Find a file
David Hubbard 53aaa88105 hw/usb/hcd-ohci: Fix ohci_service_td: accept zero-length TDs where CBP=BE+1
This changes the way the ohci emulation handles a Transfer Descriptor
with "Buffer End" set to "Current Buffer Pointer" - 1, specifically
in the case of a zero-length packet.

The OHCI spec 4.3.1.2 Table 4-2 specifies td.cbp to be zero for a
zero-length packet.  Peter Maydell tracked down commit 1328fe0c32
(hw: usb: hcd-ohci: check len and frame_number variables) where qemu
started checking this according to the spec.

What this patch does is loosen the qemu ohci implementation to allow a
zero-length packet if td.be (Buffer End) is set to td.cbp - 1, and with a
non-zero td.cbp value.

The spec is unclear whether this is valid or not -- it is not the
clearly documented way to send a zero length TD (which is CBP=BE=0),
but it isn't specifically forbidden. Actual hw seems to be ok with it.

Does any OS rely on this behavior? There have been no reports to
qemu-devel of this problem.

This is attempting to have qemu behave like actual hardware,
but this is just a minor change.

With a tiny OS[1] that boots and executes a test, the issue can be seen:

* OS that sends USB requests to a USB mass storage device
  but sends td.cbp = td.be + 1
* qemu 4.2
* qemu HEAD (4e66a0854)
* Actual OHCI controller (hardware)

Command line:
qemu-system-x86_64 -m 20 \
 -device pci-ohci,id=ohci \
 -drive if=none,format=raw,id=d,file=testmbr.raw \
 -device usb-storage,bus=ohci.0,drive=d \
 --trace "usb_*" --trace "ohci_*" -D qemu.log

Results are:

 qemu 4.2   | qemu HEAD  | actual HW
 -----------+------------+-----------
 works fine | ohci_die() | works fine

Tip: if the flags "-serial pty -serial stdio" are added to the command line
the test will output USB requests like this:

Testing qemu HEAD:

> Free mem 2M ohci port2 conn FS
> setup { 80 6 0 1 0 0 8 0 }
> ED info=80000 { mps=8 en=0 d=0 } tail=c20920
>   td0 c20880 nxt=c20960 f2000000 setup cbp=c20900 be=c20907
>   td1 c20960 nxt=c20980 f3140000    in cbp=c20908 be=c2090f
>   td2 c20980 nxt=c20920 f3080000   out cbp=c20910 be=c2090f ohci20 host err
> usb stopped

And in qemu.log:

usb_ohci_iso_td_bad_cc_overrun ISO_TD start_offset=0x00c20910 > next_offset=0x00c2090f

Testing qemu 4.2:

> Free mem 2M ohci port2 conn FS
> setup { 80 6 0 1 0 0 8 0 }
> ED info=80000 { mps=8 en=0 d=0 } tail=620920
>   td0 620880 nxt=620960 f2000000 setup cbp=620900 be=620907       cbp=0 be=620907
>   td1 620960 nxt=620980 f3140000    in cbp=620908 be=62090f       cbp=0 be=62090f
>   td2 620980 nxt=620920 f3080000   out cbp=620910 be=62090f       cbp=0 be=62090f
>    rx { 12 1 0 2 0 0 0 8 }
> setup { 0 5 1 0 0 0 0 0 } tx {}
> ED info=80000 { mps=8 en=0 d=0 } tail=620880
>   td0 620920 nxt=620960 f2000000 setup cbp=620900 be=620907       cbp=0 be=620907
>   td1 620960 nxt=620880 f3100000    in cbp=620908 be=620907       cbp=0 be=620907
> setup { 80 6 0 1 0 0 12 0 }
> ED info=80001 { mps=8 en=0 d=1 } tail=620960
>   td0 620880 nxt=6209c0 f2000000 setup cbp=620920 be=620927       cbp=0 be=620927
>   td1 6209c0 nxt=6209e0 f3140000    in cbp=620928 be=620939       cbp=0 be=620939
>   td2 6209e0 nxt=620960 f3080000   out cbp=62093a be=620939       cbp=0 be=620939
>    rx { 12 1 0 2 0 0 0 8 f4 46 1 0 0 0 1 2 3 1 }
> setup { 80 6 0 2 0 0 0 1 }
> ED info=80001 { mps=8 en=0 d=1 } tail=620880
>   td0 620960 nxt=6209a0 f2000000 setup cbp=620a20 be=620a27       cbp=0 be=620a27
>   td1 6209a0 nxt=6209c0 f3140004    in cbp=620a28 be=620b27       cbp=620a48 be=620b27
>   td2 6209c0 nxt=620880 f3080000   out cbp=620b28 be=620b27       cbp=0 be=620b27
>    rx { 9 2 20 0 1 1 4 c0 0 9 4 0 0 2 8 6 50 0 7 5 81 2 40 0 0 7 5 2 2 40 0 0 }
> setup { 0 9 1 0 0 0 0 0 } tx {}
> ED info=80001 { mps=8 en=0 d=1 } tail=620900
>   td0 620880 nxt=620940 f2000000 setup cbp=620a00 be=620a07       cbp=0 be=620a07
>   td1 620940 nxt=620900 f3100000    in cbp=620a08 be=620a07       cbp=0 be=620a07

[1] The OS disk image has been emailed to philmd@linaro.org, mjt@tls.msk.ru,
and kraxel@redhat.com:

* testCbpOffBy1.img.xz
* sha256: f87baddcb86de845de12f002c698670a426affb40946025cc32694f9daa3abed

Signed-off-by: David Hubbard <dmamfmgm@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-06-21 16:20:45 +01:00
.github/workflows github: fix config mistake preventing repo lockdown commenting 2022-04-26 16:12:26 +01:00
.gitlab/issue_templates .gitlab/issue_templates: Move suggestions into comments 2022-12-15 15:19:24 +01:00
.gitlab-ci.d .gitlab-ci.d/buildtest.yml: Use -fno-sanitize=function in the clang-system job 2024-06-06 10:26:13 +01:00
accel accel/tcg: Fix typo causing tb->page_addr[1] to not be recorded 2024-06-19 13:50:08 -07:00
audio meson: remove unnecessary dependency 2024-05-25 13:28:02 +02:00
authz error: Drop superfluous #include "qapi/qmp/qerror.h" 2023-02-23 13:56:14 +01:00
backends backends/tpm: Remove newline character in trace event 2024-06-10 13:05:27 -04:00
block crypto/block: drop qcrypto_block_open() n_threads argument 2024-06-10 11:05:43 +02:00
bsd-user bsd-user: Catch up to run-time reserved_va math 2024-06-09 10:30:25 -06:00
chardev error: Drop superfluous #include "qapi/qmp/qerror.h" 2024-04-24 09:50:58 +02:00
common-user common-user/host/ppc: Implement safe-syscall.inc.S 2023-01-23 14:39:48 -10:00
configs configs: disable emulators that require it if libfdt is not found 2024-05-10 15:45:15 +02:00
contrib plugins: Copy memory in qemu_plugin_insn_data 2024-05-15 08:55:18 +02:00
crypto crypto/block: drop qcrypto_block_open() n_threads argument 2024-06-10 11:05:43 +02:00
disas disas/riscv: Use GString in format_inst 2024-06-05 12:29:54 -07:00
docs hw/arm/virt: allow creation of a second NonSecure UART 2024-06-21 14:01:59 +01:00
dump dump/win_dump: Improve error messages on write error 2024-05-27 12:42:12 +02:00
ebpf ebpf: Added traces back. Changed source set for eBPF to 'system'. 2024-06-04 15:14:26 +08:00
fpu target/sparc: Implement FMAf extension 2024-06-05 09:05:10 -07:00
fsdev configure, meson: rename targetos to host_os 2023-12-31 09:11:29 +01:00
gdb-xml gdb-xml: fix duplicate register in arm-neon.xml 2023-11-08 15:15:23 +00:00
gdbstub user: Use get_task_state() helper 2024-05-06 14:13:45 +02:00
host/include util/bufferiszero: Add loongarch64 vector acceleration 2024-06-19 12:47:11 -07:00
hw hw/usb/hcd-ohci: Fix ohci_service_td: accept zero-length TDs where CBP=BE+1 2024-06-21 16:20:45 +01:00
include hw/arm/virt: allow creation of a second NonSecure UART 2024-06-21 14:01:59 +01:00
io qio: Inherit follow_coroutine_ctx across TLS 2024-05-29 18:30:31 -05:00
libdecnumber libdecnumber/dpd/decimal64: Fix compiler warning from Clang 15 2022-11-11 09:13:52 +01:00
linux-headers update-linux-headers: import linux/kvm_para.h header 2024-06-05 11:01:06 +02:00
linux-user linux-user: Make TARGET_NR_setgroups affect only the current thread 2024-06-19 13:50:22 -07:00
migration migration/multifd: Switch to no compression when no hardware support 2024-06-14 14:01:30 -03:00
monitor hw/intc: Introduce x-query-interrupt-controllers QMP command 2024-06-19 12:40:49 +02:00
nbd nbd/server: Mark negotiation functions as coroutine_fn 2024-04-25 12:59:19 -05:00
net tap: Shrink zeroed virtio-net header 2024-06-04 15:14:26 +08:00
pc-bios edk2: rebuild binaries with correct version information 2024-04-09 18:21:23 +02:00
plugins plugins: remove special casing for cpu->realized 2024-06-04 10:02:39 +02:00
po po: add ukrainian translation 2022-07-05 10:15:49 +02:00
python python: mkvenv: remove ensure command 2024-06-08 10:33:39 +02:00
qapi hw/intc: Introduce x-query-interrupt-controllers QMP command 2024-06-19 12:40:49 +02:00
qga qga: Remove deprecated 'blacklist' argument / config key 2024-06-04 11:53:43 +02:00
qobject docs/interop: Convert qmp-spec.txt to rST 2023-05-22 10:21:01 +02:00
qom target/sparc/cpu: Rename the CPU models with a "+" in their names 2024-05-05 21:02:47 +01:00
replay replay: Improve error messages about configuration conflicts 2024-03-09 18:56:36 +03:00
roms edk2/seabios: use common extra version 2024-04-09 18:12:20 +02:00
scripts scripts/coverity-scan/COMPONENTS.md: Include libqmp in testlibs 2024-06-21 14:01:59 +01:00
scsi configure, meson: rename targetos to host_os 2023-12-31 09:11:29 +01:00
semihosting semihosting/guestfd: Remove unused 'semihosting/uaccess.h' header 2024-04-26 15:31:37 +02:00
stats meson: Replace softmmu_ss -> system_ss 2023-06-20 10:01:30 +02:00
storage-daemon meson: remove config_targetos 2023-12-31 09:11:28 +01:00
stubs stubs/meson: Fix qemuutil build when --disable-system 2024-06-08 10:33:38 +02:00
subprojects libvhost-user: Mark mmap'ed region memory as MADV_DONTDUMP 2024-03-12 17:56:55 -04:00
system memory: Constify IOMMUTLBEvent in memory_region_notify_iommu() 2024-06-19 12:42:02 +02:00
target tcg/loongarch64: Support 64- and 256-bit vectors 2024-06-19 14:00:39 -07:00
tcg tcg/loongarch64: Fix tcg_out_movi vs some pcrel pointers 2024-06-19 13:50:22 -07:00
tests hw/i386/pc: Remove PCMachineClass::enforce_aligned_dimm 2024-06-19 12:40:49 +02:00
tools ebpf: Add a separate target for skeleton 2024-06-04 15:14:26 +08:00
trace trace: Remove deprecated 'vcpu' field from QMP trace events 2024-06-04 11:53:43 +02:00
ui ui+display: rename is_buffer_shared() -> surface_is_allocated() 2024-06-19 12:42:03 +02:00
util tcg/loongarch64: Support 64- and 256-bit vectors 2024-06-19 14:00:39 -07:00
.dir-locals.el Add .dir-locals.el file to configure emacs coding style 2015-10-08 19:46:01 +03:00
.editorconfig .editorconfig: update the automatic mode setting for Emacs 2021-03-10 15:34:11 +00:00
.exrc
.gdbinit .gdbinit: load QEMU sub-commands when gdb starts 2017-06-07 14:38:45 +01:00
.git-blame-ignore-revs metadata: add .git-blame-ignore-revs 2023-04-04 15:56:44 +01:00
.gitattributes gitattributes: Cover Objective-C source files 2022-03-29 00:15:14 +02:00
.gitignore configure: rename --enable-pypi to --enable-download, control subprojects too 2023-06-06 16:30:01 +02:00
.gitlab-ci.yml docs: Document GitLab custom CI/CD variables 2021-07-29 07:56:01 +02:00
.gitmodules meson: subprojects: replace berkeley-{soft,test}float-3 with wraps 2023-06-06 16:30:01 +02:00
.gitpublish Add a git-publish configuration file 2018-03-05 09:03:17 +00:00
.mailmap MAINTAINERS: Update Sriram Yagnaraman mail address 2024-04-24 16:03:38 +02:00
.patchew.yml scripts/checkpatch: roll diff tweaking into checkpatch itself 2021-06-25 10:08:33 +01:00
.readthedocs.yml readthodocs: fully specify a build environment 2024-01-12 13:23:48 +00:00
.travis.yml .travis.yml: Do some more testing with Clang 2024-04-25 07:03:04 +02:00
block.c error: Move ERRP_GUARD() to the beginning of the function 2024-03-12 11:45:45 +01:00
blockdev-nbd.c qapi block: Elide redundant has_FOO in generated C 2022-12-14 20:03:25 +01:00
blockdev.c qapi: blockdev-backup: add discard-source parameter 2024-05-28 15:52:15 +03:00
blockjob.c block: remove AioContext locking 2023-12-21 22:49:27 +01:00
configure Revert "python: use vendored tomli" 2024-06-08 10:33:39 +02:00
COPYING
COPYING.LIB COPYING.LIB: Synchronize the LGPL 2.1 with the version from gnu.org 2019-01-30 11:01:22 +01:00
cpu-common.c system/cpus: rename qemu_mutex_lock_iothread() to bql_lock() 2024-01-08 10:45:43 -05:00
cpu-target.c cpu-target: don't set cpu->thread_id to bogus value 2024-06-04 10:02:39 +02:00
event-loop-base.c util/event-loop-base: Introduce options to set the thread pool size 2022-05-09 10:43:23 +01:00
gitdm.config contrib/gitdm: add group map for AMD 2023-03-22 15:08:26 +00:00
hmp-commands-info.hx hw/intc: Introduce x-query-interrupt-controllers QMP command 2024-06-19 12:40:49 +02:00
hmp-commands.hx hmp/migration: Fix "migrate" command's documentation 2024-05-08 09:22:37 -03:00
iothread.c iothread: Simplify expression in qemu_in_iothread() 2024-02-13 10:59:25 +03:00
job-qmp.c qapi job: Elide redundant has_FOO in generated C 2022-12-14 20:04:47 +01:00
job.c block: remove AioContext locking 2023-12-21 22:49:27 +01:00
Kconfig meson: Introduce target-specific Kconfig 2021-07-09 18:21:34 +02:00
Kconfig.host kconfig: express dependency of individual boards on libfdt 2024-05-10 15:45:15 +02:00
LICENSE tcg/LICENSE: Remove out of date claim about TCG subdirectory licensing 2019-11-11 15:11:21 +01:00
MAINTAINERS MAINTAINERS: drop spice+ui maintainership 2024-06-19 12:42:03 +02:00
Makefile Makefile: fix use of -j without an argument 2024-04-12 12:02:12 +02:00
meson.build configure: Add uadk option 2024-06-14 14:01:29 -03:00
meson_options.txt configure: Add uadk option 2024-06-14 14:01:29 -03:00
module-common.c all: Clean up includes 2016-02-04 17:41:30 +00:00
os-posix.c qemu_init: increase NOFILE soft limit on POSIX 2024-02-09 12:47:58 +00:00
os-win32.c Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
page-target.c exec: Expose 'target_page.h' API to user emulation 2024-04-26 15:28:11 +02:00
page-vary-common.c Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
page-vary-target.c exec: Rename target specific page-vary.c -> page-vary-target.c 2023-10-04 11:03:54 -07:00
pythondeps.toml pythondeps.toml: warn about updates needed to docs/requirements.txt 2024-04-23 17:35:26 +02:00
qemu-bridge-helper.c qemu-bridge-helper: relocate path to default ACL 2020-09-30 19:11:36 +02:00
qemu-edid.c qemu-edid: Restrict input parameter -d to avoid division by zero 2022-10-12 13:38:15 +02:00
qemu-img-cmds.hx docs/devel/docs: Document .hx file syntax 2024-01-15 17:12:22 +00:00
qemu-img.c block: remove AioContext locking 2023-12-21 22:49:27 +01:00
qemu-io-cmds.c qemu-io: add cvtnum() error handling for zone commands 2024-06-10 11:05:43 +02:00
qemu-io.c block: remove AioContext locking 2023-12-21 22:49:27 +01:00
qemu-keymap.c qemu-keymap: Make references to allocations static 2024-05-29 12:41:56 +02:00
qemu-nbd.c qemu-nbd: mention --tls-hostname option in qemu-nbd --help 2024-02-13 10:59:25 +03:00
qemu-options.hx hw/i386/pc: Support smp.modules for x86 PC machine 2024-05-22 19:43:29 +02:00
qemu.nsi nsis installer: Fix mouse-over descriptions for emulators 2022-03-18 10:55:15 +00:00
qemu.sasl sasl: remove comment about obsolete kerberos versions 2021-06-14 13:28:50 +01:00
README.rst README.rst: fix link formatting 2022-08-04 13:44:21 +02:00
replication.c replication: move include out of root directory 2021-05-26 14:49:46 +02:00
trace-events trace-events: remove the remaining vcpu trace events 2023-06-01 11:05:05 -04:00
VERSION Open 9.1 development tree 2024-04-23 17:33:36 -07:00
version.rc configure: remove CONFIG_FILEVERSION and CONFIG_PRODUCTVERSION 2021-01-02 21:03:37 +01:00

