Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1309266 > unrolled thread

OHCI unplug kernel crash in kernel 4.3 and 4.4

Started byStefani Seibold <stefani@seibold.net>
First post2016-01-14 14:20 +0100
Last post2016-01-14 17:40 +0100
Articles 4 — 4 participants

Back to article view | Back to linux.kernel

Contents

  OHCI unplug kernel crash in kernel 4.3 and 4.4 Stefani Seibold <stefani@seibold.net> - 2016-01-14 14:20 +0100
    Re: OHCI unplug kernel crash in kernel 4.3 and 4.4 Oliver Neukum <oneukum@suse.com> - 2016-01-14 15:10 +0100
      Re: OHCI unplug kernel crash in kernel 4.3 and 4.4 Joerg Roedel <jroedel@suse.de> - 2016-01-14 15:30 +0100
        Re: OHCI unplug kernel crash in kernel 4.3 and 4.4 Alan Stern <stern@rowland.harvard.edu> - 2016-01-14 17:40 +0100

#1309266 — OHCI unplug kernel crash in kernel 4.3 and 4.4

FromStefani Seibold <stefani@seibold.net>
Date2016-01-14 14:20 +0100
SubjectOHCI unplug kernel crash in kernel 4.3 and 4.4
Message-ID<qQPYJ-7yP-5@gated-at.bofh.it>
A unplug of an USB 1.0 OHCI controller express card will result in a
kernel crash. The express card is attached via thunderbolt and a sonnet
express card to thunderbolt adapter. The computer hangs after the
unplug, only a power fix the situation.

This is the kernel log of a kernel 4.4 via netconsole:

pciehp 0000:06:03.0:pcie24: Card not present on Slot(3)
pciehp 0000:06:03.0:pcie24: slot(3): Link Down event
pciehp 0000:06:03.0:pcie24: Link Down event ignored on slot(3): already powering off
ehci-pci 0000:0b:00.2: HC died; cleaning up
ehci-pci 0000:0b:00.2: remove, state 4
usb usb5: USB disconnect, device number 1
pciehp 0000:00:1c.4:pcie04: Card not present on Slot(4)
pciehp 0000:00:1c.4:pcie04: slot(4): Link Down event
ehci-pci 0000:0b:00.2: USB bus 5 deregistered
ohci-pci 0000:0b:00.1: HC died; cleaning up
ohci-pci 0000:0b:00.1: remove, state 4
usb usb7: USB disconnect, device number 1
pciehp 0000:00:1c.4:pcie04: Link Down event ignored on slot(4): already powering off
ohci-pci 0000:0b:00.1: USB bus 7 deregistered
ohci-pci 0000:0b:00.0: HC died; cleaning up
ohci-pci 0000:0b:00.0: remove, state 4
usb usb6: USB disconnect, device number 1
------------[ cut here ]------------
kernel BUG at drivers/iommu/intel-iommu.c:3592!
invalid opcode: 0000 [#1] PREEMPT SMP 
Modules linked in: ohci_pci ohci_hcd binfmt_misc netconsole configfs bbswitch(O) iwlmvm iwlwifi vboxnetadp(O) vboxnetflt(O) vboxdrv(O) nvidia(PO) vhost_net tun vhost kvm_intel kvm irqbypass dell_smm_hwmon [last unloaded: netconsole]
CPU: 0 PID: 4857 Comm: kworker/0:3 Tainted: P           O    4.4.0-gentoo #1
Hardware name: Dell Inc. XPS 2720/05R2TK  , BIOS A12 09/21/2015
Workqueue: pciehp-3 pciehp_power_thread
task: ffff8804070a2300 ti: ffff8803e4658000 task.ti: ffff8803e4658000
RIP: 0010:[<ffffffff8061edf4>]  [<ffffffff8061edf4>] intel_unmap+0x1c4/0x1d0
RSP: 0018:ffff8803e465bb98  EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8804225fb098 RCX: 00000000ffffc000
RDX: 0000000000000000 RSI: 00000000ffffc000 RDI: ffff8804225fb098
RBP: ffff8803e465bbd0 R08: 0000000000000000 R09: 0000000000000000
R10: ffff88046cc000c0 R11: 0000000000000000 R12: 00000000ffffffff
R13: 00000000ffffc000 R14: ffff880468caa400 R15: ffffe8ffffc13800
FS:  0000000000000000(0000) GS:ffff88047f200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2515680324 CR3: 000000000120a000 CR4: 00000000001406f0
Stack:
 ffff8804101e4a78 ffff8803e465bbf0 ffffea000f915840 00000000ffffffff
 ffffffff812a3ec0 ffff880468caa400 ffffe8ffffc13800 ffff8803e465bbf0
 ffffffff8061ee8a ffff88045e68f000 ffff8804225fb098 ffff8803e465bc28
Call Trace:
 [<ffffffff8061ee8a>] intel_free_coherent+0x5a/0xa0
 [<ffffffffa0ad4d04>] ohci_stop+0x144/0x1c0 [ohci_hcd]
 [<ffffffff807e1fb4>] usb_remove_hcd+0xe4/0x1a0
 [<ffffffff807f2203>] usb_hcd_pci_remove+0x63/0x130
 [<ffffffff80573e79>] pci_device_remove+0x39/0xc0
 [<ffffffff80714f46>] __device_release_driver+0x96/0x130
 [<ffffffff80715003>] device_release_driver+0x23/0x30
 [<ffffffff8056d84a>] pci_stop_bus_device+0x8a/0xa0
 [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
 [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
 [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
 [<ffffffff8056d962>] pci_stop_and_remove_bus_device+0x12/0x20
 [<ffffffff80585f0b>] pciehp_unconfigure_device+0x9b/0x180
 [<ffffffff80585a23>] pciehp_disable_slot+0x43/0xb0
 [<ffffffff80585b1d>] pciehp_power_thread+0x8d/0xb0
 [<ffffffff8028aa54>] process_one_work+0x144/0x3c0
 [<ffffffff8028ad1b>] worker_thread+0x4b/0x440
 [<ffffffff8028acd0>] ? process_one_work+0x3c0/0x3c0
 [<ffffffff8028acd0>] ? process_one_work+0x3c0/0x3c0
 [<ffffffff80290269>] kthread+0xc9/0xe0
 [<ffffffff802901a0>] ? kthread_create_on_node+0x180/0x180
 [<ffffffff80b4db2f>] ret_from_fork+0x3f/0x70
 [<ffffffff802901a0>] ? kthread_create_on_node+0x180/0x180
Code: f9 48 89 de e8 fe cd ff ff 4c 89 e6 4c 89 f7 e8 23 92 ff ff 4c 89 ef e8 0b cf ff ff 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 <0f> 0b e8 45 cf ff ff e9 f3 fe ff ff 0f 1f 44 00 00 55 48 8b 76 
