)]}' { "commit": "53aaa88105e2f9cbef3a4d17df007dbdf985d6e2", "tree": "07e975abd16d8e9eef385887153f64b0e31f5f0e", "parents": [ "d338b5a80922433a2c4a63986b41f82ae4137dfc" ], "author": { "name": "David Hubbard", "email": "dmamfmgm@gmail.com", "time": "Mon May 20 18:26:34 2024 -0500" }, "committer": { "name": "Peter Maydell", "email": "peter.maydell@linaro.org", "time": "Fri Jun 21 16:20:45 2024 +0100" }, "message": "hw/usb/hcd-ohci: Fix ohci_service_td: accept zero-length TDs where CBP\u003dBE+1\n\nThis changes the way the ohci emulation handles a Transfer Descriptor\nwith \"Buffer End\" set to \"Current Buffer Pointer\" - 1, specifically\nin the case of a zero-length packet.\n\nThe OHCI spec 4.3.1.2 Table 4-2 specifies td.cbp to be zero for a\nzero-length packet. Peter Maydell tracked down commit 1328fe0c32\n(hw: usb: hcd-ohci: check len and frame_number variables) where qemu\nstarted checking this according to the spec.\n\nWhat this patch does is loosen the qemu ohci implementation to allow a\nzero-length packet if td.be (Buffer End) is set to td.cbp - 1, and with a\nnon-zero td.cbp value.\n\nThe spec is unclear whether this is valid or not -- it is not the\nclearly documented way to send a zero length TD (which is CBP\u003dBE\u003d0),\nbut it isn\u0027t specifically forbidden. Actual hw seems to be ok with it.\n\nDoes any OS rely on this behavior? There have been no reports to\nqemu-devel of this problem.\n\nThis is attempting to have qemu behave like actual hardware,\nbut this is just a minor change.\n\nWith a tiny OS[1] that boots and executes a test, the issue can be seen:\n\n* OS that sends USB requests to a USB mass storage device\n but sends td.cbp \u003d td.be + 1\n* qemu 4.2\n* qemu HEAD (4e66a0854)\n* Actual OHCI controller (hardware)\n\nCommand line:\nqemu-system-x86_64 -m 20 \\\n -device pci-ohci,id\u003dohci \\\n -drive if\u003dnone,format\u003draw,id\u003dd,file\u003dtestmbr.raw \\\n -device usb-storage,bus\u003dohci.0,drive\u003dd \\\n --trace \"usb_*\" --trace \"ohci_*\" -D qemu.log\n\nResults are:\n\n qemu 4.2 | qemu HEAD | actual HW\n -----------+------------+-----------\n works fine | ohci_die() | works fine\n\nTip: if the flags \"-serial pty -serial stdio\" are added to the command line\nthe test will output USB requests like this:\n\nTesting qemu HEAD:\n\n\u003e Free mem 2M ohci port2 conn FS\n\u003e setup { 80 6 0 1 0 0 8 0 }\n\u003e ED info\u003d80000 { mps\u003d8 en\u003d0 d\u003d0 } tail\u003dc20920\n\u003e td0 c20880 nxt\u003dc20960 f2000000 setup cbp\u003dc20900 be\u003dc20907\n\u003e td1 c20960 nxt\u003dc20980 f3140000 in cbp\u003dc20908 be\u003dc2090f\n\u003e td2 c20980 nxt\u003dc20920 f3080000 out cbp\u003dc20910 be\u003dc2090f ohci20 host err\n\u003e usb stopped\n\nAnd in qemu.log:\n\nusb_ohci_iso_td_bad_cc_overrun ISO_TD start_offset\u003d0x00c20910 \u003e next_offset\u003d0x00c2090f\n\nTesting qemu 4.2:\n\n\u003e Free mem 2M ohci port2 conn FS\n\u003e setup { 80 6 0 1 0 0 8 0 }\n\u003e ED info\u003d80000 { mps\u003d8 