Go to file
David Hubbard 3c3c233677 hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT
This changes the ohci validation to not assert if invalid data is fed to the
ohci controller. The poc in https://bugs.launchpad.net/qemu/+bug/1907042 and
migrated to bug #303 does the following to feed it a SETUP pid (valid)
at an EndPt of 1 (invalid - all SETUP pids must be addressed to EndPt 0):

        uint32_t MaxPacket = 64;
        uint32_t TDFormat = 0;
        uint32_t Skip = 0;
        uint32_t Speed = 0;
        uint32_t Direction = 0;  /* #define OHCI_TD_DIR_SETUP 0 */
        uint32_t EndPt = 1;
        uint32_t FuncAddress = 0;
        ed->attr = (MaxPacket << 16) | (TDFormat << 15) | (Skip << 14)
                   | (Speed << 13) | (Direction << 11) | (EndPt << 7)
                   | FuncAddress;
        ed->tailp = /*TDQTailPntr= */ 0;
        ed->headp = ((/*TDQHeadPntr= */ &td[0]) & 0xfffffff0)
                   | (/* ToggleCarry= */ 0 << 1);
        ed->next_ed = (/* NextED= */ 0 & 0xfffffff0)

qemu-fuzz also caught the same issue in #1510. They are both fixed by this
patch.

With a tiny OS[1] that boots and executes the poc the repro shows the issue:

* OS that sends USB requests to a USB mass storage device
  but sends a SETUP with EndPt = 1
* qemu 6.2.0 (Debian 1:6.2+dfsg-2ubuntu6.19)
* qemu HEAD (4e66a0854)
* Actual OHCI controller (hardware)

Command line:
qemu-system-x86_64 -m 20 \
 -device pci-ohci,id=ohci \
 -drive if=none,format=raw,id=d,file=testmbr.raw \
 -device usb-storage,bus=ohci.0,drive=d \
 --trace "usb_*" --trace "ohci_*" -D qemu.log

Results are:

 qemu 6.2.0 | qemu HEAD | actual HW
------------+-----------+----------------
 assertion  | assertion | sets stall bit

The assertion message is:

> qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed.
> Aborted (core dumped)

Tip: if the flags "-serial pty -serial stdio" are added to the command line
the poc outputs its USB requests like this:

> Free mem 2M ohci port0 conn FS
> setup { 80 6 0 1 0 0 8 0 }
> ED info=80000 { mps=8 en=0 d=0 } tail=c20920
>   td0 c20880 nxt=c20960 f2000000 setup cbp=c20900 be=c20907       cbp=0 be=c20907
>   td1 c20960 nxt=c20980 f3140000    in cbp=c20908 be=c2090f       cbp=0 be=c2090f
>   td2 c20980 nxt=c20920 f3080000   out cbp=0 be=0                 cbp=0 be=0
>    rx { 12 1 0 2 0 0 0 8 }
> setup { 0 5 1 0 0 0 0 0 } tx {}
> ED info=80000 { mps=8 en=0 d=0 } tail=c20880
>   td0 c20920 nxt=c20960 f2000000 setup cbp=c20900 be=c20907       cbp=0 be=c20907
>   td1 c20960 nxt=c20880 f3100000    in cbp=0 be=0                 cbp=0 be=0
> setup { 80 6 0 1 0 0 12 0 }
> ED info=80081 { mps=8 en=0 d=1 } tail=c20960
>   td0 c20880 nxt=c209c0 f2000000 setup cbp=c20920 be=c20927
>   td1 c209c0 nxt=c209e0 f3140000    in cbp=c20928 be=c20939
>   td2 c209e0 nxt=c20960 f3080000   out cbp=0 be=0qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed.
> Aborted (core dumped)

[1] The OS disk image has been emailed to philmd@linaro.org, mjt@tls.msk.ru,
and kraxel@redhat.com:

* testBadSetup.img.xz
* sha256: 045b43f4396de02b149518358bf8025d5ba11091e86458875339fc649e6e5ac6

