kern/48383: unplugging USB hub from xhci port causes panic

[Takahiro HAYASHI <t-hash%abox3.so-net.ne.jp@localhost>]

>Number:         48383
>Category:       kern
>Synopsis:       unplugging USB hub from xhci port causes panic
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 17 14:05:00 +0000 2013
>Originator:     Takahiro HAYASHI
>Release:        NetBSD 6.99.27
>Organization:
>Environment:
System: NetBSD  6.99.27 NetBSD 6.99.27 (UNIONLKDBG) #0: Sat Nov 16 09:01:19 JST 
2013  root@halt:/build/head/obj.amd64/sys/arch/amd64/compile/UNIONLKDBG amd64
Architecture: x86_64
Machine: amd64
>Description:
        Kernel panics "locking against myself" when unplugging
        USB hub from xhci port.

(plug uhub into xhci port)

xhci0: port 4 status change
xhci0: hs port 2 status change
xhci0: port 4 status change
xhci0: hs port 2 status change
xhci0: xhci_new_device up 0xfffffe810763e958 portno 2
xhci0: xhci_new_device hub 0xfffffe813f35b490
xhci0: xhci_new_device hub 0xfffffe81075c81d0
xhci0: xhci_new_device hub 0x0
xhci0: xhci_new_device rhport 4
xhci0: xhci_open addr 0 depth 1 port 2 speed 3
xhci0: xhci_do_command input: 0x0000000000000000 0x00000000 0x00002400
xhci0: xhci_do_command output: 0x00000001075ff000 0x01000000 0x01008401
xhci0: dcbaa 0xffff800048bd3008 dc 0000000107735000 slot 1
xhci0: xhci_do_command input: 0x0000000107736000 0x00000000 0x01002c00
xhci0: xhci_do_command output: 0x00000001075ff010 0x01000000 0x01008401
xhci0: xhci_new_device device address 1
xhci0: xhci_new_device bMaxPacketSize 64
xhci0: xhci_update_ep0_mps
xhci0: xhci_do_command input: 0x0000000107736000 0x00000000 0x01003400
xhci0: xhci_do_command output: 0x00000001075ff020 0x01000000 0x01008401
xhci0: xhci_open addr 1 depth 1 port 2 speed 3
uhub6 at uhub0 port 2: NEC 2.0 hub, class 9/0, rev 2.00/1.00, addr 1
uhub6: single transaction translator
xhci0: xhci_open addr 1 depth 1 port 2 speed 3
xhci0: xhci_configure_endpoint dci 3 (0x81)
xhci0: xhci_do_command input: 0x0000000107736000 0x00000000 0x01003000
xhci0: xhci_do_command output: 0x00000001075ff030 0x01000000 0x01008401

(here unplug it)

xhci0: port 4 status change
xhci0: hs port 2 status change
xhci0: xhci_device_intr_done 0xfffffe81077a5a00 slot 1 dci 3
xhci0: xhci_device_intr_abort 0xfffffe81077a5a00
Mutex error: lockdebug_wantlock: locking against myself

lock address : 0xfffffe81075144e0 type     :     sleep/adaptive
initialized  : 0xffffffff8047c314
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  1
current cpu  :                  0 last held:                  0
current lwp  : 0xfffffe810781c5c0 last held: 0xfffffe810781c5c0
last locked* : 0xffffffff803f97d1 unlocked : 0xffffffff803f91e3
owner field  : 0xfffffe810781c5c0 wait/spin:                0/0

Turnstile chain at 0xffffffff806cf280.
=> No active turnstile for this lock.

panic: LOCKDEBUG: Mutex error: lockdebug_wantlock: locking against myself
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff8015716d cs 8 rflags 246 cr2 ffff800048c0c000 
ilevel 0 rsp fffffe8001373900
curlwp 0xfffffe810781c5c0 pid 0.40 lowest kstack 0xfffffe8001370000
Stopped in pid 0.40 (system) at netbsd:breakpoint+0x5:  leave
db{0}> bt
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0x136
printf_nolog() at netbsd:printf_nolog
lockdebug_more() at netbsd:lockdebug_more
mutex_enter() at netbsd:mutex_enter+0x43c
xhci_device_intr_abort() at netbsd:xhci_device_intr_abort+0x52
usbd_abort_pipe() at netbsd:usbd_abort_pipe+0x4d
uhub_detach() at netbsd:uhub_detach+0x92
config_detach() at netbsd:config_detach+0xda
usb_disconnect_port() at netbsd:usb_disconnect_port+0xaa
uhub_explore() at netbsd:uhub_explore+0x1ab
usb_discover.clone.0() at netbsd:usb_discover.clone.0+0x4e
usb_event_thread() at netbsd:usb_event_thread+0x74
db{0}>


>How-To-Repeat:
        plug USB hub into xhci port and then unplug it.
        Both 2.0 and 3.0 hub can cause panic.

>Fix:
        No idea.

--
t-hash