Bug 841202 - Usb keyboard can't work after pass through it into guest
Usb keyboard can't work after pass through it into guest
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: qemu-kvm (Show other bugs)
6.3
x86_64 Linux
low Severity low
: rc
: ---
Assigned To: Gerd Hoffmann
Virtualization Bugs
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-07-18 08:10 EDT by Qingtang Zhou
Modified: 2013-09-29 21:32 EDT (History)
16 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-07-25 05:16:47 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
`lsusb -v` output on host (2.05 KB, text/plain)
2012-08-09 23:06 EDT, Qingtang Zhou
no flags Details
guest dmesg output (22.93 KB, text/plain)
2012-08-09 23:28 EDT, Qingtang Zhou
no flags Details
usb packet capture on host (795.86 KB, application/octet-stream)
2012-08-09 23:33 EDT, Qingtang Zhou
no flags Details
`lsusb -v` output for a worked kbd on host (1.99 KB, text/plain)
2012-08-10 07:20 EDT, Qingtang Zhou
no flags Details
usb packet capture for worked kbd on host (62.67 KB, application/octet-stream)
2012-08-10 07:24 EDT, Qingtang Zhou
no flags Details

  None (edit)
Description Qingtang Zhou 2012-07-18 08:10:21 EDT
Description of problem:
The physical usb keyboard can't work after passthrough it into guest. Though it can be found in `lsusb`, but there is no response in guest's terminal when press any key on it. 

I use tshark program (shipped with wireshark pkg) sniffer usb interface, and get nothing when press key on keyboard, only get following packets: (Detail info is pasted below)
"""
  0.000000         host -> 2.0          USB GET DESCRIPTOR Request DEVICE
  0.020053          2.0 -> host         USB GET DESCRIPTOR Response DEVICE
  0.020104         host -> 1.0          USB GET DESCRIPTOR Request DEVICE
  0.020105          1.0 -> host         USB GET DESCRIPTOR Response DEVICE
"""

Version-Release number of selected component (if applicable):
host:
# rpm -qa |grep qemu
qemu-kvm-0.12.1.2-2.295.el6.x86_64
qemu-guest-agent-0.12.1.2-2.295.el6.x86_64
qemu-kvm-tools-0.12.1.2-2.295.el6.x86_64
gpxe-roms-qemu-0.9.7-6.9.el6.noarch
qemu-img-0.12.1.2-2.295.el6.x86_64
# rpm -q kernel
kernel-2.6.32-279.el6.x86_64

guest kernel:
# rpm -q kernel
kernel-2.6.32-279.el6.x86_64

How reproducible:
100%


Steps to Reproduce:
1. Start vm with usb keyboard passthrough:
   qemu-kvm ... -device ich9-usb-uhci1,id=usb1,bus=pci.0 \
            -device usb-host,hostbus=6,hostaddr=3,bus=usb1.0 ...
2. Login to guest and check usb device with 'lsusb' (results pasted below)
3. Mount debugfs with cmd `mount -t debugfs / /sys/kernel/debug`
4. Run `tshark -Vi usbmon1` to sniffer usb packets.
5. Press keys on keyboard, bug occurs.
  
Actual results:


Expected results:


Additional info:
qemu-kvm cli:
/usr/libexec/qemu-kvm -name 'vm1' \
-chardev socket,id=qmp_monitor_id_qmp1,path=/tmp/qmp-TPw7,server,nowait \
-mon chardev=qmp_monitor_id_qmp1,mode=control \
-chardev socket,id=serial_id_TPw7,path=/tmp/serial-TPw7,server,nowait \
-device isa-serial,chardev=serial_id_TPw7 \
-device ich9-usb-uhci1,id=usb1,bus=pci.0 \
-drive file='RHEL-Server-6.3-64-virtio.qcow2',if=none,id=drive-virtio-disk1,media=disk,cache=none,boot=on,format=qcow2,aio=native \
-device virtio-blk-pci,bus=pci.0,addr=0x9,drive=drive-virtio-disk1,id=virtio-disk1 \
-m 4096 -smp 2,cores=1,threads=1,sockets=2 \
-cpu cpu64-rhel6,+sse2,+x2apic \
-rtc base=utc,clock=host,driftfix=slew \
-M rhel6.3.0 \
-boot order=cdn,once=c,menu=off \
-no-kvm-pit-reinjection \
-enable-kvm \
-device virtio-net-pci,netdev=net0,id=virtionet0,mac=00:11:22:33:44:55,bus=pci.0 \
-netdev tap,id=net0,vhost=on,fd=21 \
-vga qxl \
-spice port=8000,disable-ticketing \
-device usb-host,hostbus=6,hostaddr=3,bus=usb1.0

`lsusb` on host:
# lsusb
...
Bus 006 Device 003: ID 413c:2105 Dell Computer Corp. Model L100 Keyboard
...

