On Wed, Jan 25, 2012 at 05:24:59PM -0800, Paul Zimmerman wrote:
> On Wed, 25 Jan 2012, Paul Zimmerman wrote:
> > Next I will turn on xhci debugging and capture the failure again.
>
> Below is a netconsole log with xhci debugging enabled.
Comments below.
> --
> Paul
>
> [ 133.861915] usbtest 10-1:3.0: TEST 10: queue 32 control calls, 1000 times
> [ 133.861955] Waiting for dequeue pointer to pass the link TRB
> [ 133.861960] xhci_hcd 0000:02:00.0: Adding urb ffff880130418540 to ring's pending list
> [ 133.861965] xhci_hcd 0000:02:00.0: Adding urb ffff880130d24480 to ring's pending list
> [ 133.861970] xhci_hcd 0000:02:00.0: Adding urb ffff880130d24c00 to ring's pending list
> [ 133.861975] xhci_hcd 0000:02:00.0: Adding urb ffff880130d24300 to ring's pending list
> [ 133.861980] xhci_hcd 0000:02:00.0: Adding urb ffff880130d24cc0 to ring's pending list
> [ 133.861985] xhci_hcd 0000:02:00.0: Adding urb ffff880130d24d80 to ring's pending list
> [ 133.861992] xhci_hcd 0000:02:00.0: Adding urb ffff880130d240c0 to ring's pending list
> [ 133.861997] xhci_hcd 0000:02:00.0: Adding urb ffff880130d249c0 to ring's pending list
> [ 133.862004] xhci_hcd 0000:02:00.0: Adding urb ffff880130d246c0 to ring's pending list
> [ 133.862009] xhci_hcd 0000:02:00.0: Adding urb ffff880130d24600 to ring's pending list
> [ 133.862016] xhci_hcd 0000:02:00.0: Adding urb ffff880132c3b900 to ring's pending list
> [ 133.862049] xhci_hcd 0000:02:00.0: Adding urb ffff880132c3bcc0 to ring's pending list
> [ 133.862099] xhci_hcd 0000:02:00.0: Adding urb ffff880132c3be40 to ring's pending list
> [ 133.862146] xhci_hcd 0000:02:00.0: Adding urb ffff880132c3b480 to ring's pending list
> [ 133.862244] xhci_hcd 0000:02:00.0: Adding urb ffff880132c3b000 to ring's pending list
> [ 133.862280] xhci_hcd 0000:02:00.0: Stalled endpoint
> [ 133.862285] xhci_hcd 0000:02:00.0: Cleaning up stalled endpoint ring
> [ 133.862289] xhci_hcd 0000:02:00.0: Finding segment containing stopped TRB.
> [ 133.862292] xhci_hcd 0000:02:00.0: Finding endpoint context
> [ 133.862296] xhci_hcd 0000:02:00.0: Finding segment containing last TRB in TD.
> [ 133.862300] xhci_hcd 0000:02:00.0: Cycle state = 0x1
> [ 133.862304] xhci_hcd 0000:02:00.0: New dequeue segment = ffff88012fc30320 (virtual)
> [ 133.862308] xhci_hcd 0000:02:00.0: New dequeue pointer = 0x37804b20 (DMA)
> [ 133.862311] xhci_hcd 0000:02:00.0: Queueing new dequeue state
> [ 133.862316] xhci_hcd 0000:02:00.0: Set TR Deq Ptr cmd, new deq seg = ffff88012fc30320 (0x37804800 dma), new deq ptr = ffff880037804b20 (0x37804b20 dma), new cycle = 1
> [ 133.862321] xhci_hcd 0000:02:00.0: // Ding dong!
> [ 133.862327] xhci_hcd 0000:02:00.0: Giveback URB ffff880132c3b300, len = 0, expected = a, status = -32
> [ 133.862333] xhci_hcd 0000:02:00.0: Adding urb ffff880132c3b300 to ring's pending list
> [ 133.862338] xhci_hcd 0000:02:00.0: Ignoring reset ep completion code of 1
> [ 133.862343] xhci_hcd 0000:02:00.0: Successful Set TR Deq Ptr cmd, deq = @37804b21
> [ 133.862412] xhci_hcd 0000:02:00.0: Adding urb ffff880132c3b240 to ring's pending list
> [ 133.862447] xhci_hcd 0000:02:00.0: Stalled endpoint
> [ 133.862452] xhci_hcd 0000:02:00.0: Cleaning up stalled endpoint ring
> [ 133.862455] xhci_hcd 0000:02:00.0: Finding segment containing stopped TRB.
> [ 133.862459] xhci_hcd 0000:02:00.0: Finding endpoint context
> [ 133.862462] xhci_hcd 0000:02:00.0: Finding segment containing last TRB in TD.
> [ 133.862466] xhci_hcd 0000:02:00.0: Cycle state = 0x1
> [ 133.862470] xhci_hcd 0000:02:00.0: New dequeue segment = ffff88012fc30320 (virtual)
> [ 133.862474] xhci_hcd 0000:02:00.0: New dequeue pointer = 0x37804b80 (DMA)
> [ 133.862477] xhci_hcd 0000:02:00.0: Queueing new dequeue state
> [ 133.862482] xhci_hcd 0000:02:00.0: Set TR Deq Ptr cmd, new deq seg = ffff88012fc30320 (0x37804800 dma), new deq ptr = ffff880037804b80 (0x37804b80 dma), new cycle = 1
> [ 133.862487] xhci_hcd 0000:02:00.0: // Ding dong!
> [ 133.862492] xhci_hcd 0000:02:00.0: Giveback URB ffff880132c3b180, len = 0, expected = 9, status = -32
> [ 133.862498] xhci_hcd 0000:02:00.0: Adding urb ffff880132c3b180 to ring's pending list
> [ 133.862503] xhci_hcd 0000:02:00.0: Ignoring reset ep completion code of 1
> [ 133.862515] xhci_hcd 0000:02:00.0: Successful Set TR Deq Ptr cmd, deq = @37804b81
> [ 133.862563] xhci_hcd 0000:02:00.0: Adding urb ffff880132c3b9c0 to ring's pending list
> [ 133.862614] xhci_hcd 0000:02:00.0: Adding urb ffff880130d52b40 to ring's pending list
> [ 133.862651] xhci_hcd 0000:02:00.0: Waiting for status stage event
We had a short packet, transfer error, or something on the data stage of
the control transfer, so now we wait for the status stage event to
complete.
I wonder if the status stage event was at the top of the ring? Then we
expand the ring in between the TDs of the control transfer. Because of
the new free TRB counting, we'll overwrite the setup and data URBs, even
though we might not be done with them. I think Andiry just needs to
implement Alan Stern's suggestion of always keeping one ring segment
free, so that situations like this don't happen. That will also remove
the pending URB list, which is probably the underlying cause of the
out-of-order completion that the test complained about.
Still, there's some possible bugs in the control transfer handling, I've
discovered, particularly when there's multiple stalls in a row, and the
last TRB of the control transfer that previously stalled was right
before a link TRB. The control transfer processing assumed the ring
dequeue pointer would always point to the setup TRB, which isn't true if
a stalled transfer moves the dequeue pointer to the link TRB. I don't
think it will fix the oops that Andiry's ring expansion patchset caused,
but can you try it on top of them anyway?
Sarah
> [ 133.862656] ring expansion succeed, now has 2 segments
> [ 133.862661] usbtest 10-1:3.0: subcase 6 completed out of order, last 9
> [ 133.862666] usbtest 10-1:3.0: control queue 80.06, err -33, 31989 left, subcase 6, len 0/18
> [ 133.862673] xhci_hcd 0000:02:00.0: Cancel URB ffff880130d52600, dev 1, ep 0x0, starting at offset 0x37804bd0
> [ 133.862678] xhci_hcd 0000:02:00.0: // Ding dong!
> [ 133.862684] xhci_hcd 0000:02:00.0: Cancel URB ffff880130d52d80, dev 1, ep 0x0, starting at offset 0x37804810
> [ 133.862690] xhci_hcd 0000:02:00.0: Cancel URB ffff880130d523c0, dev 1, ep 0x0, starting at offset 0x37804840
> [ 133.862696] xhci_hcd 0000:02:00.0: Cancel URB ffff880130d52240, dev 1, ep 0x0, starting at offset 0x37804870
> [ 133.862702] xhci_hcd 0000:02:00.0: Cancel URB ffff880130d52c00, dev 1, ep 0x0, starting at offset 0x378048a0
> [ 133.862707] xhci_hcd 0000:02:00.0: Cancel URB ffff880130d526c0, dev 1, ep 0x0, starting at offset 0x378048d0
> [ 133.862713] xhci_hcd 0000:02:00.0: Cancel URB ffff880130d52840, dev 1, ep 0x0, starting at offset 0x37804900
> [ 133.862719] xhci_hcd 0000:02:00.0: Cancel URB ffff880130418180, dev 1, ep 0x0, starting at offset 0x37804930
> [ 133.862725] xhci_hcd 0000:02:00.0: Cancel URB ffff880130418600, dev 1, ep 0x0, starting at offset 0x37804960
> [ 133.862731] xhci_hcd 0000:02:00.0: Cancel URB ffff880130418d80, dev 1, ep 0x0, starting at offset 0x37804990
> [ 133.862737] xhci_hcd 0000:02:00.0: Cancel URB ffff880130418a80, dev 1, ep 0x0, starting at offset 0x378049c0
> [ 133.862748] xhci_hcd 0000:02:00.0: WARN halted endpoint, queueing URB anyway.
> [ 133.862751] ------------[ cut here ]------------
> [ 133.862758] WARNING: at /git/xhci/lib/list_debug.c:30 __list_add+0x68/0x80()
> [ 133.862762] Hardware name:
> [ 133.862765] list_add corruption. prev->next should be next (ffff8801352ff9c0), but was (null). (prev=ffff8801352d3540).
> [ 133.862769] Modules linked in: xhci_hcd usbtest netconsole configfs fuse sunrpc ipv6 uinput snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device x38_edac edac_core microcode iTCO_wdt iTCO_vendor_support snd_pcm e1000e i2c_i801 snd_timer pcspkr serio_raw snd soundcore snd_page_alloc firewire_ohci firewire_core crc_itu_t nouveau ttm drm_kms_helper drm i2c_algo_bit i2c_core mxm_wmi wmi video [last unloaded: xhci_hcd]
> [ 133.862855] Pid: 0, comm: swapper/1 Not tainted 3.2.0-rc5-sarah+ #4
> [ 133.862858] Call Trace:
> [ 133.862861] <IRQ> [<ffffffff81044f02>] warn_slowpath_common+0x85/0x9d
> [ 133.862872] [<ffffffff81044fbd>] warn_slowpath_fmt+0x46/0x48
> [ 133.862877] [<ffffffff81241dd0>] __list_add+0x68/0x80
> [ 133.862885] [<ffffffffa02c6b8c>] prepare_transfer+0x165/0x195 [xhci_hcd]
> [ 133.862893] [<ffffffffa02c7dcc>] xhci_queue_ctrl_tx+0x84/0x233 [xhci_hcd]
> [ 133.862898] [<ffffffff8110d367>] ? __kmalloc+0xe9/0xfc
> [ 133.862905] [<ffffffffa02c0f38>] xhci_urb_enqueue+0x35e/0x4be [xhci_hcd]
> [ 133.862911] [<ffffffff8133df20>] usb_hcd_submit_urb+0x628/0x6e0
> [ 133.862916] [<ffffffff812451ee>] ? is_swiotlb_buffer+0x2e/0x3b
> [ 133.862920] [<ffffffff812454fc>] ? unmap_single+0x27/0x50
> [ 133.862930] [<ffffffff8133ef0a>] usb_submit_urb+0x39e/0x3b0
> [ 133.862934] [<ffffffffa01b9a1a>] ctrl_complete+0x1c8/0x223 [usbtest]
> [ 133.862937] [<ffffffff8133cbb3>] ? usb_hcd_unmap_urb_for_dma+0x21/0x130
> [ 133.862940] [<ffffffff8133cd6e>] usb_hcd_giveback_urb+0x88/0xc0
> [ 133.862945] [<ffffffffa02c87ee>] inc_deq+0x230/0x2b9 [xhci_hcd]
> [ 133.862949] [<ffffffffa02c93c5>] finish_td+0xf7/0x1d2 [xhci_hcd]
> [ 133.862955] [<ffffffffa02ca5ac>] xhci_irq+0x110c/0x1373 [xhci_hcd]
> [ 133.862959] [<ffffffff810687b9>] ? ktime_get+0x5e/0x99
> [ 133.862962] [<ffffffff8101afbe>] ? apic_write+0x16/0x18
> [ 133.862966] [<ffffffff81064618>] ? __hrtimer_start_range_ns+0x2f3/0x305
> [ 133.862970] [<ffffffff810a5060>] ? __rcu_process_callbacks+0x7c/0x2ce
> [ 133.862975] [<ffffffffa02ca824>] xhci_msi_irq+0x11/0x15 [xhci_hcd]
> [ 133.862978] [<ffffffff8109fad6>] handle_irq_event_percpu+0x5f/0x197
> [ 133.862981] [<ffffffff8109fc49>] handle_irq_event+0x3b/0x5a
> [ 133.862984] [<ffffffff8101dc0c>] ? ack_apic_edge+0x27/0x2b
> [ 133.862987] [<ffffffff810a2531>] handle_edge_irq+0xa9/0xd0
> [ 133.862990] [<ffffffff81003bf6>] handle_irq+0x91/0x99
> [ 133.862994] [<ffffffff8148244d>] do_IRQ+0x4d/0xa5
> [ 133.862997] [<ffffffff8147972e>] common_interrupt+0x6e/0x6e
> [ 133.862999] <EOI> [<ffffffff812a1ed3>] ? arch_local_irq_enable+0x8/0xd
> [ 133.863005] [<ffffffff81065f1c>] ? sched_clock_idle_wakeup_event+0x12/0x16
> [ 133.863009] [<ffffffff812a2cb3>] acpi_idle_enter_simple+0xd5/0x116
> [ 133.863012] [<ffffffff813a13c2>] cpuidle_idle_call+0xe0/0x168
> [ 133.863016] [<ffffffff810012f1>] cpu_idle+0xae/0xda
> [ 133.863019] [<ffffffff81471830>] start_secondary+0x248/0x24f
> [ 133.863022] ---[ end trace c6c1d9fdd37ddd4d ]---
> [ 133.863027] xhci_hcd 0000:02:00.0: WARN halted endpoint, queueing URB anyway.
> [ 133.863030] usbtest 10-1:3.0: subtest 9 error, status -32
> [ 133.863032] usbtest 10-1:3.0: subtest 10 error, status -32
> [ 133.863035] xhci_hcd 0000:02:00.0: WARN halted endpoint, queueing URB anyway.
> [ 133.863038] xhci_hcd 0000:02:00.0: WARN halted endpoint, queueing URB anyway.
> [ 133.863041] usbtest 10-1:3.0: subtest 13 error, status -32
> [ 133.863044] usbtest 10-1:3.0: subtest 14 error, status -32
> [ 133.863047] usbtest 10-1:3.0: subtest 0 error, status -32
> [ 133.863049] usbtest 10-1:3.0: subtest 1 error, status -32
> [ 133.863052] usbtest 10-1:3.0: subtest 0 error, status -32
> [ 133.863054] usbtest 10-1:3.0: subtest 1 error, status -32
> [ 133.863058] xhci_hcd 0000:02:00.0: WARN halted endpoint, queueing URB anyway.
> [ 133.863061] usbtest 10-1:3.0: subtest 3 error, status -32
> [ 133.863063] usbtest 10-1:3.0: subtest 4 error, status -32
> [ 133.863066] xhci_hcd 0000:02:00.0: WARN halted endpoint, queueing URB anyway.
> [ 133.863069] usbtest 10-1:3.0: subtest 6 error, status -32
> [ 133.863072] xhci_hcd 0000:02:00.0: WARN halted endpoint, queueing URB anyway.
> [ 133.863076] xhci_hcd 0000:02:00.0: WARN halted endpoint, queueing URB anyway.
> [ 133.863079] usbtest 10-1:3.0: subtest 9 error, status -32
> [ 133.863082] xhci_hcd 0000:02:00.0: Giveback URB ffff880130d52600, len = 44, expected = 400, status = -121
> [ 133.863085] xhci_hcd 0000:02:00.0: Stalled endpoint
> [ 133.863088] xhci_hcd 0000:02:00.0: Cleaning up stalled endpoint ring
> [ 133.863090] xhci_hcd 0000:02:00.0: Finding segment containing stopped TRB.
> [ 133.863093] xhci_hcd 0000:02:00.0: Finding endpoint context
> [ 133.863095] xhci_hcd 0000:02:00.0: Finding segment containing last TRB in TD.
> [ 133.863098] xhci_hcd 0000:02:00.0: Cycle state = 0x0
> [ 133.863101] xhci_hcd 0000:02:00.0: New dequeue segment = ffff88012fc30320 (virtual)
> [ 133.863103] xhci_hcd 0000:02:00.0: New dequeue pointer = 0x37804840 (DMA)
> [ 133.863106] xhci_hcd 0000:02:00.0: Queueing new dequeue state
> [ 133.863109] xhci_hcd 0000:02:00.0: Set TR Deq Ptr cmd, new deq seg = ffff88012fc30320 (0x37804800 dma), new deq ptr = ffff880037804840 (0x37804840 dma), new cycle = 0
> [ 133.863112] xhci_hcd 0000:02:00.0: // Ding dong!
> [ 133.863116] xhci_hcd 0000:02:00.0: Giveback URB ffff880130d52d80, len = 0, expected = 9, status = -32
> [ 133.863120] xhci_hcd 0000:02:00.0: Removing canceled TD starting at 0x37804840 (dma).
> [ 133.863123] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804840
> [ 133.863126] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804850
> [ 133.863128] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804860
> [ 133.863131] xhci_hcd 0000:02:00.0: Removing canceled TD starting at 0x37804870 (dma).
> [ 133.863134] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804870
> [ 133.863137] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804880
> [ 133.863139] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804890
> [ 133.863142] xhci_hcd 0000:02:00.0: Removing canceled TD starting at 0x378048a0 (dma).
> [ 133.863145] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x378048a0
> [ 133.863147] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x378048b0
> [ 133.863150] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x378048c0
> [ 133.863152] xhci_hcd 0000:02:00.0: Removing canceled TD starting at 0x378048d0 (dma).
> [ 133.863155] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x378048d0
> [ 133.863158] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x378048e0
> [ 133.863160] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x378048f0
> [ 133.863163] xhci_hcd 0000:02:00.0: Removing canceled TD starting at 0x37804900 (dma).
> [ 133.863166] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804900
> [ 133.863169] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804910
> [ 133.863172] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804920
> [ 133.863174] xhci_hcd 0000:02:00.0: Removing canceled TD starting at 0x37804930 (dma).
> [ 133.863177] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804930
> [ 133.863180] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804940
> [ 133.863182] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804950
> [ 133.863185] xhci_hcd 0000:02:00.0: Removing canceled TD starting at 0x37804960 (dma).
> [ 133.863188] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804960
> [ 133.863191] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804970
> [ 133.863193] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804980
> [ 133.863196] xhci_hcd 0000:02:00.0: Removing canceled TD starting at 0x37804990 (dma).
> [ 133.863199] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x37804990
> [ 133.863201] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x378049a0
> [ 133.863204] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x378049b0
> [ 133.863207] xhci_hcd 0000:02:00.0: Removing canceled TD starting at 0x378049c0 (dma).
> [ 133.863210] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x378049c0
> [ 133.863212] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x378049d0
> [ 133.863215] xhci_hcd 0000:02:00.0: TRB to noop at offset 0x378049e0
> [ 133.863220] xhci_hcd 0000:02:00.0: Ignoring reset ep completion code of 1
> [ 133.863223] xhci_hcd 0000:02:00.0: Successful Set TR Deq Ptr cmd, deq = @37804840
> [ 133.863313] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
> [ 133.863349] IP: [<ffffffffa02c9452>] finish_td+0x184/0x1d2 [xhci_hcd]
> [ 133.863376] PGD 0
> [ 133.863389] Oops: 0000 [#1] SMP
> [ 133.863410] CPU 1
> [ 133.864308] ---[ end trace c6c1d9fdd37ddd4e ]---
> [ 133.864308] Kernel panic - not syncing: Fatal exception in interrupt
> [ 133.864308] Pid: 0, comm: swapper/1 Tainted: G D W 3.2.0-rc5-sarah+ #4
> [ 133.864308] Call Trace:
> [ 133.864308] <IRQ> [<ffffffff81477393>] panic+0x91/0x1a3
> [ 133.864308] [<ffffffff8147a279>] oops_end+0xb7/0xc7
> [ 133.864308] [<ffffffff810284f5>] no_context+0x204/0x213
> [ 133.864308] [<ffffffff81073e76>] ? arch_local_irq_save+0x18/0x1e
> [ 133.864308] [<ffffffff810286cc>] __bad_area_nosemaphore+0x1c8/0x1e8
> [ 133.864308] [<ffffffff810458cc>] ? console_unlock+0x1c4/0x1d3
> [ 133.864308] [<ffffffff810286ff>] bad_area_nosemaphore+0x13/0x15
> [ 133.864308] [<ffffffff8147c402>] do_page_fault+0x182/0x34a
> [ 133.864308] [<ffffffff8147750d>] ? printk+0x68/0x6b
> [ 133.864308] [<ffffffffa01b9885>] ? ctrl_complete+0x33/0x223 [usbtest]
> [ 133.864308] [<ffffffff81479985>] page_fault+0x25/0x30
> [ 133.864308] [<ffffffffa02c9452>] ? finish_td+0x184/0x1d2 [xhci_hcd]
> [ 133.864308] [<ffffffffa02c9435>] ? finish_td+0x167/0x1d2 [xhci_hcd]
> [ 133.864308] [<ffffffffa02ca5ac>] xhci_irq+0x110c/0x1373 [xhci_hcd]
> [ 133.864308] [<ffffffff81064618>] ? __hrtimer_start_range_ns+0x2f3/0x305
> [ 133.864308] [<ffffffff810a5060>] ? __rcu_process_callbacks+0x7c/0x2ce
> [ 133.864308] [<ffffffffa02ca824>] xhci_msi_irq+0x11/0x15 [xhci_hcd]
> [ 133.864308] [<ffffffff8109fad6>] handle_irq_event_percpu+0x5f/0x197
> [ 133.864308] [<ffffffff8109fc49>] handle_irq_event+0x3b/0x5a
> [ 133.864308] [<ffffffff8101dc0c>] ? ack_apic_edge+0x27/0x2b
> [ 133.864308] [<ffffffff810a2531>] handle_edge_irq+0xa9/0xd0
> [ 133.864308] [<ffffffff81003bf6>] handle_irq+0x91/0x99
> [ 133.864308] [<ffffffff8148244d>] do_IRQ+0x4d/0xa5
> [ 133.864308] [<ffffffff8147972e>] common_interrupt+0x6e/0x6e
> [ 133.864308] <EOI> [<ffffffff812a1ed3>] ? arch_local_irq_enable+0x8/0xd
> [ 133.864308] [<ffffffff81065f1c>] ? sched_clock_idle_wakeup_event+0x12/0x16
> [ 133.864308] [<ffffffff812a2cb3>] acpi_idle_enter_simple+0xd5/0x116
> [ 133.864308] [<ffffffff813a13c2>] cpuidle_idle_call+0xe0/0x168
> [ 133.864308] [<ffffffff810012f1>] cpu_idle+0xae/0xda
> [ 133.864308] [<ffffffff81471830>] start_secondary+0x248/0x24f
> [ 133.864308] panic occurred, switching back to text console
> [ 133.901211] ------------[ cut here ]------------
> [ 133.901211] WARNING: at /git/xhci/arch/x86/kernel/smp.c:119 native_smp_send_reschedule+0x2a/0x48()
> [ 133.901211] Hardware name:
> [ 133.901211] Modules linked in: xhci_hcd usbtest netconsole configfs fuse sunrpc ipv6 uinput snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device x38_edac edac_core microcode iTCO_wdt iTCO_vendor_support snd_pcm e1000e i2c_i801 snd_timer pcspkr serio_raw snd soundcore snd_page_alloc firewire_ohci firewire_core crc_itu_t nouveau ttm drm_kms_helper drm i2c_algo_bit i2c_core mxm_wmi wmi video [last unloaded: xhci_hcd]
> [ 133.901211] Pid: 0, comm: swapper/1 Tainted: G D W 3.2.0-rc5-sarah+ #4
> [ 133.901211] Call Trace:
> [ 133.901211] <IRQ> [<ffffffff81044f02>] warn_slowpath_common+0x85/0x9d
> [ 133.901211] [<ffffffff81044f34>] warn_slowpath_null+0x1a/0x1c
> [ 133.901211] [<ffffffff8101a5fc>] native_smp_send_reschedule+0x2a/0x48
> [ 133.901211] [<ffffffff8102f45a>] smp_send_reschedule+0xf/0x11
> [ 133.901211] [<ffffffff8103ce1f>] try_to_wake_up+0x177/0x1ce
> [ 133.901211] [<ffffffff8103cfe8>] wake_up_state+0x10/0x12
> [ 133.901211] [<ffffffff81054982>] signal_wake_up+0x2e/0x3f
> [ 133.901211] [<ffffffff81054df6>] complete_signal+0x158/0x167
> [ 133.901211] [<ffffffff8105505e>] __send_signal+0x259/0x276
> [ 133.901211] [<ffffffff810550db>] send_signal+0x60/0x69
> [ 133.901211] [<ffffffff81055a0d>] do_send_sig_info+0x4b/0x75
> [ 133.901211] [<ffffffff81126f13>] send_sigio_to_task+0xd0/0xe2
> [ 133.901211] [<ffffffff814793b8>] ? _raw_spin_unlock_irqrestore+0x17/0x19
> [ 133.901211] [<ffffffff8105c5da>] ? __queue_work+0x24d/0x25c
> [ 133.901211] [<ffffffff812b96d8>] ? tty_buffer_request_room+0x14e/0x160
> [ 133.901211] [<ffffffff8105c651>] ? queue_work_on+0x39/0x47
> [ 133.901211] [<ffffffff81127858>] send_sigio+0x85/0xad
> [ 133.901211] [<ffffffff811278e9>] kill_fasync+0x69/0x86
> [ 133.901211] [<ffffffff8136b4bd>] evdev_pass_event+0xa1/0xaa
> [ 133.901211] [<ffffffff8136b65b>] evdev_event+0x72/0xb5
> [ 133.901211] [<ffffffff81364c95>] input_pass_event+0x84/0xc9
> [ 133.901211] [<ffffffff8136794a>] input_handle_event+0x487/0x496
> [ 133.901211] [<ffffffff81367a4b>] input_event+0x69/0x8a
> [ 133.901211] [<ffffffff813a7186>] input_sync+0x14/0x16
> [ 133.901211] [<ffffffff813a71b6>] hidinput_report_event+0x2e/0x3b
> [ 133.901211] [<ffffffff813a616d>] hid_report_raw_event+0x319/0x359
> [ 133.901211] [<ffffffff813a63ce>] hid_input_report+0x221/0x242
> [ 133.901211] [<ffffffff813ac39f>] hid_irq_in+0x99/0x172
> [ 133.901211] [<ffffffff8133cd6e>] usb_hcd_giveback_urb+0x88/0xc0
> [ 133.901211] [<ffffffff8135cf71>] uhci_giveback_urb+0x113/0x20e
> [ 133.901211] [<ffffffff810feeb4>] ? dma_pool_free+0xd5/0xe1
> [ 133.901211] [<ffffffff8135f680>] uhci_scan_schedule+0x5d7/0x87e
> [ 133.901211] [<ffffffff8123bd20>] ? vsnprintf+0x410/0x44c
> [ 133.901211] [<ffffffff8135fe8e>] uhci_irq+0x12d/0x143
> [ 133.901211] [<ffffffff8133c7e7>] usb_hcd_irq+0x3f/0x55
> [ 133.901211] [<ffffffff8109fad6>] handle_irq_event_percpu+0x5f/0x197
> [ 133.901211] [<ffffffff8109fc49>] handle_irq_event+0x3b/0x5a
> [ 133.901211] [<ffffffff810a2463>] handle_fasteoi_irq+0x83/0xa8
> [ 133.901211] [<ffffffff81003bf6>] handle_irq+0x91/0x99
> [ 133.901211] [<ffffffff8148244d>] do_IRQ+0x4d/0xa5
> [ 133.901211] [<ffffffff8147972e>] common_interrupt+0x6e/0x6e
> [ 133.901211] [<ffffffff810458cc>] ? console_unlock+0x1c4/0x1d3
> [ 133.901211] [<ffffffffa006b52b>] ? drm_crtc_helper_set_config+0x7ef/0x934 [drm_kms_helper]
> [ 133.901211] [<ffffffff81477463>] ? panic+0x161/0x1a3
> [ 133.901211] [<ffffffff814773c8>] ? panic+0xc6/0x1a3
> [ 133.901211] [<ffffffff8147a279>] oops_end+0xb7/0xc7
> [ 133.901211] [<ffffffff810284f5>] no_context+0x204/0x213
> [ 133.901211] [<ffffffff81073e76>] ? arch_local_irq_save+0x18/0x1e
> [ 133.901211] [<ffffffff810286cc>] __bad_area_nosemaphore+0x1c8/0x1e8
> [ 133.901211] [<ffffffff810458cc>] ? console_unlock+0x1c4/0x1d3
> [ 133.901211] [<ffffffff810286ff>] bad_area_nosemaphore+0x13/0x15
> [ 133.901211] [<ffffffff8147c402>] do_page_fault+0x182/0x34a
> [ 133.901211] [<ffffffff8147750d>] ? printk+0x68/0x6b
> [ 133.901211] [<ffffffffa01b9885>] ? ctrl_complete+0x33/0x223 [usbtest]
> [ 133.901211] [<ffffffff81479985>] page_fault+0x25/0x30
> [ 133.901211] [<ffffffffa02c9452>] ? finish_td+0x184/0x1d2 [xhci_hcd]
> [ 133.901211] [<ffffffffa02c9435>] ? finish_td+0x167/0x1d2 [xhci_hcd]
> [ 133.901211] [<ffffffffa02ca5ac>] xhci_irq+0x110c/0x1373 [xhci_hcd]
> [ 133.901211] [<ffffffff81064618>] ? __hrtimer_start_range_ns+0x2f3/0x305
> [ 133.901211] [<ffffffff810a5060>] ? __rcu_process_callbacks+0x7c/0x2ce
> [ 133.901211] [<ffffffffa02ca824>] xhci_msi_irq+0x11/0x15 [xhci_hcd]
> [ 133.901211] [<ffffffff8109fad6>] handle_irq_event_percpu+0x5f/0x197
> [ 133.901211] [<ffffffff8109fc49>] handle_irq_event+0x3b/0x5a
> [ 133.901211] [<ffffffff8101dc0c>] ? ack_apic_edge+0x27/0x2b
> [ 133.901211] [<ffffffff810a2531>] handle_edge_irq+0xa9/0xd0
> [ 133.901211] [<ffffffff81003bf6>] handle_irq+0x91/0x99
> [ 133.901211] [<ffffffff8148244d>] do_IRQ+0x4d/0xa5
> [ 133.901211] [<ffffffff8147972e>] common_interrupt+0x6e/0x6e
> [ 133.901211] <EOI> [<ffffffff812a1ed3>] ? arch_local_irq_enable+0x8/0xd
> [ 133.901211] [<ffffffff81065f1c>] ? sched_clock_idle_wakeup_event+0x12/0x16
> [ 133.901211] [<ffffffff812a2cb3>] acpi_idle_enter_simple+0xd5/0x116
> [ 133.901211] [<ffffffff813a13c2>] cpuidle_idle_call+0xe0/0x168
> [ 133.901211] [<ffffffff810012f1>] cpu_idle+0xae/0xda
> [ 133.901211] [<ffffffff81471830>] start_secondary+0x248/0x24f
> [ 133.901211] ---[ end trace c6c1d9fdd37ddd4f ]---
>
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index ccfbec2..d8e876d 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1572,7 +1572,7 @@ static int xhci_requires_manual_halt_cleanup(struct xhci_hcd *xhci,
if (trb_comp_code == COMP_TX_ERR ||
trb_comp_code == COMP_BABBLE ||
trb_comp_code == COMP_SPLIT_ERR)
- /* The 0.96 spec says a babbling control endpoint
+ /* The 0.95 spec says a babbling control endpoint
* is not halted. The 0.96 spec says it is. Some HW
* claims to be 0.95 compliant, but it halts the control
* endpoint anyway. Check if a babble halted the
@@ -1734,7 +1734,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
switch (trb_comp_code) {
case COMP_SUCCESS:
- if (event_trb == ep_ring->dequeue) {
+ if (event_trb == td->first_trb) {
xhci_warn(xhci, "WARN: Success on ctrl setup TRB "
"without IOC set??\n");
*status = -ESHUTDOWN;
@@ -1765,7 +1765,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
/* else fall through */
case COMP_STALL:
/* Did we transfer part of the data (middle) phase? */
- if (event_trb != ep_ring->dequeue &&
+ if (event_trb != td->first_trb &&
event_trb != td->last_trb)
td->urb->actual_length =
td->urb->transfer_buffer_length
@@ -1781,7 +1781,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
* Did we transfer any data, despite the errors that might have
* happened? I.e. did we get past the setup stage?
*/
- if (event_trb != ep_ring->dequeue) {
+ if (event_trb != td->first_trb) {
/* The event was for the status stage */
if (event_trb == td->last_trb) {
if (td->urb->actual_length != 0) {