RIP  [<ffffffff8061edf4>] intel_unmap+0x1c4/0x1d0
 RSP <ffff8803e465bb98>
---[ end trace ad0596f59dc3d9e0 ]---
BUG: unable to handle kernel paging request at ffffffffffffffd8
IP: [<ffffffff80290881>] kthread_data+0x11/0x20
PGD 120b067 PUD 120d067 PMD 0 
Oops: 0000 [#2] PREEMPT SMP 
Modules linked in: ohci_pci ohci_hcd binfmt_misc netconsole configfs bbswitch(O) iwlmvm iwlwifi vboxnetadp(O) vboxnetflt(O) vboxdrv(O) nvidia(PO) vhost_net tun vhost kvm_intel kvm irqbypass dell_smm_hwmon [last unloaded: netconsole]
CPU: 0 PID: 4857 Comm: kworker/0:3 Tainted: P      D    O    4.4.0-gentoo #1
Hardware name: Dell Inc. XPS 2720/05R2TK  , BIOS A12 09/21/2015
task: ffff8804070a2300 ti: ffff8803e4658000 task.ti: ffff8803e4658000
RIP: 0010:[<ffffffff80290881>]  [<ffffffff80290881>] kthread_data+0x11/0x20
RSP: 0018:ffff8803e465b878  EFLAGS: 00010002
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff814bd980
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8804070a2300
RBP: ffff8803e465b888 R08: 0000000000000000 R09: ffff880468dfe901
R10: 0000000000002800 R11: 000000000000001a R12: 0000000000000000
R13: 00000000000154c0 R14: ffff8804070a2300 R15: ffff88047f2154c0
FS:  0000000000000000(0000) GS:ffff88047f200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000028 CR3: 000000000120a000 CR4: 00000000001406f0
Stack:
 ffffffff8028b8c1 ffff88047f2154c0 ffff8803e465b8e8 ffffffff80b49c5a
 ffff8803e465b8a8 ffffffff00000000 ffff8804070a2300 ffffffff80275bb8
 0000000000000000 ffff8803e465c000 ffff8803e465b930 ffff8803e465b498
Call Trace:
 [<ffffffff8028b8c1>] ? wq_worker_sleeping+0x11/0x90
 [<ffffffff80b49c5a>] __schedule+0x60a/0xaa0
 [<ffffffff80275bb8>] ? release_task+0x308/0x3e0
 [<ffffffff80b4a12c>] schedule+0x3c/0x90
 [<ffffffff80277242>] do_exit+0x702/0xa90
 [<ffffffff80207989>] oops_end+0x89/0xc0
 [<ffffffff80207beb>] die+0x4b/0x70
 [<ffffffff80204e94>] do_trap+0xb4/0x150
 [<ffffffff80204fa7>] do_error_trap+0x77/0xe0
 [<ffffffff8061edf4>] ? intel_unmap+0x1c4/0x1d0
 [<ffffffff80619eb6>] ? qi_submit_sync+0x2d6/0x3e0
 [<ffffffff80205700>] do_invalid_op+0x20/0x30
 [<ffffffff80b4f188>] invalid_op+0x18/0x20
 [<ffffffff8061edf4>] ? intel_unmap+0x1c4/0x1d0
 [<ffffffff8061ec51>] ? intel_unmap+0x21/0x1d0
 [<ffffffff8061ee8a>] intel_free_coherent+0x5a/0xa0
 [<ffffffffa0ad4d04>] ohci_stop+0x144/0x1c0 [ohci_hcd]
 [<ffffffff807e1fb4>] usb_remove_hcd+0xe4/0x1a0
 [<ffffffff807f2203>] usb_hcd_pci_remove+0x63/0x130
 [<ffffffff80573e79>] pci_device_remove+0x39/0xc0
 [<ffffffff80714f46>] __device_release_driver+0x96/0x130
 [<ffffffff80715003>] device_release_driver+0x23/0x30
 [<ffffffff8056d84a>] pci_stop_bus_device+0x8a/0xa0
 [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
 [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
 [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
 [<ffffffff8056d962>] pci_stop_and_remove_bus_device+0x12/0x20
 [<ffffffff80585f0b>] pciehp_unconfigure_device+0x9b/0x180
 [<ffffffff80585a23>] pciehp_disable_slot+0x43/0xb0
 [<ffffffff80585b1d>] pciehp_power_thread+0x8d/0xb0
 [<ffffffff8028aa54>] process_one_work+0x144/0x3c0
 [<ffffffff8028ad1b>] worker_thread+0x4b/0x440
 [<ffffffff8028acd0>] ? process_one_work+0x3c0/0x3c0
 [<ffffffff8028acd0>] ? process_one_work+0x3c0/0x3c0
 [<ffffffff80290269>] kthread+0xc9/0xe0
 [<ffffffff802901a0>] ? kthread_create_on_node+0x180/0x180
 [<ffffffff80b4db2f>] ret_from_fork+0x3f/0x70
 [<ffffffff802901a0>] ? kthread_create_on_node+0x180/0x180
Code: 02 00 00 00 e8 a1 fd ff ff 5d c3 0f 1f 44 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 

[toc] | [next] | [standalone]

#1309302

FromOliver Neukum <oneukum@suse.com>
Date2016-01-14 15:10 +0100
Message-ID<qQQL8-8bA-25@gated-at.bofh.it>
In reply to#1309266
On Thu, 2016-01-14 at 13:50 +0100, Stefani Seibold wrote:
> A unplug of an USB 1.0 OHCI controller express card will result in a
> kernel crash. The express card is attached via thunderbolt and a sonnet
> express card to thunderbolt adapter. The computer hangs after the
> unplug, only a power fix the situation.
> 
> This is the kernel log of a kernel 4.4 via netconsole:
> 
> pciehp 0000:06:03.0:pcie24: Card not present on Slot(3)
> pciehp 0000:06:03.0:pcie24: slot(3): Link Down event
> pciehp 0000:06:03.0:pcie24: Link Down event ignored on slot(3): already powering off
> ehci-pci 0000:0b:00.2: HC died; cleaning up
> ehci-pci 0000:0b:00.2: remove, state 4
> usb usb5: USB disconnect, device number 1
> pciehp 0000:00:1c.4:pcie04: Card not present on Slot(4)
> pciehp 0000:00:1c.4:pcie04: slot(4): Link Down event
> ehci-pci 0000:0b:00.2: USB bus 5 deregistered
> ohci-pci 0000:0b:00.1: HC died; cleaning up
> ohci-pci 0000:0b:00.1: remove, state 4
> usb usb7: USB disconnect, device number 1
> pciehp 0000:00:1c.4:pcie04: Link Down event ignored on slot(4): already powering off
> ohci-pci 0000:0b:00.1: USB bus 7 deregistered
> ohci-pci 0000:0b:00.0: HC died; cleaning up
> ohci-pci 0000:0b:00.0: remove, state 4
> usb usb6: USB disconnect, device number 1
> ------------[ cut here ]------------
> kernel BUG at drivers/iommu/intel-iommu.c:3592!

This is likely the crucial information. The IOMMU is unhappy.

> invalid opcode: 0000 [#1] PREEMPT SMP 
> Modules linked in: ohci_pci ohci_hcd binfmt_misc netconsole configfs bbswitch(O) iwlmvm iwlwifi vboxnetadp(O) vboxnetflt(O) vboxdrv(O) nvidia(PO) vhost_net tun vhost kvm_intel kvm irqbypass dell_smm_hwmon [last unloaded: netconsole]
> CPU: 0 PID: 4857 Comm: kworker/0:3 Tainted: P           O    4.4.0-gentoo #1
> Hardware name: Dell Inc. XPS 2720/05R2TK  , BIOS A12 09/21/2015
> Workqueue: pciehp-3 pciehp_power_thread
> task: ffff8804070a2300 ti: ffff8803e4658000 task.ti: ffff8803e4658000
> RIP: 0010:[<ffffffff8061edf4>]  [<ffffffff8061edf4>] intel_unmap+0x1c4/0x1d0
> RSP: 0018:ffff8803e465bb98  EFLAGS: 00010246
> RAX: 0000000000000000 RBX: ffff8804225fb098 RCX: 00000000ffffc000
> RDX: 0000000000000000 RSI: 00000000ffffc000 RDI: ffff8804225fb098
> RBP: ffff8803e465bbd0 R08: 0000000000000000 R09: 0000000000000000
> R10: ffff88046cc000c0 R11: 0000000000000000 R12: 00000000ffffffff
> R13: 00000000ffffc000 R14: ffff880468caa400 R15: ffffe8ffffc13800
> FS:  0000000000000000(0000) GS:ffff88047f200000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f2515680324 CR3: 000000000120a000 CR4: 00000000001406f0
> Stack:
>  ffff8804101e4a78 ffff8803e465bbf0 ffffea000f915840 00000000ffffffff
>  ffffffff812a3ec0 ffff880468caa400 ffffe8ffffc13800 ffff8803e465bbf0
>  ffffffff8061ee8a ffff88045e68f000 ffff8804225fb098 ffff8803e465bc28
> Call Trace:
>  [<ffffffff8061ee8a>] intel_free_coherent+0x5a/0xa0
>  [<ffffffffa0ad4d04>] ohci_stop+0x144/0x1c0 [ohci_hcd]
>  [<ffffffff807e1fb4>] usb_remove_hcd+0xe4/0x1a0
>  [<ffffffff807f2203>] usb_hcd_pci_remove+0x63/0x130
>  [<ffffffff80573e79>] pci_device_remove+0x39/0xc0
>  [<ffffffff80714f46>] __device_release_driver+0x96/0x130
>  [<ffffffff80715003>] device_release_driver+0x23/0x30
>  [<ffffffff8056d84a>] pci_stop_bus_device+0x8a/0xa0
>  [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
>  [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
>  [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
>  [<ffffffff8056d962>] pci_stop_and_remove_bus_device+0x12/0x20
>  [<ffffffff80585f0b>] pciehp_unconfigure_device+0x9b/0x180
>  [<ffffffff80585a23>] pciehp_disable_slot+0x43/0xb0
>  [<ffffffff80585b1d>] pciehp_power_thread+0x8d/0xb0

It is asked to do something to a mapping for a device going away.
Taking Joerg into CC.

	Regards
		Oliver

[toc] | [prev] | [next] | [standalone]

#1309322

FromJoerg Roedel <jroedel@suse.de>
Date2016-01-14 15:30 +0100
Message-ID<qQR4u-8kt-11@gated-at.bofh.it>
In reply to#1309302
On Thu, Jan 14, 2016 at 03:01:14PM +0100, Oliver Neukum wrote:
> On Thu, 2016-01-14 at 13:50 +0100, Stefani Seibold wrote:
> > A unplug of an USB 1.0 OHCI controller express card will result in a
> > kernel crash. The express card is attached via thunderbolt and a sonnet
> > express card to thunderbolt adapter. The computer hangs after the
> > unplug, only a power fix the situation.
> > 
> > This is the kernel log of a kernel 4.4 via netconsole:
> > 
> > pciehp 0000:06:03.0:pcie24: Card not present on Slot(3)
> > pciehp 0000:06:03.0:pcie24: slot(3): Link Down event
> > pciehp 0000:06:03.0:pcie24: Link Down event ignored on slot(3): already powering off
> > ehci-pci 0000:0b:00.2: HC died; cleaning up
> > ehci-pci 0000:0b:00.2: remove, state 4
> > usb usb5: USB disconnect, device number 1
> > pciehp 0000:00:1c.4:pcie04: Card not present on Slot(4)
> > pciehp 0000:00:1c.4:pcie04: slot(4): Link Down event
> > ehci-pci 0000:0b:00.2: USB bus 5 deregistered
> > ohci-pci 0000:0b:00.1: HC died; cleaning up
> > ohci-pci 0000:0b:00.1: remove, state 4
> > usb usb7: USB disconnect, device number 1
> > pciehp 0000:00:1c.4:pcie04: Link Down event ignored on slot(4): already powering off
> > ohci-pci 0000:0b:00.1: USB bus 7 deregistered
> > ohci-pci 0000:0b:00.0: HC died; cleaning up
> > ohci-pci 0000:0b:00.0: remove, state 4
> > usb usb6: USB disconnect, device number 1
> > ------------[ cut here ]------------
> > kernel BUG at drivers/iommu/intel-iommu.c:3592!
> 
> This is likely the crucial information. The IOMMU is unhappy.