`lsusb` on guest:
# lsusb
Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 002: ID 413c:2105 Dell Computer Corp. Model L100 Keyboard


Detail output of tshark program.
# tshark -Vi usbmon1
Running as user "root" and group "root". This could be dangerous.
Capturing on USB bus number 1
Frame 1 (24 bytes on wire, 24 bytes captured)
    Arrival Time: Jul 18, 2012 08:07:51.827729000
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 24 bytes
    Capture Length: 24 bytes
    [Frame is marked: False]
    [Protocols in frame: usb]
USB URB
    URB id: 0xffff8801194d03c0
    URB type: URB_SUBMIT ('S')
    URB transfer type: URB_CONTROL (2)
    Endpoint: 0x80
    Device: 2
    URB bus id: 1
    Device setup request: present (0)
    Data: not present ('<')
    URB status: Operation now in progress (-EINPROGRESS) (-115)
    URB length [bytes]: 40
    Data length [bytes]: 0
    [bInterfaceClass: Unknown (0xffff)]
    URB setup
        bmRequestType: 0x80
            1... .... = Direction: Device-to-host
            .00. .... = Type: Standard (0x00)
            ...0 0000 = Recipient: Device (0x00)
        bRequest: GET DESCRIPTOR (6)
        Descriptor Index: 0x00
        bDescriptorType: DEVICE (1)
        Language Id: no language specified (0x0000)
        wLength: 40

Frame 2 (50 bytes on wire, 50 bytes captured)
    Arrival Time: Jul 18, 2012 08:07:51.846895000
    [Time delta from previous captured frame: 0.019166000 seconds]
    [Time delta from previous displayed frame: 0.019166000 seconds]
    [Time since reference or first frame: 0.019166000 seconds]
    Frame Number: 2
    Frame Length: 50 bytes
    Capture Length: 50 bytes
    [Frame is marked: False]
    [Protocols in frame: usb]
USB URB
    URB id: 0xffff8801194d03c0
    URB type: URB_COMPLETE ('C')
    URB transfer type: URB_CONTROL (2)
    Endpoint: 0x80
    Device: 2
    URB bus id: 1
    Device setup request: not present ('-')
    Data: present (0)
    URB status: Success (0)
    URB length [bytes]: 26
    Data length [bytes]: 26
    [Request in: 1]
    [Time from request: 0.019166000 seconds]
    [bInterfaceClass: Unknown (0xffff)]
    DEVICE DESCRIPTOR
        bLength: 18
        bDescriptorType: DEVICE (1)
        bcdUSB: 0x0110
        bDeviceClass: 0
        bDeviceSubClass: 0
        bDeviceProtocol: 0
        bMaxPacketSize0: 8
        idVendor: 0x413c
        idProduct: 0x2105
        bcdDevice: 0x0352
        iManufacturer: 1
        iProduct: 2
        iSerialNumber: 0
        bNumConfigurations: 1
    Application Data: 9508810295017508

Frame 3 (24 bytes on wire, 24 bytes captured)
    Arrival Time: Jul 18, 2012 08:07:51.846945000
    [Time delta from previous captured frame: 0.000050000 seconds]
    [Time delta from previous displayed frame: 0.000050000 seconds]
    [Time since reference or first frame: 0.019216000 seconds]
    Frame Number: 3
    Frame Length: 24 bytes
    Capture Length: 24 bytes
    [Frame is marked: False]
    [Protocols in frame: usb]
USB URB
    URB id: 0xffff8801194d03c0
    URB type: URB_SUBMIT ('S')
    URB transfer type: URB_CONTROL (2)
    Endpoint: 0x80
    Device: 1
    URB bus id: 1
    Device setup request: present (0)
    Data: not present ('<')
    URB status: Operation now in progress (-EINPROGRESS) (-115)
    URB length [bytes]: 40
    Data length [bytes]: 0
    [bInterfaceClass: Unknown (0xffff)]
    URB setup
        bmRequestType: 0x80
            1... .... = Direction: Device-to-host
            .00. .... = Type: Standard (0x00)
            ...0 0000 = Recipient: Device (0x00)
        bRequest: GET DESCRIPTOR (6)
        Descriptor Index: 0x00
        bDescriptorType: DEVICE (1)
        Language Id: no language specified (0x0000)
        wLength: 40

