All of lore.kernel.org
 help / color / mirror / Atom feed
* ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1
@ 2020-06-20 19:19 Fabian Melzow
  2020-06-29 17:47 ` Mathias Nyman
  0 siblings, 1 reply; 10+ messages in thread
From: Fabian Melzow @ 2020-06-20 19:19 UTC (permalink / raw)
  To: linux-usb

Hi folks!

I have got a Canon LiDE 20 flatbed scanner (
ID 04a9:220d Canon, Inc. CanoScan N670U/N676U/LiDE 20).

When I power up my PC and plug it in everything is fine, until I try to
access it, and if it is only a "scanimage -L".

To demonstrate the bug, I wrote a shell script (scandebug.sh) using
some debugging hints from
https://bugzilla.kernel.org/show_bug.cgi?id=202541
which seems related to this bug.

#! /bin/bash
echo 'module xhci_* =p' >/sys/kernel/debug/dynamic_debug/control
echo 'module usbcore =p' >/sys/kernel/debug/dynamic_debug/control
echo 81920 > /sys/kernel/debug/tracing/buffer_size_kb
echo 1 > /sys/kernel/debug/tracing/events/xhci-hcd/enable
echo Plug in scanner...
sleep 20
echo Now doing first scanimage -L ...
logger "Now doing first scanimage -L ..."
time scanimage -L
dmesg >/root/dmesg1.txt
cp /sys/kernel/debug/tracing/trace /root/trace1.txt
echo Now doing second scanimage -L ...
logger "Now doing second scanimage -L ..."
time scanimage -L
dmesg >/root/dmesg2.txt
cp /sys/kernel/debug/tracing/trace /root/trace2.txt
lsusb -v >/root/lsusb.txt
echo "module * =_" > /sys/kernel/debug/dynamic_debug/control
echo 0 > /sys/kernel/debug/tracing/events/xhci-hcd/enable

When it runs it outputs:

[root@ping ~]# ./scandebug.sh
Plug in scanner...
Now doing first scanimage -L ...
device `plustek:libusb:001:002' is a Canon CanoScan N670U/N676U/LiDE20
flatbed scanner

real    0m45,313s
user    0m0,036s
sys     0m0,067s
Now doing second scanimage -L ...
device `plustek:libusb:001:002' is a Canon CanoScan N670U/N676U/LiDE20
flatbed scanner

real    0m4,165s
user    0m0,044s
sys     0m0,070s

As you can see, the first scanimage takes very long, in other tries it
takes at least 25 seconds, while the second and any further always take
around 4 s.

After running the first scanimage I get the following errors/warnings:

Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Successful Set TR Deq Ptr cmd, deq = @d7615080
Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Set TR Deq Ptr cmd, new deq seg = 00000000de74ec7f (0xd7615000 dma), new deq ptr = 00000000ff17b5e1 (0xd7615080 dma), new cycle = 1
Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: New dequeue pointer = 0xd7615080 (DMA)
Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: New dequeue segment = 00000000de74ec7f (virtual)
Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Cycle state = 0x1
Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Finding endpoint context
Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Removing canceled TD starting at 0xd7615070 (dma).
Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Stopped on Transfer TRB for slot 1 ep 4
Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Cancel URB 00000000fa372bb8, dev 3, ep 0x82, starting at offset 0xd7615070
Jun 20 19:41:55 ping kernel: xhci_hcd 0000:01:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x000d address=0xdc707028 flags=0x0020]
Jun 20 19:41:55 ping kernel: xhci_hcd 0000:01:00.0: Looking for event-dma 00000000d7615060 trb-start 00000000d7615070 trb-end 00000000d7615070 seg-start 00000000d7615000 seg-end 00000000d7615ff0
Jun 20 19:41:55 ping kernel: xhci_hcd 0000:01:00.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1
Jun 20 19:41:55 ping kernel: xhci_hcd 0000:01:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x000d address=0xc9b4c730 flags=0x0020]
Jun 20 19:41:55 ping kernel: xhci_hcd 0000:01:00.0: ep 0x82 - asked for 1 bytes, 0 bytes untransferred
Jun 20 19:41:55 ping kernel: xhci_hcd 0000:01:00.0: WARN Successful completion on short TX
Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: Slot state = 3, EP state = 2
Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: WARN Set TR Deq Ptr cmd failed due to incorrect slot or ep state.
Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: Set TR Deq Ptr cmd, new deq seg = 00000000de74ec7f (0xd7615000 dma), new deq ptr = 00000000f035f701 (0xd7615060 dma), new cycle = 1
Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: New dequeue pointer = 0xd7615060 (DMA)
Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: New dequeue segment = 00000000de74ec7f (virtual)
Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: Cycle state = 0x1
Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: Finding endpoint context
Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: Removing canceled TD starting at 0xd7615050 (dma).
Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: Cancel URB 000000002fee127b, dev 3, ep 0x82, starting at offset 0xd7615050


After the second scanimage -L I got no errors or warnings:

Jun 20 19:42:33 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
Jun 20 19:42:33 ping kernel: xhci_hcd 0000:09:00.3: Cancel URB 00000000e5885748, dev 2, ep 0x0, starting at offset 0xfedf51c0
Jun 20 19:42:28 ping kernel: xhci_hcd 0000:09:00.3: Successful Set TR Deq Ptr cmd, deq = @fedf51c0
Jun 20 19:42:28 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
Jun 20 19:42:28 ping kernel: xhci_hcd 0000:09:00.3: Set TR Deq Ptr cmd, new deq seg = 00000000fcf95654 (0xfedf5000 dma), new deq ptr = 000000001c042f08 (0xfedf51c0 dma), new cycle = 1
Jun 20 19:42:28 ping kernel: xhci_hcd 0000:09:00.3: New dequeue pointer = 0xfedf51c0 (DMA)
Jun 20 19:42:28 ping kernel: xhci_hcd 0000:09:00.3: New dequeue segment = 00000000fcf95654 (virtual)
Jun 20 19:42:28 ping kernel: xhci_hcd 0000:09:00.3: Cycle state = 0x1
Jun 20 19:42:28 ping kernel: xhci_hcd 0000:09:00.3: Finding endpoint context
Jun 20 19:42:28 ping kernel: xhci_hcd 0000:09:00.3: Removing canceled TD starting at 0xfedf5190 (dma).
Jun 20 19:42:28 ping kernel: xhci_hcd 0000:09:00.3: Stopped on Transfer TRB for slot 1 ep 0
Jun 20 19:42:28 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
Jun 20 19:42:28 ping kernel: xhci_hcd 0000:09:00.3: Cancel URB 00000000e5885748, dev 2, ep 0x0, starting at offset 0xfedf5190
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Successful Set TR Deq Ptr cmd, deq = @fede7830
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Ignoring reset ep completion code of 1
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Giveback URB 00000000e5885748, len = 0, expected = 4, status = -32
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Set TR Deq Ptr cmd, new deq seg = 0000000035cbb6da (0xfede7000 dma), new deq ptr = 00000000c7b3bb41 (0xfede7830 dma), new cycle = 1
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Queueing new dequeue state
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: New dequeue pointer = 0xfede7830 (DMA)
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: New dequeue segment = 0000000035cbb6da (virtual)
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Cycle state = 0x1
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Finding endpoint context
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Cleaning up stalled endpoint ring
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Stalled endpoint for slot 2 ep 0
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Successful Set TR Deq Ptr cmd, deq = @fede7800
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Ignoring reset ep completion code of 1
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Giveback URB 00000000e5885748, len = 0, expected = 10, status = -32
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Set TR Deq Ptr cmd, new deq seg = 0000000035cbb6da (0xfede7000 dma), new deq ptr = 0000000025e70308 (0xfede7800 dma), new cycle = 1
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Queueing new dequeue state
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: New dequeue pointer = 0xfede7800 (DMA)
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: New dequeue segment = 0000000035cbb6da (virtual)
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Cycle state = 0x1
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Finding endpoint context
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Cleaning up stalled endpoint ring
Jun 20 19:42:23 ping kernel: xhci_hcd 0000:09:00.3: Stalled endpoint for slot 2 ep 0

I got no warnings after startup related to IOMMU or AMD-Vi:

[fabi@ping ~]$ dmesg|grep IOMMU
[    0.404420] pci 0000:00:00.2: AMD-Vi: IOMMU performance counters supported
[    0.408184] pci 0000:00:00.2: AMD-Vi: Found IOMMU cap 0x40
[    0.409389] perf/amd_iommu: Detected AMD IOMMU #0 (2 banks, 4 counters/bank).
[    0.424729] AMD-Vi: AMD IOMMUv2 driver by Joerg Roedel <jroedel@suse.de>
[fabi@ping ~]$ dmesg|grep AMD-Vi
[    0.404420] pci 0000:00:00.2: AMD-Vi: IOMMU performance counters supported
[    0.408184] pci 0000:00:00.2: AMD-Vi: Found IOMMU cap 0x40
[    0.408185] pci 0000:00:00.2: AMD-Vi: Extended features (0xf77ef22294ada):
[    0.408187] AMD-Vi: Interrupt remapping enabled
[    0.408188] AMD-Vi: Virtual APIC enabled
[    0.408283] AMD-Vi: Lazy IO/TLB flushing enabled
[    0.424729] AMD-Vi: AMD IOMMUv2 driver by Joerg Roedel <jroedel@suse.de>

Output of awk -f scripts/ver_linux:

Linux ping 5.7.4 #1 SMP PREEMPT Sat Jun 20 14:34:20 CEST 2020 x86_64 GNU/Linux

GNU C                   10.1.0
GNU Make                4.3
Binutils                2.34.0
Util-linux              2.35.2
Mount                   2.35.2
Module-init-tools       27
E2fsprogs               1.45.6
Jfsutils                1.1.15
Reiserfsprogs           3.6.27
Xfsprogs                5.6.0
PPP                     2.4.7
Bison                   3.6.3
Flex                    2.6.4
Linux C++ Library       6.0.28
Linux C Library         2.31
Dynamic linker (ldd)    2.31
Procps                  3.3.16
Net-tools               2.10
Kbd                     2.2.0
Console-tools           2.2.0
Sh-utils                8.32
Udev                    245
Modules Loaded          8021q acpi_cpufreq aesni_intel agpgart amdgpu asus_wmi battery ccp cdrom cec crc16 crc32c_generic crc32c_intel crc32_pclmul crct10dif_pclmul cryptd crypto_simd crypto_user dca drm drm_kms_helper edac_mce_amd eeepc_wmi evdev ext4 fat fb_sys_fops garp ghash_clmulni_intel glue_helper gpio_amdpt gpu_sched hid hid_generic hid_logitech_dj hid_logitech_hidpp i2c_algo_bit i2c_piix4 igb input_leds ip_tables irqbypass jbd2 joydev k10temp kvm kvm_amd ledtrig_audio libcrc32c llc mac_hid mbcache mousedev mrp mxm_wmi nf_conntrack nf_defrag_ipv4 nf_defrag_ipv6 nfnetlink nf_reject_ipv4 nf_reject_ipv6 nf_tables nft_ct nft_reject nft_reject_inet nls_cp437 nls_iso8859_1 pcspkr pinctrl_amd rc_core rfkill rng_core sg snd snd_hda_codec snd_hda_codec_generic snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_core snd_hda_intel snd_hwdep snd_intel_dspcfg snd_pcm snd_timer soundcore sp5100_tco sparse_keymap sr_mod stp syscopyarea sysfillrect sysimgblt tpm tpm_crb tpm_tis tpm_tis_core tt
 m usbhid usbip_core usbip_host vfat wmi wmi_bmof xhci_hcd xhci_pci x_tables

CPU: AMD Ryzen 7 2700X Eight-Core Processor

The complete output of the above script along lspci -vvv, lsusb -v
and filtered journal (kernel messages and script markings) can be
downloaded from

http://fabi.bplaced.net/debuglogs1.tar.xz

Greats
Fabian Melzow

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1
  2020-06-20 19:19 ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1 Fabian Melzow
@ 2020-06-29 17:47 ` Mathias Nyman
  2020-06-30 10:40     ` kernel test robot
  2020-06-30 16:58   ` ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1 Fabian Melzow
  0 siblings, 2 replies; 10+ messages in thread
From: Mathias Nyman @ 2020-06-29 17:47 UTC (permalink / raw)
  To: Fabian Melzow, linux-usb

Hi

On 20.6.2020 22.19, Fabian Melzow wrote:
> Hi folks!
> 
> After running the first scanimage I get the following errors/warnings:
> 
> Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
> Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Successful Set TR Deq Ptr cmd, deq = @d7615080
> Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
> Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Set TR Deq Ptr cmd, new deq seg = 00000000de74ec7f (0xd7615000 dma), new deq ptr = 00000000ff17b5e1 (0xd7615080 dma), new cycle = 1
> Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: New dequeue pointer = 0xd7615080 (DMA)
> Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: New dequeue segment = 00000000de74ec7f (virtual)
> Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Cycle state = 0x1
> Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Finding endpoint context
> Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Removing canceled TD starting at 0xd7615070 (dma).
> Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Stopped on Transfer TRB for slot 1 ep 4
> Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
> Jun 20 19:42:15 ping kernel: xhci_hcd 0000:01:00.0: Cancel URB 00000000fa372bb8, dev 3, ep 0x82, starting at offset 0xd7615070
> Jun 20 19:41:55 ping kernel: xhci_hcd 0000:01:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x000d address=0xdc707028 flags=0x0020]
> Jun 20 19:41:55 ping kernel: xhci_hcd 0000:01:00.0: Looking for event-dma 00000000d7615060 trb-start 00000000d7615070 trb-end 00000000d7615070 seg-start 00000000d7615000 seg-end 00000000d7615ff0
> Jun 20 19:41:55 ping kernel: xhci_hcd 0000:01:00.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1
> Jun 20 19:41:55 ping kernel: xhci_hcd 0000:01:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x000d address=0xc9b4c730 flags=0x0020]
> Jun 20 19:41:55 ping kernel: xhci_hcd 0000:01:00.0: ep 0x82 - asked for 1 bytes, 0 bytes untransferred
> Jun 20 19:41:55 ping kernel: xhci_hcd 0000:01:00.0: WARN Successful completion on short TX
> Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
> Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
> Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: Slot state = 3, EP state = 2
> Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: WARN Set TR Deq Ptr cmd failed due to incorrect slot or ep state.
> Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
> Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: Set TR Deq Ptr cmd, new deq seg = 00000000de74ec7f (0xd7615000 dma), new deq ptr = 00000000f035f701 (0xd7615060 dma), new cycle = 1
> Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: New dequeue pointer = 0xd7615060 (DMA)
> Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: New dequeue segment = 00000000de74ec7f (virtual)
> Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: Cycle state = 0x1
> Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: Finding endpoint context
> Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: Removing canceled TD starting at 0xd7615050 (dma).
> Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: // Ding dong!
> Jun 20 19:41:54 ping kernel: xhci_hcd 0000:01:00.0: Cancel URB 000000002fee127b, dev 3, ep 0x82, starting at offset 0xd7615050
> > 
> The complete output of the above script along lspci -vvv, lsusb -v
> and filtered journal (kernel messages and script markings) can be
> downloaded from
> 
> http://fabi.bplaced.net/debuglogs1.tar.xz

I had a look at both the traces and dmesg. 
First issue I see is that the attempt to recover from a transaction error with a soft retry
isn't working. We expect the hardware to retry the transfer but nothing seems to happen.
Soft retry is described in xhci specs 4.6.8.1 and is basically a reset endpoint command with TSP set,
followed by ringing the endpoint doorbell. Traces indicate driver does this correctly but hardware
isn't retrying. We get don't get any event, no error, success or stall.

This could be hardware flaw.
Any chance you could try this on a xHC from some other vendor?

Second issue is a driver flaw, when nothing happened for 20 seconds we see the URB is canceled.
xhci driver needs to stop then endpoint to cancel the URB, but there is a hw race and endpoint
ends up halted instead of stopped. The xhci driver can't handle a halted endpoint in its stop endpoint
handler properly, and the URB is never actually removed from the ring.

The reason you see the IO_PAGE_FAULT is probably because once the ring starts running the driver will
handle the cancelled URB, and touch already freed memory:  
AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x000d address=0xdc707028 flags=0x0020]

I have a patch for this second case, I haven't upstreamed it as it got some conflicting feedback earlier.
It won't solve the 20 second delay, but should solve the the IO_PAGE_FAULT and the
"WARN Set TR Deq Ptr cmd failed due to incorrect slot or ep state" message

Can you try it out?

From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Tue, 7 Jan 2020 16:12:17 +0200
Subject: [PATCH] xhci: fix halted endpoint at stop endpoint command completion

xhci 4.6.9: A Busy endpoint may asynchronously transition from the
Running to the Halted or Error state due to error conditions detected
while processing TRBs. A possible race condition may occur if software,
thinking an endpoint is in the Running state, issues a Stop Endpoint
Command however at the same time the xHC asynchronously transitions
the endpoint to the Halted or Error state. In this case, a Context
State Error may be generated for the command completion. Software
may verify that this case occurred by inspecting the EP State for
Halted or Error when a Stop Endpoint Command results in a Context
State Error.

Fix this case by resetting the halted endpoint after cleaning
up the canceled trbs from the ring.
If the TRB we halted on was canceled then queue a new set TR dequeue
pointer command as usually.
If it wasn't canceled then move past it with a set TR dequeue pointer
and give it back with -EPIPE status as in a normal halted endpoint case.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
 drivers/usb/host/xhci-ring.c | 56 ++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 5c223e92b8db..ceb3fac3f1c9 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -745,11 +745,13 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
 	struct xhci_ring *ep_ring;
 	struct xhci_virt_ep *ep;
 	struct xhci_td *cur_td = NULL;
+	struct xhci_td *halted_td = NULL;
 	struct xhci_td *last_unlinked_td;
 	struct xhci_ep_ctx *ep_ctx;
 	struct xhci_virt_device *vdev;
 	u64 hw_deq;
 	struct xhci_dequeue_state deq_state;
+	u32 comp_code;
 
 	if (unlikely(TRB_TO_SUSPEND_PORT(le32_to_cpu(trb->generic.field[3])))) {
 		if (!xhci->devs[slot_id])
@@ -764,9 +766,19 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
 
 	vdev = xhci->devs[slot_id];
 	ep_ctx = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
+
 	trace_xhci_handle_cmd_stop_ep(ep_ctx);
 
 	ep = &xhci->devs[slot_id]->eps[ep_index];
+	comp_code = GET_COMP_CODE(le32_to_cpu(event->status));
+
+	if (comp_code == COMP_CONTEXT_STATE_ERROR) {
+		/* endpoint is halted and needs to be reset */
+		if (GET_EP_CTX_STATE(ep_ctx) == EP_STATE_HALTED) {
+			ep->ep_state |= EP_HALTED;
+		}
+	}
+
 	last_unlinked_td = list_last_entry(&ep->cancelled_td_list,
 			struct xhci_td, cancelled_td_list);
 
@@ -833,16 +845,60 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
 
 	xhci_stop_watchdog_timer_in_irq(xhci, ep);
 
+	/*
+	 * If stop endpoint command raced with a halting endpoint we need to
+	 * reset the endpoint first. If the TD we halted on isn't cancelled we
+	 * must give it back with -EPIPE status, and move ring dequeue past it.
+	 * If we can't find hw_deq, or the TD we halted on, do a soft reset
+	 */
+	   /* FIXME, is there a risk EP_HALTED is set from other cases */
+	if (ep->ep_state & EP_HALTED) {
+		enum xhci_ep_reset_type reset_type = EP_SOFT_RESET;
+		struct xhci_td *td;
+
+		if (deq_state.new_deq_ptr && deq_state.new_deq_seg) {
+			reset_type = EP_HARD_RESET;
+		} else if (ep->ep_state & EP_HAS_STREAMS) {
+			/* soft reset, nothing else */
+		} else if (!list_empty(&ep->ring->td_list)) {
+			hw_deq = xhci_get_hw_deq(xhci, vdev, ep_index, 0);
+			hw_deq &= ~0xf;
+			td = list_first_entry(&ep->ring->td_list,
+						     struct xhci_td, td_list);
+			if (trb_in_td(xhci, td->start_seg, td->first_trb,
+				      td->last_trb, hw_deq, false)) {
+				halted_td = td;
+				reset_type = EP_HARD_RESET;
+				xhci_find_new_dequeue_state(xhci, slot_id,
+							    ep_index, 0, td,
+							    &deq_state);
+			}
+		}
+		xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type);
+		/* FIXME xhci_clear_hub_tt_buffer(xhci, td, ep); */
+	}
+
 	/* If necessary, queue a Set Transfer Ring Dequeue Pointer command */
 	if (deq_state.new_deq_ptr && deq_state.new_deq_seg) {
 		xhci_queue_new_dequeue_state(xhci, slot_id, ep_index,
 					     &deq_state);
 		xhci_ring_cmd_db(xhci);
+	} else if (ep->ep_state & EP_HALTED) {
+		xhci_ring_cmd_db(xhci); /* for endpoint soft reset command */
 	} else {
 		/* Otherwise ring the doorbell(s) to restart queued transfers */
 		ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
 	}
 
+	/* If TD we halted on wasn't cancelled give it back with -EPIPE */
+	if (halted_td) {
+		xhci_unmap_td_bounce_buffer(xhci, ep->ring, halted_td);
+		list_del_init(&halted_td->td_list);
+		inc_td_cnt(halted_td->urb);
+		if (last_td_in_urb(halted_td))
+			xhci_giveback_urb_in_irq(xhci, halted_td, -EPIPE);
+	}
+
 	/*
 	 * Drop the lock and complete the URBs in the cancelled TD list.
 	 * New TDs to be cancelled might be added to the end of the list before
-- 
2.17.1




^ permalink raw reply related	[flat|nested] 10+ messages in thread

* Re: [PATCH] xhci: fix halted endpoint at stop endpoint command completion
  2020-06-29 17:47 ` Mathias Nyman
@ 2020-06-30 10:40     ` kernel test robot
  2020-06-30 16:58   ` ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1 Fabian Melzow
  1 sibling, 0 replies; 10+ messages in thread
From: kernel test robot @ 2020-06-30 10:40 UTC (permalink / raw)
  To: Mathias Nyman, Fabian Melzow, linux-usb; +Cc: kbuild-all, clang-built-linux

[-- Attachment #1: Type: text/plain, Size: 45411 bytes --]

Hi Mathias,

I love your patch! Yet something to improve:

[auto build test ERROR on usb/usb-testing]
[also build test ERROR on v5.8-rc3 next-20200629]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use  as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Mathias-Nyman/xhci-fix-halted-endpoint-at-stop-endpoint-command-completion/20200630-031254
base:   https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
config: arm-randconfig-r013-20200630 (attached as .config)
compiler: clang version 11.0.0 (https://github.com/llvm/llvm-project cf1d04484344be52ada8178e41d18fd15a9b880c)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # install arm cross compiling tool for clang build
        # apt-get install binutils-arm-linux-gnueabi
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

