NetBSD Problem Report #48383

From t-hash@abox3.so-net.ne.jp  Sun Nov 17 14:04:05 2013
Return-Path: <t-hash@abox3.so-net.ne.jp>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "Postmaster NetBSD.org" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id BD300A618D
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 17 Nov 2013 14:04:05 +0000 (UTC)
Message-Id: <201311171233.rAHCXxGv023612@ms-omx12.plus.so-net.ne.jp>
Date: Sun, 17 Nov 2013 21:33:59 +0900
From: Takahiro HAYASHI <t-hash@abox3.so-net.ne.jp>
To: gnats-bugs@gnats.NetBSD.org
Subject: unplugging USB hub from xhci port causes panic

>Number:         48383
>Category:       kern
>Synopsis:       unplugging USB hub from xhci port causes panic
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 17 14:05:00 +0000 2013
>Closed-Date:    Mon Nov 18 09:12:27 +0000 2013
>Last-Modified:  Mon Nov 18 09:12:27 +0000 2013
>Originator:     Takahiro HAYASHI
>Release:        NetBSD 6.99.27
>Organization:
>Environment:
System: NetBSD  6.99.27 NetBSD 6.99.27 (UNIONLKDBG) #0: Sat Nov 16 09:01:19 JST 2013  root@halt:/build/head/obj.amd64/sys/arch/amd64/compile/UNIONLKDBG amd64
Architecture: x86_64
Machine: amd64
>Description:
	Kernel panics "locking against myself" when unplugging
	USB hub from xhci port.

(plug uhub into xhci port)

xhci0: port 4 status change
xhci0: hs port 2 status change
xhci0: port 4 status change
xhci0: hs port 2 status change
xhci0: xhci_new_device up 0xfffffe810763e958 portno 2
xhci0: xhci_new_device hub 0xfffffe813f35b490
xhci0: xhci_new_device hub 0xfffffe81075c81d0
xhci0: xhci_new_device hub 0x0
xhci0: xhci_new_device rhport 4
xhci0: xhci_open addr 0 depth 1 port 2 speed 3
xhci0: xhci_do_command input: 0x0000000000000000 0x00000000 0x00002400
xhci0: xhci_do_command output: 0x00000001075ff000 0x01000000 0x01008401
xhci0: dcbaa 0xffff800048bd3008 dc 0000000107735000 slot 1
xhci0: xhci_do_command input: 0x0000000107736000 0x00000000 0x01002c00
xhci0: xhci_do_command output: 0x00000001075ff010 0x01000000 0x01008401
xhci0: xhci_new_device device address 1
xhci0: xhci_new_device bMaxPacketSize 64
xhci0: xhci_update_ep0_mps
xhci0: xhci_do_command input: 0x0000000107736000 0x00000000 0x01003400
xhci0: xhci_do_command output: 0x00000001075ff020 0x01000000 0x01008401
xhci0: xhci_open addr 1 depth 1 port 2 speed 3
uhub6 at uhub0 port 2: NEC 2.0 hub, class 9/0, rev 2.00/1.00, addr 1
uhub6: single transaction translator
xhci0: xhci_open addr 1 depth 1 port 2 speed 3
xhci0: xhci_configure_endpoint dci 3 (0x81)
xhci0: xhci_do_command input: 0x0000000107736000 0x00000000 0x01003000
xhci0: xhci_do_command output: 0x00000001075ff030 0x01000000 0x01008401

(here unplug it)

xhci0: port 4 status change
xhci0: hs port 2 status change
xhci0: xhci_device_intr_done 0xfffffe81077a5a00 slot 1 dci 3
xhci0: xhci_device_intr_abort 0xfffffe81077a5a00
Mutex error: lockdebug_wantlock: locking against myself

lock address : 0xfffffe81075144e0 type     :     sleep/adaptive
initialized  : 0xffffffff8047c314
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  1
current cpu  :                  0 last held:                  0
current lwp  : 0xfffffe810781c5c0 last held: 0xfffffe810781c5c0
last locked* : 0xffffffff803f97d1 unlocked : 0xffffffff803f91e3
owner field  : 0xfffffe810781c5c0 wait/spin:                0/0

