RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 841202 - Usb keyboard can't work after pass through it into guest
Summary: Usb keyboard can't work after pass through it into guest
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: qemu-kvm
Version: 6.3
Hardware: x86_64
OS: Linux
low
low
Target Milestone: rc
: ---
Assignee: Gerd Hoffmann
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-07-18 12:10 UTC by Qingtang Zhou
Modified: 2013-09-30 01:32 UTC (History)
16 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-07-25 09:16:47 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
`lsusb -v` output on host (2.05 KB, text/plain)
2012-08-10 03:06 UTC, Qingtang Zhou 		no flags Details
guest dmesg output (22.93 KB, text/plain)
2012-08-10 03:28 UTC, Qingtang Zhou 		no flags Details
usb packet capture on host (795.86 KB, application/octet-stream)
2012-08-10 03:33 UTC, Qingtang Zhou 		no flags Details
`lsusb -v` output for a worked kbd on host (1.99 KB, text/plain)
2012-08-10 11:20 UTC, Qingtang Zhou 		no flags Details
usb packet capture for worked kbd on host (62.67 KB, application/octet-stream)
2012-08-10 11:24 UTC, Qingtang Zhou 		no flags Details
View All

Description Qingtang Zhou 2012-07-18 12:10:21 UTC 
Description of problem:
The physical usb keyboard can't work after passthrough it into guest. Though it can be found in `lsusb`, but there is no response in guest's terminal when press any key on it. 

I use tshark program (shipped with wireshark pkg) sniffer usb interface, and get nothing when press key on keyboard, only get following packets: (Detail info is pasted below)
"""
  0.000000         host -> 2.0          USB GET DESCRIPTOR Request DEVICE
  0.020053          2.0 -> host         USB GET DESCRIPTOR Response DEVICE
  0.020104         host -> 1.0          USB GET DESCRIPTOR Request DEVICE
  0.020105          1.0 -> host         USB GET DESCRIPTOR Response DEVICE
"""

Version-Release number of selected component (if applicable):
host:
# rpm -qa |grep qemu
qemu-kvm-0.12.1.2-2.295.el6.x86_64
qemu-guest-agent-0.12.1.2-2.295.el6.x86_64
qemu-kvm-tools-0.12.1.2-2.295.el6.x86_64
gpxe-roms-qemu-0.9.7-6.9.el6.noarch
qemu-img-0.12.1.2-2.295.el6.x86_64
# rpm -q kernel
kernel-2.6.32-279.el6.x86_64

guest kernel:
# rpm -q kernel
kernel-2.6.32-279.el6.x86_64

How reproducible:
100%


Steps to Reproduce:
1. Start vm with usb keyboard passthrough:
   qemu-kvm ... -device ich9-usb-uhci1,id=usb1,bus=pci.0 \
            -device usb-host,hostbus=6,hostaddr=3,bus=usb1.0 ...
2. Login to guest and check usb device with 'lsusb' (results pasted below)
3. Mount debugfs with cmd `mount -t debugfs / /sys/kernel/debug`
4. Run `tshark -Vi usbmon1` to sniffer usb packets.
5. Press keys on keyboard, bug occurs.
  
Actual results:


Expected results:


Additional info:
qemu-kvm cli:
/usr/libexec/qemu-kvm -name 'vm1' \
-chardev socket,id=qmp_monitor_id_qmp1,path=/tmp/qmp-TPw7,server,nowait \
-mon chardev=qmp_monitor_id_qmp1,mode=control \
-chardev socket,id=serial_id_TPw7,path=/tmp/serial-TPw7,server,nowait \
-device isa-serial,chardev=serial_id_TPw7 \
-device ich9-usb-uhci1,id=usb1,bus=pci.0 \
-drive file='RHEL-Server-6.3-64-virtio.qcow2',if=none,id=drive-virtio-disk1,media=disk,cache=none,boot=on,format=qcow2,aio=native \
-device virtio-blk-pci,bus=pci.0,addr=0x9,drive=drive-virtio-disk1,id=virtio-disk1 \
-m 4096 -smp 2,cores=1,threads=1,sockets=2 \
-cpu cpu64-rhel6,+sse2,+x2apic \
-rtc base=utc,clock=host,driftfix=slew \
-M rhel6.3.0 \
-boot order=cdn,once=c,menu=off \
-no-kvm-pit-reinjection \
-enable-kvm \
-device virtio-net-pci,netdev=net0,id=virtionet0,mac=00:11:22:33:44:55,bus=pci.0 \
-netdev tap,id=net0,vhost=on,fd=21 \
-vga qxl \
-spice port=8000,disable-ticketing \
-device usb-host,hostbus=6,hostaddr=3,bus=usb1.0

`lsusb` on host:
# lsusb
...
Bus 006 Device 003: ID 413c:2105 Dell Computer Corp. Model L100 Keyboard
...

