Bug 929019

hit the same issue when i passthrough a USB2.0 and USB3.0 sticks to rehl7 guest using xHCI, the qemu will always core dump.
host info:
kernel-3.9.0-0.rc7.53.el7.x86_64
qemu-kvm-1.4.0-2.1.el7.x86_64
seabios-1.7.2-0.2.gita810e4e7.el7.x86_64
guest info:
kernel-3.9.0-0.rc7.53.el7.x86_64

# /usr/libexec/qemu-kvm -S -M q35 -cpu SandyBridge -enable-kvm...-device nec-usb-xhci,id=xhci0,bus=bridge1,addr=0x9 -device usb-host,hostbus=3,hostaddr=2,id=hostdev1,bus=xhci0.0 -device usb-host,hostbus=4,hostaddr=2,id=hostdev2,bus=xhci0.0

(qemu) info usb
  Device 0.0, Port 1, Speed 480 Mb/s, Product DT 101 G2
  Device 0.0, Port 2, Speed 5000 Mb/s, Product host:4.2
(qemu) 
(qemu) xhci_runtime_read: reg 0x4 unimplemented
xhci_runtime_read: reg 0x8 unimplemented
xhci_runtime_read: reg 0xc unimplemented
xhci_runtime_read: reg 0x10 unimplemented
xhci_runtime_read: reg 0x14 unimplemented
xhci_runtime_read: reg 0x18 unimplemented
xhci_runtime_read: reg 0x1c unimplemented
qemu-kvm: hw/usb/core.c:552: usb_packet_setup: Assertion `p->iov.iov != ((void *)0)' failed.
Aborted (core dumped)
(gdb) bt
#0  0x00007f310bfa9819 in raise () from /lib64/libc.so.6
#1  0x00007f310bfaaf28 in abort () from /lib64/libc.so.6
#2  0x00007f310bfa27f6 in __assert_fail_base () from /lib64/libc.so.6
#3  0x00007f310bfa28a2 in __assert_fail () from /lib64/libc.so.6
#4  0x00007f3111883018 in usb_packet_setup (p=p@entry=0x7f30feffc860, pid=pid@entry=225, ep=<optimized out>, 
    id=id@entry=0, short_not_ok=short_not_ok@entry=false, int_req=int_req@entry=false) at hw/usb/core.c:552
#5  0x00007f311189d899 in xhci_address_slot (bsr=<optimized out>, pictx=<optimized out>, slotid=2, xhci=0x7f30fcf0f010)
    at hw/usb/hcd-xhci.c:1979
#6  xhci_process_commands (xhci=0x7f30fcf0f010) at hw/usb/hcd-xhci.c:2326
#7  0x00007f3111976b62 in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7f30feffca40, 
    size=size@entry=4, access_size_min=<optimized out>, access_size_max=<optimized out>, access=access@entry=
    0x7f3111977120 <memory_region_write_accessor>, opaque=opaque@entry=0x7f30fcf0fa18)
    at /usr/src/debug/qemu-1.4.0/memory.c:364
#8  0x00007f311197bafb in memory_region_dispatch_write (size=4, data=0, addr=0, mr=0x7f30fcf0fa18)
    at /usr/src/debug/qemu-1.4.0/memory.c:916
#9  io_mem_write (mr=0x7f30fcf0fa18, addr=0, val=<optimized out>, size=<optimized out>)
    at /usr/src/debug/qemu-1.4.0/memory.c:1597
#10 0x00007f3111976b62 in access_with_adjusted_size (addr=addr@entry=0, value=value@entry=0x7f30feffcaf0, 
    size=size@entry=4, access_size_min=<optimized out>, access_size_max=<optimized out>, access=access@entry=
    0x7f3111977120 <memory_region_write_accessor>, opaque=opaque@entry=0x7f30f8007320)
    at /usr/src/debug/qemu-1.4.0/memory.c:364
#11 0x00007f311197bafb in memory_region_dispatch_write (size=4, data=0, addr=0, mr=0x7f30f8007320)
    at /usr/src/debug/qemu-1.4.0/memory.c:916
#12 io_mem_write (mr=0x7f30f8007320, addr=0, val=<optimized out>, size=size@entry=4)
    at /usr/src/debug/qemu-1.4.0/memory.c:1597
#13 0x00007f3111929e0d in address_space_rw (as=as@entry=0x7f3112667de0 <address_space_memory>, addr=4272168960, 
    buf=buf@entry=0x7f3111705028 <Address 0x7f3111705028 out of bounds>, len=4, is_write=true)
    at /usr/src/debug/qemu-1.4.0/exec.c:1893
#14 0x00007f3111929f05 in cpu_physical_memory_rw (addr=<optimized out>, buf=buf@entry=
    0x7f3111705028 <Address 0x7f3111705028 out of bounds>, len=<optimized out>, is_write=<optimized out>)
    at /usr/src/debug/qemu-1.4.0/exec.c:1975
#15 0x00007f3111974d55 in kvm_cpu_exec (env=env@entry=0x7f31133aa790) at /usr/src/debug/qemu-1.4.0/kvm-all.c:1590
#16 0x00007f3111921431 in qemu_kvm_cpu_thread_fn (arg=0x7f31133aa790) at /usr/src/debug/qemu-1.4.0/cpus.c:759
#17 0x00007f310f989c53 in start_thread () from /lib64/libpthread.so.0
#18 0x00007f310c068ecd in clone () from /lib64/libc.so.6
(gdb) q

