xhci_address_slot() ignores the result of reading the slot's DCBAA
entry. When that read fails the output context pointer is whatever the
failed read left behind, zero for unassigned memory, so the slot and
ep0 contexts land at guest address 0 and the command completes with
Success.
Log the failed read and raise HCE, as the context DMA helpers do, and
return TRB Error, as Address Device already does for an unreadable
input control context. xhci_die() only flags HCE and leaves the
controller running; the HSE and halt of xHCI 1.2 section 4.10.2.6 are
not added here.
usb_xhci_post_load() reads the same entry; a failure there now disables
the slot, as an unresolvable slot context already does.
Fixes: 62c6ae04cf43 ("xhci: Initial xHCI implementation")
Fixes: 37352df30fbc ("xhci: add live migration support")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4706
Cc: [email protected]
Signed-off-by: Junjie Cao <[email protected]>
---
hw/usb/hcd-xhci.c | 41 +++++++++++++++++++++++++++--------------
1 file changed, 27 insertions(+), 14 deletions(-)
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 5d7a77b8bc..b5cc1ad2ff 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -534,6 +534,23 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci,
dma_addr_t addr,
}
}
+static bool xhci_read_dcbaa(XHCIState *xhci, unsigned int slotid,
+ dma_addr_t *octx)
+{
+ dma_addr_t dcbaap = xhci_addr64(xhci->dcbaap_low, xhci->dcbaap_high);
+ uint64_t poctx;
+
+ if (ldq_le_dma(xhci->as, dcbaap + 8 * slotid, &poctx,
+ MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
+ __func__);
+ xhci_die(xhci);
+ return false;
+ }
+ *octx = xhci_mask64(poctx);
+ return true;
+}
+
static XHCIPort *xhci_lookup_port(XHCIState *xhci, struct USBPort *uport)
{
int index;
@@ -2103,8 +2120,7 @@ static TRBCCode xhci_address_slot(XHCIState *xhci,
unsigned int slotid,
XHCISlot *slot;
USBPort *uport;
USBDevice *dev;
- dma_addr_t ictx, octx, dcbaap;
- uint64_t poctx;
+ dma_addr_t ictx, octx;
uint32_t ictl_ctx[2];
uint32_t slot_ctx[4];
uint32_t ep0_ctx[5];
@@ -2113,10 +2129,10 @@ static TRBCCode xhci_address_slot(XHCIState *xhci,
unsigned int slotid,
assert(slotid >= 1 && slotid <= xhci->numslots);
- dcbaap = xhci_addr64(xhci->dcbaap_low, xhci->dcbaap_high);
- ldq_le_dma(xhci->as, dcbaap + 8 * slotid, &poctx, MEMTXATTRS_UNSPECIFIED);
+ if (!xhci_read_dcbaa(xhci, slotid, &octx)) {
+ return CC_TRB_ERROR;
+ }
ictx = xhci_mask64(pictx);
- octx = xhci_mask64(poctx);
DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx);
DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
@@ -3522,24 +3538,21 @@ static int usb_xhci_post_load(void *opaque, int
version_id)
XHCIState *xhci = opaque;
XHCISlot *slot;
XHCIEPContext *epctx;
- dma_addr_t dcbaap, pctx;
+ dma_addr_t pctx;
uint32_t slot_ctx[4];
uint32_t ep_ctx[5];
int slotid, epid, state;
- uint64_t addr;
-
- dcbaap = xhci_addr64(xhci->dcbaap_low, xhci->dcbaap_high);
for (slotid = 1; slotid <= xhci->numslots; slotid++) {
slot = &xhci->slots[slotid-1];
if (!slot->addressed) {
continue;
}
- ldq_le_dma(xhci->as, dcbaap + 8 * slotid, &addr,
MEMTXATTRS_UNSPECIFIED);
- slot->ctx = xhci_mask64(addr);
-
- xhci_dma_read_u32s(xhci, slot->ctx, slot_ctx, sizeof(slot_ctx));
- slot->uport = xhci_lookup_uport(xhci, slot_ctx);
+ slot->uport = NULL;
+ if (xhci_read_dcbaa(xhci, slotid, &slot->ctx)) {
+ xhci_dma_read_u32s(xhci, slot->ctx, slot_ctx, sizeof(slot_ctx));
+ slot->uport = xhci_lookup_uport(xhci, slot_ctx);
+ }
if (!slot->uport) {
/* should not happen, but may trigger on guest bugs */
slot->enabled = 0;
--
2.43.0