`lsusb` on guest:
# lsusb
Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 002: ID 413c:2105 Dell Computer Corp. Model L100 Keyboard


Detail output of tshark program.
# tshark -Vi usbmon1
Running as user "root" and group "root". This could be dangerous.
Capturing on USB bus number 1
Frame 1 (24 bytes on wire, 24 bytes captured)
    Arrival Time: Jul 18, 2012 08:07:51.827729000
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 24 bytes
    Capture Length: 24 bytes
    [Frame is marked: False]
    [Protocols in frame: usb]
USB URB
    URB id: 0xffff8801194d03c0
    URB type: URB_SUBMIT ('S')
    URB transfer type: URB_CONTROL (2)
    Endpoint: 0x80
    Device: 2
    URB bus id: 1
    Device setup request: present (0)
    Data: not present ('<')
    URB status: Operation now in progress (-EINPROGRESS) (-115)
    URB length [bytes]: 40
    Data length [bytes]: 0
    [bInterfaceClass: Unknown (0xffff)]
    URB setup
        bmRequestType: 0x80
            1... .... = Direction: Device-to-host
            .00. .... = Type: Standard (0x00)
            ...0 0000 = Recipient: Device (0x00)
        bRequest: GET DESCRIPTOR (6)
        Descriptor Index: 0x00
        bDescriptorType: DEVICE (1)
        Language Id: no language specified (0x0000)
        wLength: 40

Frame 2 (50 bytes on wire, 50 bytes captured)
    Arrival Time: Jul 18, 2012 08:07:51.846895000
    [Time delta from previous captured frame: 0.019166000 seconds]
    [Time delta from previous displayed frame: 0.019166000 seconds]
    [Time since reference or first frame: 0.019166000 seconds]
    Frame Number: 2
    Frame Length: 50 bytes
    Capture Length: 50 bytes
    [Frame is marked: False]
    [Protocols in frame: usb]
USB URB
    URB id: 0xffff8801194d03c0
    URB type: URB_COMPLETE ('C')
    URB transfer type: URB_CONTROL (2)
    Endpoint: 0x80
    Device: 2
    URB bus id: 1
    Device setup request: not present ('-')
    Data: present (0)
    URB status: Success (0)
    URB length [bytes]: 26
    Data length [bytes]: 26
    [Request in: 1]
    [Time from request: 0.019166000 seconds]
    [bInterfaceClass: Unknown (0xffff)]
    DEVICE DESCRIPTOR
        bLength: 18
        bDescriptorType: DEVICE (1)
        bcdUSB: 0x0110
        bDeviceClass: 0
        bDeviceSubClass: 0
        bDeviceProtocol: 0
        bMaxPacketSize0: 8
        idVendor: 0x413c
        idProduct: 0x2105
        bcdDevice: 0x0352
        iManufacturer: 1
        iProduct: 2
        iSerialNumber: 0
        bNumConfigurations: 1
    Application Data: 9508810295017508

Frame 3 (24 bytes on wire, 24 bytes captured)
    Arrival Time: Jul 18, 2012 08:07:51.846945000
    [Time delta from previous captured frame: 0.000050000 seconds]
    [Time delta from previous displayed frame: 0.000050000 seconds]
    [Time since reference or first frame: 0.019216000 seconds]
    Frame Number: 3
    Frame Length: 24 bytes
    Capture Length: 24 bytes
    [Frame is marked: False]
    [Protocols in frame: usb]
USB URB
    URB id: 0xffff8801194d03c0
    URB type: URB_SUBMIT ('S')
    URB transfer type: URB_CONTROL (2)
    Endpoint: 0x80
    Device: 1
    URB bus id: 1
    Device setup request: present (0)
    Data: not present ('<')
    URB status: Operation now in progress (-EINPROGRESS) (-115)
    URB length [bytes]: 40
    Data length [bytes]: 0
    [bInterfaceClass: Unknown (0xffff)]
    URB setup
        bmRequestType: 0x80
            1... .... = Direction: Device-to-host
            .00. .... = Type: Standard (0x00)
            ...0 0000 = Recipient: Device (0x00)
        bRequest: GET DESCRIPTOR (6)
        Descriptor Index: 0x00
        bDescriptorType: DEVICE (1)
        Language Id: no language specified (0x0000)
        wLength: 40