Fixed by upstream commit a67188743bc30a3ad1358b8cd0a2a3cb64c10ff9.

Build in qemu-kvm-1.5.0-1.el7

Reroduce this on qemu-kvm-1.4.0-1.el7.x86_64.
step:
the same to comment #0.
result:
qemu core dump.

Verify this issue on qemu-kvm-1.5.1-1.el7.x86_64, it have no such for usb-storage with xhci controller, it can work well in guest.
but passthrough usb3.0 stick to guest with xhci controller still core dump, please refer to bug 980377.

host info:
3.10.0-0.rc7.64.el7.x86_64
qemu-kvm-1.5.1-1.el7.x86_64
guest info:
3.10.0-0.rc7.64.el7.x86_64

# /usr/libexec/qemu-kvm -M q35 -cpu SandyBridge -enable-kvm -m 4096 -smp 4,sockets=2,cores=2,threads=1 -no-kvm-pit-reinjection -name sluo -uuid 355a2475-4e03-4cdd-bf7b-5d6a59edaa61 -rtc base=localtime,clock=host,driftfix=slew -device pci-bridge,bus=pcie.0,id=bridge1,chassis_nr=1,addr=0x3 -device virtio-serial-pci,id=virtio-serial0,max_ports=16,vectors=0,bus=bridge1,addr=0x4 -chardev socket,id=channel1,path=/tmp/helloworld1,server,nowait -device virtserialport,chardev=channel1,name=com.redhat.rhevm.vdsm,bus=virtio-serial0.0,id=port1 -chardev socket,id=channel2,path=/tmp/helloworld2,server,nowait -device virtserialport,chardev=channel2,name=com.redhat.rhevm.vdsm,bus=virtio-serial0.0,id=port2 -drive file=/home/RHEL-7.0-20130628.0-Server-x86_64.qcow3,if=none,id=drive-system-disk,format=qcow2,cache=none,aio=native,werror=stop,rerror=stop,serial="QEMU-DISK1" -device virtio-scsi-pci,num_queues=4,id=scsi0,bus=bridge1,addr=0x5 -device scsi-hd,bus=scsi0.0,drive=drive-system-disk,id=system-disk,bootindex=1 -device virtio-balloon-pci,id=ballooning,bus=bridge1,addr=0x6 -global PIIX4_PM.disable_s3=0 -global PIIX4_PM.disable_s4=0 -netdev tap,id=hostnet0,vhost=on,queues=4,script=/etc/qemu-ifup -device virtio-net-pci,mq=on,vectors=17,netdev=hostnet0,id=virtio-net-pci0,mac=08:2e:5f:0a:0d:b1,bus=bridge1,addr=0x7,bootindex=2 -k en-us -boot menu=on -qmp tcp:0:4444,server,nowait -serial unix:/tmp/ttyS0,server,nowait -vnc :1 -spice port=5931,disable-ticketing -monitor stdio -device nec-usb-xhci,id=xhci,bus=bridge1,addr=0x8 -drive file=/home/my-usb-storage1.qcow3,if=none,id=storage0,media=disk,cache=none,format=qcow2 -device usb-storage,drive=storage0,id=usb-storage0,bus=xhci.0
(qemu) info block
drive-system-disk: removable=0 io-status=ok file=/home/RHEL-7.0-20130628.0-Server-x86_64.qcow3 ro=0 drv=qcow2 encrypted=0 bps=0 bps_rd=0 bps_wr=0 iops=0 iops_rd=0 iops_wr=0
storage0: removable=0 io-status=ok file=/home/my-usb-storage1.qcow3 ro=0 drv=qcow2 encrypted=0 bps=0 bps_rd=0 bps_wr=0 iops=0 iops_rd=0 iops_wr=0
ide1-cd0: removable=1 locked=0 tray-open=0 [not inserted]
floppy0: removable=1 locked=0 tray-open=0 [not inserted]
sd0: removable=1 locked=0 tray-open=0 [not inserted]
(qemu) 

Base on above, the simulation storage for xhci has been fixed correctly. so set this issue to verified status, please correct me if any mistake.

Best Regards,
sluo

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.