Turnstile chain at 0xffffffff806cf280.
=> No active turnstile for this lock.

panic: LOCKDEBUG: Mutex error: lockdebug_wantlock: locking against myself
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff8015716d cs 8 rflags 246 cr2 ffff800048c0c000 ilevel 0 rsp fffffe8001373900
curlwp 0xfffffe810781c5c0 pid 0.40 lowest kstack 0xfffffe8001370000
Stopped in pid 0.40 (system) at netbsd:breakpoint+0x5:  leave
db{0}> bt
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0x136
printf_nolog() at netbsd:printf_nolog
lockdebug_more() at netbsd:lockdebug_more
mutex_enter() at netbsd:mutex_enter+0x43c
xhci_device_intr_abort() at netbsd:xhci_device_intr_abort+0x52
usbd_abort_pipe() at netbsd:usbd_abort_pipe+0x4d
uhub_detach() at netbsd:uhub_detach+0x92
config_detach() at netbsd:config_detach+0xda
usb_disconnect_port() at netbsd:usb_disconnect_port+0xaa
uhub_explore() at netbsd:uhub_explore+0x1ab
usb_discover.clone.0() at netbsd:usb_discover.clone.0+0x4e
usb_event_thread() at netbsd:usb_event_thread+0x74
db{0}>


>How-To-Repeat:
	plug USB hub into xhci port and then unplug it.
	Both 2.0 and 3.0 hub can cause panic.

>Fix:
	No idea.

--
t-hash

>Release-Note:

>Audit-Trail:
From: "Nick Hudson" <skrll@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/48383 CVS commit: src/sys/dev/usb
Date: Sun, 17 Nov 2013 16:11:35 +0000

 Module Name:	src
 Committed By:	skrll
 Date:		Sun Nov 17 16:11:35 UTC 2013

 Modified Files:
 	src/sys/dev/usb: xhci.c

 Log Message:
 Fix locking botch.

 PR/48383


 To generate a diff of this commit:
 cvs rdiff -u -r1.9 -r1.10 src/sys/dev/usb/xhci.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->feedback
State-Changed-By: skrll@NetBSD.org
State-Changed-When: Sun, 17 Nov 2013 16:47:09 +0000
State-Changed-Why:
Should be fixed now.


From: Takahiro HAYASHI <t-hash@abox3.so-net.ne.jp>
To: gnats-bugs@NetBSD.org, skrll@NetBSD.org
Cc: kern-bug-people@netbsd.org, netbsd-bugs@netbsd.org, gnats-admin@netbsd.org
Subject: Re: kern/48383 (unplugging USB hub from xhci port causes panic)
Date: Mon, 18 Nov 2013 18:08:29 +0900

 On Sun, 17 Nov 2013 16:47:09 +0000 (UTC)
 skrll@NetBSD.org wrote:

 > Synopsis: unplugging USB hub from xhci port causes panic
 > 
 > State-Changed-From-To: open->feedback
 > State-Changed-By: skrll@NetBSD.org
 > State-Changed-When: Sun, 17 Nov 2013 16:47:09 +0000
 > State-Changed-Why:
 > Should be fixed now.

 Yes, it works!
 Thank you for quick fix.

 xhci0: port 4 status change
 xhci0: hs port 2 status change
 xhci0: xhci_device_intr_done 0xfffffe81077a5a00 slot 1 dci 3
 xhci0: xhci_device_intr_abort 0xfffffe81077a5a00
 xhci0: xhci_device_intr_done 0xfffffe81077a5a00 slot 1 dci 3
 xhci0: xhci_device_intr_close 0xfffffe810770b368
 uhub6: detached
 uhub6: at uhub0 port 2 (addr 1) disconnected

 --
 t-hash

State-Changed-From-To: feedback->closed
State-Changed-By: skrll@NetBSD.org
State-Changed-When: Mon, 18 Nov 2013 09:12:27 +0000
State-Changed-Why:
Confirmed fixed.


>Unformatted:

Home	PR Database Search