ -1297,7 +1297,7 @@ static void usb_mtp_handle_data(USBDevice *dev, USBPacket *p) } break; case EP_EVENT: -#ifdef __linux__ +#ifdef CONFIG_INOTIFY1 if (!QTAILQ_EMPTY(&s->events)) { struct MTPMonEntry *e = QTAILQ_LAST(&s->events, events); uint32_t handle; From dff0367cf66f489aa772320fa2937a8cac1ca30d Mon Sep 17 00:00:00 2001 From: Prasad J Pandit Date: Fri, 29 Jan 2016 18:30:34 +0530 Subject: [PATCH 6/6] usb: ehci: add capability mmio write function USB Ehci emulation supports host controller capability registers. But its mmio '.write' function was missing, which lead to a null pointer dereference issue. Add a do nothing 'ehci_caps_write' definition to avoid it; Do nothing because capability registers are Read Only(RO). Reported-by: Zuozhi Fzz Signed-off-by: Prasad J Pandit Message-id: 1454072434-16045-1-git-send-email-ppandit@redhat.com Signed-off-by: Gerd Hoffmann --- hw/usb/hcd-ehci.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index 1b50601fc1..0f95d0d284 100644 --- a/hw/usb/hcd-ehci.c +++ b/hw/usb/hcd-ehci.c @@ -895,6 +895,11 @@ static uint64_t ehci_caps_read(void *ptr, hwaddr addr, return s->caps[addr]; } +static void ehci_caps_write(void *ptr, hwaddr addr, + uint64_t val, unsigned size) +{ +} + static uint64_t ehci_opreg_read(void *ptr, hwaddr addr, unsigned size) { @@ -2315,6 +2320,7 @@ static void ehci_frame_timer(void *opaque) static const MemoryRegionOps ehci_mmio_caps_ops = { .read = ehci_caps_read, + .write = ehci_caps_write, .valid.min_access_size = 1, .valid.max_access_size = 4, .impl.min_access_size = 1,