Re: xhci problem -> general protection fault

[Mathias Nyman <mathias.nyman@linux.intel.com>]

On 17.9.2020 18.30, Andrzej Pietrasiewicz wrote:
> Dear All,
> 
> I have encountered a problem in xhci which leads to general protection fault.
> 
> The problem is triggered by running this program:
> 
> https://gitlab.collabora.com/andrzej.p/bulk-cancel.git
> 
> $ sudo ./bulk-cancel -D /dev/bus/usb/002/006 -i 1 -b 1
> 
> where /dev/bus/usb/002/006 is a Gadget Zero:
> 
> It takes less than a minute until the crash happens.
> The DMAR (iommu) errors don't happen always, i.e. there are crashes
> when they are not reported in the system log. In either case the
> 
> "WARN Cannot submit Set TR Deq Ptr"
> "A Set TR Deq Ptr command is pending."
> "WARN Set TR Deq Ptr cmd failed due to incorrect slot or ep state."
> 
> messages do appear.
> 

Nice testcase and report, thanks.

I started looking at issues in this area some time ago, and wrote a couple patches but
it was left hanging. The two patches (now rebased on 5.9-rc3) can be found in my tree in the
fix_invalid_context_at_stop_endpoint branch

git://git.kernel.org/pub/scm/linux/kernel/git/mnyman/xhci.git fix_invalid_context_at_stop_endpoint 

https://git.kernel.org/pub/scm/linux/kernel/git/mnyman/xhci.git/log/?h=fix_invalid_context_at_stop_endpoint

If you could give those a try and see if they help I'd be grateful.

also, if possible, can you add xhci dynamic debug and traces to show in more detail what is going on.

mount -t debugfs none /sys/kernel/debug
echo 'module xhci_hcd =p' >/sys/kernel/debug/dynamic_debug/control
echo 'module usbcore =p' >/sys/kernel/debug/dynamic_debug/control
echo 81920 > /sys/kernel/debug/tracing/buffer_size_kb
echo 1 > /sys/kernel/debug/tracing/events/xhci-hcd/enable
< Run the testcase >
Send output of dmesg
Send content of /sys/kernel/debug/tracing/trace

Thanks
Mathias