public inbox for linux-usb@vger.kernel.org
 help / color / mirror / Atom feed
From: "Michał Pecio" <michal.pecio@gmail.com>
To: Guan Wang <guan.wang.jy@gmail.com>
Cc: mathias.nyman@linux.intel.com, gregkh@linuxfoundation.org,
	linux-usb@vger.kernel.org, guan.wang.jy@renesas.com
Subject: Re: [ISSUE REPORT] xHCI infinite endpoint reset loop on full-speed after transfer error
Date: Mon, 12 May 2025 10:19:13 +0200	[thread overview]
Message-ID: <20250512101913.69562fd3@foxbook> (raw)
In-Reply-To: <20250512063912.3331082-1-guan.wang.jy@renesas.com>

On Mon, 12 May 2025 14:39:13 +0800, Guan Wang wrote:
> Using Linux version 6.15.0-rc5-00032, I encountered an issue where
> the xHCI controller enters an infinite loop while attempting to
> recover a USB endpoint. This causes the xHCI driver to get stuck, and
> no USB transfers can proceed.
> 
> This issue appears to only occur with full-speed bulk devices such as
> USB serial adapters(e.g., USB-Serial or CDC-ACM class). I've
> reproduced it using CH340 and CP2102 USB serial devices.
> 
> **Steps to reproduce:**
> 1. Attach the device.
> 2. Start continuous data transfer (e.g., `cat /dev/ttyUSB0`).
> 3. Induce transfer errors via:
>    - EMI interference
>    - Sudden temperature changes
>    - Long USB cables
>    - Briefly shorting DP/DM lines to simulate a transaction error
> 
> After this, the xHCI controller enters an infinite reset loop on the
> affected endpoint. "Transfer error" messages continuously appear in
> the logs, creating a log storm. The issue seems to improve or
> disappear when an external high-speed USB hub is inserted between the
> host and device.

Greg may be asking the right question.

I tried this on 3ce9925823c7, which is linus/master from a few days ago,
with uPD720202 and PL2303HX or CH341A in TX-RX loopback. I temporarily
disconnect D- to get transaction errors without detaching the device.

All characters sent during disconnection are lost, and sometimes one or
two after reconnection too (bug?), but things are back to normal then.

OTOH, it stops working if I insert a high-speed hub upstream of the D-
switch (tried with two hubs). But still no transaction error storm.

In your case, it looks like USB transactions keep failing for some
reason even after the original error-inducing condition is removed.
The rest looks like usual error recovery procedure.

Any chance that some error messages are lost in dynamic debug noise?

Note: "ep 2" is 0x81 interrupt, and "ep 4" is 0x82 bulk.

Michal

  parent reply	other threads:[~2025-05-12  8:19 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-05-12  6:39 [ISSUE REPORT] xHCI infinite endpoint reset loop on full-speed after transfer error Guan Wang
2025-05-12  7:15 ` Greg KH
2025-05-12  8:19 ` Michał Pecio [this message]
2025-05-16  8:44   ` Michał Pecio

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250512101913.69562fd3@foxbook \
    --to=michal.pecio@gmail.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=guan.wang.jy@gmail.com \
    --cc=guan.wang.jy@renesas.com \
    --cc=linux-usb@vger.kernel.org \
    --cc=mathias.nyman@linux.intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox