Re: usb: chipidea: hdc: kernel panic during shutdown
On Fri, Sep 09, 2016 at 04:35:02PM +0200, Stefan Wahren wrote: > Am 05.09.2016 um 04:51 schrieb Peter Chen: > > On Fri, Sep 02, 2016 at 08:20:35PM +0200, Stefan Wahren wrote: > >> Hi Peter, > >> > >>> Stefan Wahren hat am 25. August 2016 um 19:17 > >>> geschrieben: > >>> > >>> > >>> Hi, > >>> > Peter Chen hat am 25. August 2016 um 11:16 > geschrieben: > > > On Thu, Aug 25, 2016 at 08:27:03AM +0200, Stefan Wahren wrote: > > Am 25.08.2016 um 08:44 schrieb Peter Chen: > >> On Thu, Aug 25, 2016 at 07:06:12AM +0200, Stefan Wahren wrote: > >>> Hi Alan, > >>> > >>> i tried the following patch: > >>> --- a/drivers/usb/chipidea/host.c > >>> +++ b/drivers/usb/chipidea/host.c > >>> @@ -185,6 +185,8 @@ static void host_stop(struct ci_hdrc *ci) > >>> > >>> if (hcd) { > >>> usb_remove_hcd(hcd); > >>> + ci_role_stop(ci); > >>> + synchronize_irq(ci->irq); > >> Would you please just add below line to see if this problem can be > >> fixed? > >> + ci->role = CI_ROLE_END; > >> > >> When ci->role is CI_ROLE_END, neither host nor device interrupt handler > >> will run. > > I would add this before synchronize_irq() as Alan suggested. > >>> i replaced my ci_role_stop(ci) with ci->role = CI_ROLE_END and the panic > >>> disappear: > >>> > >>> [ 114.98] ci_hdrc ci_hdrc.0: remove, state 1 > >>> [ 114.99] usb usb1: USB disconnect, device number 1 > >>> [ 115.00] usb 1-1: USB disconnect, device number 2 > >>> [ 115.00] usb 1-1.1: USB disconnect, device number 3 > >>> [ 115.03] smsc95xx 1-1.1:1.0 eth0: unregister 'smsc95xx' > >>> usb-ci_hdrc.0-1.1, > >>> smsc95xx USB 2.0 Ethernet > >>> [ 115.22] ci_hdrc ci_hdrc.0: USB bus 1 deregistered > >>> [ 115.23] otgsc:0x4e20, usbsts:0x0 > >>> [ 115.24] reboot: System halted > >> do you need more information? > >> > > I would like to know which interrupt is triggered at that time? > > So the added debug messages didn't help to find the interrupt source ( > otgsc:0x4e20, usbsts:0x0 ) ? > > Any other suggestions ? > > At least i would like to create a patch with Alan's suggestion before > 4.8 is final. > Ok, please do it. -- Best Regards, Peter Chen -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: usb: chipidea: hdc: kernel panic during shutdown
Am 05.09.2016 um 04:51 schrieb Peter Chen: > On Fri, Sep 02, 2016 at 08:20:35PM +0200, Stefan Wahren wrote: >> Hi Peter, >> >>> Stefan Wahren hat am 25. August 2016 um 19:17 >>> geschrieben: >>> >>> >>> Hi, >>> Peter Chen hat am 25. August 2016 um 11:16 geschrieben: On Thu, Aug 25, 2016 at 08:27:03AM +0200, Stefan Wahren wrote: > Am 25.08.2016 um 08:44 schrieb Peter Chen: >> On Thu, Aug 25, 2016 at 07:06:12AM +0200, Stefan Wahren wrote: >>> Hi Alan, >>> >>> i tried the following patch: >>> --- a/drivers/usb/chipidea/host.c >>> +++ b/drivers/usb/chipidea/host.c >>> @@ -185,6 +185,8 @@ static void host_stop(struct ci_hdrc *ci) >>> >>> if (hcd) { >>> usb_remove_hcd(hcd); >>> + ci_role_stop(ci); >>> + synchronize_irq(ci->irq); >> Would you please just add below line to see if this problem can be >> fixed? >> +ci->role = CI_ROLE_END; >> >> When ci->role is CI_ROLE_END, neither host nor device interrupt handler >> will run. > I would add this before synchronize_irq() as Alan suggested. >>> i replaced my ci_role_stop(ci) with ci->role = CI_ROLE_END and the panic >>> disappear: >>> >>> [ 114.98] ci_hdrc ci_hdrc.0: remove, state 1 >>> [ 114.99] usb usb1: USB disconnect, device number 1 >>> [ 115.00] usb 1-1: USB disconnect, device number 2 >>> [ 115.00] usb 1-1.1: USB disconnect, device number 3 >>> [ 115.03] smsc95xx 1-1.1:1.0 eth0: unregister 'smsc95xx' >>> usb-ci_hdrc.0-1.1, >>> smsc95xx USB 2.0 Ethernet >>> [ 115.22] ci_hdrc ci_hdrc.0: USB bus 1 deregistered >>> [ 115.23] otgsc:0x4e20, usbsts:0x0 >>> [ 115.24] reboot: System halted >> do you need more information? >> > I would like to know which interrupt is triggered at that time? So the added debug messages didn't help to find the interrupt source ( otgsc:0x4e20, usbsts:0x0 ) ? Any other suggestions ? At least i would like to create a patch with Alan's suggestion before 4.8 is final. -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: usb: chipidea: hdc: kernel panic during shutdown
