From nobody Mon Sep 28 00:33:13 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1790108990; cv=none; d=zohomail.com; s=zohoarc; b=H47m95ZURFLLfx8KcoFCoHtkPkVeksPJN+BC95DkQczloJFr2ExwTpsXIgEtYmJgtHdubC7lF/195sPMCqLq2oMdixXi8Dt3d07IrOfieAZ0VYAppu2wG83SqKwhTlLRZ4+Vxx7BUtKIrcwPz1Lwfr0vRaMaJcrLtaWDWOK0hfg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790108990; h=Content-Transfer-Encoding:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=rEWdIdJG8RbbtmT1wmZXZYg7ZGmBrN4LDgwi9RdvQt4=; b=EJvqVr4bW27ggCJVdbXxPymXQPxyhEYol09/Ebi0w0IkFNGHlBfL1efezsRNR47BbWvL7bs6fg5Qn6QtGfiOE35tqcmrPzD8DhQvilL0ZfWeuF/3u7XEpBeGuUSsGVup4TZOOelyo4KUzSWCNmbF9yTC+jnHQwnXze2unP7jOHw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790108990322384.6030324496586; Tue, 22 Sep 2026 13:29:50 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x974h-0004z5-Br; Tue, 22 Sep 2026 16:26:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x972N-0001Ks-Fj for qemu-devel@nongnu.org; Tue, 22 Sep 2026 16:24:26 -0400 Received: from mgamail.intel.com ([192.198.163.17]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x972L-0000ag-6o for qemu-devel@nongnu.org; Tue, 22 Sep 2026 16:24:23 -0400 Received: from fmviesa010.fm.intel.com ([10.60.135.150]) by fmvoesa111.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 22 Sep 2026 13:24:13 -0700 Received: from dongwonk-z390-aorus-ultra.fm.intel.com ([10.80.113.172]) by fmviesa010.fm.intel.com with ESMTP; 22 Sep 2026 13:24:13 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1790108661; x=1821644661; h=from:to:subject:date:message-id:mime-version: content-transfer-encoding; bh=YyqRli4H608p1b8QxUUSqcO1vhTHgaeHPORppEXci70=; b=elOzSlwJchgkhm1HvaJflAMhR8Ismg4q8Y0omaw4snGmJ7tB3er9P/gv IILvrYIL/wTfrWVOvfJktX5UEwzAC/rioIVpv21fNLwyVo3TsPlWTb8Is 56zP61/UdyKqW7r4P46DiQAlYHMY331+Nuw8bP5a4DZtG38tHbtatf7cK h5mcti3FA0KTMAHqMiCLYpa1byqOh6rPI4SGvolttTmaU9z98H08weMg2 slIsTCNFsYe8sH8nzZSFVtWrWGYOh5IJ3+ePWSYsK4iUdg+3rvLlTs4Ug 78Ho5JG5gIdl8Uy+so3tYbmyjqzXFkxzGpAapQ3tdVvkHp/Q8W78M30oB A==; X-CSE-ConnectionGUID: Rf6esumvSKKjR/fE0S4u1g== X-CSE-MsgGUID: P5DyqKevTr6aizMLNDA5ag== X-IronPort-AV: E=McAfee;i="6800,10657,11913"; a="90619546" X-IronPort-AV: E=Sophos;i="6.27,117,1787036400"; d="scan'208";a="90619546" X-CSE-ConnectionGUID: HgTZd+/ERFmFbTC+KZ1Zlg== X-CSE-MsgGUID: RKtwJdw2S/W5LgY7k+Hvww== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.27,117,1787036400"; d="scan'208";a="272487006" From: dongwon.kim@intel.com To: qemu-devel@nongnu.org Subject: [PATCH] hw/usb/hcd-xhci: Clamp overshot isochronous kick time Date: Wed, 12 Aug 2026 03:43:10 -0700 Message-Id: <20260812104310.38292-1-dongwon.kim@intel.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=192.198.163.17; envelope-from=dongwon.kim@intel.com; helo=mgamail.intel.com X-Spam_score_int: -9 X-Spam_score: -1.0 X-Spam_bar: - X-Spam_report: (-1.0 / 5.0 requ) BAYES_00=-1.9, DATE_IN_PAST_96_XX=3.405, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_NONE=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @intel.com) X-ZM-MESSAGEID: 1790108990880158500 Content-Type: text/plain; charset="utf-8" From: "Chew, Tong Liang" When an isochronous transfer's Frame ID is reconstructed from the current MFINDEX epoch, a delayed I/O thread can make the selected frame appear to be in the past. The existing recovery advances the kick by one MFINDEX epoch, which can place the transfer roughly two seconds in the future. The xHCI specification allows a Frame ID to be scheduled only up to 895 ms (0x1BF8 microframes) ahead of the current MFINDEX. Clamp an epoch-adjusted kick beyond that range to the current MFINDEX so the missed transfer is dispatched immediately instead of waiting for the kick timer. Signed-off-by: Tong Liang Chew Signed-off-by: Dongwon Kim --- hw/usb/hcd-xhci.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index d342aa2739..0642b5dc4f 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -1763,12 +1763,30 @@ static void xhci_calc_iso_kick(XHCIState *xhci, XHC= ITransfer *xfer, xfer->mfindex_kick =3D asap; } } else { - xfer->mfindex_kick =3D ((xfer->trbs[0].control >> TRB_TR_FRAMEID_S= HIFT) - & TRB_TR_FRAMEID_MASK) << 3; + uint32_t frame_id =3D (xfer->trbs[0].control >> TRB_TR_FRAMEID_SHI= FT) + & TRB_TR_FRAMEID_MASK; + xfer->mfindex_kick =3D (uint64_t)frame_id << 3; xfer->mfindex_kick |=3D mfindex & ~0x3fff; if (xfer->mfindex_kick + 0x100 < mfindex) { xfer->mfindex_kick +=3D 0x4000; } + /* + * Guard against epoch-advance overshoot: when the IO thread is br= iefly + * delayed, mfindex can advance past frame_kick by more than the 0= x100 + * lookahead threshold above. Adding 0x4000 then places mfindex_ki= ck + * ~2 seconds into the future, stalling all isochronous transfers = until + * the kick timer fires (observed as periodic ~2.1 s USB audio/vid= eo + * stalls). + * + * Per xHCI specification section 4.11.2.5, a Frame ID is valid on= ly + * up to 895 ms (0x1BF8 microframes) ahead of the current MFINDEX.= If + * epoch reconstruction places the kick beyond that range, clamp it + * to the current MFINDEX so the missed transfer is dispatched + * immediately instead of stalling. + */ + if (xfer->mfindex_kick > mfindex + 0x1BF8) { + xfer->mfindex_kick =3D mfindex; + } } } =20 @@ -1776,8 +1794,9 @@ static void xhci_check_intr_iso_kick(XHCIState *xhci,= XHCITransfer *xfer, XHCIEPContext *epctx, uint64_t mfinde= x) { if (xfer->mfindex_kick > mfindex) { + uint64_t delay_mf =3D xfer->mfindex_kick - mfindex; timer_mod(epctx->kick_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)= + - (xfer->mfindex_kick - mfindex) * 125000); + delay_mf * 125000); xfer->running_retry =3D 1; } else { epctx->mfindex_last =3D xfer->mfindex_kick; --=20 2.43.0