ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
xemu/hw
History
David Hubbard 3c3c233677 hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT 
This changes the ohci validation to not assert if invalid data is fed to the
ohci controller. The poc in https://bugs.launchpad.net/qemu/+bug/1907042 and
migrated to bug #303 does the following to feed it a SETUP pid (valid)
at an EndPt of 1 (invalid - all SETUP pids must be addressed to EndPt 0):

        uint32_t MaxPacket = 64;
        uint32_t TDFormat = 0;
        uint32_t Skip = 0;
        uint32_t Speed = 0;
        uint32_t Direction = 0;  /* #define OHCI_TD_DIR_SETUP 0 */
        uint32_t EndPt = 1;
        uint32_t FuncAddress = 0;
        ed->attr = (MaxPacket << 16) | (TDFormat << 15) | (Skip << 14)
                   | (Speed << 13) | (Direction << 11) | (EndPt << 7)
                   | FuncAddress;
        ed->tailp = /*TDQTailPntr= */ 0;
        ed->headp = ((/*TDQHeadPntr= */ &td[0]) & 0xfffffff0)
                   | (/* ToggleCarry= */ 0 << 1);
        ed->next_ed = (/* NextED= */ 0 & 0xfffffff0)

qemu-fuzz also caught the same issue in #1510. They are both fixed by this
patch.

With a tiny OS[1] that boots and executes the poc the repro shows the issue:

* OS that sends USB requests to a USB mass storage device
  but sends a SETUP with EndPt = 1
* qemu 6.2.0 (Debian 1:6.2+dfsg-2ubuntu6.19)
* qemu HEAD (4e66a0854)
* Actual OHCI controller (hardware)

Command line:
qemu-system-x86_64 -m 20 \
 -device pci-ohci,id=ohci \
 -drive if=none,format=raw,id=d,file=testmbr.raw \
 -device usb-storage,bus=ohci.0,drive=d \
 --trace "usb_*" --trace "ohci_*" -D qemu.log

Results are:

 qemu 6.2.0 | qemu HEAD | actual HW
------------+-----------+----------------
 assertion  | assertion | sets stall bit

The assertion message is:

> qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed.
> Aborted (core dumped)

Tip: if the flags "-serial pty -serial stdio" are added to the command line
the poc outputs its USB requests like this:

> Free mem 2M ohci port0 conn FS
> setup { 80 6 0 1 0 0 8 0 }
> ED info=80000 { mps=8 en=0 d=0 } tail=c20920
>   td0 c20880 nxt=c20960 f2000000 setup cbp=c20900 be=c20907       cbp=0 be=c20907
>   td1 c20960 nxt=c20980 f3140000    in cbp=c20908 be=c2090f       cbp=0 be=c2090f
>   td2 c20980 nxt=c20920 f3080000   out cbp=0 be=0                 cbp=0 be=0
>    rx { 12 1 0 2 0 0 0 8 }
> setup { 0 5 1 0 0 0 0 0 } tx {}
> ED info=80000 { mps=8 en=0 d=0 } tail=c20880
>   td0 c20920 nxt=c20960 f2000000 setup cbp=c20900 be=c20907       cbp=0 be=c20907
>   td1 c20960 nxt=c20880 f3100000    in cbp=0 be=0                 cbp=0 be=0
> setup { 80 6 0 1 0 0 12 0 }
> ED info=80081 { mps=8 en=0 d=1 } tail=c20960
>   td0 c20880 nxt=c209c0 f2000000 setup cbp=c20920 be=c20927
>   td1 c209c0 nxt=c209e0 f3140000    in cbp=c20928 be=c20939
>   td2 c209e0 nxt=c20960 f3080000   out cbp=0 be=0qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed.
> Aborted (core dumped)

[1] The OS disk image has been emailed to philmd@linaro.org, mjt@tls.msk.ru,
and kraxel@redhat.com:

* testBadSetup.img.xz
* sha256: 045b43f4396de02b149518358bf8025d5ba11091e86458875339fc649e6e5ac6