   drivers/usb/typec/tps6598x.c:164:19: warning: unused function 'tps6598x_write32' [-Wunused-function]
   static inline int tps6598x_write32(struct tps6598x *tps, u8 reg, u32 val)
                     ^
   drivers/usb/gadget/function/u_serial.c:538: warning: Function parameter or member 'port' not described in 'gs_start_io'
   drivers/usb/gadget/function/u_serial.c:538: warning: Excess function parameter 'dev' description in 'gs_start_io'
   drivers/usb/gadget/udc/dummy_hcd.c:1597: warning: Function parameter or member 'dum_hcd' not described in 'handle_control_request'
   drivers/usb/gadget/udc/dummy_hcd.c:1597: warning: Excess function parameter 'dum' description in 'handle_control_request'
   drivers/usb/gadget/legacy/printer.c:24:19: warning: unused variable 'driver_desc' [-Wunused-const-variable]
   static const char driver_desc [] = DRIVER_DESC;
                     ^
   1 warning generated.
   2 warnings generated.
   drivers/usb/host/ehci-platform.c:478:36: warning: unused variable 'ehci_acpi_match' [-Wunused-const-variable]
   static const struct acpi_device_id ehci_acpi_match[] = {
                                      ^
   1 warning generated.
   drivers/usb/misc/iowarrior.c:251: warning: Function parameter or member 'dev' not described in 'iowarrior_delete'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'file' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'buffer' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'count' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'ppos' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:483: warning: Function parameter or member 'file' not described in 'iowarrior_ioctl'
   drivers/usb/misc/iowarrior.c:483: warning: Function parameter or member 'cmd' not described in 'iowarrior_ioctl'
   drivers/usb/misc/iowarrior.c:483: warning: Function parameter or member 'arg' not described in 'iowarrior_ioctl'
   drivers/usb/misc/iowarrior.c:599: warning: Function parameter or member 'inode' not described in 'iowarrior_open'
   drivers/usb/misc/iowarrior.c:599: warning: Function parameter or member 'file' not described in 'iowarrior_open'
   drivers/usb/misc/iowarrior.c:647: warning: Function parameter or member 'inode' not described in 'iowarrior_release'
   drivers/usb/misc/iowarrior.c:647: warning: Function parameter or member 'file' not described in 'iowarrior_release'
   drivers/usb/misc/iowarrior.c:753: warning: Function parameter or member 'interface' not described in 'iowarrior_probe'
   drivers/usb/misc/iowarrior.c:753: warning: Function parameter or member 'id' not described in 'iowarrior_probe'
   drivers/usb/misc/iowarrior.c:879: warning: Function parameter or member 'interface' not described in 'iowarrior_disconnect'
   1 warning generated.
   drivers/usb/gadget/udc/amd5536udc_pci.c:52:19: warning: unused variable 'mod_desc' [-Wunused-const-variable]
   static const char mod_desc[] = UDC_MOD_DESCRIPTION;
                     ^
   1 warning generated.
   drivers/usb/misc/ldusb.c:192: warning: Function parameter or member 'dev' not described in 'ld_usb_abort_transfers'
   drivers/usb/misc/ldusb.c:206: warning: Function parameter or member 'dev' not described in 'ld_usb_delete'
   drivers/usb/misc/ldusb.c:220: warning: Function parameter or member 'urb' not described in 'ld_usb_interrupt_in_callback'
   drivers/usb/misc/ldusb.c:281: warning: Function parameter or member 'urb' not described in 'ld_usb_interrupt_out_callback'
   drivers/usb/misc/ldusb.c:301: warning: Function parameter or member 'inode' not described in 'ld_usb_open'
   drivers/usb/misc/ldusb.c:301: warning: Function parameter or member 'file' not described in 'ld_usb_open'
   drivers/usb/misc/ldusb.c:372: warning: Function parameter or member 'inode' not described in 'ld_usb_release'
   drivers/usb/misc/ldusb.c:372: warning: Function parameter or member 'file' not described in 'ld_usb_release'
   drivers/usb/misc/ldusb.c:414: warning: Function parameter or member 'file' not described in 'ld_usb_poll'
   drivers/usb/misc/ldusb.c:414: warning: Function parameter or member 'wait' not described in 'ld_usb_poll'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'file' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'buffer' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'count' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'ppos' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'file' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'buffer' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'count' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'ppos' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:651: warning: Function parameter or member 'intf' not described in 'ld_usb_probe'
   drivers/usb/misc/ldusb.c:651: warning: Function parameter or member 'id' not described in 'ld_usb_probe'
   drivers/usb/misc/ldusb.c:754: warning: Function parameter or member 'intf' not described in 'ld_usb_disconnect'
   drivers/usb/serial/quatech2.c:179:19: warning: unused function 'qt2_setdevice' [-Wunused-function]
   static inline int qt2_setdevice(struct usb_device *dev, u8 *data)
                     ^
   drivers/usb/core/ledtrig-usbport.c:42: warning: Function parameter or member 'usbport_data' not described in 'usbport_trig_usb_dev_observed'
   drivers/usb/core/ledtrig-usbport.c:42: warning: Function parameter or member 'usb_dev' not described in 'usbport_trig_usb_dev_observed'
   drivers/usb/core/ledtrig-usbport.c:71: warning: Function parameter or member 'usbport_data' not described in 'usbport_trig_update_count'
   drivers/usb/core/ledtrig-usbport.c:131: warning: Function parameter or member 'usbport_data' not described in 'usbport_trig_port_observed'
   drivers/usb/core/ledtrig-usbport.c:131: warning: Function parameter or member 'usb_dev' not described in 'usbport_trig_port_observed'
   drivers/usb/core/ledtrig-usbport.c:131: warning: Function parameter or member 'port1' not described in 'usbport_trig_port_observed'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'dev' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'function' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'size' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'data' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:290: warning: Function parameter or member 'dev' not described in 'tower_delete'
   drivers/usb/misc/legousbtower.c:306: warning: Function parameter or member 'inode' not described in 'tower_open'
   drivers/usb/misc/legousbtower.c:306: warning: Function parameter or member 'file' not described in 'tower_open'
   drivers/usb/misc/legousbtower.c:405: warning: Function parameter or member 'inode' not described in 'tower_release'
   drivers/usb/misc/legousbtower.c:405: warning: Function parameter or member 'file' not described in 'tower_release'
   drivers/usb/misc/legousbtower.c:452: warning: Function parameter or member 'dev' not described in 'tower_check_for_read_packet'
   drivers/usb/misc/legousbtower.c:468: warning: Function parameter or member 'file' not described in 'tower_poll'
   drivers/usb/misc/legousbtower.c:468: warning: Function parameter or member 'wait' not described in 'tower_poll'
   drivers/usb/misc/legousbtower.c:494: warning: Function parameter or member 'file' not described in 'tower_llseek'
   drivers/usb/misc/legousbtower.c:494: warning: Function parameter or member 'off' not described in 'tower_llseek'
   drivers/usb/misc/legousbtower.c:494: warning: Function parameter or member 'whence' not described in 'tower_llseek'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'file' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'buffer' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'count' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'ppos' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'file' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'buffer' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'count' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'ppos' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:669: warning: Function parameter or member 'urb' not described in 'tower_interrupt_in_callback'
   1 warning generateddrivers/usb/misc/legousbtower.c:724: warning: Function parameter or member 'urb' not described in 'tower_interrupt_out_callback'
   .
   drivers/usb/misc/legousbtower.c:752: warning: Function parameter or member 'interface' not described in 'tower_probe'
   drivers/usb/misc/legousbtower.c:752: warning: Function parameter or member 'id' not described in 'tower_probe'
   drivers/usb/misc/legousbtower.c:863: warning: Function parameter or member 'interface' not described in 'tower_disconnect'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'type' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'h' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'data' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'len' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'priv' not described in '__ffs_data_do_os_desc'
>> drivers/usb/host/xhci-ring.c:857:3: error: implicit declaration of function 'xhci_reset_halted_ep' [-Werror,-Wimplicit-function-declaration]
                   xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type);
                   ^
   1 error generated.
   make[4]: *** [scripts/Makefile.build:281: drivers/usb/host/xhci-ring.o] Error 1
   drivers/usb/host/sl811-hcd.c:588:18: warning: unused function 'checkdone' [-Wunused-function]
   static inline u8 checkdone(struct sl811 *sl811)
                    ^
   drivers/usb/gadget/udc/mv_udc_core.c:56:19: warning: unused variable 'driver_desc' [-Wunused-const-variable]
   static const char driver_desc[] = DRIVER_DESC;
                     ^
   drivers/usb/host/xhci.c:1285: warning: Function parameter or member 'desc' not described in 'xhci_get_endpoint_index'
   1 warning generated.
   drivers/usb/gadget/udc/mv_u3d_core.c:35:19: warning: unused variable 'driver_desc' [-Wunused-const-variable]
   static const char driver_desc[] = DRIVER_DESC;
                     ^
   drivers/usb/host/xhci-plat.c:457:36: warning: unused variable 'usb_xhci_acpi_match' [-Wunused-const-variable]
   static const struct acpi_device_id usb_xhci_acpi_match[] = {
                                      ^
   drivers/usb/host/xhci-dbgtty.c:19: warning: Function parameter or member 'port' not described in 'dbc_send_packet'
   drivers/usb/host/xhci-dbgtty.c:19: warning: Function parameter or member 'packet' not described in 'dbc_send_packet'
   drivers/usb/host/xhci-dbgtty.c:19: warning: Function parameter or member 'size' not described in 'dbc_send_packet'
   drivers/usb/host/bcma-hcd.c:180: warning: Function parameter or member 'usb_dev' not described in 'bcma_hcd_usb20_old_arm_init'
   drivers/usb/host/bcma-hcd.c:268: warning: Function parameter or member 'bcma_hcd' not described in 'bcma_hcd_usb20_ns_init'
   1 warning generated.
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'xhci' not described in 'dbc_dma_alloc_coherent'
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'size' not described in 'dbc_dma_alloc_coherent'
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'dma_handle' not described in 'dbc_dma_alloc_coherent'
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'flags' not described in 'dbc_dma_alloc_coherent'
   1 warning generated.
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'xhci' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'num_segs' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'cycle_state' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'type' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'max_packet' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'flags' not described in 'xhci_ring_alloc'
   1 warning generated.
   drivers/usb/gadget/udc/pch_udc.c:239: warning: Function parameter or member 'request' not described in 'pch_udc_stp_dma_desc'
   drivers/usb/gadget/udc/pch_udc.c:315: warning: Function parameter or member 'irq_work_fall' not described in 'pch_vbus_gpio_data'
   drivers/usb/gadget/udc/pch_udc.c:315: warning: Function parameter or member 'irq_work_rise' not described in 'pch_vbus_gpio_data'
   drivers/usb/gadget/udc/pch_udc.c:482: warning: Function parameter or member 'ep' not described in 'pch_udc_write_csr'
   drivers/usb/gadget/udc/pch_udc.c:482: warning: Excess function parameter 'addr' description in 'pch_udc_write_csr'
   drivers/usb/gadget/udc/pch_udc.c:498: warning: Function parameter or member 'ep' not described in 'pch_udc_read_csr'
   drivers/usb/gadget/udc/pch_udc.c:498: warning: Excess function parameter 'addr' description in 'pch_udc_read_csr'
   drivers/usb/gadget/udc/pch_udc.c:662: warning: Function parameter or member 'ep_in' not described in 'pch_udc_ep_set_bufsz'
   drivers/usb/gadget/udc/pch_udc.c:977: warning: Function parameter or member 'ep' not described in 'pch_udc_ep_enable'
   drivers/usb/gadget/udc/pch_udc.c:977: warning: Function parameter or member 'cfg' not described in 'pch_udc_ep_enable'
   drivers/usb/gadget/udc/pch_udc.c:977: warning: Excess function parameter 'regs' description in 'pch_udc_ep_enable'
   drivers/usb/gadget/udc/pch_udc.c:1010: warning: Function parameter or member 'ep' not described in 'pch_udc_ep_disable'
   drivers/usb/gadget/udc/pch_udc.c:1010: warning: Excess function parameter 'regs' description in 'pch_udc_ep_disable'
   drivers/usb/gadget/udc/pch_udc.c:1030: warning: Function parameter or member 'ep' not described in 'pch_udc_wait_ep_stall'
   drivers/usb/gadget/udc/pch_udc.c:1030: warning: Excess function parameter 'dev' description in 'pch_udc_wait_ep_stall'
   drivers/usb/gadget/udc/pch_udc.c:1341: warning: Function parameter or member 'data' not described in 'pch_vbus_gpio_irq'
   drivers/usb/gadget/udc/pch_udc.c:1341: warning: Excess function parameter 'dev' description in 'pch_vbus_gpio_irq'
   drivers/usb/gadget/udc/pch_udc.c:1365: warning: Function parameter or member 'vbus_gpio_port' not described in 'pch_vbus_gpio_init'
   drivers/usb/gadget/udc/pch_udc.c:1510: warning: Function parameter or member 'dev' not described in 'pch_udc_free_dma_chain'
   drivers/usb/gadget/udc/pch_udc.c:1510: warning: Function parameter or member 'req' not described in 'pch_udc_free_dma_chain'
   drivers/usb/gadget/udc/pch_udc.c:1717: warning: Function parameter or member 'usbep' not described in 'pch_udc_pcd_ep_disable'
   drivers/usb/gadget/udc/pch_udc.c:2006: warning: Excess function parameter 'halt' description in 'pch_udc_pcd_set_wedge'
   drivers/usb/gadget/udc/pch_udc.c:2756: warning: Function parameter or member 'pdev' not described in 'pch_udc_isr'
   drivers/usb/gadget/udc/pch_udc.c:2756: warning: Excess function parameter 'dev' description in 'pch_udc_isr'
   drivers/usb/gadget/udc/pch_udc.c:2906: warning: Function parameter or member 'dev' not described in 'init_dma_pools'
   drivers/usb/gadget/udc/pch_udc.c:2906: warning: Excess function parameter 'pdev' description in 'init_dma_pools'
   drivers/usb/host/fotg210-hcd.c:5569: warning: Function parameter or member 'pdev' not described in 'fotg210_hcd_probe'
   drivers/usb/host/fotg210-hcd.c:5666: warning: Function parameter or member 'pdev' not described in 'fotg210_hcd_remove'
   drivers/usb/host/fotg210-hcd.c:5666: warning: Excess function parameter 'dev' description in 'fotg210_hcd_remove'
   make[4]: Target '__build' not remade because of errors.
   make[2]: *** [scripts/Makefile.build:497: drivers/usb] Error 2
   make[3]: *** [scripts/Makefile.build:497: drivers/usb/host] Error 2
   make[3]: Target '__build' not remade because of errors.
   make[2]: Target '__build' not remade because of errors.
   make[1]: *** [Makefile:1756: drivers] Error 2
   make[1]: Target 'drivers/usb/' not remade because of errors.
--
   drivers/usb/typec/tps6598x.c:164:19: warning: unused function 'tps6598x_write32' [-Wunused-function]
   static inline int tps6598x_write32(struct tps6598x *tps, u8 reg, u32 val)
                     ^
   drivers/usb/gadget/function/u_serial.c:538: warning: Function parameter or member 'port' not described in 'gs_start_io'
   drivers/usb/gadget/function/u_serial.c:538: warning: Excess function parameter 'dev' description in 'gs_start_io'
   drivers/usb/gadget/udc/dummy_hcd.c:1597: warning: Function parameter or member 'dum_hcd' not described in 'handle_control_request'
   drivers/usb/gadget/udc/dummy_hcd.c:1597: warning: Excess function parameter 'dum' description in 'handle_control_request'
   drivers/usb/gadget/legacy/printer.c:24:19: warning: unused variable 'driver_desc' [-Wunused-const-variable]
   static const char driver_desc [] = DRIVER_DESC;
                     ^
   1 warning generated.
   2 warnings generated.
   drivers/usb/host/ehci-platform.c:478:36: warning: unused variable 'ehci_acpi_match' [-Wunused-const-variable]
   static const struct acpi_device_id ehci_acpi_match[] = {
                                      ^
   1 warning generated.
   drivers/usb/misc/iowarrior.c:251: warning: Function parameter or member 'dev' not described in 'iowarrior_delete'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'file' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'buffer' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'count' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'ppos' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:483: warning: Function parameter or member 'file' not described in 'iowarrior_ioctl'
   drivers/usb/misc/iowarrior.c:483: warning: Function parameter or member 'cmd' not described in 'iowarrior_ioctl'
   drivers/usb/misc/iowarrior.c:483: warning: Function parameter or member 'arg' not described in 'iowarrior_ioctl'
   drivers/usb/misc/iowarrior.c:599: warning: Function parameter or member 'inode' not described in 'iowarrior_open'
   drivers/usb/misc/iowarrior.c:599: warning: Function parameter or member 'file' not described in 'iowarrior_open'
   drivers/usb/misc/iowarrior.c:647: warning: Function parameter or member 'inode' not described in 'iowarrior_release'
   drivers/usb/misc/iowarrior.c:647: warning: Function parameter or member 'file' not described in 'iowarrior_release'
   drivers/usb/misc/iowarrior.c:753: warning: Function parameter or member 'interface' not described in 'iowarrior_probe'
   drivers/usb/misc/iowarrior.c:753: warning: Function parameter or member 'id' not described in 'iowarrior_probe'
   drivers/usb/misc/iowarrior.c:879: warning: Function parameter or member 'interface' not described in 'iowarrior_disconnect'
   1 warning generated.
   drivers/usb/gadget/udc/amd5536udc_pci.c:52:19: warning: unused variable 'mod_desc' [-Wunused-const-variable]
   static const char mod_desc[] = UDC_MOD_DESCRIPTION;
                     ^
   1 warning generated.
   drivers/usb/misc/ldusb.c:192: warning: Function parameter or member 'dev' not described in 'ld_usb_abort_transfers'
   drivers/usb/misc/ldusb.c:206: warning: Function parameter or member 'dev' not described in 'ld_usb_delete'
   drivers/usb/misc/ldusb.c:220: warning: Function parameter or member 'urb' not described in 'ld_usb_interrupt_in_callback'
   drivers/usb/misc/ldusb.c:281: warning: Function parameter or member 'urb' not described in 'ld_usb_interrupt_out_callback'
   drivers/usb/misc/ldusb.c:301: warning: Function parameter or member 'inode' not described in 'ld_usb_open'
   drivers/usb/misc/ldusb.c:301: warning: Function parameter or member 'file' not described in 'ld_usb_open'
   drivers/usb/misc/ldusb.c:372: warning: Function parameter or member 'inode' not described in 'ld_usb_release'
   drivers/usb/misc/ldusb.c:372: warning: Function parameter or member 'file' not described in 'ld_usb_release'
   drivers/usb/misc/ldusb.c:414: warning: Function parameter or member 'file' not described in 'ld_usb_poll'
   drivers/usb/misc/ldusb.c:414: warning: Function parameter or member 'wait' not described in 'ld_usb_poll'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'file' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'buffer' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'count' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'ppos' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'file' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'buffer' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'count' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'ppos' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:651: warning: Function parameter or member 'intf' not described in 'ld_usb_probe'
   drivers/usb/misc/ldusb.c:651: warning: Function parameter or member 'id' not described in 'ld_usb_probe'
   drivers/usb/misc/ldusb.c:754: warning: Function parameter or member 'intf' not described in 'ld_usb_disconnect'
   drivers/usb/serial/quatech2.c:179:19: warning: unused function 'qt2_setdevice' [-Wunused-function]
   static inline int qt2_setdevice(struct usb_device *dev, u8 *data)
                     ^
   drivers/usb/core/ledtrig-usbport.c:42: warning: Function parameter or member 'usbport_data' not described in 'usbport_trig_usb_dev_observed'
   drivers/usb/core/ledtrig-usbport.c:42: warning: Function parameter or member 'usb_dev' not described in 'usbport_trig_usb_dev_observed'
   drivers/usb/core/ledtrig-usbport.c:71: warning: Function parameter or member 'usbport_data' not described in 'usbport_trig_update_count'
   drivers/usb/core/ledtrig-usbport.c:131: warning: Function parameter or member 'usbport_data' not described in 'usbport_trig_port_observed'
   drivers/usb/core/ledtrig-usbport.c:131: warning: Function parameter or member 'usb_dev' not described in 'usbport_trig_port_observed'
   drivers/usb/core/ledtrig-usbport.c:131: warning: Function parameter or member 'port1' not described in 'usbport_trig_port_observed'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'dev' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'function' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'size' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'data' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:290: warning: Function parameter or member 'dev' not described in 'tower_delete'
   drivers/usb/misc/legousbtower.c:306: warning: Function parameter or member 'inode' not described in 'tower_open'
   drivers/usb/misc/legousbtower.c:306: warning: Function parameter or member 'file' not described in 'tower_open'
   drivers/usb/misc/legousbtower.c:405: warning: Function parameter or member 'inode' not described in 'tower_release'
   drivers/usb/misc/legousbtower.c:405: warning: Function parameter or member 'file' not described in 'tower_release'
   drivers/usb/misc/legousbtower.c:452: warning: Function parameter or member 'dev' not described in 'tower_check_for_read_packet'
   drivers/usb/misc/legousbtower.c:468: warning: Function parameter or member 'file' not described in 'tower_poll'
   drivers/usb/misc/legousbtower.c:468: warning: Function parameter or member 'wait' not described in 'tower_poll'
   drivers/usb/misc/legousbtower.c:494: warning: Function parameter or member 'file' not described in 'tower_llseek'
   drivers/usb/misc/legousbtower.c:494: warning: Function parameter or member 'off' not described in 'tower_llseek'
   drivers/usb/misc/legousbtower.c:494: warning: Function parameter or member 'whence' not described in 'tower_llseek'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'file' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'buffer' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'count' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'ppos' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'file' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'buffer' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'count' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'ppos' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:669: warning: Function parameter or member 'urb' not described in 'tower_interrupt_in_callback'
   1 warning generateddrivers/usb/misc/legousbtower.c:724: warning: Function parameter or member 'urb' not described in 'tower_interrupt_out_callback'
   .
   drivers/usb/misc/legousbtower.c:752: warning: Function parameter or member 'interface' not described in 'tower_probe'
   drivers/usb/misc/legousbtower.c:752: warning: Function parameter or member 'id' not described in 'tower_probe'
   drivers/usb/misc/legousbtower.c:863: warning: Function parameter or member 'interface' not described in 'tower_disconnect'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'type' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'h' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'data' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'len' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'priv' not described in '__ffs_data_do_os_desc'
>> drivers/usb/host/xhci-ring.c:857:3: error: implicit declaration of function 'xhci_reset_halted_ep' [-Werror,-Wimplicit-function-declaration]
                   xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type);
                   ^
   1 error generated.
   make[4]: *** [scripts/Makefile.build:281: drivers/usb/host/xhci-ring.o] Error 1
   drivers/usb/host/sl811-hcd.c:588:18: warning: unused function 'checkdone' [-Wunused-function]
   static inline u8 checkdone(struct sl811 *sl811)
                    ^
   drivers/usb/gadget/udc/mv_udc_core.c:56:19: warning: unused variable 'driver_desc' [-Wunused-const-variable]
   static const char driver_desc[] = DRIVER_DESC;
                     ^
   drivers/usb/host/xhci.c:1285: warning: Function parameter or member 'desc' not described in 'xhci_get_endpoint_index'
   1 warning generated.
   drivers/usb/gadget/udc/mv_u3d_core.c:35:19: warning: unused variable 'driver_desc' [-Wunused-const-variable]
   static const char driver_desc[] = DRIVER_DESC;
                     ^
   drivers/usb/host/xhci-plat.c:457:36: warning: unused variable 'usb_xhci_acpi_match' [-Wunused-const-variable]
   static const struct acpi_device_id usb_xhci_acpi_match[] = {
                                      ^
   drivers/usb/host/xhci-dbgtty.c:19: warning: Function parameter or member 'port' not described in 'dbc_send_packet'
   drivers/usb/host/xhci-dbgtty.c:19: warning: Function parameter or member 'packet' not described in 'dbc_send_packet'
   drivers/usb/host/xhci-dbgtty.c:19: warning: Function parameter or member 'size' not described in 'dbc_send_packet'
   drivers/usb/host/bcma-hcd.c:180: warning: Function parameter or member 'usb_dev' not described in 'bcma_hcd_usb20_old_arm_init'
   drivers/usb/host/bcma-hcd.c:268: warning: Function parameter or member 'bcma_hcd' not described in 'bcma_hcd_usb20_ns_init'
   1 warning generated.
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'xhci' not described in 'dbc_dma_alloc_coherent'
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'size' not described in 'dbc_dma_alloc_coherent'
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'dma_handle' not described in 'dbc_dma_alloc_coherent'
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'flags' not described in 'dbc_dma_alloc_coherent'
   1 warning generated.
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'xhci' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'num_segs' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'cycle_state' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'type' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'max_packet' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'flags' not described in 'xhci_ring_alloc'
   1 warning generated.
   drivers/usb/gadget/udc/pch_udc.c:239: warning: Function parameter or member 'request' not described in 'pch_udc_stp_dma_desc'
   drivers/usb/gadget/udc/pch_udc.c:315: warning: Function parameter or member 'irq_work_fall' not described in 'pch_vbus_gpio_data'
   drivers/usb/gadget/udc/pch_udc.c:315: warning: Function parameter or member 'irq_work_rise' not described in 'pch_vbus_gpio_data'
   drivers/usb/gadget/udc/pch_udc.c:482: warning: Function parameter or member 'ep' not described in 'pch_udc_write_csr'
   drivers/usb/gadget/udc/pch_udc.c:482: warning: Excess function parameter 'addr' description in 'pch_udc_write_csr'
   drivers/usb/gadget/udc/pch_udc.c:498: warning: Function parameter or member 'ep' not described in 'pch_udc_read_csr'
   drivers/usb/gadget/udc/pch_udc.c:498: warning: Excess function parameter 'addr' description in 'pch_udc_read_csr'
   drivers/usb/gadget/udc/pch_udc.c:662: warning: Function parameter or member 'ep_in' not described in 'pch_udc_ep_set_bufsz'
   drivers/usb/gadget/udc/pch_udc.c:977: warning: Function parameter or member 'ep' not described in 'pch_udc_ep_enable'
   drivers/usb/gadget/udc/pch_udc.c:977: warning: Function parameter or member 'cfg' not described in 'pch_udc_ep_enable'
   drivers/usb/gadget/udc/pch_udc.c:977: warning: Excess function parameter 'regs' description in 'pch_udc_ep_enable'
   drivers/usb/gadget/udc/pch_udc.c:1010: warning: Function parameter or member 'ep' not described in 'pch_udc_ep_disable'
   drivers/usb/gadget/udc/pch_udc.c:1010: warning: Excess function parameter 'regs' description in 'pch_udc_ep_disable'
   drivers/usb/gadget/udc/pch_udc.c:1030: warning: Function parameter or member 'ep' not described in 'pch_udc_wait_ep_stall'
   drivers/usb/gadget/udc/pch_udc.c:1030: warning: Excess function parameter 'dev' description in 'pch_udc_wait_ep_stall'
   drivers/usb/gadget/udc/pch_udc.c:1341: warning: Function parameter or member 'data' not described in 'pch_vbus_gpio_irq'
   drivers/usb/gadget/udc/pch_udc.c:1341: warning: Excess function parameter 'dev' description in 'pch_vbus_gpio_irq'
   drivers/usb/gadget/udc/pch_udc.c:1365: warning: Function parameter or member 'vbus_gpio_port' not described in 'pch_vbus_gpio_init'
   drivers/usb/gadget/udc/pch_udc.c:1510: warning: Function parameter or member 'dev' not described in 'pch_udc_free_dma_chain'
   drivers/usb/gadget/udc/pch_udc.c:1510: warning: Function parameter or member 'req' not described in 'pch_udc_free_dma_chain'
   drivers/usb/gadget/udc/pch_udc.c:1717: warning: Function parameter or member 'usbep' not described in 'pch_udc_pcd_ep_disable'
   drivers/usb/gadget/udc/pch_udc.c:2006: warning: Excess function parameter 'halt' description in 'pch_udc_pcd_set_wedge'
   drivers/usb/gadget/udc/pch_udc.c:2756: warning: Function parameter or member 'pdev' not described in 'pch_udc_isr'
   drivers/usb/gadget/udc/pch_udc.c:2756: warning: Excess function parameter 'dev' description in 'pch_udc_isr'
   drivers/usb/gadget/udc/pch_udc.c:2906: warning: Function parameter or member 'dev' not described in 'init_dma_pools'
   drivers/usb/gadget/udc/pch_udc.c:2906: warning: Excess function parameter 'pdev' description in 'init_dma_pools'
   drivers/usb/host/fotg210-hcd.c:5569: warning: Function parameter or member 'pdev' not described in 'fotg210_hcd_probe'
   drivers/usb/host/fotg210-hcd.c:5666: warning: Function parameter or member 'pdev' not described in 'fotg210_hcd_remove'
   drivers/usb/host/fotg210-hcd.c:5666: warning: Excess function parameter 'dev' description in 'fotg210_hcd_remove'
   make[4]: Target '__build' not remade because of errors.
   make[2]: *** [scripts/Makefile.build:497: drivers/usb] Error 2
   make[3]: *** [scripts/Makefile.build:497: drivers/usb/host] Error 2
   make[3]: Target '__build' not remade because of errors.
   make[2]: Target '__build' not remade because of errors.
..

