From: Henry Tseng <henrytseng@qnap.com>
To: Mathias Nyman <mathias.nyman@intel.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-usb@vger.kernel.org, Henry Tseng <henrytseng@qnap.com>
Subject: [PATCH 0/2] xhci: handshake timeout overrun and configure endpoint hang on device disconnect
Date: Wed, 30 Sep 2026 18:17:50 +0800 [thread overview]
Message-ID: <20260930101752.15794-1-henrytseng@qnap.com> (raw)
This series addresses two problems found while debugging an AMD Raven
USB 3.1 xHCI (1022:15e0) that gets declared dead when a USB storage
enclosure is unplugged. During teardown a command fails to complete,
aborting the command ring also fails, and the whole host is declared
dead, taking unrelated devices on other root ports down with it:
xhci_hcd 0000:0c:00.3: Command timeout, USBSTS: 0x00000010 PCD
xhci_hcd 0000:0c:00.3: Abort command ring
xhci_hcd 0000:0c:00.3: Abort failed to stop command ring: -110
xhci_hcd 0000:0c:00.3: xHCI host controller not responding, assume dead
Reproduced on mainline v7.3-rc5:
CPU: AMD Ryzen Embedded V1500B
xHCI: AMD Raven USB 3.1, 0000:0c:00.3 [1022:15e0]
Enclosure: QNAP TL-D800C
I have only seen this with this enclosure on this controller. Other USB
devices unplug cleanly from the same host, and this enclosure unplugs
cleanly from a Meteor Lake-P xHCI. Similar messages were reported in
[1][2] without a resolution. I could not confirm the same command was
involved.
Patch 2 fixes the host death on disconnect. The command that never
completed is a configure endpoint command issued during teardown of a
device behind the disconnected root port, right before disable slot for
the same slot. Skip it when the roothub port is gone, as
xhci_check_bandwidth() already does when the host is being removed.
Patch 1 is an independent handshake overrun noticed during the same
debugging, and does not fix the disconnect hang on its own. The command
abort handshake has a 5 s timeout but took 15.8 s with interrupts
disabled. This is not specific to this controller. When forced to time
out, a 10 s xhci_handshake() returns after 19.1 s on Alder Lake-S and
17.2 s on Meteor Lake-P. With patch 1 applied it returns after 10 s on
both.
[1] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1857385
[2] https://marc.info/?l=linux-usb&m=155120372130870&w=2
Henry Tseng (2):
xhci: make xhci_handshake() timeout wall-clock based again
xhci: skip configure endpoint when dropping endpoints of a
disconnected device
drivers/usb/host/xhci.c | 30 ++++++++++++++++++++++--------
1 file changed, 22 insertions(+), 8 deletions(-)
--
2.43.0
next reply other threads:[~2026-09-30 10:18 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-30 10:17 Henry Tseng [this message]
2026-09-30 10:17 ` [PATCH 1/2] xhci: make xhci_handshake() timeout wall-clock based again Henry Tseng
2026-09-30 10:17 ` [PATCH 2/2] xhci: skip configure endpoint when dropping endpoints of a disconnected device Henry Tseng
2026-10-02 9:30 ` [PATCH 0/2] xhci: handshake timeout overrun and configure endpoint hang on device disconnect Michal Pecio
2026-10-07 9:52 ` Henry Tseng
2026-10-08 9:06 ` Michal Pecio
2026-10-08 9:13 ` Michal Pecio
2026-10-08 10:25 ` Henry Tseng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260930101752.15794-1-henrytseng@qnap.com \
--to=henrytseng@qnap.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-usb@vger.kernel.org \
--cc=mathias.nyman@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox