On 08/29/2013 07:46 AM, Giovanni wrote:
https://bugzilla.kernel.org/show_bug.cgi?id=60810
Bug ID: 60810
Summary: Kernel oops with controller XHCI while wait usb packet
Hi
I'm looking into the NULL pointer issue after timed out address device
commands as well, but I'm not able to reproduce it.
Could you apply the attached patch, turn on xHCI debugging and send me
the log after it fails again?
Thanks
- Mathias
>From e7280da316fef0741cf6b0623c2096b10babb0dc Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx>
Date: Tue, 3 Sep 2013 16:15:07 +0300
Subject: [PATCH] xhci: Temporary debug hacks for tracing address device timeout
Not for merging
Signed-off-by: Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx>
---
drivers/usb/host/xhci-ring.c | 16 ++++++++++++++++
drivers/usb/host/xhci.c | 2 ++
2 files changed, 18 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 1969c00..805d0ec 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1260,6 +1260,8 @@ static void xhci_cmd_to_noop(struct xhci_hcd *xhci, struct xhci_cd *cur_cd)
cycle_state = le32_to_cpu(cmd_trb->generic.field[3])
& TRB_CYCLE;
+ xhci_warn(xhci, "clear trb @%p in command ring to noop\n", cmd_trb);
+
/* modify the command trb to NO OP command */
cmd_trb->generic.field[0] = 0;
cmd_trb->generic.field[1] = 0;
@@ -1377,6 +1379,9 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
return;
}
+ xhci_warn(xhci, "cmd completion dequeue pointers, hw @%llx, sw @%p, slot %d\n",
+ cmd_dma, xhci->cmd_ring->dequeue, slot_id);
+
if ((GET_COMP_CODE(le32_to_cpu(event->status)) == COMP_CMD_ABORT) ||
(GET_COMP_CODE(le32_to_cpu(event->status)) == COMP_CMD_STOP)) {
/* If the return value is 0, we think the trb pointed by
@@ -1388,8 +1393,15 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
if (handle_stopped_cmd_ring(xhci,
GET_COMP_CODE(le32_to_cpu(event->status)))) {
inc_deq(xhci, xhci->cmd_ring);
+ xhci_warn(xhci, "Manual deque pointer update to @%p\n",
+ xhci->cmd_ring->dequeue);
+
return;
+
}
+ xhci_warn(xhci, "handling cmd completion on stopped ring, dq: @%p\n",
+ xhci->cmd_ring->dequeue);
+
}
switch (le32_to_cpu(xhci->cmd_ring->dequeue->generic.field[3])
@@ -3892,6 +3904,10 @@ static int queue_command(struct xhci_hcd *xhci, u32 field1, u32 field2,
"unfailable commands failed.\n");
return ret;
}
+ if (field4 & TRB_TYPE(TRB_ADDR_DEV))
+ xhci_warn(xhci, "Address device on cmd ring @%p\n",
+ xhci->cmd_ring->enqueue);
+
queue_trb(xhci, xhci->cmd_ring, false, field1, field2, field3,
field4 | xhci->cmd_ring->cycle_state);
return 0;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index d8f640b..3270afe 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3726,6 +3726,8 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
xhci_warn(xhci, "%s while waiting for address device command\n",
timeleft == 0 ? "Timeout" : "Signal");
/* cancel the address device command */
+ xhci_warn(xhci, "add address device cmd @%p to cancel ring\n",
+ cmd_trb);
ret = xhci_cancel_cmd(xhci, NULL, cmd_trb);
if (ret < 0)
return ret;
--
1.7.4.1
