Re: [PATCH RFT RFC] usb: xhci: Kill hosts with HCE or HSE on command timeout

Michal Pecio
2026-05-02T21:55:23Z

On Sat, 2 May 2026 08:38:34 -0300, Desnes Nunes wrote:
> > diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
> > index e5823650850a..3041deb67b57 100644
> > --- a/drivers/usb/host/xhci-ring.c
> > +++ b/drivers/usb/host/xhci-ring.c
> > @@ -1761,13 +1761,15 @@ void xhci_handle_command_timeout(struct work_struct *work)
> > /* mark this command to be cancelled */
> > xhci->current_cmd->status = COMP_COMMAND_ABORTED;
> >
> > - /* Make sure command ring is running before aborting it */
> > + /* check for crashed or disconnected chip */
> > hw_ring_state = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
> > - if (hw_ring_state == ~(u64)0) {
> > + if (hw_ring_state == ~(u64)0 || usbsts & (STS_FATAL | STS_HCE)) {
> > + xhci_info(xhci, "kill the damn thing\n");
> > xhci_hc_died(xhci);
> > goto time_out_completed;
> > }
> >
> > + /* Make sure command ring is running before aborting it */
> > if ((xhci->cmd_ring_state & CMD_RING_STATE_RUNNING) &&
> > (hw_ring_state & CMD_RING_RUNNING)) {
> > /* Prevent new doorbell, and start command abort */
>
> FYI, sorry to be the bearer of bad news, but this also panics the
> system as soon as I run `echo c > /proc/sysrq-trigger`.

Is this not what's supposed to happen?

Sorry, that complaint is so odd that I thought I'm seeing another case
of debugging being outsourced to an AI chatbot, which forgot that panic
is triggered intentionally here. Now I'm just confused.

> Kdump doesn't run and no vmcore is produced:

Is the kdump kernel not launched, or does it crash during boot?
The latter would make sense if there is some problem with the code.

But I don't understand how patching xhci-hcd could possibly have
any effect on the former. Does this new code execute at all? Does
"kill the damn thing" ever appear in dmesg?

Regards,
Michal