Page MenuHomeFreeBSD

Prevent calling USB backends multiple times.
ClosedPublic

Authored by grehan on Jun 11 2020, 9:58 AM.

Details

Summary

The TRB processing loop could potentially call a back-end twice
with the same status transaction. While this was generally benign,
some code paths in the tablet backend weren't set up to handle
this case, resulting in a NULL dereference.

Fix by

  • returning a STALL error when an invalid request was seen in the backend
  • skipping a call to the backend if the number of packets in a status transaction was zero (this code fragment was taken from the Intel ACRN xhci backend)

The NULL dereferences will be fixed in a follow-up commit.

Discussed with/Reviewed by: Leon Dang (author)

Test Plan

Boot up a Linux guest with XHCI table configured; run 'lsusb -v' and
verify command complets.

Boot Linux/Windows guests in graphics mode with XHCI tablet and verify
mouse works as expected.

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

grehan created this revision.Jun 11 2020, 9:58 AM
grehan requested review of this revision.Jun 11 2020, 9:58 AM
jhb added a subscriber: jhb.Jun 11 2020, 4:52 PM
jhb added inline comments.
usr.sbin/bhyve/pci_xhci.c
1863 ↗(On Diff #72973)

So if I'm understanding correctly, STALL means "non-fatal error, return partial results from previous completed commands" whereas IOERROR is supposed to mean "the entire transaction failed without any results"?

grehan added inline comments.Jun 11 2020, 11:05 PM
usr.sbin/bhyve/pci_xhci.c
1863 ↗(On Diff #72973)

For control transfers that's really the only signalled error return e.g. for unimplemented requests to the device ("9.2.7 Request Error" in the USB3.0 spec, and also qemu backend code).

IOERROR would be if a device goes dead during a transfer.

These aren't currently propagated but I'm hoping to do that in an upcoming rework.

jhb accepted this revision.Jun 24 2020, 4:46 PM
This revision is now accepted and ready to land.Jun 24 2020, 4:46 PM
This revision was automatically updated to reflect the committed changes.