Signed-off-by: David Hubbard <dmamfmgm@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: authorship and signed-off-by tag names fixed up as
 per on-list agreement]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-05-31 11:26:00 +01:00
.github/workflows github: fix config mistake preventing repo lockdown commenting 2022-04-26 16:12:26 +01:00
.gitlab/issue_templates .gitlab/issue_templates: Move suggestions into comments 2022-12-15 15:19:24 +01:00
.gitlab-ci.d gitlab: use 'setarch -R' to workaround tsan bug 2024-05-14 12:40:08 +02:00
accel accel/tcg: Make TCGCPUOps::cpu_exec_halt return bool for whether to halt 2024-05-30 16:13:48 +01:00
audio meson: remove unnecessary dependency 2024-05-25 13:28:02 +02:00
authz error: Drop superfluous #include "qapi/qmp/qerror.h" 2023-02-23 13:56:14 +01:00
backends backends/iommufd: Make iommufd_backend_*() return bool 2024-05-16 16:59:20 +02:00
block qapi: blockdev-backup: add discard-source parameter 2024-05-28 15:52:15 +03:00
bsd-user user: Declare get_task_state() once in 'accel/tcg/vcpu-state.h' 2024-05-06 14:13:45 +02:00
chardev error: Drop superfluous #include "qapi/qmp/qerror.h" 2024-04-24 09:50:58 +02:00
common-user common-user/host/ppc: Implement safe-syscall.inc.S 2023-01-23 14:39:48 -10:00
configs configs: disable emulators that require it if libfdt is not found 2024-05-10 15:45:15 +02:00
contrib plugins: Copy memory in qemu_plugin_insn_data 2024-05-15 08:55:18 +02:00
crypto crypto: query gcrypt for cipher availability 2024-03-19 20:17:12 +00:00
disas disas: Use translator_st to get disassembly data 2024-05-15 08:55:19 +02:00
docs target/arm: Implement FEAT WFxT and enable for '-cpu max' 2024-05-30 16:35:17 +01:00
dump dump/win_dump: Improve error messages on write error 2024-05-27 12:42:12 +02:00
ebpf ebpf: Restrict to system emulation 2024-04-18 11:17:27 +02:00
fpu target/nios2: Remove the deprecated Nios II target 2024-04-24 16:03:38 +02:00
fsdev configure, meson: rename targetos to host_os 2023-12-31 09:11:29 +01:00
gdb-xml gdb-xml: fix duplicate register in arm-neon.xml 2023-11-08 15:15:23 +00:00
gdbstub user: Use get_task_state() helper 2024-05-06 14:13:45 +02:00
host/include accel/tcg: Rename load-extract/store-insert headers using .h.inc suffix 2024-04-26 15:31:37 +02:00
hw hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT 2024-05-31 11:26:00 +01:00
include accel/tcg: Make TCGCPUOps::cpu_exec_halt return bool for whether to halt 2024-05-30 16:13:48 +01:00
io io: Introduce qio_channel_file_new_dupfd 2024-03-12 15:22:23 -04:00
libdecnumber libdecnumber/dpd/decimal64: Fix compiler warning from Clang 15 2022-11-11 09:13:52 +01:00
linux-headers linux-headers: update to current kvm/next 2024-04-23 17:35:25 +02:00
linux-user target/i386: Pass host pointer and size to cpu_x86_{xsave,xrstor} 2024-05-26 15:49:58 -07:00
migration migration: Rephrase message on failure to save / load Xen device state 2024-05-27 12:42:52 +02:00
monitor kconfig: allow compiling out QEMU device tree code per target 2024-05-10 15:45:15 +02:00
nbd nbd/server: Mark negotiation functions as coroutine_fn 2024-04-25 12:59:19 -05:00
net net/slirp: Use newer slirp_*_hostxfwd API 2024-04-29 02:04:58 +02:00
pc-bios edk2: rebuild binaries with correct version information 2024-04-09 18:21:23 +02:00
plugins plugins: remove op from qemu_plugin_inline_cb 2024-05-16 08:55:23 +01:00
po po: add ukrainian translation 2022-07-05 10:15:49 +02:00
python python/qemu/machine: add method to retrieve QEMUMachine::binary field 2024-04-25 10:12:43 +02:00
