Re: [PATCH] usb: xhci: Tear down host on Reset Endpoint and Set TR Dequeue timeout

[Ambareesh Balaji <ambareeshbalaji@gmail.com>]

Hi Michal,

Thanks for the review.

On Wed, 4 Nov 2026 10:15:06 +0100, Michal Pecio wrote:
> I have long wondered if we shouldn't simply halt the HC on every
> command timeout other than Address Device. Commands shouldn't be
> taking 5 seconds to complete. When they do, something unexpected
> must be going on and it's unclear if the HC is still usable or
> capable of recovering cleanly when we abort the command.

Your approach is better than mine, which only covers Reset Endpoint
and Set TR Dequeue Pointer. I am happy to drop my patch in favour of
yours for 7.5, and agree it should not have Fixes: or Cc: stable. I
will test your patch once it is posted.

> I haven't seen cases when Reset EP or Set TR Dequeue hang but other
> commands still work.

I can't show that these timeouts happen on real hardware yet. What I
have is:

1) A fault injection reproducer. On an AMD xHCI (1022:1587) passed
through to a QEMU guest, I halt a usbhid interrupt IN endpoint with a
real SET_FEATURE(ENDPOINT_HALT), then suppress the doorbell of the Set
TR Dequeue Pointer command queued by the usbhid unbind. Without a fix
the unbind blocks forever in usb_kill_urb(). With my patch the command
times out, the host is torn down and the unbind completes. Normal
unbind and rebind of the same device is unaffected. I can send the
injection module and test script if you want to run it against your
patch.

2) One real hang with the same symptom on the same controller type
(kernel 7.3.1, tainted by out-of-tree DKMS modules). After a Focusrite
Scarlett Solo logged "USB disconnect", usb_hub_wq stayed in D state
for over 4 minutes in usb_kill_urb(), called from
scarlett2_private_free() on the disconnect path. Nothing recovered it
and only a reboot helped. There was no "xHCI host not responding to
stop endpoint command" in the log.

Reset Endpoint and Set TR Dequeue Pointer timeouts are only reported
through xhci_dbg(), so the missing message does not rule them out,
but it does not confirm them either. I see USB audio hangs like this
once or twice a month. I have enabled xHCI dynamic debug and tracing
and will send what I capture if it happens again.

Regards,
Ambareesh