Signed-off-by: David Hubbard <dmamfmgm@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: authorship and signed-off-by tag names fixed up as
 per on-list agreement]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 		2024-05-31 11:26:00 +01:00
..
9pfs xen: register legacy backends via xen_backend_init 2024-05-10 15:45:15 +02:00
acpi hmat acpi: Fix out of bounds access due to missing use of indirection 2024-03-12 17:59:46 -04:00
adc hw, target: Add ResetType argument to hold and exit phase methods 2024-04-25 10:21:06 +01:00
alpha alpha: switch boards to "default y" 2024-05-03 15:47:47 +02:00
arm arm/sbsa-ref: move to Neoverse-N2 as default 2024-05-30 13:21:06 +01:00
audio misc: Use QEMU header path relative to include/ directory 2024-05-09 00:07:21 +02:00
avr avr: switch boards to "default y" 2024-05-03 15:47:47 +02:00
block hw/pflash: fix block write start 2024-05-17 16:49:04 +02:00
char hw: arm: Remove use of tabs in some source files 2024-05-28 14:20:48 +01:00
core Migration pull request 2024-05-22 15:32:25 -07:00
cpu hw: Add a Kconfig switch for the TYPE_CPU_CLUSTER device 2024-04-25 12:48:12 +02:00
cris cris: switch boards to "default y" 2024-05-03 15:47:47 +02:00
cxl hw/cxl/cxl-cdat: Make cxl_doe_cdat_init() return boolean 2024-04-25 12:48:12 +02:00
display virtio-gpu: fix v2 migration 2024-05-22 17:34:41 -03:00
dma xlnx_dpdma: fix descriptor endianness bug 2024-05-28 14:20:48 +01:00
fsi hw/fsi: Aspeed APB2OPB & On-chip peripheral bus 2024-02-01 08:33:18 +01:00
gpio hw: arm: Remove use of tabs in some source files 2024-05-28 14:20:48 +01:00
hppa hw/hppa/machine: Replace g_memdup() by g_memdup2() 2024-05-08 19:42:45 +02:00
hyperv kvm: move target-dependent interrupt routing out of kvm-all.c 2024-05-03 15:47:48 +02:00
i2c hw, target: Add ResetType argument to hold and exit phase methods 2024-04-25 10:21:06 +01:00
i386 hw/i386/pc: Support smp.modules for x86 PC machine 2024-05-22 19:43:29 +02:00
ide hw/ide/core.c (cmd_read_native_max): Avoid limited device parameters 2024-04-30 06:21:47 +02:00
input hw: arm: Remove use of tabs in some source files 2024-05-28 14:20:48 +01:00
intc hw/intc/arm_gic: Fix writes to GICD_ITARGETSRn 2024-05-30 13:21:06 +01:00
ipack hw/ipack: Constify VMState 2023-12-29 11:17:30 +11:00
ipmi hw/ipmi: Constify VMState 2023-12-29 11:17:30 +11:00
isa hw/isa/vt82c686: Keep track of PIRQ/PINT pins separately 2024-04-15 13:07:11 +02:00
loongarch hw/loongarch/virt: Fix FDT memory node address width 2024-05-23 09:30:41 +08:00
m68k m68k: switch boards to "default y" 2024-05-03 15:47:47 +02:00
mem hw/cxl/cxl-cdat: Make cxl_doe_cdat_init() return boolean 2024-04-25 12:48:12 +02:00
microblaze microblaze: switch boards to "default y" 2024-05-03 15:47:47 +02:00
mips kconfig: express dependency of individual boards on libfdt 2024-05-10 15:45:15 +02:00
misc hw: misc: edu: use qemu_log_mask instead of hw_error 2024-04-30 06:21:47 +02:00
net Misc HW patch queue 2024-04-25 09:43:29 -07:00
nubus hw/nubus: add nubus-virtio-mmio device 2024-02-27 09:36:39 +01:00
nvme hw/nvme: fix -Werror=maybe-uninitialized 2024-04-02 16:15:07 +02:00
nvram hw, target: Add ResetType argument to hold and exit phase methods 2024-04-25 10:21:06 +01:00
openrisc kconfig: express dependency of individual boards on libfdt 2024-05-10 15:45:15 +02:00
pci hw, target: Add ResetType argument to hold and exit phase methods 2024-04-25 10:21:06 +01:00
pci-bridge Misc HW patch queue 2024-04-25 09:43:29 -07:00
pci-host hw, target: Add ResetType argument to hold and exit phase methods 2024-04-25 10:21:06 +01:00
pcmcia hw/pcmcia/pxa2xx: Inline pxa2xx_pcmcia_init() 2023-10-27 12:48:57 +01:00
ppc target/ppc: Remove id_tlbs flag from CPU env 2024-05-24 09:43:11 +10:00
remote hw/remote/vfio-user: Fix config space access byte order 2024-05-08 19:43:15 +02:00
riscv kconfig: express dependency of individual boards on libfdt 2024-05-10 15:45:15 +02:00
rtc hw/i386: move rtc-reset-reinjection command out of hw/rtc 2024-05-10 15:45:15 +02:00
rx kconfig: express dependency of individual boards on libfdt 2024-05-10 15:45:15 +02:00
s390x s390: move css_migration_enabled from machine to css.c 2024-05-10 15:45:15 +02:00
scsi esp.c: remove explicit setting of DRQ within ESP state machine 2024-04-04 15:17:53 +01:00
sd hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set 2024-04-10 09:09:34 +02:00
sensor hw, target: Add ResetType argument to hold and exit phase methods 2024-04-25 10:21:06 +01:00
sh4 sh4: select correct components for no-board build 2024-05-10 15:45:14 +02:00
smbios hw/smbios: add stub for smbios_get_table_legacy() 2024-03-26 14:32:54 +01:00
sparc sparc: switch boards to "default y" 2024-05-03 15:47:48 +02:00
sparc64 qemu-sparc queue 2024-05-06 10:19:56 -07:00
ssi Misc HW patch queue 2024-04-25 09:43:29 -07:00
timer hw, target: Add ResetType argument to hold and exit phase methods 2024-04-25 10:21:06 +01:00
tpm hw/tpm: Remove HOST_PAGE_ALIGN from tpm_ppi_init 2024-02-29 11:35:36 -10:00
tricore tricore: switch boards to "default y" 2024-05-03 15:47:48 +02:00
ufs hw/ufs: Fix buffer overflow bug 2024-04-29 12:13:35 +09:00
usb hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT 2024-05-31 11:26:00 +01:00
vfio vfio/igd: Use g_autofree in vfio_probe_igd_bar4_quirk() 2024-05-22 10:04:22 +02:00
virtio memory: Add Error** argument to memory_get_xlat_addr() 2024-05-16 16:59:19 +02:00
watchdog hw/watchdog/sbsa_gwdt: Make watchdog timer frequency a QOM property 2024-04-30 15:14:15 +01:00
xen xen: register legacy backends via xen_backend_init 2024-05-10 15:45:15 +02:00
xenpv xen: initialize legacy backends from xen_bus_init() 2024-05-10 15:45:15 +02:00
xtensa hw/xtensa: require libfdt 2024-05-10 15:45:15 +02:00
Kconfig hw: Fix problem with the A*MPCORE switches in the Kconfig files 2024-04-25 12:48:12 +02:00
meson.build hw/rdma: Remove deprecated pvrdma device and rdmacm-mux helper 2024-04-24 16:03:38 +02:00