Received-SPF: pass (google.com: domain of linux-kernel+bounces-136737-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Message-ID: <82113c7d-0405-ba11-94d9-5673593cec50@linux.intel.com>
Date: Tue, 9 Apr 2024 14:22:10 +0300
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Firefox/102.0 Thunderbird/102.13.0
Content-Language: en-US
To: =?UTF-8?Q?Micha=c5=82_Pecio?= <michal.pecio@gmail.com>
Cc: Paul Menzel <pmenzel@molgen.mpg.de>,
 Mathias Nyman <mathias.nyman@intel.com>, LKML
 <linux-kernel@vger.kernel.org>, linux-usb@vger.kernel.org,
 Niklas Neronin <niklas.neronin@linux.intel.com>
References: <58bca6f2-797a-4e20-a476-2294309afdd5@molgen.mpg.de>
 <20240405113247.743e34b2@foxbook>
 <7090d3af-18ce-40e1-8ac2-bf18152e5c4a@molgen.mpg.de>
 <20240406183659.3daf4fa0@foxbook>
 <c57f2116-8c42-44fb-9c32-6115ad88f914@molgen.mpg.de>
 <20240407142542.036fb02f@foxbook>
 <1f64af9a-0618-a7da-4acc-f043b6580308@linux.intel.com>
 <20240408210541.771253ff@foxbook>
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Subject: Re: xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part
 of current TD ep_index 1 comp_code 1
In-Reply-To: <20240408210541.771253ff@foxbook>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 8.4.2024 22.05, Michał Pecio wrote:
>> It's also possible this TD/TRB was cancelled due to the disconnect.
>> Could be that even if driver removes the TD from the list and cleans
>> out the TRB from the ring buffer (turns TRB to no-op) hardware may
>> have read ahead and cached the TRB, and process it anyway.
> 
> I thought about it, but my debug patch says that the missing TD was
> freed by finish_td(), which is called on TDs considered completed by
> hardware. A cancelled TD would show giveback_invalidated_tds().
> 
> 
> Anyway, we now have new information from the reporter. My v2 patch
> keeps a log of the last five events processed on each transfer ring
> and dumps the log on TRB mismatch errors.
> 
> Unfortunately, it looks like the host controller is broken and signals
> completion of those transfers twice. The log below shows two distinct
> events for TRB 32959a1c0 and that the coresponding TD has just been
> freed by finish_td().

The trace confirms this, we get double completion events for several Isoc TRBs.
These double completions are seen after a transaction error on the same device (different endpoint).

Transfer events for TRB ..a1c0 twice, with a transaction error in between:
  <idle>-0       [000] d.h2. 33819.709897: xhci_handle_event: EVENT: TRB 000000032959a1c0 status 'Success' len 0 slot 6 ep 2 type 'Transfer Event' flags e:c
  <idle>-0       [000] d.h2. 33819.709904: xhci_handle_event: EVENT: TRB 000000041547d010 status 'USB Transaction Error' len 4 slot 6 ep 15 type 'Transfer Event' flags e:c
  systemd-journal-395     [000] d.H1. 33819.711886: xhci_handle_event: EVENT: TRB 000000032959a1c0 status 'Success' len 0 slot 6 ep 2 type 'Transfer Event' flags e:c

Transfer events for TRB ..a1d0 twice (the next TRB)
  systemd-journal-395     [000] d.H1. 33819.712001: xhci_handle_event: EVENT: TRB 000000032959a1d0 status 'Success' len 0 slot 6 ep 2 type 'Transfer Event' flags e:c
  systemd-journal-395     [000] d.H1. 33819.712059: xhci_handle_event: EVENT: TRB 000000032959a1d0 status 'Success' len 0 slot 6 ep 2 type 'Transfer Event' flags e:c

Transfer events for TRB ..a1e0 twice
  systemd-journal-395     [000] d.H1. 33819.712139: xhci_handle_event: EVENT: TRB 000000032959a1e0 status 'Success' len 0 slot 6 ep 2 type 'Transfer Event' flags e:c
  systemd-journal-395     [000] d.h1. 33819.712871: xhci_handle_event: EVENT: TRB 000000032959a1e0 status 'Success' len 0 slot 6 ep 2 type 'Transfer Event' flags e:c

etc..

Driver can cope with these extra events, but if this is common we should
probably handle it silently and not concern users with that ERROR message.

We are actually at the moment looking at improving handle_tx_event() with
Niklas (cc), and will take this into consideration.

Thanks
Mathias