Re: xhci_hcd 0000:0c:00.0 dies with "Abort failed to stop command ring: -110" exactly 24s post-init, tunneled USB4 xHCI behind Goshen Ridge (ASUS ThunderboltEX 4) + CalDigit TS4

[Michal Pecio <michal.pecio@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2460 bytes --]

On Fri, 25 Sep 2026 20:28:14 -0400, Ben wrote:
> Kernel Information:
> >   git remote -v
> > origin https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (fetch)
> > origin https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (push)
> > thunderbolt https://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt.git/ (fetch)
> > thunderbolt https://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt.git/ (push)
> >   git status
> > HEAD detached at thunderbolt/master
> > Changes not staged for commit:
> >  (use "git add <file>..." to update what will be committed)
> >  (use "git restore <file>..." to discard changes in working directory)
> > modified:   drivers/usb/host/xhci-mem.c
> > modified:   drivers/usb/host/xhci.c  
> 
> I've provided more snapshots. One with the quirks from console
> options, one without.

This looks right, but the debugfs dumps don't seem to have been taken
from the patched kernel. Not sure what are those slot_2xx directories,
but neither of them has the bogus IR0_ERSTBA_LOW value.

Was USB functional at all? The patch would break it. Maybe it wasn't
ideal, please try this revised patch which only touches the suspect
host controller. And don't use xhci_hcd.quirks=0x800000 anymore.

Please confirm that the string "beef cafe" appears in dmesg, this shows
that the patch is applied and it recognized the suspect controller.
Then check if there are any "AMD-Vi" errors logged, particularly at
addresses 0xbeef0000 and 0xcafe0000, and check this:

# grep ERSTBA_LOW /sys/kernel/debug/usb/xhci/0000\:0c\:00.0/reg-runtime
IR0_ERSTBA_LOW = 0xbeef0000
  
> usbmon.txt is the result of:
>   sudo cat /sys/kernel/debug/usb/usbmon/0u | tee usbmon.log
> 
> followed by:
>   echo 0000:0c:00.0 | sudo tee /sys/bus/pci/drivers/xhci_hcd/unbind
>   sleep 2
>   echo 0000:0c:00.0 | sudo tee /sys/bus/pci/drivers/xhci_hcd/bind

This confirms that USB core initializes the hub, detects connected
ports and tries to enable them without working Port Status Change
events. Hub interrupt endpoints only see submissions and unlinks.

I separately confirmed the same on my system. I completely patched
out the call to handle_port_status() and devices connected during
driver reload were still detected, only hotplug stopped working.

So it's not surprising that Enable Slot command is queued without
functional xHCI events.

Regards,
Michal

[-- Attachment #2: xhci-bogus-dma.patch --]
[-- Type: text/x-patch, Size: 1525 bytes --]

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 83ed26c4f9e4..a8f6d50eaf03 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2349,7 +2349,7 @@ void xhci_add_interrupter(struct xhci_hcd *xhci, unsigned int intr_num)
 
 	erst_base = xhci_read_64(xhci, &ir->ir_set->erst_base);
 	erst_base &= ~ERST_BASE_ADDRESS_MASK;
-	erst_base |= ir->erst.erst_dma_addr & ERST_BASE_ADDRESS_MASK;
+	erst_base |= xhci->quirks == 0x9810 ? 0xbeef0000 : ir->erst.erst_dma_addr & ERST_BASE_ADDRESS_MASK;
 	if (xhci->quirks & XHCI_WRITE_64_HI_LO)
 		hi_lo_writeq(erst_base, &ir->ir_set->erst_base);
 	else
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index e5c8b3a945a6..62c0690d4b55 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -497,7 +497,7 @@ static void xhci_set_cmd_ring_deq(struct xhci_hcd *xhci)
 
 	crcr = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
 	crcr &= ~(CMD_RING_PTR_MASK | CMD_RING_CYCLE);
-	crcr |= deq_dma;
+	crcr |= xhci->quirks == 0x9810 ? 0xcafe0000 : deq_dma;
 	crcr |= xhci->cmd_ring->cycle_state;
 
 	xhci_dbg_trace(xhci, trace_xhci_dbg_init, "Setting command ring address to 0x%llx", crcr);
@@ -533,6 +533,9 @@ static void xhci_init(struct usb_hcd *hcd)
 {
 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
 
+	if (xhci->quirks == 0x9810)
+		xhci_info(xhci, "beef cafe\n");
+
 	xhci_dbg_trace(xhci, trace_xhci_dbg_init, "Starting %s", __func__);
 
 	/* Set the Number of Device Slots Enabled to the maximum supported value */