linux-kernel - Re: xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 1 comp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1f64af9a-0618-a7da-4acc-f043b6580308@linux.intel.com>
Date: Mon, 8 Apr 2024 10:17:15 +0300
From: Mathias Nyman <mathias.nyman@...ux.intel.com>
To: Michał Pecio <michal.pecio@...il.com>,
 Paul Menzel <pmenzel@...gen.mpg.de>
Cc: Mathias Nyman <mathias.nyman@...el.com>,
 LKML <linux-kernel@...r.kernel.org>, linux-usb@...r.kernel.org
Subject: Re: xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part
 of current TD ep_index 1 comp_code 1

On 7.4.2024 15.25, Michał Pecio wrote:
> This (and the absence of any earlier errors on the endpoint) looks
> like the hardware may be confirming a "successful" transfer twice or
> the driver may be processing one such confirmation twice.

It's also possible this TD/TRB was cancelled due to the disconnect.
Could be that even if driver removes the TD from the list and cleans out the TRB
from the ring buffer (turns TRB to no-op) hardware may have read ahead and cached the TRB,
and process it anyway.

> 
> [   94.088594] usb 1-2: USB disconnect, device number 8
> [   94.089370] xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 1 comp_code 1
> [   94.089403] xhci_hcd 0000:00:14.0: Looking for event-dma 00000001250310f0 trb-start 0000000125031100 trb-end 0000000125031100 seg-start 0000000125031000 seg-end 0000000125031ff0
> [   94.089427] xhci_hcd 0000:00:14.0: last xhci_td_cleanup: first_dma 1250310f0 last_dma 1250310f0 status -115 from finish_td
> 
> (I say "successful" but it really isn't - the device is no longer
> listening. But there is no delivery confirmation on isochronous OUT
> endpoints so the xHC doesn't suspect anything.)
> 
> Could you try again with this updated debug patch to get more info?

Would also be helpful to add xhci dynamic debug and xhci tracing (two separate logs)
These will show in detail everything that is going on.

Steps:

mount -t debugfs none /sys/kernel/debug
echo 'module xhci_hcd =p' >/sys/kernel/debug/dynamic_debug/control
echo 'module usbcore =p' >/sys/kernel/debug/dynamic_debug/control
echo 81920 > /sys/kernel/debug/tracing/buffer_size_kb
echo 1 > /sys/kernel/debug/tracing/events/xhci-hcd/enable
echo 1 > /sys/kernel/debug/tracing/tracing_on
< Reproduce issue >
Send output of dmesg
Send content of /sys/kernel/debug/tracing/trace

please copy the /sys/kernel/debug/tracing/trace file somewhere as soon
as possible after reproducing the issue. It grows fast.

Thanks
Mathias