Re: [PATCH 0/2] xhci: handshake timeout overrun and configure endpoint hang on device disconnect

[Michal Pecio <michal.pecio@gmail.com>]

On Wed, 07 Oct 2026 17:52:13 +0800, Henry Tseng wrote:
> port_bandwidth/ is left out, since reading it takes xhci->lock and
> queues a get port bandwidth command.

Thanks for pointing it out, we do need to skip this in such cases.

> xhci_handshake() is still called with xhci->lock held and interrupts
> disabled in other places.

Yes, we know. They need to be individually fixed to drop the lock.

Your debugfs shows the following tree of devices still existing:

# USB3 hub
devices/01/name:1-1
devices/02/name:2-1

	# unknown USB3 device
	devices/04/name:2-1.3

	# another USB3 hub
	devices/06/name:2-1.4
	devices/07/name:1-1.4

		# USB3 UAS device
		devices/08/name:2-1.4.4

Event ring dump (--> shows corresponding commands):

 1 0x00000000ffffc230: TRB 00000000bb0324f0 status 'Short Packet' len 96 slot 8 ep 7 type 'Transfer Event' flags e:c
 1 0x00000000ffffc240: TRB 0000000001000000 status 'Success' len 0 slot 0 ep 0 type 'Port Status Change Event' flags e:c
 1 0x00000000ffffc250: TRB 00000000ffffe5e0 status 'Success' len 0 slot 3 ep 0 type 'Command Completion Event' flags e:c
-->  0 0x00000000ffffe5e0: Configure Endpoint Command: ctx 00000000ba6ac000 slot 3 flags d:C 
 1 0x00000000ffffc260: TRB 00000000ffffe5f0 status 'Success' len 0 slot 3 ep 0 type 'Command Completion Event' flags e:c
-->  0 0x00000000ffffe5f0: Disable Slot Command: slot 3 flags C 
 1 0x00000000ffffc270: TRB 00000000bb067000 status 'Stopped' len 1 slot 5 ep 3 type 'Transfer Event' flags e:c
 1 0x00000000ffffc280: TRB 00000000ffffe600 status 'Success' len 0 slot 5 ep 0 type 'Command Completion Event' flags e:c
-->  0 0x00000000ffffe600: Stop Ring Command: slot 5 sp 0 ep 3 flags C 
 1 0x00000000ffffc290: TRB 0000000005000000 status 'Success' len 0 slot 0 ep 0 type 'Port Status Change Event' flags e:c
 1 0x00000000ffffc2a0: TRB 00000000ffffe610 status 'Success' len 0 slot 5 ep 0 type 'Command Completion Event' flags e:c
-->  0 0x00000000ffffe610: Configure Endpoint Command: ctx 00000000bb025000 slot 5 flags d:C 
 1 0x00000000ffffc2b0: TRB 00000000bb030000 status 'Stopped' len 2 slot 4 ep 7 type 'Transfer Event' flags e:c
 1 0x00000000ffffc2c0: TRB 00000000ffffe620 status 'Success' len 0 slot 4 ep 0 type 'Command Completion Event' flags e:c
-->  0 0x00000000ffffe620: Stop Ring Command: slot 4 sp 0 ep 7 flags C 
 1 0x00000000ffffc2d0: TRB 00000000fd0c7000 status 'USB Transaction Error' len 1 slot 7 ep 3 type 'Transfer Event' flags e:c
 1 0x00000000ffffc2e0: TRB 00000000ba600010 status 'USB Transaction Error' len 1 slot 1 ep 3 type 'Transfer Event' flags e:c

Some UAS transfer completes normally. Then the 1-1/2-1 hub is
disconnected from the root port 1/5. USB2 disconnection is reported
first and causes removal of unknown devices on slot 3 and 5.

USB3 disconnection is reported later and causes 2-1.3 endpoint 0x83
to be stopped (probably URB unlink?) and the device deconfigured.
Stop completes normally at bb030000 (possibly no transfer has ever
completed on this endpoint) and Configure Endpoint gets stuck.

The last sign of life from the xHC are Trannsaction Errors for USB2
status endpoints of those hubs. They get halted and never reset, so
technically it's a spec violation to disable these endpoints, but we
aren't even thinking about doing it yet.

Can you identify the 2-1.3 device? Can it be separated or is all 
this stuff inside one physical box?

Does it help to blacklist "uas" driver before connecting the whole
tree? My guess at this point: probably not, it's not a streams bug.

What happens if deconfigure manually before disconnection:

  echo 0 > /sys/bus/usb/devices/4-6/bConfigurationValue

Will it hang on deconfiguration, disconnection, or not at all?

Regards,
Michal