On Fri, Sep 02, 2016 at 08:20:35PM +0200, Stefan Wahren wrote: > Hi Peter, > > > Stefan Wahren hat am 25. August 2016 um 19:17 > > geschrieben: > > > > > > Hi, > > > > > Peter Chen hat am 25. August 2016 um 11:16 > > > geschrieben: > > > > > > > > > On Thu, Aug 25, 2016 at 08:27:03AM +0200, Stefan Wahren wrote: > > > > Am 25.08.2016 um 08:44 schrieb Peter Chen: > > > > > On Thu, Aug 25, 2016 at 07:06:12AM +0200, Stefan Wahren wrote: > > > > >> Hi Alan, > > > > >> > > > > >> i tried the following patch: > > > > >> --- a/drivers/usb/chipidea/host.c > > > > >> +++ b/drivers/usb/chipidea/host.c > > > > >> @@ -185,6 +185,8 @@ static void host_stop(struct ci_hdrc *ci) > > > > >> > > > > >> if (hcd) { > > > > >> usb_remove_hcd(hcd); > > > > >> + ci_role_stop(ci); > > > > >> + synchronize_irq(ci->irq); > > > > > Would you please just add below line to see if this problem can be > > > > > fixed? > > > > > + ci->role = CI_ROLE_END; > > > > > > > > > > When ci->role is CI_ROLE_END, neither host nor device interrupt > > > > > handler > > > > > will run. > > > > > > > > I would add this before synchronize_irq() as Alan suggested. > > > > i replaced my ci_role_stop(ci) with ci->role = CI_ROLE_END and the panic > > disappear: > > > > [ 114.98] ci_hdrc ci_hdrc.0: remove, state 1 > > [ 114.99] usb usb1: USB disconnect, device number 1 > > [ 115.00] usb 1-1: USB disconnect, device number 2 > > [ 115.00] usb 1-1.1: USB disconnect, device number 3 > > [ 115.03] smsc95xx 1-1.1:1.0 eth0: unregister 'smsc95xx' > > usb-ci_hdrc.0-1.1, > > smsc95xx USB 2.0 Ethernet > > [ 115.22] ci_hdrc ci_hdrc.0: USB bus 1 deregistered > > [ 115.23] otgsc:0x4e20, usbsts:0x0 > > [ 115.24] reboot: System halted > > do you need more information? > I would like to know which interrupt is triggered at that time? -- Best Regards, Peter Chen -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: usb: chipidea: hdc: kernel panic during shutdown
Hi Peter, > Stefan Wahren hat am 25. August 2016 um 19:17 > geschrieben: > > > Hi, > > > Peter Chen hat am 25. August 2016 um 11:16 > > geschrieben: > > > > > > On Thu, Aug 25, 2016 at 08:27:03AM +0200, Stefan Wahren wrote: > > > Am 25.08.2016 um 08:44 schrieb Peter Chen: > > > > On Thu, Aug 25, 2016 at 07:06:12AM +0200, Stefan Wahren wrote: > > > >> Hi Alan, > > > >> > > > >> i tried the following patch: > > > >> --- a/drivers/usb/chipidea/host.c > > > >> +++ b/drivers/usb/chipidea/host.c > > > >> @@ -185,6 +185,8 @@ static void host_stop(struct ci_hdrc *ci) > > > >> > > > >> if (hcd) { > > > >> usb_remove_hcd(hcd); > > > >> + ci_role_stop(ci); > > > >> + synchronize_irq(ci->irq); > > > > Would you please just add below line to see if this problem can be > > > > fixed? > > > > + ci->role = CI_ROLE_END; > > > > > > > > When ci->role is CI_ROLE_END, neither host nor device interrupt handler > > > > will run. > > > > > > I would add this before synchronize_irq() as Alan suggested. > > i replaced my ci_role_stop(ci) with ci->role = CI_ROLE_END and the panic > disappear: > > [ 114.98] ci_hdrc ci_hdrc.0: remove, state 1 > [ 114.99] usb usb1: USB disconnect, device number 1 > [ 115.00] usb 1-1: USB disconnect, device number 2 > [ 115.00] usb 1-1.1: USB disconnect, device number 3 > [ 115.03] smsc95xx 1-1.1:1.0 eth0: unregister 'smsc95xx' > usb-ci_hdrc.0-1.1, > smsc95xx USB 2.0 Ethernet > [ 115.22] ci_hdrc ci_hdrc.0: USB bus 1 deregistered > [ 115.23] otgsc:0x4e20, usbsts:0x0 > [ 115.24] reboot: System halted do you need more information? What would be the next step? Stefan > > Regards > Stefan -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: usb: chipidea: hdc: kernel panic during shutdown
Hi, > Peter Chen hat am 25. August 2016 um 11:16 > geschrieben: > > > On Thu, Aug 25, 2016 at 08:27:03AM +0200, Stefan Wahren wrote: > > Am 25.08.2016 um 08:44 schrieb Peter Chen: > > > On Thu, Aug 25, 2016 at 07:06:12AM +0200, Stefan Wahren wrote: > > >> Hi Alan, > > >> > > >> i tried the following patch: > > >> --- a/drivers/usb/chipidea/host.c > > >> +++ b/drivers/usb/chipidea/host.c > > >> @@ -185,6 +185,8 @@ static void host_stop(struct ci_hdrc *ci) > > >> > > >> if (hcd) { > > >> usb_remove_hcd(hcd); > > >> + ci_role_stop(ci); > > >> + synchronize_irq(ci->irq); > > > Would you please just add below line to see if this problem can be > > > fixed? > > > + ci->role = CI_ROLE_END; > > > > > > When ci->role is CI_ROLE_END, neither host nor device interrupt handler > > > will run. > > > > I would add this before synchronize_irq() as Alan suggested. i replaced my ci_role_stop(ci) with ci->role = CI_ROLE_END and the panic disappear: [ 114.98] ci_hdrc ci_hdrc.0: remove, state 1 [ 114.99] usb usb1: USB disconnect, device number 1 [ 115.00] usb 1-1: USB disconnect, device number 2 [ 115.00] usb 1-1.1: USB disconnect, device number 3 [ 115.03] smsc95xx 1-1.1:1.0 eth0: unregister 'smsc95xx' usb-ci_hdrc.0-1.1, smsc95xx USB 2.0 Ethernet [ 115.22] ci_hdrc ci_hdrc.0: USB bus 1 deregistered [ 115.23] otgsc:0x4e20, usbsts:0x0 [ 115.24] reboot: System halted Regards Stefan -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: usb: chipidea: hdc: kernel panic during shutdown
On Thu, Aug 25, 2016 at 08:27:03AM +0200, Stefan Wahren wrote: > Am 25.08.2016 um 08:44 schrieb Peter Chen: > > On Thu, Aug 25, 2016 at 07:06:12AM +0200, Stefan Wahren wrote: > >> Hi Alan, > >> > >> i tried the following patch: > >> --- a/drivers/usb/chipidea/host.c > >> +++ b/drivers/usb/chipidea/host.c > >> @@ -185,6 +185,8 @@ static void host_stop(struct ci_hdrc *ci) > >> > >> if (hcd) { > >> usb_remove_hcd(hcd); > >> + ci_role_stop(ci); > >> + synchronize_irq(ci->irq); > > Would you please just add below line to see if this problem can be > > fixed? > > + ci->role = CI_ROLE_END; > > > > When ci->role is CI_ROLE_END, neither host nor device interrupt handler > > will run. > > I would add this before synchronize_irq() as Alan suggested. > > > > > What is your controller role? (dr_mode = host, peripheral or otg)? > > I'm using the unmodified arch/arm/boot/dts/imx23-olinuxino.dts so: > > dr_mode = host It is so strange that there are interrupts after usb_remove_hcd is called since the controller has already at reset status. > > > Besides, you would please add below line at core.c to show what > > interrupt occurs at that time: > > > > > > diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c > > index b5c155b..e6b8a7e 100644 > > --- a/drivers/usb/chipidea/core.c > > +++ b/drivers/usb/chipidea/core.c > > @@ -596,6 +596,12 @@ static irqreturn_t ci_irq(int irq, void *data) > > /* Handle device/host interrupt */ > > if (ci->role != CI_ROLE_END) > > ret = ci_role(ci)->irq(ci); > > + else > > + dev_info(ci->dev, "otgsc:0x%x, usbsts:0x%x\n", > > + hw_read_otgsc(ci, ~0), > > + hw_read_intr_status(ci) & > > hw_read_intr_enable(ci) > > + ); > > + > > > > return ret; > > } > > If possible, add above code to see which is suspicious interrupts. -- Best Regards, Peter Chen -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: usb: chipidea: hdc: kernel panic during shutdown
Am 25.08.2016 um 08:44 schrieb Peter Chen: > On Thu, Aug 25, 2016 at 07:06:12AM +0200, Stefan Wahren wrote: >> Hi Alan, >> >> i tried the following patch: >> --- a/drivers/usb/chipidea/host.c >> +++ b/drivers/usb/chipidea/host.c >> @@ -185,6 +185,8 @@ static void host_stop(struct ci_hdrc *ci) >> >> if (hcd) { >> usb_remove_hcd(hcd); >> + ci_role_stop(ci); >> + synchronize_irq(ci->irq); > Would you please just add below line to see if this problem can be > fixed? > + ci->role = CI_ROLE_END; > > When ci->role is CI_ROLE_END, neither host nor device interrupt handler > will run. I would add this before synchronize_irq() as Alan suggested. > > What is your controller role? (dr_mode = host, peripheral or otg)? I'm using the unmodified arch/arm/boot/dts/imx23-olinuxino.dts so: dr_mode = host > Besides, you would please add below line at core.c to show what > interrupt occurs at that time: > > > diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c > index b5c155b..e6b8a7e 100644 > --- a/drivers/usb/chipidea/core.c > +++ b/drivers/usb/chipidea/core.c > @@ -596,6 +596,12 @@ static irqreturn_t ci_irq(int irq, void *data) > /* Handle device/host interrupt */ > if (ci->role != CI_ROLE_END) > ret = ci_role(ci)->irq(ci); > + else > + dev_info(ci->dev, "otgsc:0x%x, usbsts:0x%x\n", > + hw_read_otgsc(ci, ~0), > + hw_read_intr_status(ci) & > hw_read_intr_enable(ci) > + ); > + > > return ret; > } > -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: usb: chipidea: hdc: kernel panic during shutdown
On Thu, Aug 25, 2016 at 07:06:12AM +0200, Stefan Wahren wrote: > Hi Alan, > > > Alan Stern hat am 24. August 2016 um 20:55 > > geschrieben: > > > > > > On Wed, 24 Aug 2016, Stefan Wahren wrote: > > > > > Hi, > > > > > > [add Li Jun to CC] > > > > > > > Alan Stern hat am 24. August 2016 um 15:45 > > > > geschrieben: > > > > > > > > > > > > On Wed, 24 Aug 2016, Peter Chen wrote: > > > > > > > > > On Tue, Aug 23, 2016 at 09:17:02PM +0200, Stefan Wahren wrote: > > > > > > Hi, > > > > > > > > > > > > i'm using a iMX233-OLinuXino board and the kernel panics during > > > > > > shutdown > > > > > > with > > > > > > 4.8.0-rc2-next-20160819: > > > > > > > > > > > > [ 420.04] ci_hdrc ci_hdrc.0: remove, state 1 > > > > > > [ 420.05] usb usb1: USB disconnect, device number 1 > > > > > > [ 420.06] usb 1-1: USB disconnect, device number 2 > > > > > > [ 420.06] usb 1-1.1: USB disconnect, device number 3 > > > > > > [ 420.09] smsc95xx 1-1.1:1.0 eth0: unregister 'smsc95xx' > > > > > > usb-ci_hdrc.0-1.1, > > > > > > smsc95xx USB 2.0 Ethernet > > > > > > [ 420.29] ci_hdrc