Page MenuHomeFreeBSD

Prevent calling USB backends multiple times.

Authored by grehan on Jun 11 2020, 9:58 AM.



The TRB processing loop could potentially call a back-end twice
with the same status transaction. While this was generally benign,
some code paths in the tablet backend weren't set up to handle
this case, resulting in a NULL dereference.

Fix by

  • returning a STALL error when an invalid request was seen in the backend
  • skipping a call to the backend if the number of packets in a status transaction was zero (this code fragment was taken from the Intel ACRN xhci backend)

The NULL dereferences will be fixed in a follow-up commit.

Discussed with/Reviewed by: Leon Dang (author)

Test Plan

Boot up a Linux guest with XHCI table configured; run 'lsusb -v' and
verify command complets.

Boot Linux/Windows guests in graphics mode with XHCI tablet and verify
mouse works as expected.

Diff Detail

rS FreeBSD src repository - subversion
Automatic diff as part of commit; lint not applicable.
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

jhb added inline comments.
1863 ↗(On Diff #72973)

So if I'm understanding correctly, STALL means "non-fatal error, return partial results from previous completed commands" whereas IOERROR is supposed to mean "the entire transaction failed without any results"?

1863 ↗(On Diff #72973)

For control transfers that's really the only signalled error return e.g. for unimplemented requests to the device ("9.2.7 Request Error" in the USB3.0 spec, and also qemu backend code).

IOERROR would be if a device goes dead during a transfer.

These aren't currently propagated but I'm hoping to do that in an upcoming rework.

This revision is now accepted and ready to land.Jun 24 2020, 4:46 PM
This revision was automatically updated to reflect the committed changes.