Frame 4 (42 bytes on wire, 42 bytes captured)
    Arrival Time: Jul 18, 2012 08:07:51.846946000
    [Time delta from previous captured frame: 0.000001000 seconds]
    [Time delta from previous displayed frame: 0.000001000 seconds]
    [Time since reference or first frame: 0.019217000 seconds]
    Frame Number: 4
    Frame Length: 42 bytes
    Capture Length: 42 bytes
    [Frame is marked: False]
    [Protocols in frame: usb]
USB URB
    URB id: 0xffff8801194d03c0
    URB type: URB_COMPLETE ('C')
    URB transfer type: URB_CONTROL (2)
    Endpoint: 0x80
    Device: 1
    URB bus id: 1
    Device setup request: not present ('-')
    Data: present (0)
    URB status: Success (0)
    URB length [bytes]: 18
    Data length [bytes]: 18
    [Request in: 3]
    [Time from request: 0.000001000 seconds]
    [bInterfaceClass: Unknown (0xffff)]
    DEVICE DESCRIPTOR
        bLength: 18
        bDescriptorType: DEVICE (1)
        bcdUSB: 0x0110
        bDeviceClass: 9
        bDeviceSubClass: 0
        bDeviceProtocol: 0
        bMaxPacketSize0: 64
        idVendor: 0x1d6b
        idProduct: 0x0001
        bcdDevice: 0x0206
        iManufacturer: 3
        iProduct: 2
        iSerialNumber: 1
        bNumConfigurations: 1
Comment 2 Gerd Hoffmann 2012-08-09 09:11:10 UTC 
Doesn't reproduce with a usb keyboard I have at hand here.

Can you attach the 'lsusb -v' output for the device please?
Can you attach the guest kernel log too?

tshark is neat, didn't know wireshark can decode usb too.
Can you try running it on the host while the guest boots up?
Comment 3 Qingtang Zhou 2012-08-10 03:06:16 UTC 
Created attachment 603399 [details]
`lsusb -v` output on host
Comment 4 Qingtang Zhou 2012-08-10 03:28:05 UTC 
Created attachment 603400 [details]
guest dmesg output
Comment 5 Qingtang Zhou 2012-08-10 03:33:52 UTC 
Created attachment 603403 [details]
usb packet capture on host

Hi, Gerd,
I got more than 10k pkts when guest booting, so I have to attach the capture file directly. you can view it with 'wireshark' (>= 1.2.0) program.
This capture file contains all the usb pkts since guest start to I issue a 'lsusb' command in guest's terminal. 

(the usb kbd port number changed (from 3) to 5 after I tried serval times, sorry for it, a bit different from former log msg.)
Comment 6 Qingtang Zhou 2012-08-10 03:35:49 UTC 
(In reply to comment #5)
> (the usb kbd port number changed (from 3) to 5 after I tried serval times,
> sorry for it, a bit different from former log msg.)
Oh, typo, serval -> several
Comment 7 Gerd Hoffmann 2012-08-10 10:34:53 UTC 
Hmm, so there is a constant flow of URB_INTERRUPT messages?
Does this also happen when the guest is not running?
Does the keyboard work on the host?
Comment 8 Qingtang Zhou 2012-08-10 11:12:07 UTC 
(In reply to comment #7)
> Hmm, so there is a constant flow of URB_INTERRUPT messages?
> Does this also happen when the guest is not running?
No, tshark won't get any pkts except I pressing some key on the keyboard.

> Does the keyboard work on the host?
Yes, it works when not passthrough into guest. After passthrough, it can't input anything on host or guest.
Comment 9 Qingtang Zhou 2012-08-10 11:20:03 UTC 
Created attachment 603477 [details]
`lsusb -v` output for a worked kbd on host

Hi Gerd, 
I tried a HP kbd model 'KU-0316' productid '03f0:0024'. it works after passthrough into guest.
The new attachment is the lsusb info.
Comment 10 Qingtang Zhou 2012-08-10 11:24:02 UTC 
Created attachment 603478 [details]
usb packet capture for worked kbd on host

This attachment is the capture file for the hp kbd, it only contains 700+ pkts, since guest start to I issue 'lsusb' cmd in a terminal.
Comment 11 Gerd Hoffmann 2012-08-10 12:15:20 UTC 
Does the dell keyboard work in grub?
Comment 12 Qingtang Zhou 2012-08-10 12:25:59 UTC 
(In reply to comment #11)
> Does the dell keyboard work in grub?
No, it doesn't work.
Comment 15 Ronen Hod 2013-07-25 09:16:47 UTC 
Closing.
Unlikely to be fixed in RHEL6.
Please test with RHEL7, and file a new BZ
Note You need to log in before you can comment on or make changes to this bug.