qapi qapi: Do not cast function pointers 2024-05-29 12:41:56 +02:00
qga qga: Shorten several error messages 2024-05-27 12:59:10 +02:00
qobject docs/interop: Convert qmp-spec.txt to rST 2023-05-22 10:21:01 +02:00
qom target/sparc/cpu: Rename the CPU models with a "+" in their names 2024-05-05 21:02:47 +01:00
replay replay: Improve error messages about configuration conflicts 2024-03-09 18:56:36 +03:00
roms edk2/seabios: use common extra version 2024-04-09 18:12:20 +02:00
scripts scripts/update-linux-headers.sh: Fix the path of setup_data.h 2024-05-29 12:41:56 +02:00
scsi configure, meson: rename targetos to host_os 2023-12-31 09:11:29 +01:00
semihosting semihosting/guestfd: Remove unused 'semihosting/uaccess.h' header 2024-04-26 15:31:37 +02:00
stats meson: Replace softmmu_ss -> system_ss 2023-06-20 10:01:30 +02:00
storage-daemon meson: remove config_targetos 2023-12-31 09:11:28 +01:00
stubs monitor: remove MonitorDef from typedefs.h 2024-05-03 15:47:48 +02:00
subprojects libvhost-user: Mark mmap'ed region memory as MADV_DONTDUMP 2024-03-12 17:56:55 -04:00
system cpus: Improve error messages on memsave, pmemsave write error 2024-05-27 12:42:44 +02:00
target target/arm: Implement FEAT WFxT and enable for '-cpu max' 2024-05-30 16:35:17 +01:00
tcg tcg: include dependencies in static_library() 2024-05-25 13:28:02 +02:00
tests tests/avocado: update sbsa-ref firmware 2024-05-30 13:21:06 +01:00
tools ebpf: Updated eBPF program and skeleton. 2024-03-12 19:31:47 +08:00
trace tracing: install trace events file only if necessary 2023-12-27 05:01:55 -05:00
ui meson: remove unnecessary dependency 2024-05-25 13:28:02 +02:00
util util/uri: Remove the old URI parsing code 2024-05-14 12:46:46 +02:00
.dir-locals.el Add .dir-locals.el file to configure emacs coding style 2015-10-08 19:46:01 +03:00
.editorconfig .editorconfig: update the automatic mode setting for Emacs 2021-03-10 15:34:11 +00:00
.exrc qemu: add .exrc 2012-09-07 09:02:44 +03:00
.gdbinit .gdbinit: load QEMU sub-commands when gdb starts 2017-06-07 14:38:45 +01:00
.git-blame-ignore-revs metadata: add .git-blame-ignore-revs 2023-04-04 15:56:44 +01:00
.gitattributes gitattributes: Cover Objective-C source files 2022-03-29 00:15:14 +02:00
.gitignore configure: rename --enable-pypi to --enable-download, control subprojects too 2023-06-06 16:30:01 +02:00
.gitlab-ci.yml docs: Document GitLab custom CI/CD variables 2021-07-29 07:56:01 +02:00
.gitmodules meson: subprojects: replace berkeley-{soft,test}float-3 with wraps 2023-06-06 16:30:01 +02:00
.gitpublish Add a git-publish configuration file 2018-03-05 09:03:17 +00:00
.mailmap MAINTAINERS: Update Sriram Yagnaraman mail address 2024-04-24 16:03:38 +02:00
.patchew.yml scripts/checkpatch: roll diff tweaking into checkpatch itself 2021-06-25 10:08:33 +01:00
.readthedocs.yml readthodocs: fully specify a build environment 2024-01-12 13:23:48 +00:00
.travis.yml .travis.yml: Do some more testing with Clang 2024-04-25 07:03:04 +02:00
block.c error: Move ERRP_GUARD() to the beginning of the function 2024-03-12 11:45:45 +01:00
blockdev-nbd.c qapi block: Elide redundant has_FOO in generated C 2022-12-14 20:03:25 +01:00
blockdev.c qapi: blockdev-backup: add discard-source parameter 2024-05-28 15:52:15 +03:00
blockjob.c block: remove AioContext locking 2023-12-21 22:49:27 +01:00
configure configure: move -mcx16 flag out of CPU_CFLAGS 2024-05-24 09:27:56 +02:00
COPYING COPYING: update from FSF 2008-10-12 17:54:42 +00:00
COPYING.LIB COPYING.LIB: Synchronize the LGPL 2.1 with the version from gnu.org 2019-01-30 11:01:22 +01:00
