On 31/10/2026 04.37, Junjie Cao wrote:
xhci_address_slot() ignores the result of reading the slot's DCBAA entry. When that read fails the output context pointer is whatever the failed read left behind, zero for unassigned memory, so the slot and ep0 contexts land at guest address 0 and the command completes with Success.Log the failed read and raise HCE, as the context DMA helpers do, and return TRB Error, as Address Device already does for an unreadable input control context. xhci_die() only flags HCE and leaves the controller running; the HSE and halt of xHCI 1.2 section 4.10.2.6 are not added here. usb_xhci_post_load() reads the same entry; a failure there now disables the slot, as an unresolvable slot context already does. Fixes: 62c6ae04cf43 ("xhci: Initial xHCI implementation") Fixes: 37352df30fbc ("xhci: add live migration support") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4706 Cc: [email protected] Signed-off-by: Junjie Cao <[email protected]> --- hw/usb/hcd-xhci.c | 41 +++++++++++++++++++++++++++-------------- 1 file changed, 27 insertions(+), 14 deletions(-)
Reviewed-by: Thomas Huth <[email protected]>