vim +/xhci_reset_halted_ep +857 drivers/usb/host/xhci-ring.c

   710	
   711	/*
   712	 * When we get a command completion for a Stop Endpoint Command, we need to
   713	 * unlink any cancelled TDs from the ring.  There are two ways to do that:
   714	 *
   715	 *  1. If the HW was in the middle of processing the TD that needs to be
   716	 *     cancelled, then we must move the ring's dequeue pointer past the last TRB
   717	 *     in the TD with a Set Dequeue Pointer Command.
   718	 *  2. Otherwise, we turn all the TRBs in the TD into No-op TRBs (with the chain
   719	 *     bit cleared) so that the HW will skip over them.
   720	 */
   721	static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
   722			union xhci_trb *trb, struct xhci_event_cmd *event)
   723	{
   724		unsigned int ep_index;
   725		struct xhci_ring *ep_ring;
   726		struct xhci_virt_ep *ep;
   727		struct xhci_td *cur_td = NULL;
   728		struct xhci_td *halted_td = NULL;
   729		struct xhci_td *last_unlinked_td;
   730		struct xhci_ep_ctx *ep_ctx;
   731		struct xhci_virt_device *vdev;
   732		u64 hw_deq;
   733		struct xhci_dequeue_state deq_state;
   734		u32 comp_code;
   735	
   736		if (unlikely(TRB_TO_SUSPEND_PORT(le32_to_cpu(trb->generic.field[3])))) {
   737			if (!xhci->devs[slot_id])
   738				xhci_warn(xhci, "Stop endpoint command "
   739					"completion for disabled slot %u\n",
   740					slot_id);
   741			return;
   742		}
   743	
   744		memset(&deq_state, 0, sizeof(deq_state));
   745		ep_index = TRB_TO_EP_INDEX(le32_to_cpu(trb->generic.field[3]));
   746	
   747		vdev = xhci->devs[slot_id];
   748		ep_ctx = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
   749	
   750		trace_xhci_handle_cmd_stop_ep(ep_ctx);
   751	
   752		ep = &xhci->devs[slot_id]->eps[ep_index];
   753		comp_code = GET_COMP_CODE(le32_to_cpu(event->status));
   754	
   755		if (comp_code == COMP_CONTEXT_STATE_ERROR) {
   756			/* endpoint is halted and needs to be reset */
   757			if (GET_EP_CTX_STATE(ep_ctx) == EP_STATE_HALTED) {
   758				ep->ep_state |= EP_HALTED;
   759			}
   760		}
   761	
   762		last_unlinked_td = list_last_entry(&ep->cancelled_td_list,
   763				struct xhci_td, cancelled_td_list);
   764	
   765		if (list_empty(&ep->cancelled_td_list)) {
   766			xhci_stop_watchdog_timer_in_irq(xhci, ep);
   767			ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
   768			return;
   769		}
   770	
   771		/* Fix up the ep ring first, so HW stops executing cancelled TDs.
   772		 * We have the xHCI lock, so nothing can modify this list until we drop
   773		 * it.  We're also in the event handler, so we can't get re-interrupted
   774		 * if another Stop Endpoint command completes
   775		 */
   776		list_for_each_entry(cur_td, &ep->cancelled_td_list, cancelled_td_list) {
   777			xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
   778					"Removing canceled TD starting at 0x%llx (dma).",
   779					(unsigned long long)xhci_trb_virt_to_dma(
   780						cur_td->start_seg, cur_td->first_trb));
   781			ep_ring = xhci_urb_to_transfer_ring(xhci, cur_td->urb);
   782			if (!ep_ring) {
   783				/* This shouldn't happen unless a driver is mucking
   784				 * with the stream ID after submission.  This will
   785				 * leave the TD on the hardware ring, and the hardware
   786				 * will try to execute it, and may access a buffer
   787				 * that has already been freed.  In the best case, the
   788				 * hardware will execute it, and the event handler will
   789				 * ignore the completion event for that TD, since it was
   790				 * removed from the td_list for that endpoint.  In
   791				 * short, don't muck with the stream ID after
   792				 * submission.
   793				 */
   794				xhci_warn(xhci, "WARN Cancelled URB %p "
   795						"has invalid stream ID %u.\n",
   796						cur_td->urb,
   797						cur_td->urb->stream_id);
   798				goto remove_finished_td;
   799			}
   800			/*
   801			 * If we stopped on the TD we need to cancel, then we have to
   802			 * move the xHC endpoint ring dequeue pointer past this TD.
   803			 */
   804			hw_deq = xhci_get_hw_deq(xhci, vdev, ep_index,
   805						 cur_td->urb->stream_id);
   806			hw_deq &= ~0xf;
   807	
   808			if (trb_in_td(xhci, cur_td->start_seg, cur_td->first_trb,
   809				      cur_td->last_trb, hw_deq, false)) {
   810				xhci_find_new_dequeue_state(xhci, slot_id, ep_index,
   811							    cur_td->urb->stream_id,
   812							    cur_td, &deq_state);
   813			} else {
   814				td_to_noop(xhci, ep_ring, cur_td, false);
   815			}
   816	
   817	remove_finished_td:
   818			/*
   819			 * The event handler won't see a completion for this TD anymore,
   820			 * so remove it from the endpoint ring's TD list.  Keep it in
   821			 * the cancelled TD list for URB completion later.
   822			 */
   823			list_del_init(&cur_td->td_list);
   824		}
   825	
   826		xhci_stop_watchdog_timer_in_irq(xhci, ep);
   827	
   828		/*
   829		 * If stop endpoint command raced with a halting endpoint we need to
   830		 * reset the endpoint first. If the TD we halted on isn't cancelled we
   831		 * must give it back with -EPIPE status, and move ring dequeue past it.
   832		 * If we can't find hw_deq, or the TD we halted on, do a soft reset
   833		 */
   834		   /* FIXME, is there a risk EP_HALTED is set from other cases */
   835		if (ep->ep_state & EP_HALTED) {
   836			enum xhci_ep_reset_type reset_type = EP_SOFT_RESET;
   837			struct xhci_td *td;
   838	
   839			if (deq_state.new_deq_ptr && deq_state.new_deq_seg) {
   840				reset_type = EP_HARD_RESET;
   841			} else if (ep->ep_state & EP_HAS_STREAMS) {
   842				/* soft reset, nothing else */
   843			} else if (!list_empty(&ep->ring->td_list)) {
   844				hw_deq = xhci_get_hw_deq(xhci, vdev, ep_index, 0);
   845				hw_deq &= ~0xf;
   846				td = list_first_entry(&ep->ring->td_list,
   847							     struct xhci_td, td_list);
   848				if (trb_in_td(xhci, td->start_seg, td->first_trb,
   849					      td->last_trb, hw_deq, false)) {
   850					halted_td = td;
   851					reset_type = EP_HARD_RESET;
   852					xhci_find_new_dequeue_state(xhci, slot_id,
   853								    ep_index, 0, td,
   854								    &deq_state);
   855				}
   856			}
 > 857			xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type);
   858			/* FIXME xhci_clear_hub_tt_buffer(xhci, td, ep); */
   859		}
   860	
   861		/* If necessary, queue a Set Transfer Ring Dequeue Pointer command */
   862		if (deq_state.new_deq_ptr && deq_state.new_deq_seg) {
   863			xhci_queue_new_dequeue_state(xhci, slot_id, ep_index,
   864						     &deq_state);
   865			xhci_ring_cmd_db(xhci);
   866		} else if (ep->ep_state & EP_HALTED) {
   867			xhci_ring_cmd_db(xhci); /* for endpoint soft reset command */
   868		} else {
   869			/* Otherwise ring the doorbell(s) to restart queued transfers */
   870			ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
   871		}
   872	
   873		/* If TD we halted on wasn't cancelled give it back with -EPIPE */
   874		if (halted_td) {
   875			xhci_unmap_td_bounce_buffer(xhci, ep->ring, halted_td);
   876			list_del_init(&halted_td->td_list);
   877			inc_td_cnt(halted_td->urb);
   878			if (last_td_in_urb(halted_td))
   879				xhci_giveback_urb_in_irq(xhci, halted_td, -EPIPE);
   880		}
   881	
   882		/*
   883		 * Drop the lock and complete the URBs in the cancelled TD list.
   884		 * New TDs to be cancelled might be added to the end of the list before
   885		 * we can complete all the URBs for the TDs we already unlinked.
   886		 * So stop when we've completed the URB for the last TD we unlinked.
   887		 */
   888		do {
   889			cur_td = list_first_entry(&ep->cancelled_td_list,
   890					struct xhci_td, cancelled_td_list);
   891			list_del_init(&cur_td->cancelled_td_list);
   892	
   893			/* Clean up the cancelled URB */
   894			/* Doesn't matter what we pass for status, since the core will
   895			 * just overwrite it (because the URB has been unlinked).
   896			 */
   897			ep_ring = xhci_urb_to_transfer_ring(xhci, cur_td->urb);
   898			xhci_unmap_td_bounce_buffer(xhci, ep_ring, cur_td);
   899			inc_td_cnt(cur_td->urb);
   900			if (last_td_in_urb(cur_td))
   901				xhci_giveback_urb_in_irq(xhci, cur_td, 0);
   902	
   903			/* Stop processing the cancelled list if the watchdog timer is
   904			 * running.
   905			 */
   906			if (xhci->xhc_state & XHCI_STATE_DYING)
   907				return;
   908		} while (cur_td != last_unlinked_td);
   909	
   910		/* Return to the event handler with xhci->lock re-acquired */
   911	}
   912	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 28432 bytes --]

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH] xhci: fix halted endpoint at stop endpoint command completion
@ 2020-06-30 10:40     ` kernel test robot
  0 siblings, 0 replies; 10+ messages in thread
From: kernel test robot @ 2020-06-30 10:40 UTC (permalink / raw)
  To: kbuild-all

[-- Attachment #1: Type: text/plain, Size: 45996 bytes --]

Hi Mathias,

I love your patch! Yet something to improve:

[auto build test ERROR on usb/usb-testing]
[also build test ERROR on v5.8-rc3 next-20200629]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use  as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Mathias-Nyman/xhci-fix-halted-endpoint-at-stop-endpoint-command-completion/20200630-031254
base:   https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
config: arm-randconfig-r013-20200630 (attached as .config)
compiler: clang version 11.0.0 (https://github.com/llvm/llvm-project cf1d04484344be52ada8178e41d18fd15a9b880c)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # install arm cross compiling tool for clang build
        # apt-get install binutils-arm-linux-gnueabi
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

   drivers/usb/typec/tps6598x.c:164:19: warning: unused function 'tps6598x_write32' [-Wunused-function]
   static inline int tps6598x_write32(struct tps6598x *tps, u8 reg, u32 val)
                     ^
   drivers/usb/gadget/function/u_serial.c:538: warning: Function parameter or member 'port' not described in 'gs_start_io'
   drivers/usb/gadget/function/u_serial.c:538: warning: Excess function parameter 'dev' description in 'gs_start_io'
   drivers/usb/gadget/udc/dummy_hcd.c:1597: warning: Function parameter or member 'dum_hcd' not described in 'handle_control_request'
   drivers/usb/gadget/udc/dummy_hcd.c:1597: warning: Excess function parameter 'dum' description in 'handle_control_request'
   drivers/usb/gadget/legacy/printer.c:24:19: warning: unused variable 'driver_desc' [-Wunused-const-variable]
   static const char driver_desc [] = DRIVER_DESC;
                     ^
   1 warning generated.
   2 warnings generated.
   drivers/usb/host/ehci-platform.c:478:36: warning: unused variable 'ehci_acpi_match' [-Wunused-const-variable]
   static const struct acpi_device_id ehci_acpi_match[] = {
                                      ^
   1 warning generated.
   drivers/usb/misc/iowarrior.c:251: warning: Function parameter or member 'dev' not described in 'iowarrior_delete'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'file' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'buffer' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'count' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'ppos' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:483: warning: Function parameter or member 'file' not described in 'iowarrior_ioctl'
   drivers/usb/misc/iowarrior.c:483: warning: Function parameter or member 'cmd' not described in 'iowarrior_ioctl'
   drivers/usb/misc/iowarrior.c:483: warning: Function parameter or member 'arg' not described in 'iowarrior_ioctl'
   drivers/usb/misc/iowarrior.c:599: warning: Function parameter or member 'inode' not described in 'iowarrior_open'
   drivers/usb/misc/iowarrior.c:599: warning: Function parameter or member 'file' not described in 'iowarrior_open'
   drivers/usb/misc/iowarrior.c:647: warning: Function parameter or member 'inode' not described in 'iowarrior_release'
   drivers/usb/misc/iowarrior.c:647: warning: Function parameter or member 'file' not described in 'iowarrior_release'
   drivers/usb/misc/iowarrior.c:753: warning: Function parameter or member 'interface' not described in 'iowarrior_probe'
   drivers/usb/misc/iowarrior.c:753: warning: Function parameter or member 'id' not described in 'iowarrior_probe'
   drivers/usb/misc/iowarrior.c:879: warning: Function parameter or member 'interface' not described in 'iowarrior_disconnect'
   1 warning generated.
   drivers/usb/gadget/udc/amd5536udc_pci.c:52:19: warning: unused variable 'mod_desc' [-Wunused-const-variable]
   static const char mod_desc[] = UDC_MOD_DESCRIPTION;
                     ^
   1 warning generated.
   drivers/usb/misc/ldusb.c:192: warning: Function parameter or member 'dev' not described in 'ld_usb_abort_transfers'
   drivers/usb/misc/ldusb.c:206: warning: Function parameter or member 'dev' not described in 'ld_usb_delete'
   drivers/usb/misc/ldusb.c:220: warning: Function parameter or member 'urb' not described in 'ld_usb_interrupt_in_callback'
   drivers/usb/misc/ldusb.c:281: warning: Function parameter or member 'urb' not described in 'ld_usb_interrupt_out_callback'
   drivers/usb/misc/ldusb.c:301: warning: Function parameter or member 'inode' not described in 'ld_usb_open'
   drivers/usb/misc/ldusb.c:301: warning: Function parameter or member 'file' not described in 'ld_usb_open'
   drivers/usb/misc/ldusb.c:372: warning: Function parameter or member 'inode' not described in 'ld_usb_release'
   drivers/usb/misc/ldusb.c:372: warning: Function parameter or member 'file' not described in 'ld_usb_release'
   drivers/usb/misc/ldusb.c:414: warning: Function parameter or member 'file' not described in 'ld_usb_poll'
   drivers/usb/misc/ldusb.c:414: warning: Function parameter or member 'wait' not described in 'ld_usb_poll'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'file' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'buffer' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'count' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'ppos' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'file' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'buffer' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'count' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'ppos' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:651: warning: Function parameter or member 'intf' not described in 'ld_usb_probe'
   drivers/usb/misc/ldusb.c:651: warning: Function parameter or member 'id' not described in 'ld_usb_probe'
   drivers/usb/misc/ldusb.c:754: warning: Function parameter or member 'intf' not described in 'ld_usb_disconnect'
   drivers/usb/serial/quatech2.c:179:19: warning: unused function 'qt2_setdevice' [-Wunused-function]
   static inline int qt2_setdevice(struct usb_device *dev, u8 *data)
                     ^
   drivers/usb/core/ledtrig-usbport.c:42: warning: Function parameter or member 'usbport_data' not described in 'usbport_trig_usb_dev_observed'
   drivers/usb/core/ledtrig-usbport.c:42: warning: Function parameter or member 'usb_dev' not described in 'usbport_trig_usb_dev_observed'
   drivers/usb/core/ledtrig-usbport.c:71: warning: Function parameter or member 'usbport_data' not described in 'usbport_trig_update_count'
   drivers/usb/core/ledtrig-usbport.c:131: warning: Function parameter or member 'usbport_data' not described in 'usbport_trig_port_observed'
   drivers/usb/core/ledtrig-usbport.c:131: warning: Function parameter or member 'usb_dev' not described in 'usbport_trig_port_observed'
   drivers/usb/core/ledtrig-usbport.c:131: warning: Function parameter or member 'port1' not described in 'usbport_trig_port_observed'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'dev' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'function' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'size' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'data' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:290: warning: Function parameter or member 'dev' not described in 'tower_delete'
   drivers/usb/misc/legousbtower.c:306: warning: Function parameter or member 'inode' not described in 'tower_open'
   drivers/usb/misc/legousbtower.c:306: warning: Function parameter or member 'file' not described in 'tower_open'
   drivers/usb/misc/legousbtower.c:405: warning: Function parameter or member 'inode' not described in 'tower_release'
   drivers/usb/misc/legousbtower.c:405: warning: Function parameter or member 'file' not described in 'tower_release'
   drivers/usb/misc/legousbtower.c:452: warning: Function parameter or member 'dev' not described in 'tower_check_for_read_packet'
   drivers/usb/misc/legousbtower.c:468: warning: Function parameter or member 'file' not described in 'tower_poll'
   drivers/usb/misc/legousbtower.c:468: warning: Function parameter or member 'wait' not described in 'tower_poll'
   drivers/usb/misc/legousbtower.c:494: warning: Function parameter or member 'file' not described in 'tower_llseek'
   drivers/usb/misc/legousbtower.c:494: warning: Function parameter or member 'off' not described in 'tower_llseek'
   drivers/usb/misc/legousbtower.c:494: warning: Function parameter or member 'whence' not described in 'tower_llseek'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'file' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'buffer' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'count' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'ppos' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'file' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'buffer' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'count' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'ppos' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:669: warning: Function parameter or member 'urb' not described in 'tower_interrupt_in_callback'
   1 warning generateddrivers/usb/misc/legousbtower.c:724: warning: Function parameter or member 'urb' not described in 'tower_interrupt_out_callback'
   .
   drivers/usb/misc/legousbtower.c:752: warning: Function parameter or member 'interface' not described in 'tower_probe'
   drivers/usb/misc/legousbtower.c:752: warning: Function parameter or member 'id' not described in 'tower_probe'
   drivers/usb/misc/legousbtower.c:863: warning: Function parameter or member 'interface' not described in 'tower_disconnect'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'type' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'h' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'data' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'len' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'priv' not described in '__ffs_data_do_os_desc'
>> drivers/usb/host/xhci-ring.c:857:3: error: implicit declaration of function 'xhci_reset_halted_ep' [-Werror,-Wimplicit-function-declaration]
                   xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type);
                   ^
   1 error generated.
   make[4]: *** [scripts/Makefile.build:281: drivers/usb/host/xhci-ring.o] Error 1
   drivers/usb/host/sl811-hcd.c:588:18: warning: unused function 'checkdone' [-Wunused-function]
   static inline u8 checkdone(struct sl811 *sl811)
                    ^
   drivers/usb/gadget/udc/mv_udc_core.c:56:19: warning: unused variable 'driver_desc' [-Wunused-const-variable]
   static const char driver_desc[] = DRIVER_DESC;
                     ^
   drivers/usb/host/xhci.c:1285: warning: Function parameter or member 'desc' not described in 'xhci_get_endpoint_index'
   1 warning generated.
   drivers/usb/gadget/udc/mv_u3d_core.c:35:19: warning: unused variable 'driver_desc' [-Wunused-const-variable]
   static const char driver_desc[] = DRIVER_DESC;
                     ^
   drivers/usb/host/xhci-plat.c:457:36: warning: unused variable 'usb_xhci_acpi_match' [-Wunused-const-variable]
   static const struct acpi_device_id usb_xhci_acpi_match[] = {
                                      ^
   drivers/usb/host/xhci-dbgtty.c:19: warning: Function parameter or member 'port' not described in 'dbc_send_packet'
   drivers/usb/host/xhci-dbgtty.c:19: warning: Function parameter or member 'packet' not described in 'dbc_send_packet'
   drivers/usb/host/xhci-dbgtty.c:19: warning: Function parameter or member 'size' not described in 'dbc_send_packet'
   drivers/usb/host/bcma-hcd.c:180: warning: Function parameter or member 'usb_dev' not described in 'bcma_hcd_usb20_old_arm_init'
   drivers/usb/host/bcma-hcd.c:268: warning: Function parameter or member 'bcma_hcd' not described in 'bcma_hcd_usb20_ns_init'
   1 warning generated.
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'xhci' not described in 'dbc_dma_alloc_coherent'
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'size' not described in 'dbc_dma_alloc_coherent'
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'dma_handle' not described in 'dbc_dma_alloc_coherent'
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'flags' not described in 'dbc_dma_alloc_coherent'
   1 warning generated.
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'xhci' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'num_segs' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'cycle_state' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'type' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'max_packet' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'flags' not described in 'xhci_ring_alloc'
   1 warning generated.
   drivers/usb/gadget/udc/pch_udc.c:239: warning: Function parameter or member 'request' not described in 'pch_udc_stp_dma_desc'
   drivers/usb/gadget/udc/pch_udc.c:315: warning: Function parameter or member 'irq_work_fall' not described in 'pch_vbus_gpio_data'
   drivers/usb/gadget/udc/pch_udc.c:315: warning: Function parameter or member 'irq_work_rise' not described in 'pch_vbus_gpio_data'
   drivers/usb/gadget/udc/pch_udc.c:482: warning: Function parameter or member 'ep' not described in 'pch_udc_write_csr'
   drivers/usb/gadget/udc/pch_udc.c:482: warning: Excess function parameter 'addr' description in 'pch_udc_write_csr'
   drivers/usb/gadget/udc/pch_udc.c:498: warning: Function parameter or member 'ep' not described in 'pch_udc_read_csr'
   drivers/usb/gadget/udc/pch_udc.c:498: warning: Excess function parameter 'addr' description in 'pch_udc_read_csr'
   drivers/usb/gadget/udc/pch_udc.c:662: warning: Function parameter or member 'ep_in' not described in 'pch_udc_ep_set_bufsz'
   drivers/usb/gadget/udc/pch_udc.c:977: warning: Function parameter or member 'ep' not described in 'pch_udc_ep_enable'
   drivers/usb/gadget/udc/pch_udc.c:977: warning: Function parameter or member 'cfg' not described in 'pch_udc_ep_enable'
   drivers/usb/gadget/udc/pch_udc.c:977: warning: Excess function parameter 'regs' description in 'pch_udc_ep_enable'
   drivers/usb/gadget/udc/pch_udc.c:1010: warning: Function parameter or member 'ep' not described in 'pch_udc_ep_disable'
   drivers/usb/gadget/udc/pch_udc.c:1010: warning: Excess function parameter 'regs' description in 'pch_udc_ep_disable'
   drivers/usb/gadget/udc/pch_udc.c:1030: warning: Function parameter or member 'ep' not described in 'pch_udc_wait_ep_stall'
   drivers/usb/gadget/udc/pch_udc.c:1030: warning: Excess function parameter 'dev' description in 'pch_udc_wait_ep_stall'
   drivers/usb/gadget/udc/pch_udc.c:1341: warning: Function parameter or member 'data' not described in 'pch_vbus_gpio_irq'
   drivers/usb/gadget/udc/pch_udc.c:1341: warning: Excess function parameter 'dev' description in 'pch_vbus_gpio_irq'
   drivers/usb/gadget/udc/pch_udc.c:1365: warning: Function parameter or member 'vbus_gpio_port' not described in 'pch_vbus_gpio_init'
   drivers/usb/gadget/udc/pch_udc.c:1510: warning: Function parameter or member 'dev' not described in 'pch_udc_free_dma_chain'
   drivers/usb/gadget/udc/pch_udc.c:1510: warning: Function parameter or member 'req' not described in 'pch_udc_free_dma_chain'
   drivers/usb/gadget/udc/pch_udc.c:1717: warning: Function parameter or member 'usbep' not described in 'pch_udc_pcd_ep_disable'
   drivers/usb/gadget/udc/pch_udc.c:2006: warning: Excess function parameter 'halt' description in 'pch_udc_pcd_set_wedge'
   drivers/usb/gadget/udc/pch_udc.c:2756: warning: Function parameter or member 'pdev' not described in 'pch_udc_isr'
   drivers/usb/gadget/udc/pch_udc.c:2756: warning: Excess function parameter 'dev' description in 'pch_udc_isr'
   drivers/usb/gadget/udc/pch_udc.c:2906: warning: Function parameter or member 'dev' not described in 'init_dma_pools'
   drivers/usb/gadget/udc/pch_udc.c:2906: warning: Excess function parameter 'pdev' description in 'init_dma_pools'
   drivers/usb/host/fotg210-hcd.c:5569: warning: Function parameter or member 'pdev' not described in 'fotg210_hcd_probe'
   drivers/usb/host/fotg210-hcd.c:5666: warning: Function parameter or member 'pdev' not described in 'fotg210_hcd_remove'
   drivers/usb/host/fotg210-hcd.c:5666: warning: Excess function parameter 'dev' description in 'fotg210_hcd_remove'
   make[4]: Target '__build' not remade because of errors.
   make[2]: *** [scripts/Makefile.build:497: drivers/usb] Error 2
   make[3]: *** [scripts/Makefile.build:497: drivers/usb/host] Error 2
   make[3]: Target '__build' not remade because of errors.
   make[2]: Target '__build' not remade because of errors.
   make[1]: *** [Makefile:1756: drivers] Error 2
   make[1]: Target 'drivers/usb/' not remade because of errors.
--
   drivers/usb/typec/tps6598x.c:164:19: warning: unused function 'tps6598x_write32' [-Wunused-function]
   static inline int tps6598x_write32(struct tps6598x *tps, u8 reg, u32 val)
                     ^
   drivers/usb/gadget/function/u_serial.c:538: warning: Function parameter or member 'port' not described in 'gs_start_io'
   drivers/usb/gadget/function/u_serial.c:538: warning: Excess function parameter 'dev' description in 'gs_start_io'
   drivers/usb/gadget/udc/dummy_hcd.c:1597: warning: Function parameter or member 'dum_hcd' not described in 'handle_control_request'
   drivers/usb/gadget/udc/dummy_hcd.c:1597: warning: Excess function parameter 'dum' description in 'handle_control_request'
   drivers/usb/gadget/legacy/printer.c:24:19: warning: unused variable 'driver_desc' [-Wunused-const-variable]
   static const char driver_desc [] = DRIVER_DESC;
                     ^
   1 warning generated.
   2 warnings generated.
   drivers/usb/host/ehci-platform.c:478:36: warning: unused variable 'ehci_acpi_match' [-Wunused-const-variable]
   static const struct acpi_device_id ehci_acpi_match[] = {
                                      ^
   1 warning generated.
   drivers/usb/misc/iowarrior.c:251: warning: Function parameter or member 'dev' not described in 'iowarrior_delete'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'file' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'buffer' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'count' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:279: warning: Function parameter or member 'ppos' not described in 'iowarrior_read'
   drivers/usb/misc/iowarrior.c:483: warning: Function parameter or member 'file' not described in 'iowarrior_ioctl'
   drivers/usb/misc/iowarrior.c:483: warning: Function parameter or member 'cmd' not described in 'iowarrior_ioctl'
   drivers/usb/misc/iowarrior.c:483: warning: Function parameter or member 'arg' not described in 'iowarrior_ioctl'
   drivers/usb/misc/iowarrior.c:599: warning: Function parameter or member 'inode' not described in 'iowarrior_open'
   drivers/usb/misc/iowarrior.c:599: warning: Function parameter or member 'file' not described in 'iowarrior_open'
   drivers/usb/misc/iowarrior.c:647: warning: Function parameter or member 'inode' not described in 'iowarrior_release'
   drivers/usb/misc/iowarrior.c:647: warning: Function parameter or member 'file' not described in 'iowarrior_release'
   drivers/usb/misc/iowarrior.c:753: warning: Function parameter or member 'interface' not described in 'iowarrior_probe'
   drivers/usb/misc/iowarrior.c:753: warning: Function parameter or member 'id' not described in 'iowarrior_probe'
   drivers/usb/misc/iowarrior.c:879: warning: Function parameter or member 'interface' not described in 'iowarrior_disconnect'
   1 warning generated.
   drivers/usb/gadget/udc/amd5536udc_pci.c:52:19: warning: unused variable 'mod_desc' [-Wunused-const-variable]
   static const char mod_desc[] = UDC_MOD_DESCRIPTION;
                     ^
   1 warning generated.
   drivers/usb/misc/ldusb.c:192: warning: Function parameter or member 'dev' not described in 'ld_usb_abort_transfers'
   drivers/usb/misc/ldusb.c:206: warning: Function parameter or member 'dev' not described in 'ld_usb_delete'
   drivers/usb/misc/ldusb.c:220: warning: Function parameter or member 'urb' not described in 'ld_usb_interrupt_in_callback'
   drivers/usb/misc/ldusb.c:281: warning: Function parameter or member 'urb' not described in 'ld_usb_interrupt_out_callback'
   drivers/usb/misc/ldusb.c:301: warning: Function parameter or member 'inode' not described in 'ld_usb_open'
   drivers/usb/misc/ldusb.c:301: warning: Function parameter or member 'file' not described in 'ld_usb_open'
   drivers/usb/misc/ldusb.c:372: warning: Function parameter or member 'inode' not described in 'ld_usb_release'
   drivers/usb/misc/ldusb.c:372: warning: Function parameter or member 'file' not described in 'ld_usb_release'
   drivers/usb/misc/ldusb.c:414: warning: Function parameter or member 'file' not described in 'ld_usb_poll'
   drivers/usb/misc/ldusb.c:414: warning: Function parameter or member 'wait' not described in 'ld_usb_poll'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'file' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'buffer' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'count' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:439: warning: Function parameter or member 'ppos' not described in 'ld_usb_read'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'file' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'buffer' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'count' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:526: warning: Function parameter or member 'ppos' not described in 'ld_usb_write'
   drivers/usb/misc/ldusb.c:651: warning: Function parameter or member 'intf' not described in 'ld_usb_probe'
   drivers/usb/misc/ldusb.c:651: warning: Function parameter or member 'id' not described in 'ld_usb_probe'
   drivers/usb/misc/ldusb.c:754: warning: Function parameter or member 'intf' not described in 'ld_usb_disconnect'
   drivers/usb/serial/quatech2.c:179:19: warning: unused function 'qt2_setdevice' [-Wunused-function]
   static inline int qt2_setdevice(struct usb_device *dev, u8 *data)
                     ^
   drivers/usb/core/ledtrig-usbport.c:42: warning: Function parameter or member 'usbport_data' not described in 'usbport_trig_usb_dev_observed'
   drivers/usb/core/ledtrig-usbport.c:42: warning: Function parameter or member 'usb_dev' not described in 'usbport_trig_usb_dev_observed'
   drivers/usb/core/ledtrig-usbport.c:71: warning: Function parameter or member 'usbport_data' not described in 'usbport_trig_update_count'
   drivers/usb/core/ledtrig-usbport.c:131: warning: Function parameter or member 'usbport_data' not described in 'usbport_trig_port_observed'
   drivers/usb/core/ledtrig-usbport.c:131: warning: Function parameter or member 'usb_dev' not described in 'usbport_trig_port_observed'
   drivers/usb/core/ledtrig-usbport.c:131: warning: Function parameter or member 'port1' not described in 'usbport_trig_port_observed'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'dev' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'function' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'size' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:280: warning: Function parameter or member 'data' not described in 'lego_usb_tower_debug_data'
   drivers/usb/misc/legousbtower.c:290: warning: Function parameter or member 'dev' not described in 'tower_delete'
   drivers/usb/misc/legousbtower.c:306: warning: Function parameter or member 'inode' not described in 'tower_open'
   drivers/usb/misc/legousbtower.c:306: warning: Function parameter or member 'file' not described in 'tower_open'
   drivers/usb/misc/legousbtower.c:405: warning: Function parameter or member 'inode' not described in 'tower_release'
   drivers/usb/misc/legousbtower.c:405: warning: Function parameter or member 'file' not described in 'tower_release'
   drivers/usb/misc/legousbtower.c:452: warning: Function parameter or member 'dev' not described in 'tower_check_for_read_packet'
   drivers/usb/misc/legousbtower.c:468: warning: Function parameter or member 'file' not described in 'tower_poll'
   drivers/usb/misc/legousbtower.c:468: warning: Function parameter or member 'wait' not described in 'tower_poll'
   drivers/usb/misc/legousbtower.c:494: warning: Function parameter or member 'file' not described in 'tower_llseek'
   drivers/usb/misc/legousbtower.c:494: warning: Function parameter or member 'off' not described in 'tower_llseek'
   drivers/usb/misc/legousbtower.c:494: warning: Function parameter or member 'whence' not described in 'tower_llseek'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'file' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'buffer' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'count' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:503: warning: Function parameter or member 'ppos' not described in 'tower_read'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'file' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'buffer' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'count' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:587: warning: Function parameter or member 'ppos' not described in 'tower_write'
   drivers/usb/misc/legousbtower.c:669: warning: Function parameter or member 'urb' not described in 'tower_interrupt_in_callback'
   1 warning generateddrivers/usb/misc/legousbtower.c:724: warning: Function parameter or member 'urb' not described in 'tower_interrupt_out_callback'
   .
   drivers/usb/misc/legousbtower.c:752: warning: Function parameter or member 'interface' not described in 'tower_probe'
   drivers/usb/misc/legousbtower.c:752: warning: Function parameter or member 'id' not described in 'tower_probe'
   drivers/usb/misc/legousbtower.c:863: warning: Function parameter or member 'interface' not described in 'tower_disconnect'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'type' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'h' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'data' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'len' not described in '__ffs_data_do_os_desc'
   drivers/usb/gadget/function/f_fs.c:2361: warning: Function parameter or member 'priv' not described in '__ffs_data_do_os_desc'
>> drivers/usb/host/xhci-ring.c:857:3: error: implicit declaration of function 'xhci_reset_halted_ep' [-Werror,-Wimplicit-function-declaration]
                   xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type);
                   ^
   1 error generated.
   make[4]: *** [scripts/Makefile.build:281: drivers/usb/host/xhci-ring.o] Error 1
   drivers/usb/host/sl811-hcd.c:588:18: warning: unused function 'checkdone' [-Wunused-function]
   static inline u8 checkdone(struct sl811 *sl811)
                    ^
   drivers/usb/gadget/udc/mv_udc_core.c:56:19: warning: unused variable 'driver_desc' [-Wunused-const-variable]
   static const char driver_desc[] = DRIVER_DESC;
                     ^
   drivers/usb/host/xhci.c:1285: warning: Function parameter or member 'desc' not described in 'xhci_get_endpoint_index'
   1 warning generated.
   drivers/usb/gadget/udc/mv_u3d_core.c:35:19: warning: unused variable 'driver_desc' [-Wunused-const-variable]
   static const char driver_desc[] = DRIVER_DESC;
                     ^
   drivers/usb/host/xhci-plat.c:457:36: warning: unused variable 'usb_xhci_acpi_match' [-Wunused-const-variable]
   static const struct acpi_device_id usb_xhci_acpi_match[] = {
                                      ^
   drivers/usb/host/xhci-dbgtty.c:19: warning: Function parameter or member 'port' not described in 'dbc_send_packet'
   drivers/usb/host/xhci-dbgtty.c:19: warning: Function parameter or member 'packet' not described in 'dbc_send_packet'
   drivers/usb/host/xhci-dbgtty.c:19: warning: Function parameter or member 'size' not described in 'dbc_send_packet'
   drivers/usb/host/bcma-hcd.c:180: warning: Function parameter or member 'usb_dev' not described in 'bcma_hcd_usb20_old_arm_init'
   drivers/usb/host/bcma-hcd.c:268: warning: Function parameter or member 'bcma_hcd' not described in 'bcma_hcd_usb20_ns_init'
   1 warning generated.
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'xhci' not described in 'dbc_dma_alloc_coherent'
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'size' not described in 'dbc_dma_alloc_coherent'
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'dma_handle' not described in 'dbc_dma_alloc_coherent'
   drivers/usb/host/xhci-dbgcap.c:20: warning: Function parameter or member 'flags' not described in 'dbc_dma_alloc_coherent'
   1 warning generated.
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'xhci' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'num_segs' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'cycle_state' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'type' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'max_packet' not described in 'xhci_ring_alloc'
   drivers/usb/host/xhci-mem.c:365: warning: Function parameter or member 'flags' not described in 'xhci_ring_alloc'
   1 warning generated.
   drivers/usb/gadget/udc/pch_udc.c:239: warning: Function parameter or member 'request' not described in 'pch_udc_stp_dma_desc'
   drivers/usb/gadget/udc/pch_udc.c:315: warning: Function parameter or member 'irq_work_fall' not described in 'pch_vbus_gpio_data'
   drivers/usb/gadget/udc/pch_udc.c:315: warning: Function parameter or member 'irq_work_rise' not described in 'pch_vbus_gpio_data'
   drivers/usb/gadget/udc/pch_udc.c:482: warning: Function parameter or member 'ep' not described in 'pch_udc_write_csr'
   drivers/usb/gadget/udc/pch_udc.c:482: warning: Excess function parameter 'addr' description in 'pch_udc_write_csr'
   drivers/usb/gadget/udc/pch_udc.c:498: warning: Function parameter or member 'ep' not described in 'pch_udc_read_csr'
   drivers/usb/gadget/udc/pch_udc.c:498: warning: Excess function parameter 'addr' description in 'pch_udc_read_csr'
   drivers/usb/gadget/udc/pch_udc.c:662: warning: Function parameter or member 'ep_in' not described in 'pch_udc_ep_set_bufsz'
   drivers/usb/gadget/udc/pch_udc.c:977: warning: Function parameter or member 'ep' not described in 'pch_udc_ep_enable'
   drivers/usb/gadget/udc/pch_udc.c:977: warning: Function parameter or member 'cfg' not described in 'pch_udc_ep_enable'
   drivers/usb/gadget/udc/pch_udc.c:977: warning: Excess function parameter 'regs' description in 'pch_udc_ep_enable'
   drivers/usb/gadget/udc/pch_udc.c:1010: warning: Function parameter or member 'ep' not described in 'pch_udc_ep_disable'
   drivers/usb/gadget/udc/pch_udc.c:1010: warning: Excess function parameter 'regs' description in 'pch_udc_ep_disable'
   drivers/usb/gadget/udc/pch_udc.c:1030: warning: Function parameter or member 'ep' not described in 'pch_udc_wait_ep_stall'
   drivers/usb/gadget/udc/pch_udc.c:1030: warning: Excess function parameter 'dev' description in 'pch_udc_wait_ep_stall'
   drivers/usb/gadget/udc/pch_udc.c:1341: warning: Function parameter or member 'data' not described in 'pch_vbus_gpio_irq'
   drivers/usb/gadget/udc/pch_udc.c:1341: warning: Excess function parameter 'dev' description in 'pch_vbus_gpio_irq'
   drivers/usb/gadget/udc/pch_udc.c:1365: warning: Function parameter or member 'vbus_gpio_port' not described in 'pch_vbus_gpio_init'
   drivers/usb/gadget/udc/pch_udc.c:1510: warning: Function parameter or member 'dev' not described in 'pch_udc_free_dma_chain'
   drivers/usb/gadget/udc/pch_udc.c:1510: warning: Function parameter or member 'req' not described in 'pch_udc_free_dma_chain'
   drivers/usb/gadget/udc/pch_udc.c:1717: warning: Function parameter or member 'usbep' not described in 'pch_udc_pcd_ep_disable'
   drivers/usb/gadget/udc/pch_udc.c:2006: warning: Excess function parameter 'halt' description in 'pch_udc_pcd_set_wedge'
   drivers/usb/gadget/udc/pch_udc.c:2756: warning: Function parameter or member 'pdev' not described in 'pch_udc_isr'
   drivers/usb/gadget/udc/pch_udc.c:2756: warning: Excess function parameter 'dev' description in 'pch_udc_isr'
   drivers/usb/gadget/udc/pch_udc.c:2906: warning: Function parameter or member 'dev' not described in 'init_dma_pools'
   drivers/usb/gadget/udc/pch_udc.c:2906: warning: Excess function parameter 'pdev' description in 'init_dma_pools'
   drivers/usb/host/fotg210-hcd.c:5569: warning: Function parameter or member 'pdev' not described in 'fotg210_hcd_probe'
   drivers/usb/host/fotg210-hcd.c:5666: warning: Function parameter or member 'pdev' not described in 'fotg210_hcd_remove'
   drivers/usb/host/fotg210-hcd.c:5666: warning: Excess function parameter 'dev' description in 'fotg210_hcd_remove'
   make[4]: Target '__build' not remade because of errors.
   make[2]: *** [scripts/Makefile.build:497: drivers/usb] Error 2
   make[3]: *** [scripts/Makefile.build:497: drivers/usb/host] Error 2
   make[3]: Target '__build' not remade because of errors.
   make[2]: Target '__build' not remade because of errors.
..

vim +/xhci_reset_halted_ep +857 drivers/usb/host/xhci-ring.c

   710	
   711	/*
   712	 * When we get a command completion for a Stop Endpoint Command, we need to
   713	 * unlink any cancelled TDs from the ring.  There are two ways to do that:
   714	 *
   715	 *  1. If the HW was in the middle of processing the TD that needs to be
   716	 *     cancelled, then we must move the ring's dequeue pointer past the last TRB
   717	 *     in the TD with a Set Dequeue Pointer Command.
   718	 *  2. Otherwise, we turn all the TRBs in the TD into No-op TRBs (with the chain
   719	 *     bit cleared) so that the HW will skip over them.
   720	 */
   721	static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
   722			union xhci_trb *trb, struct xhci_event_cmd *event)
   723	{
   724		unsigned int ep_index;
   725		struct xhci_ring *ep_ring;
   726		struct xhci_virt_ep *ep;
   727		struct xhci_td *cur_td = NULL;
   728		struct xhci_td *halted_td = NULL;
   729		struct xhci_td *last_unlinked_td;
   730		struct xhci_ep_ctx *ep_ctx;
   731		struct xhci_virt_device *vdev;
   732		u64 hw_deq;
   733		struct xhci_dequeue_state deq_state;
   734		u32 comp_code;
   735	
   736		if (unlikely(TRB_TO_SUSPEND_PORT(le32_to_cpu(trb->generic.field[3])))) {
   737			if (!xhci->devs[slot_id])
   738				xhci_warn(xhci, "Stop endpoint command "
   739					"completion for disabled slot %u\n",
   740					slot_id);
   741			return;
   742		}
   743	
   744		memset(&deq_state, 0, sizeof(deq_state));
   745		ep_index = TRB_TO_EP_INDEX(le32_to_cpu(trb->generic.field[3]));
   746	
   747		vdev = xhci->devs[slot_id];
   748		ep_ctx = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
   749	
   750		trace_xhci_handle_cmd_stop_ep(ep_ctx);
   751	
   752		ep = &xhci->devs[slot_id]->eps[ep_index];
   753		comp_code = GET_COMP_CODE(le32_to_cpu(event->status));
   754	
   755		if (comp_code == COMP_CONTEXT_STATE_ERROR) {
   756			/* endpoint is halted and needs to be reset */
   757			if (GET_EP_CTX_STATE(ep_ctx) == EP_STATE_HALTED) {
   758				ep->ep_state |= EP_HALTED;
   759			}
   760		}
   761	
   762		last_unlinked_td = list_last_entry(&ep->cancelled_td_list,
   763				struct xhci_td, cancelled_td_list);
   764	
   765		if (list_empty(&ep->cancelled_td_list)) {
   766			xhci_stop_watchdog_timer_in_irq(xhci, ep);
   767			ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
   768			return;
   769		}
   770	
   771		/* Fix up the ep ring first, so HW stops executing cancelled TDs.
   772		 * We have the xHCI lock, so nothing can modify this list until we drop
   773		 * it.  We're also in the event handler, so we can't get re-interrupted
   774		 * if another Stop Endpoint command completes
   775		 */
   776		list_for_each_entry(cur_td, &ep->cancelled_td_list, cancelled_td_list) {
   777			xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
   778					"Removing canceled TD starting at 0x%llx (dma).",
   779					(unsigned long long)xhci_trb_virt_to_dma(
   780						cur_td->start_seg, cur_td->first_trb));
   781			ep_ring = xhci_urb_to_transfer_ring(xhci, cur_td->urb);
   782			if (!ep_ring) {
   783				/* This shouldn't happen unless a driver is mucking
   784				 * with the stream ID after submission.  This will
   785				 * leave the TD on the hardware ring, and the hardware
   786				 * will try to execute it, and may access a buffer
   787				 * that has already been freed.  In the best case, the
   788				 * hardware will execute it, and the event handler will
   789				 * ignore the completion event for that TD, since it was
   790				 * removed from the td_list for that endpoint.  In
   791				 * short, don't muck with the stream ID after
   792				 * submission.
   793				 */
   794				xhci_warn(xhci, "WARN Cancelled URB %p "
   795						"has invalid stream ID %u.\n",
   796						cur_td->urb,
   797						cur_td->urb->stream_id);
   798				goto remove_finished_td;
   799			}
   800			/*
   801			 * If we stopped on the TD we need to cancel, then we have to
   802			 * move the xHC endpoint ring dequeue pointer past this TD.
   803			 */
   804			hw_deq = xhci_get_hw_deq(xhci, vdev, ep_index,
   805						 cur_td->urb->stream_id);
   806			hw_deq &= ~0xf;
   807	
   808			if (trb_in_td(xhci, cur_td->start_seg, cur_td->first_trb,
   809				      cur_td->last_trb, hw_deq, false)) {
   810				xhci_find_new_dequeue_state(xhci, slot_id, ep_index,
   811							    cur_td->urb->stream_id,
   812							    cur_td, &deq_state);
   813			} else {
   814				td_to_noop(xhci, ep_ring, cur_td, false);
   815			}
   816	
   817	remove_finished_td:
   818			/*
   819			 * The event handler won't see a completion for this TD anymore,
   820			 * so remove it from the endpoint ring's TD list.  Keep it in
   821			 * the cancelled TD list for URB completion later.
   822			 */
   823			list_del_init(&cur_td->td_list);
   824		}
   825	
   826		xhci_stop_watchdog_timer_in_irq(xhci, ep);
   827	
   828		/*
   829		 * If stop endpoint command raced with a halting endpoint we need to
   830		 * reset the endpoint first. If the TD we halted on isn't cancelled we
   831		 * must give it back with -EPIPE status, and move ring dequeue past it.
   832		 * If we can't find hw_deq, or the TD we halted on, do a soft reset
   833		 */
   834		   /* FIXME, is there a risk EP_HALTED is set from other cases */
   835		if (ep->ep_state & EP_HALTED) {
   836			enum xhci_ep_reset_type reset_type = EP_SOFT_RESET;
   837			struct xhci_td *td;
   838	
   839			if (deq_state.new_deq_ptr && deq_state.new_deq_seg) {
   840				reset_type = EP_HARD_RESET;
   841			} else if (ep->ep_state & EP_HAS_STREAMS) {
   842				/* soft reset, nothing else */
   843			} else if (!list_empty(&ep->ring->td_list)) {
   844				hw_deq = xhci_get_hw_deq(xhci, vdev, ep_index, 0);
   845				hw_deq &= ~0xf;
   846				td = list_first_entry(&ep->ring->td_list,
   847							     struct xhci_td, td_list);
   848				if (trb_in_td(xhci, td->start_seg, td->first_trb,
   849					      td->last_trb, hw_deq, false)) {
   850					halted_td = td;
   851					reset_type = EP_HARD_RESET;
   852					xhci_find_new_dequeue_state(xhci, slot_id,
   853								    ep_index, 0, td,
   854								    &deq_state);
   855				}
   856			}
 > 857			xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type);
   858			/* FIXME xhci_clear_hub_tt_buffer(xhci, td, ep); */
   859		}
   860	
   861		/* If necessary, queue a Set Transfer Ring Dequeue Pointer command */
   862		if (deq_state.new_deq_ptr && deq_state.new_deq_seg) {
   863			xhci_queue_new_dequeue_state(xhci, slot_id, ep_index,
   864						     &deq_state);
   865			xhci_ring_cmd_db(xhci);
   866		} else if (ep->ep_state & EP_HALTED) {
   867			xhci_ring_cmd_db(xhci); /* for endpoint soft reset command */
   868		} else {
   869			/* Otherwise ring the doorbell(s) to restart queued transfers */
   870			ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
   871		}
   872	
   873		/* If TD we halted on wasn't cancelled give it back with -EPIPE */
   874		if (halted_td) {
   875			xhci_unmap_td_bounce_buffer(xhci, ep->ring, halted_td);
   876			list_del_init(&halted_td->td_list);
   877			inc_td_cnt(halted_td->urb);
   878			if (last_td_in_urb(halted_td))
   879				xhci_giveback_urb_in_irq(xhci, halted_td, -EPIPE);
   880		}
   881	
   882		/*
   883		 * Drop the lock and complete the URBs in the cancelled TD list.
   884		 * New TDs to be cancelled might be added to the end of the list before
   885		 * we can complete all the URBs for the TDs we already unlinked.
   886		 * So stop when we've completed the URB for the last TD we unlinked.
   887		 */
   888		do {
   889			cur_td = list_first_entry(&ep->cancelled_td_list,
   890					struct xhci_td, cancelled_td_list);
   891			list_del_init(&cur_td->cancelled_td_list);
   892	
   893			/* Clean up the cancelled URB */
   894			/* Doesn't matter what we pass for status, since the core will
   895			 * just overwrite it (because the URB has been unlinked).
   896			 */
   897			ep_ring = xhci_urb_to_transfer_ring(xhci, cur_td->urb);
   898			xhci_unmap_td_bounce_buffer(xhci, ep_ring, cur_td);
   899			inc_td_cnt(cur_td->urb);
   900			if (last_td_in_urb(cur_td))
   901				xhci_giveback_urb_in_irq(xhci, cur_td, 0);
   902	
   903			/* Stop processing the cancelled list if the watchdog timer is
   904			 * running.
   905			 */
   906			if (xhci->xhc_state & XHCI_STATE_DYING)
   907				return;
   908		} while (cur_td != last_unlinked_td);
   909	
   910		/* Return to the event handler with xhci->lock re-acquired */
   911	}
   912	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 28432 bytes --]

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1
  2020-06-29 17:47 ` Mathias Nyman
  2020-06-30 10:40     ` kernel test robot
@ 2020-06-30 16:58   ` Fabian Melzow
  2020-06-30 19:03     ` Mathias Nyman
  1 sibling, 1 reply; 10+ messages in thread
From: Fabian Melzow @ 2020-06-30 16:58 UTC (permalink / raw)
  To: Mathias Nyman; +Cc: linux-usb

Hi!

Am Mon, 29 Jun 2020 20:47:24 +0300
schrieb Mathias Nyman <mathias.nyman@linux.intel.com>:

> First issue I see is that the attempt to recover from a transaction
> error with a soft retry isn't working. We expect the hardware to
> retry the transfer but nothing seems to happen. Soft retry is
> described in xhci specs 4.6.8.1 and is basically a reset endpoint
> command with TSP set, followed by ringing the endpoint doorbell.
> Traces indicate driver does this correctly but hardware isn't
> retrying. We get don't get any event, no error, success or stall.
> 
> This could be hardware flaw.
> Any chance you could try this on a xHC from some other vendor?

There is no other xHC hardware available to me.

> Second issue is a driver flaw, when nothing happened for 20 seconds
> we see the URB is canceled. xhci driver needs to stop then endpoint
> to cancel the URB, but there is a hw race and endpoint ends up halted
> instead of stopped. The xhci driver can't handle a halted endpoint in
> its stop endpoint handler properly, and the URB is never actually
> removed from the ring.
> 
> The reason you see the IO_PAGE_FAULT is probably because once the
> ring starts running the driver will handle the cancelled URB, and
> touch already freed memory: AMD-Vi: Event logged [IO_PAGE_FAULT
> domain=0x000d address=0xdc707028 flags=0x0020]
> 
> I have a patch for this second case, I haven't upstreamed it as it
> got some conflicting feedback earlier. It won't solve the 20 second
> delay, but should solve the the IO_PAGE_FAULT and the "WARN Set TR
> Deq Ptr cmd failed due to incorrect slot or ep state" message
> 
> Can you try it out?

I successful applied the patch against Linux 5.7.4, but get this error when
compiling drivers/usb/host/xhci-ring.c:

  CC [M]  drivers/usb/host/xhci-ring.o
drivers/usb/host/xhci-ring.c: In function ‘xhci_handle_cmd_stop_ep’:
drivers/usb/host/xhci-ring.c:857:3: error: implicit declaration of function ‘xhci_reset_halted_ep’ [-Werror=implicit-function-declaration]
  857 |   xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type);
      |   ^~~~~~~~~~~~~~~~~~~~


Fabian

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1
  2020-06-30 16:58   ` ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1 Fabian Melzow
@ 2020-06-30 19:03     ` Mathias Nyman
  2020-07-01  9:17       ` David Heinzelmann
  2020-07-01 17:51       ` Fabian Melzow
  0 siblings, 2 replies; 10+ messages in thread
From: Mathias Nyman @ 2020-06-30 19:03 UTC (permalink / raw)
  To: Fabian Melzow; +Cc: linux-usb

[-- Attachment #1: Type: text/plain, Size: 2482 bytes --]

On 30.6.2020 19.58, Fabian Melzow wrote:
> Hi!
> 
> Am Mon, 29 Jun 2020 20:47:24 +0300
> schrieb Mathias Nyman <mathias.nyman@linux.intel.com>:
> 
>> First issue I see is that the attempt to recover from a transaction
>> error with a soft retry isn't working. We expect the hardware to
>> retry the transfer but nothing seems to happen. Soft retry is
>> described in xhci specs 4.6.8.1 and is basically a reset endpoint
>> command with TSP set, followed by ringing the endpoint doorbell.
>> Traces indicate driver does this correctly but hardware isn't
>> retrying. We get don't get any event, no error, success or stall.
>>
>> This could be hardware flaw.
>> Any chance you could try this on a xHC from some other vendor?
> 
> There is no other xHC hardware available to me.
> 
>> Second issue is a driver flaw, when nothing happened for 20 seconds
>> we see the URB is canceled. xhci driver needs to stop then endpoint
>> to cancel the URB, but there is a hw race and endpoint ends up halted
>> instead of stopped. The xhci driver can't handle a halted endpoint in
>> its stop endpoint handler properly, and the URB is never actually
>> removed from the ring.
>>
>> The reason you see the IO_PAGE_FAULT is probably because once the
>> ring starts running the driver will handle the cancelled URB, and
>> touch already freed memory: AMD-Vi: Event logged [IO_PAGE_FAULT
>> domain=0x000d address=0xdc707028 flags=0x0020]
>>
>> I have a patch for this second case, I haven't upstreamed it as it
>> got some conflicting feedback earlier. It won't solve the 20 second
>> delay, but should solve the the IO_PAGE_FAULT and the "WARN Set TR
>> Deq Ptr cmd failed due to incorrect slot or ep state" message
>>
>> Can you try it out?
> 
> I successful applied the patch against Linux 5.7.4, but get this error when
> compiling drivers/usb/host/xhci-ring.c:
> 
>   CC [M]  drivers/usb/host/xhci-ring.o
> drivers/usb/host/xhci-ring.c: In function ‘xhci_handle_cmd_stop_ep’:
> drivers/usb/host/xhci-ring.c:857:3: error: implicit declaration of function ‘xhci_reset_halted_ep’ [-Werror=implicit-function-declaration]
>   857 |   xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type);
>       |   ^~~~~~~~~~~~~~~~~~~~
> 

Right, forgot that you need another patch before this.

both patches attached, also applied to 5.8-rc1 in branch "fix_invalid_context_at_stop_endpoint"
git://git.kernel.org/pub/scm/linux/kernel/git/mnyman/xhci.git fix_invalid_context_at_stop_endpoint

-Mathias


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-xhci-crete-xhci_reset_halted_ep-helper-function.patch --]
[-- Type: text/x-patch; name="0001-xhci-crete-xhci_reset_halted_ep-helper-function.patch", Size: 2587 bytes --]

From ddb2004cb51fcf5acd668590c56fbf571ca66071 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Tue, 17 Dec 2019 14:03:34 +0200
Subject: [PATCH 1/2] xhci: crete xhci_reset_halted_ep() helper function

Create a separate helper function to only issue reset endpont
commands to clear halted endpoints.

This will be useful for cases where the a halted endpoint is discovered
while completing some other command, and needs to be cleared before
continuing.

No functional changes

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
 drivers/usb/host/xhci-ring.c | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 2c255d0620b0..5c223e92b8db 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -708,6 +708,26 @@ static void xhci_unmap_td_bounce_buffer(struct xhci_hcd *xhci,
 	seg->bounce_offs = 0;
 }
 
+static int xhci_reset_halted_ep(struct xhci_hcd *xhci, unsigned int slot_id,
+				unsigned int ep_index, enum xhci_ep_reset_type reset_type)
+{
+	struct xhci_command *command;
+	int ret = 0;
+
+	command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
+	if (!command) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	ret = xhci_queue_reset_ep(xhci, command, slot_id, ep_index, reset_type);
+done:
+	if (ret)
+		xhci_err(xhci, "ERROR queuing reset endpoint for slot %d ep_index %d, %d\n",
+			 slot_id, ep_index, ret);
+	return ret;
+}
+
 /*
  * When we get a command completion for a Stop Endpoint Command, we need to
  * unlink any cancelled TDs from the ring.  There are two ways to do that:
@@ -1855,7 +1875,7 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
 		enum xhci_ep_reset_type reset_type)
 {
 	struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index];
-	struct xhci_command *command;
+	int err;
 
 	/*
 	 * Avoid resetting endpoint if link is inactive. Can cause host hang.
@@ -1864,13 +1884,11 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
 	if (xhci->devs[slot_id]->flags & VDEV_PORT_ERROR)
 		return;
 
-	command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
-	if (!command)
-		return;
-
 	ep->ep_state |= EP_HALTED;
 
-	xhci_queue_reset_ep(xhci, command, slot_id, ep_index, reset_type);
+	err = xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type);
+	if (err)
+		return;
 
 	if (reset_type == EP_HARD_RESET) {
 		ep->ep_state |= EP_HARD_CLEAR_TOGGLE;
-- 
2.17.1


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #3: 0002-xhci-fix-halted-endpoint-at-stop-endpoint-command-co.patch --]
[-- Type: text/x-patch; name="0002-xhci-fix-halted-endpoint-at-stop-endpoint-command-co.patch", Size: 5167 bytes --]

From 9483b48fd7167358d76d86d48790df4301ec7b43 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Tue, 7 Jan 2020 16:12:17 +0200
Subject: [PATCH 2/2] xhci: fix halted endpoint at stop endpoint command
 completion

xhci 4.6.9: A Busy endpoint may asynchronously transition from the
Running to the Halted or Error state due to error conditions detected
while processing TRBs. A possible race condition may occur if software,
thinking an endpoint is in the Running state, issues a Stop Endpoint
Command however at the same time the xHC asynchronously transitions
the endpoint to the Halted or Error state. In this case, a Context
State Error may be generated for the command completion. Software
may verify that this case occurred by inspecting the EP State for
Halted or Error when a Stop Endpoint Command results in a Context
State Error.

Fix this case by resetting the halted endpoint after cleaning
up the calcelled trbs from the ring.
If the TRB we halted on was cancelled then queue a new set TR dequeue
pointer command as usually.
If it wasn't cancelled then move past it with a set TR dequeue pointer
and give it back with -EPIPE status as in a normal halted endpoint case.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
 drivers/usb/host/xhci-ring.c | 56 ++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 5c223e92b8db..ceb3fac3f1c9 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -745,11 +745,13 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
 	struct xhci_ring *ep_ring;
 	struct xhci_virt_ep *ep;
 	struct xhci_td *cur_td = NULL;
+	struct xhci_td *halted_td = NULL;
 	struct xhci_td *last_unlinked_td;
 	struct xhci_ep_ctx *ep_ctx;
 	struct xhci_virt_device *vdev;
 	u64 hw_deq;
 	struct xhci_dequeue_state deq_state;
+	u32 comp_code;
 
 	if (unlikely(TRB_TO_SUSPEND_PORT(le32_to_cpu(trb->generic.field[3])))) {
 		if (!xhci->devs[slot_id])
@@ -764,9 +766,19 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
 
 	vdev = xhci->devs[slot_id];
 	ep_ctx = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
+
 	trace_xhci_handle_cmd_stop_ep(ep_ctx);
 
 	ep = &xhci->devs[slot_id]->eps[ep_index];
+	comp_code = GET_COMP_CODE(le32_to_cpu(event->status));
+
+	if (comp_code == COMP_CONTEXT_STATE_ERROR) {
+		/* endpoint is halted and needs to be reset */
+		if (GET_EP_CTX_STATE(ep_ctx) == EP_STATE_HALTED) {
+			ep->ep_state |= EP_HALTED;
+		}
+	}
+
 	last_unlinked_td = list_last_entry(&ep->cancelled_td_list,
 			struct xhci_td, cancelled_td_list);
 
@@ -833,16 +845,60 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
 
 	xhci_stop_watchdog_timer_in_irq(xhci, ep);
 
+	/*
+	 * If stop endpoint command raced with a halting endpoint we need to
+	 * reset the endpoint first. If the TD we halted on isn't cancelled we
+	 * must give it back with -EPIPE status, and move ring dequeue past it.
+	 * If we can't find hw_deq, or the TD we halted on, do a soft reset
+	 */
+	   /* FIXME, is there a risk EP_HALTED is set from other cases */
+	if (ep->ep_state & EP_HALTED) {
+		enum xhci_ep_reset_type reset_type = EP_SOFT_RESET;
+		struct xhci_td *td;
+
+		if (deq_state.new_deq_ptr && deq_state.new_deq_seg) {
+			reset_type = EP_HARD_RESET;
+		} else if (ep->ep_state & EP_HAS_STREAMS) {
+			/* soft reset, nothing else */
+		} else if (!list_empty(&ep->ring->td_list)) {
+			hw_deq = xhci_get_hw_deq(xhci, vdev, ep_index, 0);
+			hw_deq &= ~0xf;
+			td = list_first_entry(&ep->ring->td_list,
+						     struct xhci_td, td_list);
+			if (trb_in_td(xhci, td->start_seg, td->first_trb,
+				      td->last_trb, hw_deq, false)) {
+				halted_td = td;
+				reset_type = EP_HARD_RESET;
+				xhci_find_new_dequeue_state(xhci, slot_id,
+							    ep_index, 0, td,
+							    &deq_state);
+			}
+		}
+		xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type);
+		/* FIXME xhci_clear_hub_tt_buffer(xhci, td, ep); */
+	}
+
 	/* If necessary, queue a Set Transfer Ring Dequeue Pointer command */
 	if (deq_state.new_deq_ptr && deq_state.new_deq_seg) {
 		xhci_queue_new_dequeue_state(xhci, slot_id, ep_index,
 					     &deq_state);
 		xhci_ring_cmd_db(xhci);
+	} else if (ep->ep_state & EP_HALTED) {
+		xhci_ring_cmd_db(xhci); /* for endpoint soft reset command */
 	} else {
 		/* Otherwise ring the doorbell(s) to restart queued transfers */
 		ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
 	}
 
+	/* If TD we halted on wasn't cancelled give it back with -EPIPE */
+	if (halted_td) {
+		xhci_unmap_td_bounce_buffer(xhci, ep->ring, halted_td);
+		list_del_init(&halted_td->td_list);
+		inc_td_cnt(halted_td->urb);
+		if (last_td_in_urb(halted_td))
+			xhci_giveback_urb_in_irq(xhci, halted_td, -EPIPE);
+	}
+
 	/*
 	 * Drop the lock and complete the URBs in the cancelled TD list.
 	 * New TDs to be cancelled might be added to the end of the list before
-- 
2.17.1


^ permalink raw reply related	[flat|nested] 10+ messages in thread

* Re: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1
  2020-06-30 19:03     ` Mathias Nyman
@ 2020-07-01  9:17       ` David Heinzelmann
  2020-07-03 16:00         ` Mathias Nyman
  2020-07-01 17:51       ` Fabian Melzow
  1 sibling, 1 reply; 10+ messages in thread
From: David Heinzelmann @ 2020-07-01  9:17 UTC (permalink / raw)
  To: Mathias Nyman; +Cc: Fabian Melzow, linux-usb

On Tue, Jun 30, 2020 at 10:03:29PM +0300, Mathias Nyman wrote:
> On 30.6.2020 19.58, Fabian Melzow wrote:
> > Hi!
> > 
> > Am Mon, 29 Jun 2020 20:47:24 +0300
> > schrieb Mathias Nyman <mathias.nyman@linux.intel.com>:
> > 
> >> First issue I see is that the attempt to recover from a transaction
> >> error with a soft retry isn't working. We expect the hardware to
> >> retry the transfer but nothing seems to happen. Soft retry is
> >> described in xhci specs 4.6.8.1 and is basically a reset endpoint
> >> command with TSP set, followed by ringing the endpoint doorbell.
> >> Traces indicate driver does this correctly but hardware isn't
> >> retrying. We get don't get any event, no error, success or stall.
> >>
> >> This could be hardware flaw.
> >> Any chance you could try this on a xHC from some other vendor?
> > 
> > There is no other xHC hardware available to me.
> > 
> >> Second issue is a driver flaw, when nothing happened for 20 seconds
> >> we see the URB is canceled. xhci driver needs to stop then endpoint
> >> to cancel the URB, but there is a hw race and endpoint ends up halted
> >> instead of stopped. The xhci driver can't handle a halted endpoint in
> >> its stop endpoint handler properly, and the URB is never actually
> >> removed from the ring.
> >>
> >> The reason you see the IO_PAGE_FAULT is probably because once the
> >> ring starts running the driver will handle the cancelled URB, and
> >> touch already freed memory: AMD-Vi: Event logged [IO_PAGE_FAULT
> >> domain=0x000d address=0xdc707028 flags=0x0020]
> >>
> >> I have a patch for this second case, I haven't upstreamed it as it
> >> got some conflicting feedback earlier. It won't solve the 20 second
> >> delay, but should solve the the IO_PAGE_FAULT and the "WARN Set TR
> >> Deq Ptr cmd failed due to incorrect slot or ep state" message
> >>
> >> Can you try it out?
> > 
> > I successful applied the patch against Linux 5.7.4, but get this error when
> > compiling drivers/usb/host/xhci-ring.c:
> > 
> >   CC [M]  drivers/usb/host/xhci-ring.o
> > drivers/usb/host/xhci-ring.c: In function ‘xhci_handle_cmd_stop_ep’:
> > drivers/usb/host/xhci-ring.c:857:3: error: implicit declaration of function ‘xhci_reset_halted_ep’ [-Werror=implicit-function-declaration]
> >   857 |   xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type);
> >       |   ^~~~~~~~~~~~~~~~~~~~
> > 
> 
> Right, forgot that you need another patch before this.
> 
> both patches attached, also applied to 5.8-rc1 in branch "fix_invalid_context_at_stop_endpoint"
> git://git.kernel.org/pub/scm/linux/kernel/git/mnyman/xhci.git fix_invalid_context_at_stop_endpoint
> 
> -Mathias
> 

Hi,

I've been investigating what appears to be an identical problem recently which I think is related
to the description from xhci 4.6.9. I have an fx2 device which stalls its endpoint while at the
same time the URBs are aborted from the software.

Kernel logs which occured when the xhci driver is stucked at the halted endpoint.

Jun 29 17:27:12 dhe-pc kernel: xhci_hcd 0000:00:14.0: WARN Cannot submit Set TR Deq Ptr
Jun 29 17:27:12 dhe-pc kernel: xhci_hcd 0000:00:14.0: A Set TR Deq Ptr command is pending.
Jun 29 17:27:12 dhe-pc kernel: xhci_hcd 0000:00:14.0: WARN Set TR Deq Ptr cmd failed due to incorrect slot or ep state.
Jun 29 17:27:21 dhe-pc kernel: xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 6
Jun 29 17:27:21 dhe-pc kernel: xhci_hcd 0000:00:14.0: Looking for event-dma 00000001173dc630 trb-start 00000001173dcc30 trb-end 0000000000000000 seg-start 00000001173dc000 seg-end 00000001173dcff0
Jun 29 17:27:21 dhe-pc kernel: xhci_hcd 0000:00:14.0: Looking for event-dma 00000001173dc630 trb-start 0000000116e53000 trb-end 0000000116e53830 seg-start 0000000116e53000 seg-end 0000000116e53ff0

I have applied your patch to kernel version 5.8-rc3 and I can confirm that the patch solves
my problem for the halted endpoint.

I still get the following error messages from time to time.

Jul 01 09:56:56 dhe kernel: xhci_hcd 0000:00:14.0: WARN Event TRB for slot 11 ep 4 with no TDs queued?
Jul 01 09:56:56 dhe kernel: xhci_hcd 0000:00:14.0: WARN Cannot submit Set TR Deq Ptr
Jul 01 09:56:56 dhe kernel: xhci_hcd 0000:00:14.0: A Set TR Deq Ptr command is pending.

or

Jul 01 10:09:27 dhe kernel: xhci_hcd 0000:00:14.0: WARN Cannot submit Set TR Deq Ptr
Jul 01 10:09:27 dhe kernel: xhci_hcd 0000:00:14.0: A Set TR Deq Ptr command is pending.
Jul 01 10:09:29 dhe kernel: xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 13
Jul 01 10:09:29 dhe kernel: xhci_hcd 0000:00:14.0: Looking for event-dma 0000000473d66d90 trb-start 0000000473d66e70 trb-end 0000000000000000 seg-start 0000000473d66000 seg-end 0000000473d66ff0
Jul 01 10:09:29 dhe kernel: xhci_hcd 0000:00:14.0: Looking for event-dma 0000000473d66d90 trb-start 0000000473d65000 trb-end 0000000473d65a70 seg-start 0000000473d65000 seg-end 0000000473d65ff0
Jul 01 10:09:29 dhe kernel: xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 13
Jul 01 10:09:29 dhe kernel: xhci_hcd 0000:00:14.0: Looking for event-dma 0000000473d66e60 trb-start 0000000473d66e70 trb-end 0000000000000000 seg-start 0000000473d66000 seg-end 0000000473d66ff0
Jul 01 10:09:29 dhe kernel: xhci_hcd 0000:00:14.0: Looking for event-dma 0000000473d66e60 trb-start 0000000473d65000 trb-end 0000000473d65a70 seg-start 0000000473d65000 seg-end 0000000473d65ff0

but the core problem that the xhci is stucked at the halted endpoint state does not occur anymore.
If you are interested in more detailed debug logs I can provide them.

David


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1
  2020-06-30 19:03     ` Mathias Nyman
  2020-07-01  9:17       ` David Heinzelmann
@ 2020-07-01 17:51       ` Fabian Melzow
  2020-07-03 15:57         ` Mathias Nyman
  1 sibling, 1 reply; 10+ messages in thread
From: Fabian Melzow @ 2020-07-01 17:51 UTC (permalink / raw)
  To: Mathias Nyman; +Cc: linux-usb

Am Tue, 30 Jun 2020 22:03:29 +0300
schrieb Mathias Nyman <mathias.nyman@linux.intel.com>:

> On 30.6.2020 19.58, Fabian Melzow wrote:

> > I successful applied the patch against Linux 5.7.4, but get this
> > error when compiling drivers/usb/host/xhci-ring.c:
> > 
> >   CC [M]  drivers/usb/host/xhci-ring.o
> > drivers/usb/host/xhci-ring.c: In function ‘xhci_handle_cmd_stop_ep’:
> > drivers/usb/host/xhci-ring.c:857:3: error: implicit declaration of
> > function ‘xhci_reset_halted_ep’
> > [-Werror=implicit-function-declaration] 857 |
> > xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type); |
> > ^~~~~~~~~~~~~~~~~~~~ 
> 
> Right, forgot that you need another patch before this.

Applied it and after recompiling I get:

Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Get port status 5-1 read: 0x2a0, return 0x100
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Waiting for status stage event
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Successful Set TR Deq Ptr cmd, deq = @fedf51f0
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Ignoring reset ep completion code of 1
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Giveback URB 0000000096cbf5fe, len = 0, expected = 4, status = -32
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Set TR Deq Ptr cmd, new deq seg = 00000000a8c5372f (0xfedf5000 dma), new deq ptr = 00000000037c6b7a (0xfedf51f0 dma), new cycle = 1
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Queueing new dequeue state
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: New dequeue pointer = 0xfedf51f0 (DMA)
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: New dequeue segment = 00000000a8c5372f (virtual)
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Cycle state = 0x1
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Finding endpoint context
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Cleaning up stalled endpoint ring
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Stalled endpoint for slot 1 ep 0
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Successful Set TR Deq Ptr cmd, deq = @fedf51c0
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Set TR Deq Ptr cmd, new deq seg = 00000000a8c5372f (0xfedf5000 dma), new deq ptr = 000000007e18677c (0xfedf51c0 dma), new cycle = 1
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: New dequeue pointer = 0xfedf51c0 (DMA)
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: New dequeue segment = 00000000a8c5372f (virtual)
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Cycle state = 0x1
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Finding endpoint context
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Removing canceled TD starting at 0xfedf5190 (dma).
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Stopped on Transfer TRB for slot 1 ep 0
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Cancel URB 000000009a11684b, dev 2, ep 0x0, starting at offset 0xfedf5190
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Successful Set TR Deq Ptr cmd, deq = @fede7830
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Ignoring reset ep completion code of 1
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Giveback URB 000000009a11684b, len = 0, expected = 4, status = -32
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Set TR Deq Ptr cmd, new deq seg = 0000000010319786 (0xfede7000 dma), new deq ptr = 0000000083eff911 (0xfede7830 dma), new cycle = 1
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Queueing new dequeue state
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: New dequeue pointer = 0xfede7830 (DMA)
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: New dequeue segment = 0000000010319786 (virtual)
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Cycle state = 0x1
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Finding endpoint context
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Cleaning up stalled endpoint ring
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Stalled endpoint for slot 2 ep 0
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Successful Set TR Deq Ptr cmd, deq = @fede7800
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Ignoring reset ep completion code of 1
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Giveback URB 000000009a11684b, len = 0, expected = 10, status = -32
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Set TR Deq Ptr cmd, new deq seg = 0000000010319786 (0xfede7000 dma), new deq ptr = 00000000ad85653f (0xfede7800 dma), new cycle = 1
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Queueing new dequeue state
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: New dequeue pointer = 0xfede7800 (DMA)
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: New dequeue segment = 0000000010319786 (virtual)
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Cycle state = 0x1
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Finding endpoint context
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Cleaning up stalled endpoint ring
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Stalled endpoint for slot 2 ep 0
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Waiting for status stage event
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Waiting for status stage event
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Waiting for status stage event
Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: xhci_hub_status_data: stopping port polling.
Jul 01 19:06:24 ping kernel: usb usb6: bus auto-suspend, wakeup 1

Look like the problem is fixed, but if you want, you can check the
debuglogs at http://fabi.bplaced.net/debuglogs2.tar.xz

Thanks!

Fabian

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1
  2020-07-01 17:51       ` Fabian Melzow
@ 2020-07-03 15:57         ` Mathias Nyman
  0 siblings, 0 replies; 10+ messages in thread
From: Mathias Nyman @ 2020-07-03 15:57 UTC (permalink / raw)
  To: Fabian Melzow; +Cc: linux-usb

On 1.7.2020 20.51, Fabian Melzow wrote:
> Am Tue, 30 Jun 2020 22:03:29 +0300
> schrieb Mathias Nyman <mathias.nyman@linux.intel.com>:
> 
>> On 30.6.2020 19.58, Fabian Melzow wrote:
> 
>>> I successful applied the patch against Linux 5.7.4, but get this
>>> error when compiling drivers/usb/host/xhci-ring.c:
>>>
>>>   CC [M]  drivers/usb/host/xhci-ring.o
>>> drivers/usb/host/xhci-ring.c: In function ‘xhci_handle_cmd_stop_ep’:
>>> drivers/usb/host/xhci-ring.c:857:3: error: implicit declaration of
>>> function ‘xhci_reset_halted_ep’
>>> [-Werror=implicit-function-declaration] 857 |
>>> xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type); |
>>> ^~~~~~~~~~~~~~~~~~~~ 
>>
>> Right, forgot that you need another patch before this.
> 
> Applied it and after recompiling I get:
> 
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Get port status 5-1 read: 0x2a0, return 0x100
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Waiting for status stage event
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Successful Set TR Deq Ptr cmd, deq = @fedf51f0
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Ignoring reset ep completion code of 1
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Giveback URB 0000000096cbf5fe, len = 0, expected = 4, status = -32
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Set TR Deq Ptr cmd, new deq seg = 00000000a8c5372f (0xfedf5000 dma), new deq ptr = 00000000037c6b7a (0xfedf51f0 dma), new cycle = 1
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Queueing new dequeue state
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: New dequeue pointer = 0xfedf51f0 (DMA)
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: New dequeue segment = 00000000a8c5372f (virtual)
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Cycle state = 0x1
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Finding endpoint context
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Cleaning up stalled endpoint ring
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Stalled endpoint for slot 1 ep 0
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Successful Set TR Deq Ptr cmd, deq = @fedf51c0
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Set TR Deq Ptr cmd, new deq seg = 00000000a8c5372f (0xfedf5000 dma), new deq ptr = 000000007e18677c (0xfedf51c0 dma), new cycle = 1
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: New dequeue pointer = 0xfedf51c0 (DMA)
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: New dequeue segment = 00000000a8c5372f (virtual)
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Cycle state = 0x1
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Finding endpoint context
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Removing canceled TD starting at 0xfedf5190 (dma).
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Stopped on Transfer TRB for slot 1 ep 0
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
> Jul 01 19:06:29 ping kernel: xhci_hcd 0000:09:00.3: Cancel URB 000000009a11684b, dev 2, ep 0x0, starting at offset 0xfedf5190
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Successful Set TR Deq Ptr cmd, deq = @fede7830
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Ignoring reset ep completion code of 1
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Giveback URB 000000009a11684b, len = 0, expected = 4, status = -32
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Set TR Deq Ptr cmd, new deq seg = 0000000010319786 (0xfede7000 dma), new deq ptr = 0000000083eff911 (0xfede7830 dma), new cycle = 1
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Queueing new dequeue state
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: New dequeue pointer = 0xfede7830 (DMA)
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: New dequeue segment = 0000000010319786 (virtual)
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Cycle state = 0x1
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Finding endpoint context
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Cleaning up stalled endpoint ring
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Stalled endpoint for slot 2 ep 0
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Successful Set TR Deq Ptr cmd, deq = @fede7800
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Ignoring reset ep completion code of 1
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Giveback URB 000000009a11684b, len = 0, expected = 10, status = -32
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: // Ding dong!
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Set TR Deq Ptr cmd, new deq seg = 0000000010319786 (0xfede7000 dma), new deq ptr = 00000000ad85653f (0xfede7800 dma), new cycle = 1
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Queueing new dequeue state
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: New dequeue pointer = 0xfede7800 (DMA)
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: New dequeue segment = 0000000010319786 (virtual)
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Cycle state = 0x1
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Finding endpoint context
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Cleaning up stalled endpoint ring
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Stalled endpoint for slot 2 ep 0
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Waiting for status stage event
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Waiting for status stage event
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: Waiting for status stage event
> Jul 01 19:06:24 ping kernel: xhci_hcd 0000:09:00.3: xhci_hub_status_data: stopping port polling.
> Jul 01 19:06:24 ping kernel: usb usb6: bus auto-suspend, wakeup 1
> 
> Look like the problem is fixed, but if you want, you can check the
> debuglogs at http://fabi.bplaced.net/debuglogs2.tar.xz

Thanks, I'll need to take a closer look at those.
I'll be away for the next two weeks which will cause some delay

-Mathias


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1
  2020-07-01  9:17       ` David Heinzelmann
@ 2020-07-03 16:00         ` Mathias Nyman
  0 siblings, 0 replies; 10+ messages in thread
From: Mathias Nyman @ 2020-07-03 16:00 UTC (permalink / raw)
  To: David Heinzelmann; +Cc: Fabian Melzow, linux-usb

On 1.7.2020 12.17, David Heinzelmann wrote:
> On Tue, Jun 30, 2020 at 10:03:29PM +0300, Mathias Nyman wrote:
>> On 30.6.2020 19.58, Fabian Melzow wrote:
>>> Hi!
>>>
>>> Am Mon, 29 Jun 2020 20:47:24 +0300
>>> schrieb Mathias Nyman <mathias.nyman@linux.intel.com>:
>>>
>>>> First issue I see is that the attempt to recover from a transaction
>>>> error with a soft retry isn't working. We expect the hardware to
>>>> retry the transfer but nothing seems to happen. Soft retry is
>>>> described in xhci specs 4.6.8.1 and is basically a reset endpoint
>>>> command with TSP set, followed by ringing the endpoint doorbell.
>>>> Traces indicate driver does this correctly but hardware isn't
>>>> retrying. We get don't get any event, no error, success or stall.
>>>>
>>>> This could be hardware flaw.
>>>> Any chance you could try this on a xHC from some other vendor?
>>>
>>> There is no other xHC hardware available to me.
>>>
>>>> Second issue is a driver flaw, when nothing happened for 20 seconds
>>>> we see the URB is canceled. xhci driver needs to stop then endpoint
>>>> to cancel the URB, but there is a hw race and endpoint ends up halted
>>>> instead of stopped. The xhci driver can't handle a halted endpoint in
>>>> its stop endpoint handler properly, and the URB is never actually
>>>> removed from the ring.
>>>>
>>>> The reason you see the IO_PAGE_FAULT is probably because once the
>>>> ring starts running the driver will handle the cancelled URB, and
>>>> touch already freed memory: AMD-Vi: Event logged [IO_PAGE_FAULT
>>>> domain=0x000d address=0xdc707028 flags=0x0020]
>>>>
>>>> I have a patch for this second case, I haven't upstreamed it as it
>>>> got some conflicting feedback earlier. It won't solve the 20 second
>>>> delay, but should solve the the IO_PAGE_FAULT and the "WARN Set TR
>>>> Deq Ptr cmd failed due to incorrect slot or ep state" message
>>>>
>>>> Can you try it out?
>>>
>>> I successful applied the patch against Linux 5.7.4, but get this error when
>>> compiling drivers/usb/host/xhci-ring.c:
>>>
>>>   CC [M]  drivers/usb/host/xhci-ring.o
>>> drivers/usb/host/xhci-ring.c: In function ‘xhci_handle_cmd_stop_ep’:
>>> drivers/usb/host/xhci-ring.c:857:3: error: implicit declaration of function ‘xhci_reset_halted_ep’ [-Werror=implicit-function-declaration]
>>>   857 |   xhci_reset_halted_ep(xhci, slot_id, ep_index, reset_type);
>>>       |   ^~~~~~~~~~~~~~~~~~~~
>>>
>>
>> Right, forgot that you need another patch before this.
>>
>> both patches attached, also applied to 5.8-rc1 in branch "fix_invalid_context_at_stop_endpoint"
>> git://git.kernel.org/pub/scm/linux/kernel/git/mnyman/xhci.git fix_invalid_context_at_stop_endpoint
>>
>> -Mathias
>>
> 
> Hi,
> 
> I've been investigating what appears to be an identical problem recently which I think is related
> to the description from xhci 4.6.9. I have an fx2 device which stalls its endpoint while at the
> same time the URBs are aborted from the software.
> 
> Kernel logs which occured when the xhci driver is stucked at the halted endpoint.
> 
> Jun 29 17:27:12 dhe-pc kernel: xhci_hcd 0000:00:14.0: WARN Cannot submit Set TR Deq Ptr
> Jun 29 17:27:12 dhe-pc kernel: xhci_hcd 0000:00:14.0: A Set TR Deq Ptr command is pending.
> Jun 29 17:27:12 dhe-pc kernel: xhci_hcd 0000:00:14.0: WARN Set TR Deq Ptr cmd failed due to incorrect slot or ep state.
> Jun 29 17:27:21 dhe-pc kernel: xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 6
> Jun 29 17:27:21 dhe-pc kernel: xhci_hcd 0000:00:14.0: Looking for event-dma 00000001173dc630 trb-start 00000001173dcc30 trb-end 0000000000000000 seg-start 00000001173dc000 seg-end 00000001173dcff0
> Jun 29 17:27:21 dhe-pc kernel: xhci_hcd 0000:00:14.0: Looking for event-dma 00000001173dc630 trb-start 0000000116e53000 trb-end 0000000116e53830 seg-start 0000000116e53000 seg-end 0000000116e53ff0
> 
> I have applied your patch to kernel version 5.8-rc3 and I can confirm that the patch solves
> my problem for the halted endpoint.
> 
> I still get the following error messages from time to time.
> 
> Jul 01 09:56:56 dhe kernel: xhci_hcd 0000:00:14.0: WARN Event TRB for slot 11 ep 4 with no TDs queued?
> Jul 01 09:56:56 dhe kernel: xhci_hcd 0000:00:14.0: WARN Cannot submit Set TR Deq Ptr
> Jul 01 09:56:56 dhe kernel: xhci_hcd 0000:00:14.0: A Set TR Deq Ptr command is pending.
> 
> or
> 
> Jul 01 10:09:27 dhe kernel: xhci_hcd 0000:00:14.0: WARN Cannot submit Set TR Deq Ptr
> Jul 01 10:09:27 dhe kernel: xhci_hcd 0000:00:14.0: A Set TR Deq Ptr command is pending.
> Jul 01 10:09:29 dhe kernel: xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 13
> Jul 01 10:09:29 dhe kernel: xhci_hcd 0000:00:14.0: Looking for event-dma 0000000473d66d90 trb-start 0000000473d66e70 trb-end 0000000000000000 seg-start 0000000473d66000 seg-end 0000000473d66ff0
> Jul 01 10:09:29 dhe kernel: xhci_hcd 0000:00:14.0: Looking for event-dma 0000000473d66d90 trb-start 0000000473d65000 trb-end 0000000473d65a70 seg-start 0000000473d65000 seg-end 0000000473d65ff0
> Jul 01 10:09:29 dhe kernel: xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 13
> Jul 01 10:09:29 dhe kernel: xhci_hcd 0000:00:14.0: Looking for event-dma 0000000473d66e60 trb-start 0000000473d66e70 trb-end 0000000000000000 seg-start 0000000473d66000 seg-end 0000000473d66ff0
> Jul 01 10:09:29 dhe kernel: xhci_hcd 0000:00:14.0: Looking for event-dma 0000000473d66e60 trb-start 0000000473d65000 trb-end 0000000473d65a70 seg-start 0000000473d65000 seg-end 0000000473d65ff0
> 
> but the core problem that the xhci is stucked at the halted endpoint state does not occur anymore.
> If you are interested in more detailed debug logs I can provide them.

Thanks, that could be useful and interesting, this is hard issue for me reproduce
I'll however be away for next couple of weeks.I can look at this in more detail when I get back

-Mathias

^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2020-07-03 15:56 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-20 19:19 ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1 Fabian Melzow
2020-06-29 17:47 ` Mathias Nyman
2020-06-30 10:40   ` [PATCH] xhci: fix halted endpoint at stop endpoint command completion kernel test robot
2020-06-30 10:40     ` kernel test robot
2020-06-30 16:58   ` ERROR Transfer event TRB DMA ptr not part of current TD ep_index 4 comp_code 1 Fabian Melzow
2020-06-30 19:03     ` Mathias Nyman
2020-07-01  9:17       ` David Heinzelmann
2020-07-03 16:00         ` Mathias Nyman
2020-07-01 17:51       ` Fabian Melzow
2020-07-03 15:57         ` Mathias Nyman

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.