The only explanation for this is that the device driver calls into the
iommu code after the BUS_NOTIFY_REMOVED_DEVICE notifier ran. I see in
the stack-trace below that device_release_driver() is called from an
unusual place in pci code.

Unless there is a good explanation for calling device_release_driver()
after the BUS_NOTIFY_REMOVED_DEVICE notifier, this is no bug in the
iommu code.



	Joerg

[toc] | [prev] | [next] | [standalone]

#1309471

FromAlan Stern <stern@rowland.harvard.edu>
Date2016-01-14 17:40 +0100
Message-ID<qQT6i-1dw-17@gated-at.bofh.it>
In reply to#1309322
On Thu, 14 Jan 2016, Joerg Roedel wrote:

> On Thu, Jan 14, 2016 at 03:01:14PM +0100, Oliver Neukum wrote:
> > On Thu, 2016-01-14 at 13:50 +0100, Stefani Seibold wrote:
> > > A unplug of an USB 1.0 OHCI controller express card will result in a
> > > kernel crash. The express card is attached via thunderbolt and a sonnet
> > > express card to thunderbolt adapter. The computer hangs after the
> > > unplug, only a power fix the situation.
> > > 
> > > This is the kernel log of a kernel 4.4 via netconsole:
> > > 
> > > pciehp 0000:06:03.0:pcie24: Card not present on Slot(3)
> > > pciehp 0000:06:03.0:pcie24: slot(3): Link Down event
> > > pciehp 0000:06:03.0:pcie24: Link Down event ignored on slot(3): already powering off
> > > ehci-pci 0000:0b:00.2: HC died; cleaning up
> > > ehci-pci 0000:0b:00.2: remove, state 4
> > > usb usb5: USB disconnect, device number 1
> > > pciehp 0000:00:1c.4:pcie04: Card not present on Slot(4)
> > > pciehp 0000:00:1c.4:pcie04: slot(4): Link Down event
> > > ehci-pci 0000:0b:00.2: USB bus 5 deregistered
> > > ohci-pci 0000:0b:00.1: HC died; cleaning up
> > > ohci-pci 0000:0b:00.1: remove, state 4
> > > usb usb7: USB disconnect, device number 1
> > > pciehp 0000:00:1c.4:pcie04: Link Down event ignored on slot(4): already powering off
> > > ohci-pci 0000:0b:00.1: USB bus 7 deregistered
> > > ohci-pci 0000:0b:00.0: HC died; cleaning up
> > > ohci-pci 0000:0b:00.0: remove, state 4
> > > usb usb6: USB disconnect, device number 1
> > > ------------[ cut here ]------------
> > > kernel BUG at drivers/iommu/intel-iommu.c:3592!
> > 
> > This is likely the crucial information. The IOMMU is unhappy.
> 
> The only explanation for this is that the device driver calls into the
> iommu code after the BUS_NOTIFY_REMOVED_DEVICE notifier ran. I see in
> the stack-trace below that device_release_driver() is called from an
> unusual place in pci code.
> 
> Unless there is a good explanation for calling device_release_driver()
> after the BUS_NOTIFY_REMOVED_DEVICE notifier, this is no bug in the
> iommu code.

I don't think that is what happened.  The BUS_NOTIFY_REMOVED_DEVICE 
notifier is sent by device_del(), which is called (indirectly) by 
pci_remove_bus_device().  The device driver's remove routine -- which 
is what called into the iommu code -- is invoked through 
device_release_driver(), which is called (indirectly) by 
pci_stop_bus_device().

Since pci_stop_and_remove_bus_device() calls pci_stop_bus_device() 
before pci_remove_bus_device(), the notifier does not get sent until 
after the iommu code runs.

Alan Stern

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web