cpu-common.c system/cpus: rename qemu_mutex_lock_iothread() to bql_lock() 2024-01-08 10:45:43 -05:00
cpu-target.c exec/cpu: Extract page-protection definitions to page-protection.h 2024-05-06 11:17:15 +02:00
event-loop-base.c util/event-loop-base: Introduce options to set the thread pool size 2022-05-09 10:43:23 +01:00
gitdm.config contrib/gitdm: add group map for AMD 2023-03-22 15:08:26 +00:00
hmp-commands-info.hx hw/rdma: Remove deprecated pvrdma device and rdmacm-mux helper 2024-04-24 16:03:38 +02:00
hmp-commands.hx hmp/migration: Fix "migrate" command's documentation 2024-05-08 09:22:37 -03:00
iothread.c iothread: Simplify expression in qemu_in_iothread() 2024-02-13 10:59:25 +03:00
job-qmp.c qapi job: Elide redundant has_FOO in generated C 2022-12-14 20:04:47 +01:00
job.c block: remove AioContext locking 2023-12-21 22:49:27 +01:00
Kconfig meson: Introduce target-specific Kconfig 2021-07-09 18:21:34 +02:00
Kconfig.host kconfig: express dependency of individual boards on libfdt 2024-05-10 15:45:15 +02:00
LICENSE tcg/LICENSE: Remove out of date claim about TCG subdirectory licensing 2019-11-11 15:11:21 +01:00
MAINTAINERS qapi/vfio: Add VFIO migration QAPI event 2024-05-16 16:59:19 +02:00
Makefile Makefile: fix use of -j without an argument 2024-04-12 12:02:12 +02:00
meson_options.txt migration: Remove block migration 2024-05-08 09:20:58 -03:00
meson.build migration: remove unnecessary zlib dependency 2024-05-25 13:28:02 +02:00
module-common.c all: Clean up includes 2016-02-04 17:41:30 +00:00
os-posix.c qemu_init: increase NOFILE soft limit on POSIX 2024-02-09 12:47:58 +00:00
os-win32.c Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
page-target.c exec: Expose 'target_page.h' API to user emulation 2024-04-26 15:28:11 +02:00
page-vary-common.c Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
page-vary-target.c exec: Rename target specific page-vary.c -> page-vary-target.c 2023-10-04 11:03:54 -07:00
pythondeps.toml pythondeps.toml: warn about updates needed to docs/requirements.txt 2024-04-23 17:35:26 +02:00
qemu-bridge-helper.c qemu-bridge-helper: relocate path to default ACL 2020-09-30 19:11:36 +02:00
qemu-edid.c qemu-edid: Restrict input parameter -d to avoid division by zero 2022-10-12 13:38:15 +02:00
qemu-img-cmds.hx docs/devel/docs: Document .hx file syntax 2024-01-15 17:12:22 +00:00
qemu-img.c block: remove AioContext locking 2023-12-21 22:49:27 +01:00
qemu-io-cmds.c block: Mark bdrv_get_specific_info() and callers GRAPH_RDLOCK 2023-10-12 16:31:33 +02:00
qemu-io.c block: remove AioContext locking 2023-12-21 22:49:27 +01:00
qemu-keymap.c qemu-keymap: Make references to allocations static 2024-05-29 12:41:56 +02:00
qemu-nbd.c qemu-nbd: mention --tls-hostname option in qemu-nbd --help 2024-02-13 10:59:25 +03:00
qemu-options.hx hw/i386/pc: Support smp.modules for x86 PC machine 2024-05-22 19:43:29 +02:00
qemu.nsi nsis installer: Fix mouse-over descriptions for emulators 2022-03-18 10:55:15 +00:00
qemu.sasl sasl: remove comment about obsolete kerberos versions 2021-06-14 13:28:50 +01:00
README.rst README.rst: fix link formatting 2022-08-04 13:44:21 +02:00
replication.c replication: move include out of root directory 2021-05-26 14:49:46 +02:00
trace-events trace-events: remove the remaining vcpu trace events 2023-06-01 11:05:05 -04:00
VERSION Open 9.1 development tree 2024-04-23 17:33:36 -07:00
version.rc configure: remove CONFIG_FILEVERSION and CONFIG_PRODUCTVERSION 2021-01-02 21:03:37 +01:00

