On 17.9.2020 18.30, Andrzej Pietrasiewicz wrote: > Dear All, > > I have encountered a problem in xhci which leads to general protection fault. > > The problem is triggered by running this program: > > https://gitlab.collabora.com/andrzej.p/bulk-cancel.git > > $ sudo ./bulk-cancel -D /dev/bus/usb/002/006 -i 1 -b 1 > > where /dev/bus/usb/002/006 is a Gadget Zero: > > It takes less than a minute until the crash happens. > The DMAR (iommu) errors don't happen always, i.e. there are crashes > when they are not reported in the system log. In either case the > > "WARN Cannot submit Set TR Deq Ptr" > "A Set TR Deq Ptr command is pending." > "WARN Set TR Deq Ptr cmd failed due to incorrect slot or ep state." > > messages do appear. > Nice testcase and report, thanks. I started looking at issues in this area some time ago, and wrote a couple patches but it was left hanging. The two patches (now rebased on 5.9-rc3) can be found in my tree in the fix_invalid_context_at_stop_endpoint branch git://git.kernel.org/pub/scm/linux/kernel/git/mnyman/xhci.git fix_invalid_context_at_stop_endpoint https://git.kernel.org/pub/scm/linux/kernel/git/mnyman/xhci.git/log/?h=fix_invalid_context_at_stop_endpoint If you could give those a try and see if they help I'd be grateful. also, if possible, can you add xhci dynamic debug and traces to show in more detail what is going on. mount -t debugfs none /sys/kernel/debug echo 'module xhci_hcd =p' >/sys/kernel/debug/dynamic_debug/control echo 'module usbcore =p' >/sys/kernel/debug/dynamic_debug/control echo 81920 > /sys/kernel/debug/tracing/buffer_size_kb echo 1 > /sys/kernel/debug/tracing/events/xhci-hcd/enable < Run the testcase > Send output of dmesg Send content of /sys/kernel/debug/tracing/trace Thanks Mathias
