xhci_kick_epctx: Assertion `ring->dequeue != 0' failed.
Bug #1883732 reported by
Bugs SysSec
This bug affects 2 people
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
To reproduce run the QEMU with the following command line:
```
qemu-system-x86_64 -cdrom hypertrash_
```
QEMU Version:
```
# qemu-5.0.0
$ ./configure --target-
$ x86_64-
QEMU emulator version 5.0.0
Copyright (c) 2003-2020 Fabrice Bellard and the QEMU Project developers
```
To post a comment you must log in.
Here's a QTest reproducer:
cat << EOF | ./i386- softmmu/ qemu-system- i386 \ drive=mydrive \ file=null- co://,size= 2M,format= raw,if= none \
-device nec-usb-xhci -trace usb\* \
-device usb-audio -device usb-storage,
-drive id=mydrive,
-nodefaults -nographic -qtest stdio
outl 0xcf8 0x80001014
outl 0xcfc 0xff000a8e
outl 0xcf8 0x80001004
outl 0xcfc 0x1c77695e
writel 0xff000a8e00000040 0x1d00d815
write 0x1d 0x1 0x5c
write 0x2d 0x1 0x27
write 0x3d 0x1 0x2e
write 0xd 0x1 0x60
write 0x17232 0x1 0x03
write 0x17254 0x1 0x05
write 0x4d 0x1 0x5c
write 0x5d 0x1 0x27
write 0x60 0x1 0x2e
write 0x61 0x1 0x72
write 0x62 0x1 0x01
write 0x6d 0x1 0x2e
write 0x6f 0x1 0x01
writel 0xff000a8e00002000 0x0
writeq 0xff000a8e00002000 0x514ef0100000009
EOF
The trace: 5.565242: usb_xhci_ oper_write off 0x0000, val 0x1d00d815 5.565247: usb_xhci_ run 5.565252: usb_xhci_ irq_intx level 0 5.565377: usb_xhci_ doorbell_ write off 0x0000, val 0x00000000 5.565384: usb_xhci_ fetch_trb addr 0x0000000000000000, ???, p 0x0000000000000000, s 0x00000000, c 0x00006000 5.565390: usb_xhci_ unimplemented command (0x18) 5.565395: usb_xhci_ fetch_trb addr 0x0000000000000010, CR_NOOP, p 0x0000000000000000, s 0x00000000, c 0x00005c00 5.565399: usb_xhci_ fetch_trb addr 0x0000000000000020, CR_ENABLE_SLOT, p 0x0000000000000000, s 0x00000000, c 0x00002700 5.565403: usb_xhci_ slot_enable slotid 1 5.565406: usb_xhci_ fetch_trb addr 0x0000000000000030, CR_ADDRESS_DEVICE, p 0x0000000000000000, s 0x00000000, c 0x00002e00 5.565411: usb_xhci_ fetch_trb addr 0x0000000000000040, CR_NOOP, p 0x0000000000000000, s 0x00000000, c 0x00005c00 5.565416: usb_xhci_ fetch_trb addr 0x0000000000000050, CR_ENABLE_SLOT, p 0x0000000000000000, s 0x00000000, c 0x00002700 5.565421: usb_xhci_ slot_enable slotid 2 5.565423: usb_xhci_ fetch_trb addr 0x0000000000000060, CR_ADDRESS_DEVICE, p 0x000000000001722e, s 0x00000000, c 0x01002e00 5.565431: usb_xhci_ slot_address slotid 1, port 1 5.565436: usb_xhci_ ep_enable slotid 1, epid 1 5.565444: usb_xhci_ fetch_trb addr 0x0000000000000070, TRB_RESERVED, p 0x0000000000000000, s 0x00000000, c 0x00000000
[R +0.031152] writel 0xff000a8e00000040 0x1d00d815
26994@159712475
26994@159712475
26994@159712475
OK
[S +0.031173] OK
[R +0.031179] write 0x1d 0x1 0x5c
OK
[S +0.031190] OK
[R +0.031195] write 0x2d 0x1 0x27
OK
[S +0.031198] OK
[R +0.031203] write 0x3d 0x1 0x2e
OK
[S +0.031207] OK
[R +0.031211] write 0xd 0x1 0x60
OK
[S +0.031214] OK
[R +0.031219] write 0x17232 0x1 0x03
OK
[S +0.031224] OK
[R +0.031228] write 0x17254 0x1 0x05
OK
[S +0.031231] OK
[R +0.031236] write 0x4d 0x1 0x5c
OK
[S +0.031239] OK
[R +0.031244] write 0x5d 0x1 0x27
OK
[S +0.031247] OK
[R +0.031251] write 0x60 0x1 0x2e
OK
[S +0.031254] OK
[R +0.031259] write 0x61 0x1 0x72
OK
[S +0.031262] OK
[R +0.031267] write 0x62 0x1 0x01
OK
[S +0.031270] OK
[R +0.031275] write 0x6d 0x1 0x2e
OK
[S +0.031278] OK
[R +0.031282] write 0x6f 0x1 0x01
OK
[S +0.031286] OK
[R +0.031290] writel 0xff000a8e00002000 0x0
26994@159712475
26994@159712475
26994@159712475
26994@159712475
26994@159712475
26994@159712475
26994@159712475
26994@159712475
26994@159712475
26994@159712475
26994@159712475
26994@159712475
26994@159712475
26994@159712475
OK
[S +0.031365] OK
[R +0.031370] writeq 0xff000a8e00002000 0x514...