[ISSUE REPORT] xHCI infinite endpoint reset loop on full-speed after transfer error

[ISSUE REPORT] xHCI infinite endpoint reset loop on full-speed after transfer error

[Guan Wang]

From: Guan Wang <guan.wang.jy@gmail.com>

Hello,

Using Linux version 6.15.0-rc5-00032, I encountered an issue where the xHCI controller enters an
infinite loop while attempting to recover a USB endpoint. This causes the xHCI driver to get stuck,
and no USB transfers can proceed.

This issue appears to only occur with full-speed bulk devices such as USB serial adapters(e.g.,
USB-Serial or CDC-ACM class). I've reproduced it using CH340 and CP2102 USB serial devices.

**Steps to reproduce:**
1. Attach the device.
2. Start continuous data transfer (e.g., `cat /dev/ttyUSB0`).
3. Induce transfer errors via:
   - EMI interference
   - Sudden temperature changes
   - Long USB cables
   - Briefly shorting DP/DM lines to simulate a transaction error

After this, the xHCI controller enters an infinite reset loop on the affected endpoint. "Transfer error"
messages continuously appear in the logs, creating a log storm. The issue seems to improve or disappear
when an external high-speed USB hub is inserted between the host and device.

Do you have any comments or suggestions? The log is shown below:


**USB emulation dmesg**

[   41.109377] usb 3-1: new full-speed USB device number 2 using xhci-renesas-hcd
[   41.277651] xhci-renesas-hcd ee000000.usb: add ep 0x82, slot id 1, new drop flags = 0x0, new add flags = 0x21
[   41.277676] xhci-renesas-hcd ee000000.usb: add ep 0x2, slot id 1, new drop flags = 0x0, new add flags = 0x31
[   41.277697] xhci-renesas-hcd ee000000.usb: add ep 0x81, slot id 1, new drop flags = 0x0, new add flags = 0x39
[   41.286380] ch341 3-1:1.0: ch341-uart converter detected
[   41.305437] usb 3-1: ch341-uart converter now attached to ttyUSB0

T:  Bus=03 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=480  MxCh= 1
B:  Alloc=  0/800 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 2.00 Cls=09(hub  ) Sub=00 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0002 Rev= 6.15
S:  Manufacturer=Linux 6.15.0-rc5-00032-g0d8d44db295c-dirty xhci-hcd
S:  Product=xHCI Host Controller
S:  SerialNumber=ee000000.usb
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   4 Ivl=256ms

T:  Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  3 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=ff(vend.) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
P:  Vendor=1a86 ProdID=7523 Rev=81.34
S:  Product=USB Serial
C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=104mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=02 Driver=ch341
E:  Ad=82(I) Atr=02(Bulk) MxPS=  32 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  32 Ivl=0ms
E:  Ad=81(I) Atr=03(Int.) MxPS=   8 Ivl=1ms


**reproduced dmesg (any EMI issue during USB transfering)**

[  126.432551] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.432571] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=0
[  126.432581] xhci-renesas-hcd ee000000.usb: Soft-reset ep 2, slot 1
[  126.432593] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.432903] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.436538] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.436546] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=1
[  126.436553] xhci-renesas-hcd ee000000.usb: Soft-reset ep 2, slot 1
[  126.436561] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.436934] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.437631] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 4 on endpoint
[  126.437641] process_bulk_intr_td: USB transaction error on TD 0000000038987fa4, err_count=0
[  126.437648] xhci-renesas-hcd ee000000.usb: Soft-reset ep 4, slot 1
[  126.437656] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.438067] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.440624] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.440633] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=2
[  126.440640] xhci-renesas-hcd ee000000.usb: Soft-reset ep 2, slot 1
[  126.440647] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.441047] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.444624] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.444634] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=3
[  126.444641] xhci-renesas-hcd ee000000.usb: Soft-reset ep 2, slot 1
[  126.444649] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.445052] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.448624] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.448634] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=4
[  126.448640] finish_td: USB transaction error on TD 000000009ed82d11
[  126.448647] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[  126.448654] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.449051] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.449060] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04b000 (dma) in stream 0 URB 0000000046762d58
[  126.449072] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04b010, cycle 1
[  126.449072]
[  126.449079] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.449084] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000046762d58 TD as cancel_status is 2
[  126.449360] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b04b010
[  126.449370] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000046762d58 TD
[  126.449377] xhci-renesas-hcd ee000000.usb: Giveback URB 0000000046762d58, len = 0, expected = 8, status = -71
[  126.449389] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[  126.449629] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 4 on endpoint
[  126.449639] process_bulk_intr_td: USB transaction error on TD 0000000038987fa4, err_count=1
[  126.449646] xhci-renesas-hcd ee000000.usb: Soft-reset ep 4, slot 1
[  126.449654] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.450067] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.452623] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.452633] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=5
[  126.452638] finish_td: USB transaction error on TD 000000009ed82d11
[  126.452644] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[  126.452652] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.453048] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.453057] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04b010 (dma) in stream 0 URB 0000000046762d58
[  126.453067] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04b020, cycle 1
[  126.453067]
[  126.453073] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.453078] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000046762d58 TD as cancel_status is 2
[  126.453363] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b04b020
[  126.453373] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000046762d58 TD
[  126.453380] xhci-renesas-hcd ee000000.usb: Giveback URB 0000000046762d58, len = 0, expected = 8, status = -71
[  126.453388] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[  126.456623] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.456632] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=6
[  126.456638] finish_td: USB transaction error on TD 000000009ed82d11
[  126.456644] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[  126.456651] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.457048] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.457057] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04b020 (dma) in stream 0 URB 0000000046762d58
[  126.457066] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04b030, cycle 1
[  126.457066]
[  126.457072] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.457077] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000046762d58 TD as cancel_status is 2
[  126.457361] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b04b030
[  126.457371] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000046762d58 TD
[  126.457378] xhci-renesas-hcd ee000000.usb: Giveback URB 0000000046762d58, len = 0, expected = 8, status = -71
[  126.457387] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[  126.460623] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.460632] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=7
[  126.460638] finish_td: USB transaction error on TD 000000009ed82d11
[  126.460644] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[  126.460652] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.461048] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.461057] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04b030 (dma) in stream 0 URB 0000000046762d58
[  126.461067] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04b040, cycle 1
[  126.461067]
[  126.461073] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.461078] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000046762d58 TD as cancel_status is 2
[  126.461362] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b04b040
[  126.461372] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000046762d58 TD
[  126.461379] xhci-renesas-hcd ee000000.usb: Giveback URB 0000000046762d58, len = 0, expected = 8, status = -71
[  126.461387] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[  126.461626] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 4 on endpoint
[  126.461636] process_bulk_intr_td: USB transaction error on TD 0000000038987fa4, err_count=2
[  126.461643] xhci-renesas-hcd ee000000.usb: Soft-reset ep 4, slot 1
[  126.461651] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.462067] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.464624] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.464633] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=8
[  126.464639] finish_td: USB transaction error on TD 000000009ed82d11
[  126.464645] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[  126.464653] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.465045] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.465054] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04b040 (dma) in stream 0 URB 0000000046762d58
[  126.465064] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04b050, cycle 1
[  126.465064]
[  126.465070] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.465075] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000046762d58 TD as cancel_status is 2
[  126.465361] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b04b050
[  126.465371] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000046762d58 TD
[  126.465377] xhci-renesas-hcd ee000000.usb: Giveback URB 0000000046762d58, len = 0, expected = 8, status = -71
[  126.465386] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[  126.468620] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.468629] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=9
[  126.468635] finish_td: USB transaction error on TD 000000009ed82d11
[  126.468641] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[  126.468649] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.469049] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.469058] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04b050 (dma) in stream 0 URB 0000000046762d58
[  126.469068] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04b060, cycle 1
[  126.469068]
[  126.469074] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.469079] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000046762d58 TD as cancel_status is 2
[  126.469360] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b04b060
[  126.469370] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000046762d58 TD
[  126.469376] xhci-renesas-hcd ee000000.usb: Giveback URB 0000000046762d58, len = 0, expected = 8, status = -71
[  126.469384] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[  126.472623] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.472632] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=10
[  126.472638] finish_td: USB transaction error on TD 000000009ed82d11
[  126.472644] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[  126.472652] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.473049] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.473058] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04b060 (dma) in stream 0 URB 0000000046762d58
[  126.473068] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04b070, cycle 1
[  126.473068]
[  126.473074] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.473079] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000046762d58 TD as cancel_status is 2
[  126.473363] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b04b070
[  126.473373] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000046762d58 TD
[  126.473380] xhci-renesas-hcd ee000000.usb: Giveback URB 0000000046762d58, len = 0, expected = 8, status = -71
[  126.473388] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[  126.473625] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 4 on endpoint
[  126.473634] process_bulk_intr_td: USB transaction error on TD 0000000038987fa4, err_count=3
[  126.473641] xhci-renesas-hcd ee000000.usb: Soft-reset ep 4, slot 1
[  126.473649] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.474064] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.476623] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.476632] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=11
[  126.476638] finish_td: USB transaction error on TD 000000009ed82d11
[  126.476643] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[  126.476651] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.477050] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.477060] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04b070 (dma) in stream 0 URB 0000000046762d58
[  126.477070] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04b080, cycle 1
[  126.477070]
[  126.477076] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.477081] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000046762d58 TD as cancel_status is 2
[  126.477360] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b04b080
[  126.477370] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000046762d58 TD
[  126.477377] xhci-renesas-hcd ee000000.usb: Giveback URB 0000000046762d58, len = 0, expected = 8, status = -71
[  126.477385] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[  126.480623] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.480632] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=12
[  126.480638] finish_td: USB transaction error on TD 000000009ed82d11
[  126.480644] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[  126.480651] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.481051] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.481060] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04b080 (dma) in stream 0 URB 0000000046762d58
[  126.481070] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04b090, cycle 1
[  126.481070]
[  126.481076] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.481081] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000046762d58 TD as cancel_status is 2
[  126.481293] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b04b090
[  126.481302] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000046762d58 TD
[  126.481309] xhci-renesas-hcd ee000000.usb: Giveback URB 0000000046762d58, len = 0, expected = 8, status = -71
[  126.481317] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[  126.484540] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[  126.484552] process_bulk_intr_td: USB transaction error on TD 000000009ed82d11, err_count=13
[  126.484559] finish_td: USB transaction error on TD 000000009ed82d11
[  126.484566] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[  126.484575] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.484903] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.484911] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04b090 (dma) in stream 0 URB 0000000046762d58
[  126.484922] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04b0a0, cycle 1
[  126.484922]
[  126.484929] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.484934] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000046762d58 TD as cancel_status is 2
[  126.485159] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b04b0a0
[  126.485168] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000046762d58 TD
[  126.485174] xhci-renesas-hcd ee000000.usb: Giveback URB 0000000046762d58, len = 0, expected = 8, status = -71
[  126.485184] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[  126.485544] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 4 on endpoint
[  126.485554] process_bulk_intr_td: USB transaction error on TD 0000000038987fa4, err_count=4
[  126.485559] finish_td: USB transaction error on TD 0000000038987fa4
[  126.485566] xhci-renesas-hcd ee000000.usb: Hard-reset ep 4, slot 1
[  126.485574] xhci-renesas-hcd ee000000.usb: // Ding dong!
[  126.485922] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[  126.485930] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b047000 (dma) in stream 0 URB 000000002edc85e8
[  126.485939] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b047010, cycle 1
...
...
...
[ 1251.703007] xhci-renesas-hcd ee000000.usb: // Ding dong!
[ 1251.703011] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 000000002edc85e8 TD as cancel_status is 2
[ 1251.703253] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b047710
[ 1251.703259] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 000000002edc85e8 TD
[ 1251.703265] xhci-renesas-hcd ee000000.usb: Giveback URB 000000002edc85e8, len = 0, expected = 32, status = -71
[ 1251.703274] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[ 1251.703289] ch341-uart ttyUSB0: usb_serial_generic_read_bulk_callback - urb 0, len 0
[ 1251.703295] ch341-uart ttyUSB0: usb_serial_generic_read_bulk_callback - nonzero urb status: -71
[ 1251.703300] ch341-uart ttyUSB0: usb_serial_generic_submit_read_urb - urb 0
[ 1251.705611] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[ 1251.705626] process_bulk_intr_td: USB transaction error on TD 0000000038987fa4, err_count=273535
[ 1251.705633] finish_td: USB transaction error on TD 0000000038987fa4
[ 1251.705639] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[ 1251.705649] xhci-renesas-hcd ee000000.usb: // Ding dong!
[ 1251.705971] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[ 1251.705977] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04bab0 (dma) in stream 0 URB 0000000046762d58
[ 1251.705986] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04bac0, cycle 1
[ 1251.705986]
[ 1251.705991] xhci-renesas-hcd ee000000.usb: // Ding dong!
[ 1251.705995] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000046762d58 TD as cancel_status is 2
[ 1251.706227] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b04bac0
[ 1251.706233] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000046762d58 TD
[ 1251.706239] xhci-renesas-hcd ee000000.usb: Giveback URB 0000000046762d58, len = 0, expected = 8, status = -71
[ 1251.706249] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[ 1251.709611] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[ 1251.709626] process_bulk_intr_td: USB transaction error on TD 0000000038987fa4, err_count=273536
[ 1251.709632] finish_td: USB transaction error on TD 0000000038987fa4
[ 1251.709638] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[ 1251.709648] xhci-renesas-hcd ee000000.usb: // Ding dong!
[ 1251.709972] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[ 1251.709979] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04bac0 (dma) in stream 0 URB 0000000046762d58
[ 1251.709987] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04bad0, cycle 1
[ 1251.709987]
[ 1251.709992] xhci-renesas-hcd ee000000.usb: // Ding dong!
[ 1251.709997] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000046762d58 TD as cancel_status is 2
[ 1251.710226] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b04bad0
[ 1251.710233] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000046762d58 TD
[ 1251.710239] xhci-renesas-hcd ee000000.usb: Giveback URB 0000000046762d58, len = 0, expected = 8, status = -71
[ 1251.710250] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[ 1251.713611] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[ 1251.713626] process_bulk_intr_td: USB transaction error on TD 0000000038987fa4, err_count=273537
[ 1251.713633] finish_td: USB transaction error on TD 0000000038987fa4
[ 1251.713639] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[ 1251.713649] xhci-renesas-hcd ee000000.usb: // Ding dong!
[ 1251.713971] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[ 1251.713977] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04bad0 (dma) in stream 0 URB 0000000046762d58
[ 1251.713986] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04bae0, cycle 1
[ 1251.713986]
[ 1251.713992] xhci-renesas-hcd ee000000.usb: // Ding dong!
[ 1251.713996] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 0000000046762d58 TD as cancel_status is 2
[ 1251.714227] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b04bae0
[ 1251.714233] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 0000000046762d58 TD
[ 1251.714240] xhci-renesas-hcd ee000000.usb: Giveback URB 0000000046762d58, len = 0, expected = 8, status = -71
[ 1251.714251] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[ 1251.714613] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 4 on endpoint
[ 1251.714620] process_bulk_intr_td: USB transaction error on TD 00000000ed91d91d, err_count=99057
[ 1251.714626] finish_td: USB transaction error on TD 00000000ed91d91d
[ 1251.714631] xhci-renesas-hcd ee000000.usb: Hard-reset ep 4, slot 1
[ 1251.714638] xhci-renesas-hcd ee000000.usb: // Ding dong!
[ 1251.714986] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[ 1251.714992] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b047710 (dma) in stream 0 URB 000000009ef56dc1
[ 1251.715001] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b047720, cycle 1
[ 1251.715001]
[ 1251.715006] xhci-renesas-hcd ee000000.usb: // Ding dong!
[ 1251.715011] xhci-renesas-hcd ee000000.usb: xhci_giveback_invalidated_tds: Keep cancelled URB 000000009ef56dc1 TD as cancel_status is 2
[ 1251.715252] xhci-renesas-hcd ee000000.usb: Successful Set TR Deq Ptr cmd, deq = @4b047720
[ 1251.715259] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: Giveback cancelled URB 000000009ef56dc1 TD
[ 1251.715265] xhci-renesas-hcd ee000000.usb: Giveback URB 000000009ef56dc1, len = 0, expected = 32, status = -71
[ 1251.715274] xhci-renesas-hcd ee000000.usb: xhci_handle_cmd_set_deq: All TDs cleared, ring doorbell
[ 1251.715291] ch341-uart ttyUSB0: usb_serial_generic_read_bulk_callback - urb 1, len 0
[ 1251.715298] ch341-uart ttyUSB0: usb_serial_generic_read_bulk_callback - nonzero urb status: -71
[ 1251.715303] ch341-uart ttyUSB0: usb_serial_generic_submit_read_urb - urb 1
[ 1251.717610] xhci-renesas-hcd ee000000.usb: Transfer error for slot 1 ep 2 on endpoint
[ 1251.717622] process_bulk_intr_td: USB transaction error on TD 0000000038987fa4, err_count=273538
[ 1251.717628] finish_td: USB transaction error on TD 0000000038987fa4
[ 1251.717635] xhci-renesas-hcd ee000000.usb: Hard-reset ep 2, slot 1
[ 1251.717644] xhci-renesas-hcd ee000000.usb: // Ding dong!
[ 1251.717972] xhci-renesas-hcd ee000000.usb: Ignoring reset ep completion code of 1
[ 1251.717979] xhci-renesas-hcd ee000000.usb: Removing canceled TD starting at 0x4b04bae0 (dma) in stream 0 URB 0000000046762d58
[ 1251.717988] xhci-renesas-hcd ee000000.usb: Set TR Deq ptr 0x4b04baf0, cycle 1
...
...
...

