Re: [PATCH v2 09/11] usb: xhci: Rework and improve the TD matching and skipping logic

[Michal Pecio <michal.pecio@gmail.com>]

On Fri, 09 Oct 2026 15:34:20 +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] usb: xhci: handle_tx_event() halts >1.0 hosts on bogus MSE pointers
> --
> 
> commit cc3554d902e447131e844c7826abc9b1b4f75f82
> Author: Michal Pecio <michal.pecio@gmail.com>
> 
>     usb: xhci: Rework and improve the TD matching and skipping logic
>     
>     Matching events with TDs and giving back missed TDs is carried out
>     by a complicated loop. Replace it with a simpler linear logic:
>     
>     0. Having verified that 'td_list' isn't empty,
>     1. Scan it to find the matching TD and count missed TDs,
>     2. Perform necessary adjustments for corner cases,
>     3. Give back missed TDs, if applicable, using a short and tidy loop,
>     4. Check if the event refers to the expected TD and proceed as usual.
> 
> > diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
> > index 7597ef8105c65..243b1fd2b2f68 100644
> > --- a/drivers/usb/host/xhci-ring.c
> > +++ b/drivers/usb/host/xhci-ring.c  
> [ ... ]
> > @@ -2858,66 +2861,50 @@ static int handle_tx_event(struct xhci_hcd *xhci,  
> [ ... ]
> > +	td = find_td_by_dma(ep_ring, &missed_tds, ep_trb_dma);
> >  
> > -			xhci_dbg(xhci,
> > -				 "Found td. Clear skip flag for slot %u ep %u.\n",
> > -				 slot_id, ep_index);
> > +	if (ep->skip) {
> > +		if (!td) {
> > +			/*
> > +			 * xHCI 1.0 allowed MSE events to have zero TRB pointers. Some old chips
> > +			 * also generate bogus non-zero pointers. We know, don't bother warning.
> > +			 * Missed TDs will be given back by the next event with a valid pointer.
> > +			 */
> > +			if (trb_comp_code == COMP_MISSED_SERVICE_ERROR &&
> > +			    xhci->hci_version <= 0x100)
> > +				return 0;  
> 
> [Severity: High]
> Does this code inadvertently halt hosts > 1.0 on bogus MSE pointers?
>
> By restricting the leniency for bogus Missed Service Error (MSE)
> pointers strictly to xHCI 1.0, controllers > 1.0 that generate a
> bogus pointer for MSE will fall through and hit the "HC is busted"
> block below.

Nothing actually gets halted, only warnings are logged, as for any
out-of-spec event that isn't known and dealt with. Specifically, MSE
are being logged since 2025, as we began to process them more.

One HW bug has been reported since then, in old Intel chipsets, not
sure how many PCI IDs are affected. Hence no warnings on xHCI 1.0.
Otherwise, I prefer to keep logging anomalies because it helps with
discovering SW bugs and properly attributing HW bugs to xHCI layer.

Regards,
Michal