ci_hdrc.0: USB bus 1 deregistered > > > > > > [ 420.30] Unable to handle kernel NULL pointer dereference at > > > > > > virtual > > > > > > address 0118 > > > > > > [ 420.30] pgd = c2ea4000 > > > > > > [ 420.30] [0118] *pgd= > > > > > > [ 420.30] Internal error: Oops: 5 [#1] ARM > > > > > > [ 420.30] Modules linked in: > > > > > > [ 420.30] CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted > > > > > > 4.8.0-rc2-next-20160819 #1 > > > > > > [ 420.30] Hardware name: Freescale MXS (Device Tree) > > > > > > [ 420.30] task: c349 task.stack: c348e000 > > > > > > [ 420.30] PC is at usb_hcd_irq+0x0/0x34 > > > > > > [ 420.30] LR is at ci_irq+0x58/0x12c > > > > > > > > > I am afraid the hcd is freed before the interrupt triggered. Would you > > > > > please try below changes: > > > > > > > > > > diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c > > > > > index 96ae695..61237a9 100644 > > > > > --- a/drivers/usb/chipidea/host.c > > > > > +++ b/drivers/usb/chipidea/host.c > > > > > @@ -103,7 +103,7 @@ static const struct ehci_driver_overrides > > > > > ehci_ci_overrides = { > > > > > static irqreturn_t host_irq(struct ci_hdrc *ci) > > > > > { > > > > > - return usb_hcd_irq(ci->irq, ci->hcd); > > > > > + return ci->hcd ? usb_hcd_irq(ci->irq, ci->hcd) : IRQ_NONE; > > > > > } > > > > > > > > This should not be needed. Instead, the driver should make sure that > > > > the interrupt handler has been fully unregistered before the hcd is > > > > deallocated. > > > > > > according to ci_hdrc_probe() from the chipidea core the IRQ seems to be > > > requested via devm_request_irq() with the flag IRQF_SHARED. > > > > > > I have the suspicion the following commit triggers the kernel panic: > > > > > > 43a404577a93 ("usb: chipidea: host: set host to be null after hcd is > > > freed") > > > > No, that's not the cause. Without that commit, you would try to access > > deallocated memory instead of trying to dereference a NULL pointer, but > > the kernel would still oops. > > > > Instead, how about setting ci->role to CI_ROLE_END and then calling > > synchronize_irq(ci->irq) in host_stop(), before the usb_put_hcd()? > > i tried the following patch: > > --- a/drivers/usb/chipidea/host.c > +++ b/drivers/usb/chipidea/host.c > @@ -185,6 +185,8 @@ static void host_stop(struct ci_hdrc *ci) > > if (hcd) { > usb_remove_hcd(hcd); > + ci_role_stop(ci); > + synchronize_irq(ci->irq); Would you please just add below line to see if this problem can be fixed? + ci->role = CI_ROLE_END; When ci->role is CI_ROLE_END, neither host nor device interrupt handler will run. What is your controller role? (dr_mode = host, peripheral or otg)? Besides, you would please add below line at core.c to show what interrupt occurs at that time: diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c index b5c155b..e6b8a7e 100644 --- a/drivers/usb/chipidea/core.c +++ b/drivers/usb/chipidea/core.c @@ -596,6 +596,12 @@ static irqreturn_t ci_irq(int irq, void *data) /* Handle device/host interrupt */ if (ci->role != CI_ROLE_END) ret = ci_role(ci)->irq(ci); + else + dev_info(ci->dev, "otgsc:0x%x, usbsts:0x%x\n", + hw_read_otgsc(ci, ~0), + hw_read_intr_status(ci) & hw_read_intr_enable(ci) + ); + return ret; } > usb_put_hcd(hcd); > if (ci->platdata->reg_vbus && !ci_otg_is_fsm_mode(ci) && > (ci->platdata->flags & CI_HDRC_TURN_VBUS_EARLY_ON)) > > the i get the following during shutdown: The reason for this is the host_stop is re-entered. Peter > > [ 102.17] ci_hdrc ci_hdrc.0: remove, state 1
Re: usb: chipidea: hdc: kernel panic during shutdown
Hi Alan, > Alan Stern hat am 24. August 2016 um 20:55 > geschrieben: > > > On Wed, 24 Aug 2016, Stefan Wahren wrote: > > > Hi, > > > > [add Li Jun to CC] > > > > > Alan Stern hat am 24. August 2016 um 15:45 > > > geschrieben: > > > > > > > > > On Wed, 24 Aug 2016, Peter Chen wrote: > > > > > > > On Tue, Aug 23, 2016 at 09:17:02PM +0200, Stefan Wahren wrote: > > > > > Hi, > > > > > > > > > > i'm using a iMX233-OLinuXino board and the kernel panics during > > > > > shutdown > > > > > with > > > > > 4.8.0-rc2-next-20160819: > > > > > > > > > > [ 420.04] ci_hdrc ci_hdrc.0: remove, state 1 > > > > > [ 420.05] usb usb1: USB disconnect, device number 1 > > > > > [ 420.06] usb 1-1: USB disconnect, device number 2 > > > > > [ 420.06] usb 1-1.1: USB disconnect, device number 3 > > > > > [ 420.09] smsc95xx 1-1.1:1.0 eth0: unregister 'smsc95xx' > > > > > usb-ci_hdrc.0-1.1, > > > > > smsc95xx USB 2.0 Ethernet > > > > > [ 420.29] ci_hdrc ci_hdrc.0: USB bus 1 deregistered > > > > > [ 420.30] Unable to handle kernel NULL pointer dereference at > > > > > virtual > > > > > address 0118 > > > > > [ 420.30] pgd = c2ea4000 > > > > > [ 420.30] [0118] *pgd= > > > > > [ 420.30] Internal error: Oops: 5 [#1] ARM > > > > > [ 420.30] Modules linked in: > > > > > [ 420.30] CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted > > > > > 4.8.0-rc2-next-20160819 #1 > > > > > [ 420.30] Hardware name: Freescale MXS (Device Tree) > > > > > [ 420.30] task: c349 task.stack: c348e000 > > > > > [ 420.30] PC is at usb_hcd_irq+0x0/0x34 > > > > > [ 420.30] LR is at ci_irq+0x58/0x12c > > > > > > > I am afraid the hcd is freed before the interrupt triggered. Would you > > > > please try below changes: > > > > > > > > diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c > > > > index 96ae695..61237a9 100644 > > > > --- a/drivers/usb/chipidea/host.c > > > > +++ b/drivers/usb/chipidea/host.c > > > > @@ -103,7 +103,7 @@ static const struct ehci_driver_overrides > > > > ehci_ci_overrides = { > > > > static irqreturn_t host_irq(struct ci_hdrc *ci) > > > > { > > > > - return usb_hcd_irq(ci->irq, ci->hcd); > > > > + return ci->hcd ? usb_hcd_irq(ci->irq, ci->hcd) : IRQ_NONE; > > > > } > > > > > > This should not be needed. Instead, the driver should make sure that > > > the interrupt handler has been fully unregistered before the hcd is > > > deallocated. > > > > according to ci_hdrc_probe() from the chipidea core the IRQ seems to be > > requested via devm_request_irq() with the flag IRQF_SHARED. > > > > I have the suspicion the following commit triggers the kernel panic: > > > > 43a404577a93 ("usb: chipidea: host: set host to be null after hcd is freed") > > No, that's not the cause. Without that commit, you would try to access > deallocated memory instead of trying to dereference a NULL pointer, but > the kernel would still oops. > > Instead, how about setting ci->role to CI_ROLE_END and then calling > synchronize_irq(ci->irq) in host_stop(), before the usb_put_hcd()? i tried the following patch: --- a/drivers/usb/chipidea/host.c +++ b/drivers/usb/chipidea/host.c @@ -185,6 +185,8 @@ static void host_stop(struct ci_hdrc *ci) if (hcd) { usb_remove_hcd(hcd); + ci_role_stop(ci); + synchronize_irq(ci->irq); usb_put_hcd(hcd); if (ci->platdata->reg_vbus && !ci_otg_is_fsm_mode(ci) && (ci->platdata->flags & CI_HDRC_TURN_VBUS_EARLY_ON)) the i get the following during shutdown: [ 102.17] ci_hdrc ci_hdrc.0: remove, state 1 [ 102.18] usb usb1: USB disconnect, device number 1 [ 102.18] usb 1-1: USB disconnect, device number 2 [ 102.19] usb 1-1.1: USB disconnect, device number 3 [ 102.22] smsc95xx 1-1.1:1.0 eth0: unregister 'smsc95xx' usb-ci_hdrc.0-1.1, smsc95xx USB 2.0 Ethernet [ 102.41] ci_hdrc ci_hdrc.0: USB bus 1 deregistered [ 102.42] ci_hdrc ci_hdrc.0: remove, state 0 [ 102.42] Unable to handle kernel NULL pointer dereference at virtual address 0090 [ 102.43] pgd = c2e74000 [ 102.43] [0090] *pgd= [ 102.44] Internal error: Oops: 5 [#1] ARM [ 102.44] Modules linked in: [ 102.44] CPU: 0 PID: 1 Comm: systemd-shutdow Tainted: GW 4.8.0-rc3-00026-gcad9d20-dirty #4 [ 102.44] Hardware name: Freescale MXS (Device Tree) [ 102.44] task: c349 task.stack: c348e000 [ 102.44] PC is at sysfs_remove_group+0x18/0x9c [ 102.44] LR is at usb_remove_hcd+0x3c/0x1ac [ 102.44] pc : []lr : []psr: 6013 [ 102.44] sp : c348fd48 ip : c349 fp : be87dc58 [ 102.44] r10: c08cd48c r9 : r8 : c348fe5c [ 102.44] r7 : c354bc44 r6 : c08a5160 r5 : 0078 r4 : c08afd2c [ 102.44] r3 : c349 r2 : r1 : r0 : 0078 [ 102.44] Flags: nZCv IRQs on
Re: usb: chipidea: hdc: kernel panic during shutdown
On Wed, 24 Aug 2016, Stefan Wahren wrote: > Hi, > > [add Li Jun to CC] > > > Alan Stern hat am 24. August 2016 um 15:45 > > geschrieben: > > > > > > On Wed, 24 Aug 2016, Peter Chen wrote: > > > > > On Tue, Aug 23, 2016 at 09:17:02PM +0200, Stefan Wahren wrote: > > > > Hi, > > > > > > > > i'm using a iMX233-OLinuXino board and the kernel panics during shutdown > > > > with > > > > 4.8.0-rc2-next-20160819: > > > > > > > > [ 420.04] ci_hdrc ci_hdrc.0: remove, state 1 > > > > [ 420.05] usb usb1: USB disconnect, device number 1 > > > > [ 420.06] usb 1-1: USB disconnect, device number 2 > > > > [ 420.06] usb 1-1.1: USB disconnect, device number 3 > > > > [ 420.09] smsc95xx 1-1.1:1.0 eth0: unregister 'smsc95xx' > > > > usb-ci_hdrc.0-1.1, > > > > smsc95xx USB 2.0 Ethernet > > > > [ 420.29] ci_hdrc ci_hdrc.0: USB bus 1 deregistered > > > > [ 420.30] Unable to handle kernel NULL pointer dereference at > > > > virtual > > > > address 0118 > > > > [ 420.30] pgd = c2ea4000 > > > > [ 420.30] [0118] *pgd= > > > > [ 420.30] Internal error: Oops: 5 [#1] ARM > > > > [ 420.30] Modules linked in: > > > > [ 420.30] CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted > > > > 4.8.0-rc2-next-20160819 #1 > > > > [ 420.30] Hardware name: Freescale MXS (Device Tree) > > > > [ 420.30] task: c349 task.stack: c348e000 > > > > [ 420.30] PC is at usb_hcd_irq+0x0/0x34 > > > > [ 420.30] LR is at ci_irq+0x58/0x12c > > > > > I am afraid the hcd is freed before the interrupt triggered. Would you > > > please try below changes: > > > > > > diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c > > > index 96ae695..61237a9 100644 > > > --- a/drivers/usb/chipidea/host.c > > > +++ b/drivers/usb/chipidea/host.c > > > @@ -103,7 +103,7 @@ static const struct ehci_driver_overrides > > > ehci_ci_overrides = { > > > static irqreturn_t host_irq(struct ci_hdrc *ci) > > > { > > > - return usb_hcd_irq(ci->irq, ci->hcd); > > > + return ci->hcd ? usb_hcd_irq(ci->irq, ci->hcd) : IRQ_NONE; > > > } > > > > This should not be needed. Instead, the driver should make sure that > > the interrupt handler has been fully unregistered before the hcd is > > deallocated. > > according to ci_hdrc_probe() from the chipidea core the IRQ seems to be > requested via devm_request_irq() with the flag IRQF_SHARED. > > I have the suspicion the following commit triggers the kernel panic: > > 43a404577a93 ("usb: chipidea: host: set host to be null after hcd is freed") No, that's not the cause. Without that commit, you would try to access deallocated memory instead of trying to dereference a NULL pointer, but the kernel would still oops. Instead, how about setting ci->role to CI_ROLE_END and then calling synchronize_irq(ci->irq) in host_stop(), before the usb_put_hcd()? Alan Stern -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: usb: chipidea: hdc: kernel panic during shutdown
Hi, [add Li Jun to CC] > Alan Stern hat am 24. August 2016 um 15:45 > geschrieben: > > > On Wed, 24 Aug 2016, Peter Chen wrote: > > > On Tue, Aug 23, 2016 at 09:17:02PM +0200, Stefan Wahren wrote: > > > Hi, > > > > > > i'm using a iMX233-OLinuXino board and the kernel panics during shutdown > > > with > > > 4.8.0-rc2-next-20160819: > > > > > > [ 420.04] ci_hdrc ci_hdrc.0: remove, state 1 > > > [ 420.05] usb usb1: USB disconnect, device number 1 > > > [ 420.06] usb 1-1: USB disconnect, device number 2 > > > [ 420.06] usb 1-1.1: USB disconnect, device number 3 > > > [ 420.09] smsc95xx 1-1.1:1.0 eth0: unregister 'smsc95xx' > > > usb-ci_hdrc.0-1.1, > > > smsc95xx USB 2.0 Ethernet > > > [ 420.29] ci_hdrc ci_hdrc.0: USB bus 1 deregistered > > > [ 420.30] Unable to handle kernel NULL pointer dereference at virtual > > > address 0118 > > > [ 420.30] pgd = c2ea4000 > > > [ 420.30] [0118] *pgd= > > > [ 420.30] Internal error: Oops: 5 [#1] ARM > > > [ 420.30] Modules linked in: > > > [ 420.30] CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted > > > 4.8.0-rc2-next-20160819 #1 > > > [ 420.30] Hardware name: Freescale MXS (Device Tree) > > > [ 420.30] task: c349 task.stack: c348e000 > > > [ 420.30] PC is at usb_hcd_irq+0x0/0x34 > > > [ 420.30] LR is at ci_irq+0x58/0x12c > > > I am afraid the hcd is freed before the interrupt triggered. Would you > > please try below changes: > > > > diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c > > index 96ae695..61237a9 100644 > > --- a/drivers/usb/chipidea/host.c > > +++ b/drivers/usb/chipidea/host.c > > @@ -103,7 +103,7 @@ static const struct ehci_driver_overrides > > ehci_ci_overrides = { > > static irqreturn_t host_irq(struct ci_hdrc *ci) > > { > > - return usb_hcd_irq(ci->irq, ci->hcd); > > + return ci->hcd ? usb_hcd_irq(ci->irq, ci->hcd) : IRQ_NONE; > > } > > This should not be needed. Instead, the driver should make sure that > the interrupt handler has been fully unregistered before the hcd is > deallocated. according to ci_hdrc_probe() from the chipidea core the IRQ seems to be requested via devm_request_irq() with the flag IRQF_SHARED. I have the suspicion the following commit triggers the kernel panic: 43a404577a93 ("usb: chipidea: host: set host to be null after hcd is freed") I will validate this. > > Alan Stern > -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: usb: chipidea: hdc: kernel panic during shutdown
On Wed, 24 Aug 2016, Peter Chen wrote: > On Tue, Aug 23, 2016 at 09:17:02PM +0200, Stefan Wahren wrote: > > Hi, > > > > i'm using a iMX233-OLinuXino board and the kernel panics during shutdown > > with > > 4.8.0-rc2-next-20160819: > > > > [ 420.04] ci_hdrc ci_hdrc.0: remove, state 1 > > [ 420.05] usb usb1: USB disconnect, device number 1 > > [ 420.06] usb 1-1: USB disconnect, device number 2 > > [ 420.06] usb 1-1.1: USB disconnect, device number 3 > > [ 420.09] smsc95xx 1-1.1:1.0 eth0: unregister 'smsc95xx' > > usb-ci_hdrc.0-1.1, > > smsc95xx USB 2.0 Ethernet > > [ 420.29] ci_hdrc ci_hdrc.0: USB bus 1 deregistered > > [ 420.30] Unable to handle kernel NULL pointer dereference at virtual > > address 0118 > > [ 420.30] pgd = c2ea4000 > > [ 420.30] [0118] *pgd= > > [ 420.30] Internal error: Oops: 5 [#1] ARM > > [ 420.30] Modules linked in: > > [ 420.30] CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted > > 4.8.0-rc2-next-20160819 #1 > > [ 420.30] Hardware name: Freescale MXS (Device Tree) > > [ 420.30] task: c349 task.stack: c348e000 > > [ 420.30] PC is at usb_hcd_irq+0x0/0x34 > > [ 420.30] LR is at ci_irq+0x58/0x12c > I am afraid the hcd is freed before the interrupt triggered. Would you > please try below changes: > > diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c > index 96ae695..61237a9 100644 > --- a/drivers/usb/chipidea/host.c > +++ b/drivers/usb/chipidea/host.c > @@ -103,7 +103,7 @@ static const struct ehci_driver_overrides > ehci_ci_overrides = { > static irqreturn_t host_irq(struct ci_hdrc *ci) > { > - return usb_hcd_irq(ci->irq, ci->hcd); > + return ci->hcd ? usb_hcd_irq(ci->irq, ci->hcd) : IRQ_NONE; > } This should not be needed. Instead, the driver should make sure that the interrupt handler has been fully unregistered before the hcd is deallocated. Alan Stern -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: usb: chipidea: hdc: kernel panic during shutdown
On Tue, Aug 23, 2016 at 09:17:02PM +0200, Stefan Wahren wrote: > Hi, > > i'm using a iMX233-OLinuXino board and the kernel panics during shutdown with > 4.8.0-rc2-next-20160819: > > [ 420.04] ci_hdrc ci_hdrc.0: remove, state 1 > [ 420.05] usb usb1: USB disconnect, device number 1 > [ 420.06] usb 1-1: USB disconnect, device number 2 > [ 420.06] usb 1-1.1: USB disconnect, device number 3 > [ 420.09] smsc95xx 1-1.1:1.0 eth0: unregister 'smsc95xx' > usb-ci_hdrc.0-1.1, > smsc95xx USB 2.0 Ethernet > [ 420.29] ci_hdrc ci_hdrc.0: USB bus 1 deregistered > [ 420.30] Unable to handle kernel NULL pointer dereference at virtual > address 0118 > [ 420.30] pgd = c2ea4000 > [ 420.30] [0118] *pgd= > [ 420.30] Internal error: Oops: 5 [#1] ARM > [ 420.30] Modules linked in: > [ 420.30] CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted > 4.8.0-rc2-next-20160819 #1 > [ 420.30] Hardware name: Freescale MXS (Device Tree) > [ 420.30] task: c349 task.stack: c348e000 > [ 420.30] PC is at usb_hcd_irq+0x0/0x34 > [ 420.30] LR is at ci_irq+0x58/0x12c > [ 420.30] pc : []lr : []psr: a093 > [ 420.30] sp : c348fd20 ip : c348fcd8 fp : c3704624 > [ 420.30] r10: c3708300 r9 : c3602010 r8 : 6013 > [ 420.30] r7 : 0094 r6 : 2013 r5 : c3549600 r4 : c3602010 > [ 420.30] r3 : 12a0 r2 : 0808 r1 : r0 : 0094 > [ 420.30] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment > none > [ 420.30] Control: 0005317f Table: 42ea4000 DAC: 0051 > [ 420.30] Process systemd-shutdow (pid: 1, stack limit = 0xc348e190) > [ 420.30] Stack: (0xc348fd20 to 0xc349) > [ 420.30] fd20: c3549610 c3549600 2013 c006bfac c3549600 > 0094 c3602010 > [ 420.30] fd40: c370e2e0 c36f4e80 c36f4e80 0005 c370e2e0 c006c098 > c348fd70 c3704410 > [ 420.30] fd60: c370e2e0 c039cd68 0005 a013 c36f4e00 c370e2e0 > a013 c039ce0c > [ 420.30] fd80: c354b844 c348fe5c c08d604c c3704624 c370e2e0 > 0001 c3704410 > [ 420.30] fda0: c08bc194 c08ad460 c354b844 c348fe5c c08d604c > be829c58 c03997e8 > [ 420.30] fdc0: c370 c3704410 c08ad460 c0399954 c3402a4c c3704410 > c08ad460 c0398d64 > [ 420.30] fde0: c3704410 c354b810 c112ebf4 c0396e2c c349 0007 > 0006 c348fe5c > [ 420.30] fe00: c3704400 c3704410 c354b810 c354b844 c348fe5c c039bb90 > c3704400 c3708090 > [ 420.30] fe20: c354b810 c039c118 c044941c c354b800 c044e6f8 > c354b810 c03a47fc > [ 420.30] fe40: c354b810 c354b410 c112ebf4 c039b578 c354b810 c0397410 > 0002 c08ad22c > [ 420.30] fe60: c342fa20 c354b81c 4321fedc c0866838 cdef0123 f3f82200 > c000a484 c348e000 > [ 420.30] fe80: c00427f4 4321fedc c0042a10 > c348fec8 0029 > [ 420.30] fea0: c2e2d488 c34b9c28 0002 c00690fc > c0132e0c > [ 420.30] fec0: be8291f8 0004 be829f8a 0010 > be829224 0005 > [ 420.30] fee0: be8292c4 000f 7f5fb9f8 0001 be828d3c c08629b4 > c348ffb0 00053177 > [ 420.30] ff00: 07ff 000f0f24 c2e2d480 > > [ 420.30] ff20: 0001 0029 c348fec8 > 0005 > [ 420.30] ff40: 0004001e 0005 be82924c 0005 be82924c > c348e000 > [ 420.30] ff60: 7f60e854 c0132f24 c348ff88 c2e2d480 c2e2d480 > c0132f70 > [ 420.30] ff80: c000a484 8102d190 8102c118 > 8102d190 8102c118 > [ 420.30] ffa0: 0058 c000a2e0 8102d190 fee1dead 28121969 > cdef0123 f3f82200 > [ 420.30] ffc0: 8102d190 8102c118 0058 be829bc4 > be829c58 > [ 420.30] ffe0: 7f60de4c be829b08 7f5ee114 b6e46088 6010 fee1dead > > [ 420.30] [] (usb_hcd_irq) from [] (0xc3549600) > [ 420.30] Code: c077a4d4 c08b802c c08b8040 c08b7fb0 (e5913118) > [ 420.30] ---[ end trace 5e83b1955a5bd084 ]--- > [ 420.62] systemd-shutdow: 2 output lines suppressed due to ratelimiting > [ 420.62] Kernel panic - not syncing: Attempted to kill init! > exitcode=0x000b > [ 420.62] > [ 420.62] ---[ end Kernel panic - not syncing: Attempted to kill init! > I am afraid the hcd is freed before the interrupt triggered. Would you please try below changes: diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c index 96ae695..61237a9 100644 --- a/drivers/usb/chipidea/host.c +++ b/drivers/usb/chipidea/host.c @@ -103,7 +103,7 @@ static const struct ehci_driver_overrides ehci_ci_overrides = { static irqreturn_t host_irq(struct ci_hdrc *ci) { - return usb_hcd_irq(ci->irq, ci->hcd); + return ci->hcd ? usb_hcd_irq(ci->irq, ci->hcd) : IRQ_NONE; } static int host_start(struct ci_hdrc *ci) --
usb: chipidea: hdc: kernel panic during shutdown
Hi, i'm using a iMX233-OLinuXino board and the kernel panics during shutdown with 4.8.0-rc2-next-20160819: [ 420.04] ci_hdrc ci_hdrc.0: remove, state 1 [ 420.05] usb usb1: USB disconnect, device number 1 [ 420.06] usb 1-1: USB disconnect, device number 2 [ 420.06] usb 1-1.1: USB disconnect, device number 3 [ 420.09] smsc95xx 1-1.1:1.0 eth0: unregister 'smsc95xx' usb-ci_hdrc.0-1.1, smsc95xx USB 2.0 Ethernet [ 420.29] ci_hdrc ci_hdrc.0: USB bus 1 deregistered [ 420.30] Unable to handle kernel NULL pointer dereference at virtual address 0118 [ 420.30] pgd = c2ea4000 [ 420.30] [0118] *pgd= [ 420.30] Internal error: Oops: 5 [#1] ARM [ 420.30] Modules linked in: [ 420.30] CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted 4.8.0-rc2-next-20160819 #1 [ 420.30] Hardware name: Freescale MXS (Device Tree) [ 420.30] task: c349 task.stack: c348e000 [ 420.30] PC is at usb_hcd_irq+0x0/0x34 [ 420.30] LR is at ci_irq+0x58/0x12c [ 420.30] pc : []lr : []psr: a093 [ 420.30] sp : c348fd20 ip : c348fcd8 fp : c3704624 [ 420.30] r10: c3708300 r9 : c3602010 r8 : 6013 [ 420.30] r7 : 0094 r6 : 2013 r5 : c3549600 r4 : c3602010 [ 420.30] r3 : 12a0 r2 : 0808 r1 : r0 : 0094 [ 420.30] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none [ 420.30] Control: 0005317f Table: 42ea4000 DAC: 0051 [ 420.30] Process systemd-shutdow (pid: 1, stack limit = 0xc348e190) [ 420.30] Stack: (0xc348fd20 to 0xc349) [ 420.30] fd20: c3549610 c3549600 2013 c006bfac c3549600 0094 c3602010 [ 420.30] fd40: c370e2e0 c36f4e80 c36f4e80 0005 c370e2e0 c006c098 c348fd70 c3704410 [ 420.30] fd60: c370e2e0 c039cd68 0005 a013 c36f4e00 c370e2e0 a013 c039ce0c [ 420.30] fd80: c354b844 c348fe5c c08d604c c3704624 c370e2e0 0001 c3704410 [ 420.30] fda0: c08bc194 c08ad460 c354b844 c348fe5c c08d604c be829c58 c03997e8 [ 420.30] fdc0: c370 c3704410 c08ad460 c0399954 c3402a4c c3704410 c08ad460 c0398d64 [ 420.30] fde0: c3704410 c354b810 c112ebf4 c0396e2c c349 0007 0006 c348fe5c [ 420.30] fe00: c3704400 c3704410 c354b810 c354b844 c348fe5c c039bb90 c3704400 c3708090 [ 420.30] fe20: c354b810 c039c118 c044941c c354b800 c044e6f8 c354b810 c03a47fc [ 420.30] fe40: c354b810 c354b410 c112ebf4 c039b578 c354b810 c0397410 0002 c08ad22c [ 420.30] fe60: c342fa20 c354b81c 4321fedc c0866838 cdef0123 f3f82200 c000a484 c348e000 [ 420.30] fe80: c00427f4 4321fedc c0042a10 c348fec8 0029 [ 420.30] fea0: c2e2d488 c34b9c28 0002 c00690fc c0132e0c [ 420.30] fec0: be8291f8 0004 be829f8a 0010 be829224 0005 [ 420.30] fee0: be8292c4 000f 7f5fb9f8 0001 be828d3c c08629b4 c348ffb0 00053177 [ 420.30] ff00: 07ff 000f0f24 c2e2d480 [ 420.30] ff20: 0001 0029 c348fec8 0005 [ 420.30] ff40: 0004001e 0005 be82924c 0005 be82924c c348e000 [ 420.30] ff60: 7f60e854 c0132f24 c348ff88 c2e2d480 c2e2d480 c0132f70 [ 420.30] ff80: c000a484 8102d190 8102c118 8102d190 8102c118 [ 420.30] ffa0: 0058 c000a2e0 8102d190 fee1dead 28121969 cdef0123 f3f82200 [ 420.30] ffc0: 8102d190 8102c118 0058 be829bc4 be829c58 [ 420.30] ffe0: 7f60de4c be829b08 7f5ee114 b6e46088 6010 fee1dead [ 420.30] [] (usb_hcd_irq) from [] (0xc3549600) [ 420.30] Code: c077a4d4 c08b802c c08b8040 c08b7fb0 (e5913118) [ 420.30] ---[ end trace 5e83b1955a5bd084 ]--- [ 420.62] systemd-shutdow: 2 output lines suppressed due to ratelimiting [ 420.62] Kernel panic - not syncing: Attempted to kill init! exitcode=0x000b [ 420.62] [ 420.62] ---[ end Kernel panic - not syncing: Attempted to kill init! I will try to bisect this issue. Regards Stefan -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html