Best Regards,
Guan Wang

Re: [ISSUE REPORT] xHCI infinite endpoint reset loop on full-speed after transfer error

[Greg KH]

On Mon, May 12, 2025 at 02:39:13PM +0800, Guan Wang wrote:
> From: Guan Wang <guan.wang.jy@gmail.com>
> 
> Hello,
> 
> Using Linux version 6.15.0-rc5-00032, I encountered an issue where the xHCI controller enters an
> infinite loop while attempting to recover a USB endpoint. This causes the xHCI driver to get stuck,
> and no USB transfers can proceed.
> 
> This issue appears to only occur with full-speed bulk devices such as USB serial adapters(e.g.,
> USB-Serial or CDC-ACM class). I've reproduced it using CH340 and CP2102 USB serial devices.
> 
> **Steps to reproduce:**
> 1. Attach the device.
> 2. Start continuous data transfer (e.g., `cat /dev/ttyUSB0`).
> 3. Induce transfer errors via:
>    - EMI interference
>    - Sudden temperature changes
>    - Long USB cables
>    - Briefly shorting DP/DM lines to simulate a transaction error
> 
> After this, the xHCI controller enters an infinite reset loop on the affected endpoint. "Transfer error"
> messages continuously appear in the logs, creating a log storm. The issue seems to improve or disappear
> when an external high-speed USB hub is inserted between the host and device.
> 
> Do you have any comments or suggestions? The log is shown below:
> 
> 
> **USB emulation dmesg**
> 
> [   41.109377] usb 3-1: new full-speed USB device number 2 using xhci-renesas-hcd
> [   41.277651] xhci-renesas-hcd ee000000.usb: add ep 0x82, slot id 1, new drop flags = 0x0, new add flags = 0x21
> [   41.277676] xhci-renesas-hcd ee000000.usb: add ep 0x2, slot id 1, new drop flags = 0x0, new add flags = 0x31
> [   41.277697] xhci-renesas-hcd ee000000.usb: add ep 0x81, slot id 1, new drop flags = 0x0, new add flags = 0x39

Does this happen on other xhci controllers as well?  Or just the Renesas
chip?

thanks,

greg k-h

Re: [ISSUE REPORT] xHCI infinite endpoint reset loop on full-speed after transfer error

[Michał Pecio]

On Mon, 12 May 2025 14:39:13 +0800, Guan Wang wrote:
> Using Linux version 6.15.0-rc5-00032, I encountered an issue where
> the xHCI controller enters an infinite loop while attempting to
> recover a USB endpoint. This causes the xHCI driver to get stuck, and
> no USB transfers can proceed.
> 
> This issue appears to only occur with full-speed bulk devices such as
> USB serial adapters(e.g., USB-Serial or CDC-ACM class). I've
> reproduced it using CH340 and CP2102 USB serial devices.
> 
> **Steps to reproduce:**
> 1. Attach the device.
> 2. Start continuous data transfer (e.g., `cat /dev/ttyUSB0`).
> 3. Induce transfer errors via:
>    - EMI interference
>    - Sudden temperature changes
>    - Long USB cables
>    - Briefly shorting DP/DM lines to simulate a transaction error
> 
> After this, the xHCI controller enters an infinite reset loop on the
> affected endpoint. "Transfer error" messages continuously appear in
> the logs, creating a log storm. The issue seems to improve or
> disappear when an external high-speed USB hub is inserted between the
> host and device.

Greg may be asking the right question.

I tried this on 3ce9925823c7, which is linus/master from a few days ago,
with uPD720202 and PL2303HX or CH341A in TX-RX loopback. I temporarily
disconnect D- to get transaction errors without detaching the device.

All characters sent during disconnection are lost, and sometimes one or
two after reconnection too (bug?), but things are back to normal then.

OTOH, it stops working if I insert a high-speed hub upstream of the D-
switch (tried with two hubs). But still no transaction error storm.

In your case, it looks like USB transactions keep failing for some
reason even after the original error-inducing condition is removed.
The rest looks like usual error recovery procedure.

Any chance that some error messages are lost in dynamic debug noise?

Note: "ep 2" is 0x81 interrupt, and "ep 4" is 0x82 bulk.

Michal

Re: [ISSUE REPORT] xHCI infinite endpoint reset loop on full-speed after transfer error

[Michał Pecio]

On Mon, 12 May 2025 10:19:13 +0200, Michał Pecio wrote:
> On Mon, 12 May 2025 14:39:13 +0800, Guan Wang wrote:
> > Using Linux version 6.15.0-rc5-00032, I encountered an issue where
> > the xHCI controller enters an infinite loop while attempting to
> > recover a USB endpoint. This causes the xHCI driver to get stuck,
> > and no USB transfers can proceed.
> > 
> > This issue appears to only occur with full-speed bulk devices such
> > as USB serial adapters(e.g., USB-Serial or CDC-ACM class). I've
> > reproduced it using CH340 and CP2102 USB serial devices.
> > 
> > **Steps to reproduce:**
> > 1. Attach the device.
> > 2. Start continuous data transfer (e.g., `cat /dev/ttyUSB0`).
> > 3. Induce transfer errors via:
> >    - EMI interference
> >    - Sudden temperature changes
> >    - Long USB cables
> >    - Briefly shorting DP/DM lines to simulate a transaction error
> > 
> > After this, the xHCI controller enters an infinite reset loop on the
> > affected endpoint. "Transfer error" messages continuously appear in
> > the logs, creating a log storm. The issue seems to improve or
> > disappear when an external high-speed USB hub is inserted between
> > the host and device.  
> 
> Greg may be asking the right question.
> 
> I tried this on 3ce9925823c7, which is linus/master from a few days
> ago, with uPD720202 and PL2303HX or CH341A in TX-RX loopback. I
> temporarily disconnect D- to get transaction errors without detaching
> the device.
> 
> All characters sent during disconnection are lost, and sometimes one
> or two after reconnection too (bug?), but things are back to normal
> then.

This has all the signs of toggle mismatch: the OUT transfer succeeds,
but no corresponding IN transfer occurs, even though URBs are clearly
pending because the next character sent does generate an IN transfer
without new IN URB submission in between.

I wonder if your issue may simply be a matter of overly pedantic host
controller refusing to accept DATA1 PID right after Reset Endpoint, on
the grounds that it must be a software bug (which it is).

> OTOH, it stops working if I insert a high-speed hub upstream of the D-
> switch (tried with two hubs). But still no transaction error storm.

This appears to be usb-serial not resubmitting URBs failed with -EPIPE.
Simply reopening the port restores operation.