en\u003d0 d\u003d0 } tail\u003d620920\n\u003e td0 620880 nxt\u003d620960 f2000000 setup cbp\u003d620900 be\u003d620907 cbp\u003d0 be\u003d620907\n\u003e td1 620960 nxt\u003d620980 f3140000 in cbp\u003d620908 be\u003d62090f cbp\u003d0 be\u003d62090f\n\u003e td2 620980 nxt\u003d620920 f3080000 out cbp\u003d620910 be\u003d62090f cbp\u003d0 be\u003d62090f\n\u003e rx { 12 1 0 2 0 0 0 8 }\n\u003e setup { 0 5 1 0 0 0 0 0 } tx {}\n\u003e ED info\u003d80000 { mps\u003d8 en\u003d0 d\u003d0 } tail\u003d620880\n\u003e td0 620920 nxt\u003d620960 f2000000 setup cbp\u003d620900 be\u003d620907 cbp\u003d0 be\u003d620907\n\u003e td1 620960 nxt\u003d620880 f3100000 in cbp\u003d620908 be\u003d620907 cbp\u003d0 be\u003d620907\n\u003e setup { 80 6 0 1 0 0 12 0 }\n\u003e ED info\u003d80001 { mps\u003d8 en\u003d0 d\u003d1 } tail\u003d620960\n\u003e td0 620880 nxt\u003d6209c0 f2000000 setup cbp\u003d620920 be\u003d620927 cbp\u003d0 be\u003d620927\n\u003e td1 6209c0 nxt\u003d6209e0 f3140000 in cbp\u003d620928 be\u003d620939 cbp\u003d0 be\u003d620939\n\u003e td2 6209e0 nxt\u003d620960 f3080000 out cbp\u003d62093a be\u003d620939 cbp\u003d0 be\u003d620939\n\u003e rx { 12 1 0 2 0 0 0 8 f4 46 1 0 0 0 1 2 3 1 }\n\u003e setup { 80 6 0 2 0 0 0 1 }\n\u003e ED info\u003d80001 { mps\u003d8 en\u003d0 d\u003d1 } tail\u003d620880\n\u003e td0 620960 nxt\u003d6209a0 f2000000 setup cbp\u003d620a20 be\u003d620a27 cbp\u003d0 be\u003d620a27\n\u003e td1 6209a0 nxt\u003d6209c0 f3140004 in cbp\u003d620a28 be\u003d620b27 cbp\u003d620a48 be\u003d620b27\n\u003e td2 6209c0 nxt\u003d620880 f3080000 out cbp\u003d620b28 be\u003d620b27 cbp\u003d0 be\u003d620b27\n\u003e rx { 9 2 20 0 1 1 4 c0 0 9 4 0 0 2 8 6 50 0 7 5 81 2 40 0 0 7 5 2 2 40 0 0 }\n\u003e setup { 0 9 1 0 0 0 0 0 } tx {}\n\u003e ED info\u003d80001 { mps\u003d8 en\u003d0 d\u003d1 } tail\u003d620900\n\u003e td0 620880 nxt\u003d620940 f2000000 setup cbp\u003d620a00 be\u003d620a07 cbp\u003d0 be\u003d620a07\n\u003e td1 620940 nxt\u003d620900 f3100000 in cbp\u003d620a08 be\u003d620a07 cbp\u003d0 be\u003d620a07\n\n[1] The OS disk image has been emailed to philmd@linaro.org, mjt@tls.msk.ru,\nand kraxel@redhat.com:\n\n* testCbpOffBy1.img.xz\n* sha256: f87baddcb86de845de12f002c698670a426affb40946025cc32694f9daa3abed\n\nSigned-off-by: David Hubbard \u003cdmamfmgm@gmail.com\u003e\nReviewed-by: Alex Bennée \u003calex.bennee@linaro.org\u003e\nReviewed-by: Peter Maydell \u003cpeter.maydell@linaro.org\u003e\nSigned-off-by: Peter Maydell \u003cpeter.maydell@linaro.org\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "acd60169802de563168498d98dfc6e93446c2de8", "old_mode": 33188, "old_path": "hw/usb/hcd-ohci.c", "new_id": "71b54914d32410ad16e73b179676e18fe6a77d73", "new_mode": 33188, "new_path": "hw/usb/hcd-ohci.c" }, { "type": "modify", "old_id": "46732717a950ea0c8e0da319499ba47c1ace379e", "old_mode": 33188, "old_path": "hw/usb/trace-events", "new_id": "dd04f14add12dd59f88174f0d815203d0685ac67", "new_mode": 33188, "new_path": "hw/usb/trace-events" } ] }