===========
QEMU README
===========

QEMU is a generic and open source machine & userspace emulator and
virtualizer.

QEMU is capable of emulating a complete machine in software without any
need for hardware virtualization support. By using dynamic translation,
it achieves very good performance. QEMU can also integrate with the Xen
and KVM hypervisors to provide emulated hardware while allowing the
hypervisor to manage the CPU. With hypervisor support, QEMU can achieve
near native performance for CPUs. When QEMU emulates CPUs directly it is
capable of running operating systems made for one machine (e.g. an ARMv7
board) on a different machine (e.g. an x86_64 PC board).

QEMU is also capable of providing userspace API virtualization for Linux
and BSD kernel interfaces. This allows binaries compiled against one
architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a
different architecture ABI (e.g. the Linux x86_64 ABI). This does not
involve any hardware emulation, simply CPU and syscall emulation.

QEMU aims to fit into a variety of use cases. It can be invoked directly
by users wishing to have full control over its behaviour and settings.
It also aims to facilitate integration into higher level management
layers, by providing a stable command line interface and monitor API.
It is commonly invoked indirectly via the libvirt library when using
open source applications such as oVirt, OpenStack and virt-manager.

QEMU as a whole is released under the GNU General Public License,
version 2. For full licensing details, consult the LICENSE file.


Documentation
=============

Documentation can be found hosted online at
`<https://www.qemu.org/documentation/>`_. The documentation for the
current development version that is available at
`<https://www.qemu.org/docs/master/>`_ is generated from the ``docs/``
folder in the source tree, and is built by `Sphinx
<https://www.sphinx-doc.org/en/master/>`_.


Building
========

QEMU is multi-platform software intended to be buildable on all modern
Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety
of other UNIX targets. The simple steps to build QEMU are:


.. code-block:: shell

  mkdir build
  cd build
  ../configure
  make

Additional information can also be found online via the QEMU website:

* `<https://wiki.qemu.org/Hosts/Linux>`_
* `<https://wiki.qemu.org/Hosts/Mac>`_
* `<https://wiki.qemu.org/Hosts/W32>`_


Submitting patches
==================

The QEMU source code is maintained under the GIT version control system.

.. code-block:: shell

   git clone https://gitlab.com/qemu-project/qemu.git

When submitting patches, one common approach is to use 'git
format-patch' and/or 'git send-email' to format & send the mail to the
qemu-devel@nongnu.org mailing list. All patches submitted must contain
a 'Signed-off-by' line from the author. Patches should follow the
guidelines set out in the `style section
<https://www.qemu.org/docs/master/devel/style.html>`_ of
the Developers Guide.

Additional information on submitting patches can be found online via
the QEMU website

* `<https://wiki.qemu.org/Contribute/SubmitAPatch>`_
* `<https://wiki.qemu.org/Contribute/TrivialPatches>`_

The QEMU website is also maintained under source control.

.. code-block:: shell

  git clone https://gitlab.com/qemu-project/qemu-web.git

* `<https://www.qemu.org/2017/02/04/the-new-qemu-website-is-up/>`_

A 'git-publish' utility was created to make above process less
cumbersome, and is highly recommended for making regular contributions,
or even just for sending consecutive patch series revisions. It also
requires a working 'git send-email' setup, and by default doesn't
automate everything, so you may want to go through the above steps
manually for once.

For installation instructions, please go to

*  `<https://github.com/stefanha/git-publish>`_

The workflow with 'git-publish' is:

.. code-block:: shell

  $ git checkout master -b my-feature
  $ # work on new commits, add your 'Signed-off-by' lines to each
  $ git publish

Your patch series will be sent and tagged as my-feature-v1 if you need to refer
back to it in the future.

Sending v2:

.. code-block:: shell

  $ git checkout my-feature # same topic branch
  $ # making changes to the commits (using 'git rebase', for example)
  $ git publish

Your patch series will be sent with 'v2' tag in the subject and the git tip
will be tagged as my-feature-v2.

Bug reporting
=============

The QEMU project uses GitLab issues to track bugs. Bugs
found when running code built from QEMU git or upstream released sources
should be reported via:

* `<https://gitlab.com/qemu-project/qemu/-/issues>`_

If using QEMU via an operating system vendor pre-built binary package, it
is preferable to report bugs to the vendor's own bug tracker first. If
the bug is also known to affect latest upstream code, it can also be
reported via GitLab.

For additional information on bug reporting consult:

* `<https://wiki.qemu.org/Contribute/ReportABug>`_


ChangeLog
=========

For version history and release notes, please visit
`<https://wiki.qemu.org/ChangeLog/>`_ or look at the git history for
more detailed information.


Contact
=======

The QEMU community can be contacted in a number of ways, with the two
main methods being email and IRC

* `<mailto:qemu-devel@nongnu.org>`_
* `<https://lists.nongnu.org/mailman/listinfo/qemu-devel>`_
* #qemu on irc.oftc.net

Information on additional methods of contacting the community can be
found online via the QEMU website:

* `<https://wiki.qemu.org/Contribute/StartHere>`_