Frame 4 (42 bytes on wire, 42 bytes captured)
    Arrival Time: Jul 18, 2012 08:07:51.846946000
    [Time delta from previous captured frame: 0.000001000 seconds]
    [Time delta from previous displayed frame: 0.000001000 seconds]
    [Time since reference or first frame: 0.019217000 seconds]
    Frame Number: 4
    Frame Length: 42 bytes
    Capture Length: 42 bytes
    [Frame is marked: False]
    [Protocols in frame: usb]
USB URB
    URB id: 0xffff8801194d03c0
    URB type: URB_COMPLETE ('C')
    URB transfer type: URB_CONTROL (2)
    Endpoint: 0x80
    Device: 1
    URB bus id: 1
    Device setup request: not present ('-')
    Data: present (0)
    URB status: Success (0)
    URB length [bytes]: 18
    Data length [bytes]: 18
    [Request in: 3]
    [Time from request: 0.000001000 seconds]
    [bInterfaceClass: Unknown (0xffff)]
    DEVICE DESCRIPTOR
        bLength: 18
        bDescriptorType: DEVICE (1)
        bcdUSB: 0x0110
        bDeviceClass: 9
        bDeviceSubClass: 0
        bDeviceProtocol: 0
        bMaxPacketSize0: 64
        idVendor: 0x1d6b
        idProduct: 0x0001
        bcdDevice: 0x0206
        iManufacturer: 3
        iProduct: 2
        iSerialNumber: 1
        bNumConfigurations: 1
Comment 2 Gerd Hoffmann 2012-08-09 05:11:10 EDT
Doesn't reproduce with a usb keyboard I have at hand here.

Can you attach the 'lsusb -v' output for the device please?
Can you attach the guest kernel log too?

tshark is neat, didn't know wireshark can decode usb too.
Can you try running it on the host while the guest boots up?
Comment 3 Qingtang Zhou 2012-08-09 23:06:16 EDT
Created attachment 603399 [details]
`lsusb -v` output on host
Comment 4 Qingtang Zhou 2012-08-09 23:28:05 EDT
Created attachment 603400 [details]
guest dmesg output
Comment 5 Qingtang Zhou 2012-08-09 23:33:52 EDT
Created attachment 603403 [details]
usb packet capture on host

Hi, Gerd,
I got more than 10k pkts when guest booting, so I have to attach the capture file directly. you can view it with 'wireshark' (>= 1.2.0) program.
This capture file contains all the usb pkts since guest start to I issue a 'lsusb' command in guest's terminal. 

(the usb kbd port number changed (from 3) to 5 after I tried serval times, sorry for it, a bit different from former log msg.)
Comment 6 Qingtang Zhou 2012-08-09 23:35:49 EDT
(In reply to comment #5)
> (the usb kbd port number changed (from 3) to 5 after I tried serval times,
> sorry for it, a bit different from former log msg.)
Oh, typo, serval -> several
Comment 7 Gerd Hoffmann 2012-08-10 06:34:53 EDT
Hmm, so there is a constant flow of URB_INTERRUPT messages?
Does this also happen when the guest is not running?
Does the keyboard work on the host?
Comment 8 Qingtang Zhou 2012-08-10 07:12:07 EDT
(In reply to comment #7)
> Hmm, so there is a constant flow of URB_INTERRUPT messages?
> Does this also happen when the guest is not running?
No, tshark won't get any pkts except I pressing some key on the keyboard.

> Does the keyboard work on the host?
Yes, it works when not passthrough into guest. After passthrough, it can't input anything on host or guest.
Comment 9 Qingtang Zhou 2012-08-10 07:20:03 EDT
Created attachment 603477 [details]
`lsusb -v` output for a worked kbd on host

Hi Gerd, 
I tried a HP kbd model 'KU-0316' productid '03f0:0024'. it works after passthrough into guest.
The new attachment is the lsusb info.
Comment 10 Qingtang Zhou 2012-08-10 07:24:02 EDT
Created attachment 603478 [details]
usb packet capture for worked kbd on host

This attachment is the capture file for the hp kbd, it only contains 700+ pkts, since guest start to I issue 'lsusb' cmd in a terminal.
Comment 11 Gerd Hoffmann 2012-08-10 08:15:20 EDT
Does the dell keyboard work in grub?
Comment 12 Qingtang Zhou 2012-08-10 08:25:59 EDT
(In reply to comment #11)
> Does the dell keyboard work in grub?
No, it doesn't work.
Comment 15 Ronen Hod 2013-07-25 05:16:47 EDT
Closing.
Unlikely to be fixed in RHEL6.
Please test with RHEL7, and file a new BZ

Note You need to log in before you can comment on or make changes to this bug.