Linux USB
 help / color / mirror / Atom feed
From: Henry Tseng <henrytseng@qnap.com>
To: Mathias Nyman <mathias.nyman@intel.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	linux-usb@vger.kernel.org, Henry Tseng <henrytseng@qnap.com>
Subject: [PATCH 0/2] xhci: handshake timeout overrun and configure endpoint hang on device disconnect
Date: Wed, 30 Sep 2026 18:17:50 +0800	[thread overview]
Message-ID: <20260930101752.15794-1-henrytseng@qnap.com> (raw)

This series addresses two problems found while debugging an AMD Raven
USB 3.1 xHCI (1022:15e0) that gets declared dead when a USB storage
enclosure is unplugged. During teardown a command fails to complete,
aborting the command ring also fails, and the whole host is declared
dead, taking unrelated devices on other root ports down with it:

  xhci_hcd 0000:0c:00.3: Command timeout, USBSTS: 0x00000010 PCD
  xhci_hcd 0000:0c:00.3: Abort command ring
  xhci_hcd 0000:0c:00.3: Abort failed to stop command ring: -110
  xhci_hcd 0000:0c:00.3: xHCI host controller not responding, assume dead

Reproduced on mainline v7.3-rc5:

  CPU:        AMD Ryzen Embedded V1500B
  xHCI:       AMD Raven USB 3.1, 0000:0c:00.3 [1022:15e0]
  Enclosure:  QNAP TL-D800C

I have only seen this with this enclosure on this controller. Other USB
devices unplug cleanly from the same host, and this enclosure unplugs
cleanly from a Meteor Lake-P xHCI. Similar messages were reported in
[1][2] without a resolution. I could not confirm the same command was
involved.

Patch 2 fixes the host death on disconnect. The command that never
completed is a configure endpoint command issued during teardown of a
device behind the disconnected root port, right before disable slot for
the same slot. Skip it when the roothub port is gone, as
xhci_check_bandwidth() already does when the host is being removed.

Patch 1 is an independent handshake overrun noticed during the same
debugging, and does not fix the disconnect hang on its own. The command
abort handshake has a 5 s timeout but took 15.8 s with interrupts
disabled. This is not specific to this controller. When forced to time
out, a 10 s xhci_handshake() returns after 19.1 s on Alder Lake-S and
17.2 s on Meteor Lake-P. With patch 1 applied it returns after 10 s on
both.

[1] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1857385
[2] https://marc.info/?l=linux-usb&m=155120372130870&w=2

Henry Tseng (2):
  xhci: make xhci_handshake() timeout wall-clock based again
  xhci: skip configure endpoint when dropping endpoints of a
    disconnected device

 drivers/usb/host/xhci.c | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

-- 
2.43.0


             reply	other threads:[~2026-09-30 10:18 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-30 10:17 Henry Tseng [this message]
2026-09-30 10:17 ` [PATCH 1/2] xhci: make xhci_handshake() timeout wall-clock based again Henry Tseng
2026-09-30 10:17 ` [PATCH 2/2] xhci: skip configure endpoint when dropping endpoints of a disconnected device Henry Tseng
2026-10-02  9:30 ` [PATCH 0/2] xhci: handshake timeout overrun and configure endpoint hang on device disconnect Michal Pecio
2026-10-07  9:52   ` Henry Tseng
2026-10-08  9:06     ` Michal Pecio
2026-10-08  9:13       ` Michal Pecio
2026-10-08 10:25       ` Henry Tseng

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260930101752.15794-1-henrytseng@qnap.com \
    --to=henrytseng@qnap.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=mathias.nyman@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox