From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=35173 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1ORr3X-0004B2-79 for qemu-devel@nongnu.org; Thu, 24 Jun 2010 14:21:44 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.69) (envelope-from ) id 1ORr3V-0004UA-BA for qemu-devel@nongnu.org; Thu, 24 Jun 2010 14:21:42 -0400 Received: from mail-qw0-f45.google.com ([209.85.216.45]:36054) by eggs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1ORr3V-0004Tx-7p for qemu-devel@nongnu.org; Thu, 24 Jun 2010 14:21:41 -0400 Received: by qwg8 with SMTP id 8so142730qwg.4 for ; Thu, 24 Jun 2010 11:21:40 -0700 (PDT) Message-ID: <4C23A24B.5050408@gmail.com> Date: Thu, 24 Jun 2010 14:22:03 -0400 From: TJ MIME-Version: 1.0 Subject: Re: [Qemu-devel] Guest OS hangs on usb_add References: <4C22E300.5020109@gmail.com> <4C239CF0.4040901@cisco.com> In-Reply-To: <4C239CF0.4040901@cisco.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "David S. Ahern" Cc: qemu-devel@nongnu.org On 06/24/10 13:59, David S. Ahern wrote: > > > On 06/23/10 22:45, TJ wrote: >> >>> ---------- Forwarded message ---------- >>> From: Timothy Jones >>> Date: Wed, Jun 23, 2010 at 9:07 PM >>> Subject: Guest OS hangs on usb_add >>> To: qemu-devel@nongnu.org >>> >>> >>> With some digging around I found out that the qemu hangs in >>> usb_host_claim_interfaces, which is caused by screwed up usb >>> descriptor. The device reports the following: >>> >>> (gdb) p dev->descr_len >>> $21 = 50 >>> (gdb) p /x dev->descr[0]@50 >>> $23 = {0x18, 0x1, 0x0, 0x1, 0xff, 0xff, 0xff, 0x8, 0x47, 0x46, 0x0, >>> 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x9, 0x2, 0x20, >>> 0x0, 0x1, 0x1, 0x0, 0x80, 0x19, 0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0xff, >>> 0xff, 0x0, 0x7, 0x5, 0x81, 0x2, 0x40, 0x0, 0x0, >>> 0x7, 0x5, 0x3, 0x2, 0x10, 0x0, 0x0} >>> >>> The first 0x18 (Device Descriptor bLength) is supposed to be decimal >>> 18, not hex! According to USB spec, if the device reports size greater >>> than expected, the host is supposed ignore the extra bytes. So qemu >>> behaves correctly here. However, with this length, the following >>> Configuration Descriptor length falls on a 0x0 and so the qemu spins >>> in an endless loop. (This is prolly something that should be detected >>> and reported as error by qemu.) >>> >>> My question is: This 0x18 -- is this something that comes from the >>> device itself (ie, firmware bug)? Or does it come from the USB >>> subsystem? > > What kind of device is this? > > David > Universal Remote Control MX-950 http://www.universalremote.com/product_detail.php?model=35 -TJ