Real xHCI hardware stalls at Enable Slot because the command TRB is not visible to the controller when the doorbell is rung. QEMU auto-processes without requiring a barrier; real hardware needs explicit synchronization.
The fix
xhci.sg
MMIO read barrier before doorbell — adds an MMIO read (peek) from the doorbell register after writing the TRB and before ringing the doorbell. This enforces a memory barrier so the TRB is globally visible before the doorbell signals the controller. Real metal testing showed stall at stage 1 (Enable Slot) without the barrier. With this fix, the TRB arrives at the command processor and the completion event is delivered to the event ring.
Why QEMU hid this
QEMU's xHCI emulation processes command TRBs synchronously when the doorbell is written — no real DMA coherency window exists. On real hardware, the PCIe posted-write to the TRB ring may still be in a write buffer when the doorbell write arrives at the controller. The MMIO read forces the CPU to drain pending writes before proceeding.