Assertion failed with USB pass through with XHCI controller
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Unassigned | ||
qemu (Debian) |
Fix Released
|
Unknown
|
Bug Description
Starting qemu 2.8.0 with XHCI controller and host device passed through results in an assertion failure:
qemu-system-x86_64: hw/usb/core.c:623: usb_packet_cleanup: Assertion `!usb_packet_
Can be reproduced with the following command (passing through a Lenovo keyboard):
qemu-system-x86_64 -usb -device nec-usb-xhci,id=usb -device usb-host,
If nec-usb-xhci is changed to usb-ehci, qemu tries to boot without assertion failures.
Can be reproduced with the latest master (commit dbe2b65) and v2.8.0.
Bisected the issue to following commit:
first bad commit: [94b037f2a451b3
Backtrace from commit dbe2b65:
#0 0x00007f2eb4657227 in __GI_raise (sig=sig@entry=6) at ../sysdeps/
resultvar = 0
pid = 3453
selftid = 3453
#1 0x00007f2eb465867a in __GI_abort () at abort.c:89
save_stage = 2
act = {__sigaction_
sigs = {__val = {32, 0 <repeats 15 times>}}
#2 0x00007f2eb46502cd in __assert_fail_base (fmt=0x7f2eb47893a0 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
assertion=
function=
str = 0x55615cfdf510 ""
total = 4096
#3 0x00007f2eb4650382 in __GI___assert_fail (assertion=
line=619, function=
No locals.
#4 0x000055615afc385e in usb_packet_cleanup ()
No symbol table info available.
#5 0x000055615afda555 in xhci_ep_free_xfer ()
No symbol table info available.
#6 0x000055615afdc156 in xhci_kick_epctx ()
No symbol table info available.
#7 0x000055615afda099 in xhci_ep_kick_timer ()
No symbol table info available.
#8 0x000055615b08ceee in timerlist_
No symbol table info available.
#9 0x000055615b08cf36 in qemu_clock_
No symbol table info available.
#10 0x000055615b08d2df in qemu_clock_
No symbol table info available.
#11 0x000055615b08be40 in main_loop_wait ()
No symbol table info available.
#12 0x000055615ae3870f in main_loop ()
No symbol table info available.
#13 0x000055615ae4027b in main ()
Changed in qemu: | |
status: | New → Fix Committed |
Changed in qemu (Debian): | |
status: | Unknown → Confirmed |
Changed in qemu (Debian): | |
status: | Confirmed → Fix Committed |
Changed in qemu (Debian): | |
status: | Fix Committed → Fix Released |
Changed in qemu: | |
status: | Fix Committed → Fix Released |
This behaviour was introduced by commit:
94b037f2a451b3d c855f9f2c346e50 49a361bd55
xhci: use linked list for transfers
However, QEMU does not crash yet, but linux' xhci_hcd reports errors like "ERROR Transfer event TRB DMA...". The following commit
5612564ea9cf5b9 636438a1b58ae9a 2ab6ca16ae
xhci: drop XHCITransfer->xhci
finally makes QEMU crash on the assertion check.
I tried to dig into the code, but I'm not an expert in usb stuff so I don't understand it. usb_packet_ is_inflight checks if USBPacket.state is USB_PACKET_QUEUED or USB_PACKET_ASYNC. I suppose that somewhere in the code changed by 94b037f2 finished usb transfers do not have the packet state changed.