===========
QEMU README
===========

QEMU is a generic and open source machine & userspace emulator and
virtualizer.

QEMU is capable of emulating a complete machine in software without any
need for hardware virtualization support. By using dynamic translation,
it achieves very good performance. QEMU can also integrate with the Xen
and KVM hypervisors to provide emulated hardware while allowing the
hypervisor to manage the CPU. With hypervisor support, QEMU can achieve
near native performance for CPUs. When QEMU emulates CPUs directly it is
capable of running operating systems made for one machine (e.g. an ARMv7
board) on a different machine (e.g. an x86_64 PC board).

QEMU is also capable of providing userspace API virtualization for Linux
and BSD kernel interfaces. This allows binaries compiled against one
architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a
different architecture ABI (e.g. the Linux x86_64 ABI). This does not
involve any hardware emulation, simply CPU and syscall emulation.

QEMU aims to fit into a variety of use cases. It can be invoked directly
by users wishing to have full control over its behaviour and settings.
It also aims to facilitate integration into higher level management
layers, by providing a stable command line interface and monitor API.
It is commonly invoked indirectly via the libvirt library when using
open source applications such as oVirt, OpenStack and virt-manager.

QEMU as a whole is released under the GNU General Public License,
version 2. For full licensing details, consult the LICENSE file.


Documentation
=============

Documentation can be found hosted online at
`<https://www.qemu.org/documentation/>`_. The documentation for the
current development version that is available at
`<https://www.qemu.org/docs/master/>`_ is generated from the ``docs/``
folder in the source tree, and is built by `Sphinx
<https://www.sphinx-doc.org/en/master/>`_.


Building
========

QEMU is multi-platform software intended to be buildable on all modern
Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety
of other UNIX targets. The simple steps to build QEMU are:


.. code-block:: shell

  mkdir build
  cd build
  ../configure
  make

Additional information can also be found online via the QEMU website:

* `<https://wiki.qemu.org/Hosts/Linux>`_
* `<https://wiki.qemu.org/Hosts/Mac>`_
* `<https://wiki.qemu.org/Hosts/W32>`_


Submitting patches
==================

The QEMU source code is maintained under the GIT version control system.

.. code-block:: shell

   git clone https://gitlab.com/qemu-project/qemu.git

When submitting patches, one common approach is to use 'git
format-patch' and/or 'git send-email' to format & send the mail to the
qemu-devel@nongnu.org mailing list. All patches submitted must contain
a 'Signed-off-by' line from the author. Patches should follow the
guidelines set out in the `style section
<https://www.qemu.org/docs/master/devel/style.html>`_ of
the Developers Guide.

Additional information on submitting patches can be found online via
the QEMU website

* `<https://wiki.qemu.org/Contribute/SubmitAPatch>`_
* `<https://wiki.qemu.org/Contribute/TrivialPatches>`_

The QEMU website is also maintained under source control.

.. code-block:: shell

  git clone https://gitlab.com/qemu-project/qemu-web.git

* `<https://www.qemu.org/2017/02/04/the-new-qemu-website-is-up/>`_

A 'git-publish' utility was created to make above process less
cumbersome, and is highly recommended for making regular contributions,
or even just for sending consecutive patch series revisions. It also
requires a working 'git send-email' setup, and by default doesn't
automate everything, so you may want to go through the above steps
manually for once.

For installation instructions, please go to

*  `<https://github.com/stefanha/git-publish>`_

The workflow with 'git-publish' is:

.. code-block:: shell

  $ git checkout master -b my-feature
  $ # work on new commits, add your 'Signed-off-by' lines to each
  $ git publish

Your patch series will be sent and tagged as my-feature-v1 if you need to refer
back to it in the future.

Sending v2:

.. code-block:: shell

  $ git checkout my-feature # same topic branch
  $ # making changes to the commits (using 'git rebase', for example)
  $ git publish

Your patch series will be sent with 'v2' tag in the subject and the git tip
will be tagged as my-feature-v2.

Bug reporting
=============

The QEMU project uses GitLab issues to track bugs. Bugs
found when running code built from QEMU git or upstream released sources
should be reported via:

* `<https://gitlab.com/qemu-project/qemu/-/issues>`_

If using QEMU via an operating system vendor pre-built binary package, it
is preferable to report bugs to the vendor's own bug tracker first. If
the bug is also known to affect latest upstream code, it can also be
reported via GitLab.

For additional information on bug reporting consult:

* `<https://wiki.qemu.org/Contribute/ReportABug>`_


ChangeLog
=========

For version history and release notes, please visit
`<https://wiki.qemu.org/ChangeLog/>`_ or look at the git history for
more detailed information.


Contact
=======

The QEMU community can be contacted in a number of ways, with the two
main methods being email and IRC

* `<mailto:qemu-devel@nongnu.org>`_
* `<https://lists.nongnu.org/mailman/listinfo/qemu-devel>`_
* #qemu on irc.oftc.net

Information on additional methods of contacting the community can be
found online via the QEMU website:

* `<https://wiki.qemu.org/Contribute/StartHere>`_