G.4 (2h): bounded xHCI event-ring drain fixes boot-attach livelock

Root cause of the G.1 follow-up boot-time attach race: on pathological
controller behavior the xhci_poll_events() drain loop had no hard ceiling.
ERDP is written back only when the loop exits, so the controller cannot
reclaim event TRBs mid-drain; if it keeps producing events the head can
chase the software dequeue pointer forever. xhci_poll_events() never returns,
sk_repl_idle() never reaches its bot_msc_attach_pending check, and a fresh
USB BOT device that finished SET_CONFIGURATION is left flagged-but-never-
attached while the guest appears hung.

Fix: bound the drain to a full ring (XHCI_EVT_RING_MAX_DRAIN = 256), so
xhci_poll_events() always terminates and always writes ERDP each call.
Unprocessed events keep their cycle bit and are re-read next poll; nothing
is dropped. On the healthy path one drain processes only the one-or-few
events the controller posts per chained command, so the bound never triggers
except in the pathological case it breaks.

Beyond the G.1 additions: a new macro in include/starkernel/xhci.h and a
bounded loop in src/starkernel/usb/xhci.c. Builds clean on amd64. Verified
across six consecutive fresh QEMU boots (previously intermittently hung).

This commit is contained in:

Robert Allan James

2026-08-29 09:48:48 -04:00

parent 49a3faa331

commit dc2f38a1e1

5 changed files with 31 additions and 7 deletions

									
										capsules/BLOCK_MAP.md
									
		+1
		-1
	
												View File
												
				@@ -1,5 +1,5 @@

				# Capsule Block Manifest — Auto-generated

				<!-- Generated by mkcapsule --manifest  2026-08-29T04:57:27Z -->

				<!-- Generated by mkcapsule --manifest  2026-08-29T13:48:09Z -->

				<!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->

				<!-- Hand-written justifications and immutability notes live  -->

				<!-- in MANIFEST.md alongside this auto-generated index.      -->