Re: Hitting "unused qh not empty" BUG in qh_destroy

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 16 Sep 2014, Joe Lawrence wrote:

> > Anyway, the log above means that a QH was linked before the HC died,
> > but then it was never unlinked.  Please add a line at the start of
> > ehci_endpoint_disable, printing out the value of ep->hcpriv for
> > comparison with the values listed above.
> 
> Will do.
> 
> > Also, let's see the contents of *qh and *(qh->hw) for the left-over QH
> > at *(ehci->async->qh_next.qh).  You can get those right away from your 
> > crash dump data, right?
> 
> Yep, interestingly enough, *(ehci->async->qh_next.qh) appears to be
> mostly full of zeros:

> crash> struct ehci_qh 0xffff88083d6b4558         << *(ehci->async->qh_next.qh)
> struct ehci_qh {
>   hw = 0x0,
>   qh_dma = 0x0, 
>   qh_next = {
>     qh = 0x0, 
>     itd = 0x0, 
>     sitd = 0x0, 
>     fstn = 0x0, 
>     hw_next = 0x0, 
>     ptr = 0x0
>   }, 
>   qtd_list = {
>     next = 0x0, 
>     prev = 0x0
>   }, 
>   intr_node = {
>     next = 0x0, 
>     prev = 0x0
>   }, 
>   dummy = 0x0, 
>   unlink_node = {
>     next = 0x0, 
>     prev = 0x0
>   }, 
>   unlink_cycle = 0x6, 
>   qh_state = 0x0, 
>   xacterrs = 0x0, 
>   usecs = 0x0, 
>   gap_uf = 0x0, 
>   c_usecs = 0x0, 
>   tt_usecs = 0x0, 
>   period = 0x0, 
>   start = 0x0, 
>   dev = 0x6, 
>   is_out = 0x0, 
>   clearing_tt = 0x0, 
>   dequeue_during_giveback = 0x0, 
>   exception = 0x0
> }

So this QH was destroyed properly, but somehow the link pointer in
ehci->async continued to point at it.  And it got destroyed without
passing through single_unlink_async.

Maybe you should also add a check at the end of ehci_endpoint_disable, 
just before the done: label.  For example,

	BUG_ON(ehci->async->qh_next.qh == qh);

Then if you really want to be thorough, in single_unlink_async, just
after the "while" loop, print the values of prev, prev->qh_next.qh, qh,
and qh->qh_next.qh.  And in qh_link_async, just after the wmb(), print
the values of head->qh_next.qh and qh.  (This could end up generating
quite a lot of output...)

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux