2.4.21-rc2 kernel panic USB sched.c:564

When Attempting to sync a Handspring Visor (PalmOS USB device), I sometimes (about 1 time out of 4) get the following panic.

--

Scheduling in interrupt
kernel BUG at sched.c:564!

invalid operand: 0000
CPU:    0
EIP:    0010:[<c0117811>]    Tainted: PF
EFLAGS: 00010286
eax: 00000018   ebx: d8c90ce0   ecx: dd1ba000   edx: dd1bbf7c
esi: c02b6000   edi: d8c90ce8   epb: c02b7d7c   esp: c02b7d54
ds: 0018   es: 0018   ss: 0018
Process swapper (pid: 0, stackpage=c02b7000) 
Stack: c024d76a de13d980 dfca2680 e1da294f c02b6000 00000000 01a6010b d8c90ce0
       c02b6000 d8c90ce8 c02b7d84 c0107c4a 00000001 c02b6000 d8c90ce8 d8c90ce8
       d8c90c88 d8c90ce0 d8c90c00 ffffffea c0107da4 d8c90ce0 d8c90c00 ffffffed
Call Trace:    [<e1da294f>] [<c0107c4a>] [<c0107da4>] [<e3235a73>] [<e3235c08>]
  [<c0176122>] [<c0177ded>] [<c0176bc7>] [<c0185623>] [<c0184925>] [<e1c45b10>]

...

Code: 0f 0b 34 02 62 d7 24 c0 e9 09 fd ff ff 0f 0b 2d 02 62 d7 24
 <0>Kernel panic: Aiee, killing interrupt handler!

In interrupt handler - not syncing

--

# lspci -vvv
00:00.0 Host bridge: Intel Corp. 82845 845 (Brookdale) Chipset Host Bridge (rev 04)
        Subsystem: Toshiba America Info Systems: Unknown device 0001
        Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
        Status: Cap+ 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ >SERR- <PERR-
        Latency: 0
        Region 0: Memory at e0000000 (32-bit, prefetchable) [size=256M]
        Capabilities: [e4] #09 [d104]
        Capabilities: [a0] AGP version 2.0
                Status: RQ=31 SBA+ 64bit- FW+ Rate=x1,x2,x4
                Command: RQ=0 SBA- AGP+ 64bit- FW- Rate=x4

00:01.0 PCI bridge: Intel Corp. 82845 845 (Brookdale) Chipset AGP Bridge (rev 04) (prog-if 00 [Normal decode])
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap- 66Mhz+ UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Latency: 64
Bus: primary=00, secondary=01, subordinate=01, sec-latency=64
I/O behind bridge: 0000f000-00000fff
Memory behind bridge: fd000000-fdffffff
Prefetchable memory behind bridge: d7f00000-dfffffff
BridgeCtl: Parity- SERR- NoISA- VGA+ MAbort- >Reset- FastB2B-

00:1d.0 USB Controller: Intel Corp. 82801CA/CAM USB (Hub #1) (rev 02) (prog-if 00 [UHCI])
Subsystem: Toshiba America Info Systems: Unknown device 0001
Control: I/O+ Mem- BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap- 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Latency: 0
Interrupt: pin A routed to IRQ 11
Region 4: I/O ports at efe0 [size=32]

00:1d.1 USB Controller: Intel Corp. 82801CA/CAM USB (Hub #2) (rev 02) (prog-if 00 [UHCI])
Subsystem: Toshiba America Info Systems: Unknown device 0001
Control: I/O+ Mem- BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap- 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Latency: 0
Interrupt: pin B routed to IRQ 7
Region 4: I/O ports at ef80 [size=32]

00:1d.2 USB Controller: Intel Corp. 82801CA/CAM USB (Hub #3) (rev 02) (prog-if 00 [UHCI])
Subsystem: Toshiba America Info Systems: Unknown device 0001
Control: I/O+ Mem- BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap- 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Latency: 0
Interrupt: pin C routed to IRQ 6
Region 4: I/O ports at 1000 [size=32]

00:1e.0 PCI bridge: Intel Corp. 82801BAM/CAM PCI Bridge (rev 42) (prog-if 00 [Normal decode])
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap- 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Latency: 0
Bus: primary=00, secondary=02, subordinate=05, sec-latency=64
I/O behind bridge: 0000d000-0000dfff
Memory behind bridge: fce00000-fcefffff
Prefetchable memory behind bridge: fff00000-000fffff
BridgeCtl: Parity- SERR- NoISA- VGA- MAbort- >Reset- FastB2B-

00:1f.0 ISA bridge: Intel Corp. 82801CAM ISA Bridge (LPC) (rev 02)
Control: I/O+ Mem+ BusMaster+ SpecCycle+ MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap- 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Latency: 0

00:1f.1 IDE interface: Intel Corp. 82801CAM IDE U100 (rev 02) (prog-if 8a [Master SecP PriP])
Subsystem: Toshiba America Info Systems: Unknown device 0001
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap- 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Latency: 0
Interrupt: pin A routed to IRQ 6
Region 0: I/O ports at <ignored>
Region 1: I/O ports at <ignored>
Region 2: I/O ports at <ignored>
Region 3: I/O ports at <ignored>
Region 4: I/O ports at cfa0 [size=16]
Region 5: Memory at 20000000 (32-bit, non-prefetchable) [size=1K]

00:1f.5 Multimedia audio controller: Intel Corp. 82801CA/CAM AC'97 Audio (rev 02)
Subsystem: Toshiba America Info Systems: Unknown device 0002
Control: I/O+ Mem- BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap- 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Latency: 0
Interrupt: pin B routed to IRQ 11
Region 0: I/O ports at 1400 [size=256]
Region 1: I/O ports at 1040 [size=64]

00:1f.6 Modem: Intel Corp. 82801CA/CAM AC'97 Modem (rev 02) (prog-if 00 [Generic])
Subsystem: Toshiba America Info Systems: Unknown device 0001
Control: I/O+ Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap- 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Interrupt: pin B routed to IRQ 11
Region 0: I/O ports at 1800 [size=256]
Region 1: I/O ports at 1080 [size=128]

01:00.0 VGA compatible controller: nVidia Corporation NV17 [GeForce4 440 Go] (rev a3) (prog-if 00 [VGA])
Subsystem: Toshiba America Info Systems: Unknown device 0001
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap+ 66Mhz+ UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Latency: 248 (1250ns min, 250ns max)
Interrupt: pin A routed to IRQ 5
Region 0: Memory at fd000000 (32-bit, non-prefetchable) [size=16M]
Region 1: Memory at d8000000 (32-bit, prefetchable) [size=128M]
Region 2: Memory at d7f80000 (32-bit, prefetchable) [size=512K]
Expansion ROM at <unassigned> [disabled] [size=128K]
Capabilities: [60] Power Management version 2
Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
Status: D0 PME-Enable- DSel=0 DScale=0 PME-
Capabilities: [44] AGP version 2.0
Status: RQ=31 SBA- 64bit- FW+ Rate=x1,x2,x4
Command: RQ=31 SBA- AGP+ 64bit- FW- Rate=x4

02:07.0 FireWire (IEEE 1394): Texas Instruments TSB43AB22/A IEEE-1394a-2000 Controller (PHY/Link) (prog-if 10 [OHCI])
Subsystem: Toshiba America Info Systems: Unknown device 0001
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap+ 66Mhz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Latency: 64 (500ns min, 1000ns max)
Interrupt: pin A routed to IRQ 11
Region 0: [virtual] Memory at 20000800 (32-bit, non-prefetchable) [size=2K]
Region 1: [virtual] Memory at 20004000 (32-bit, non-prefetchable) [size=16K]
Capabilities: [44] Power Management version 2
Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=55mA PME(D0+,D1+,D2+,D3hot+,D3cold+)
Status: D0 PME-Enable- DSel=0 DScale=0 PME-

02:08.0 Ethernet controller: Intel Corp. 82801CAM (ICH3) PRO/100 VE (LOM) Ethernet Controller (rev 42)
Subsystem: Toshiba America Info Systems EtherExpress PRO/100 VE
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap+ 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Latency: 64 (2000ns min, 14000ns max), cache line size 08
Interrupt: pin A routed to IRQ 4
Region 0: Memory at fceff000 (32-bit, non-prefetchable) [size=4K]
Region 1: I/O ports at df40 [size=64]
Capabilities: [dc] Power Management version 2
Flags: PMEClk- DSI+ D1+ D2+ AuxCurrent=0mA PME(D0+,D1+,D2+,D3hot+,D3cold+)
Status: D0 PME-Enable- DSel=0 DScale=2 PME-

02:0b.0 CardBus bridge: Toshiba America Info Systems ToPIC95 PCI to Cardbus Bridge with ZV Support (rev 32)

        Subsystem: Toshiba America Info Systems: Unknown device 0001
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
        Status: Cap+ 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=slow >TAbort- <TAbort- <MAbort- >SERR- <PERR-
        Latency: 168
        Interrupt: pin A routed to IRQ 11
        Region 0: Memory at 20001000 (32-bit, non-prefetchable) [size=4K]
        Bus: primary=02, secondary=04, subordinate=04, sec-latency=0
        Memory window 0: 20400000-207ff000 (prefetchable)
        Memory window 1: 20800000-20bff000
        I/O window 0: 00004000-000040ff
        I/O window 1: 00004400-000044ff
        BridgeCtl: Parity- SERR- ISA- VGA- MAbort- >Reset- 16bInt+ PostWrite+
        16-bit legacy interface ports at 0001

02:0b.1 CardBus bridge: Toshiba America Info Systems ToPIC95 PCI to Cardbus Bridge with ZV Support (rev 32)

        Subsystem: Toshiba America Info Systems: Unknown device 0001
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
        Status: Cap+ 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=slow >TAbort- <TAbort- <MAbort- >SERR- <PERR-
        Latency: 168
        Interrupt: pin B routed to IRQ 11
        Region 0: Memory at 20002000 (32-bit, non-prefetchable) [size=4K]
        Bus: primary=02, secondary=05, subordinate=05, sec-latency=0
        Memory window 0: 20c00000-20fff000 (prefetchable)
        Memory window 1: 21000000-213ff000
        I/O window 0: 00004800-000048ff
        I/O window 1: 00004c00-00004cff
        BridgeCtl: Parity- SERR- ISA- VGA- MAbort- >Reset- 16bInt+ PostWrite+
        16-bit legacy interface ports at 0001

02:0c.0 System peripheral: Toshiba America Info Systems TC6371AF SmartMedia Controller (rev 03)
Subsystem: Toshiba America Info Systems: Unknown device 0001
Control: I/O- Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap+ 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=slow >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Interrupt: pin B routed to IRQ 11
Region 0: Memory at 20000400 (32-bit, non-prefetchable) [disabled] [size=32]
Capabilities: [80] Power Management version 2
Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=0mA PME(D0+,D1+,D2+,D3hot+,D3cold+)
Status: D3 PME-Enable- DSel=0 DScale=0 PME-

02:0d.0 System peripheral: Toshiba America Info Systems SD TypA Controller (rev 03)
Subsystem: Toshiba America Info Systems: Unknown device 0001
Control: I/O- Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B-
Status: Cap+ 66Mhz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Interrupt: pin A routed to IRQ 11
Region 0: Memory at 20000600 (32-bit, non-prefetchable) [disabled] [size=512]
Capabilities: [80] Power Management version 2
Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=0mA PME(D0+,D1+,D2+,D3hot+,D3cold+)
Status: D3 PME-Enable- DSel=0 DScale=0 PME-

can you run that oops through ksymoops so that we can see where it died at?

thanks,

greg k-h

Here you go:

ksymoops 2.4.5 on i686 2.4.21-rc2. Options used
-V (default)
-k /proc/ksyms (default)
-l /proc/modules (default)
-o /lib/modules/2.4.21-rc2/ (default)
-m /boot/System.map-2.4.21-rc2 (default)

Warning: You did not tell me where to find symbol information. I will assume that the log matches the kernel and modules that are running right now and I'll use the default options above for symbol resolution. If the current kernel and/or modules do not match the log, you can get more accurate output by telling me the kernel version and where to find map, modules, ksyms etc. ksymoops -h explains the options.

Error (expand_objects): cannot stat(/lib/ext3.o) for ext3
ksymoops: No such file or directory
Error (expand_objects): cannot stat(/lib/jbd.o) for jbd
ksymoops: No such file or directory
Warning (map_ksym_to_module): cannot match loaded module ext3 to a unique module object. Trace may not be reliable. kernel BUG at sched.c:564!

invalid operand: 0000
CPU:    0
EIP:    0010:[<c0117811>]    Tainted: PF

Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010286
eax: 00000018 ebx: d8c90ce0 ecx: dd1ba000 edx: dd1bbf7c
esi: c02b6000 edi: d8c90ce8 epb: c02b7d7c esp: c02b7d54
Warning (Oops_set_regs): garbage 'epb: c02b7d7c esp: c02b7d54 ' at end of register line ignored
ds: 0018 es: 0018 ss: 0018
Process swapper (pid: 0, stackpage=c02b7000) Stack: c024d76a de13d980 dfca2680 e1da294f c02b6000 00000000 01a6010b d8c90ce0

       c02b6000 d8c90ce8 c02b7d84 c0107c4a 00000001 c02b6000 d8c90ce8
       d8c90ce8 d8c90c88 d8c90ce0 d8c90c00 ffffffea c0107da4 d8c90ce0
       d8c90c00 ffffffed
Call Trace:    [<e1da294f>] [<c0107c4a>] [<c0107da4>] [<e3235a73>] [<e3235c08>]
  [<c0176122>] [<c0177ded>] [<c0176bc7>] [<c0185623>] [<c0184925>] [<e1c45b10>]
  [<c01755e0>] [<e323a9b2>] [<e323c36a>] [<e1c47de5>] [<e1c47f57>] [<c010a625>]
  [<c010a7c4>] [<c0107040>] [<c010ce98>] [<c0107040>] [<c0107063>] [<c01070f2>]
  [<c0105000>]
Code: 0f 0b 34 02 62 d7 24 c0 e9 09 fd ff ff 0f 0b 2d 02 62 d7 24

Trace; e1da294f <[e100].data.end+104d0/12be1> Trace; c0107c4a <__down+6a/b0>
Trace; c0107da4 <__down_failed+8/c>
Trace; e3235a73 <END_OF_CODE+fbff8c/????> Trace; e3235c08 <END_OF_CODE+fc0121/????> Trace; c0176122 <opost+22/1b0>
Trace; c0177ded <n_tty_receive_char+17d/750> Trace; c0176bc7 <n_tty_receive_buf+247/4d0> Trace; c0185623 <poke_blanked_console+53/70> Trace; c0184925 <vt_console_print+225/310> Trace; e1c45b10 <[usb-uhci]uhci_clean_transfer+120/1c0> Trace; c01755e0 <flush_to_ldisc+c0/f0>
Trace; e323a9b2 <END_OF_CODE+fc4ecb/????> Trace; e323c36a <END_OF_CODE+fc6883/????> Trace; e1c47de5 <[usb-uhci]process_urb+185/260> Trace; e1c47f57 <[usb-uhci]uhci_interrupt+97/170> Trace; c010a625 <handle_IRQ_event+45/70> Trace; c010a7c4 <do_IRQ+84/f0>
Trace; c0107040 <default_idle+0/40>
Trace; c010ce98 <call_do_IRQ+5/d>
Trace; c0107040 <default_idle+0/40>
Trace; c0107063 <default_idle+23/40>
Trace; c01070f2 <cpu_idle+52/70>
Trace; c0105000 <_stext+0/0>

Code; c0117811 <schedule+331/350>
00000000 <_EIP>:
Code; c0117811 <schedule+331/350> <=====
0: 0f 0b ud2a <=====
Code; c0117813 <schedule+333/350>
2: 34 02 xor $0x2,%al
Code; c0117815 <schedule+335/350>
4: 62 d7 bound %edx,%edi
Code; c0117817 <schedule+337/350>
6: 24 c0 and $0xc0,%al
Code; c0117819 <schedule+339/350>
8: e9 09 fd ff ff jmp fffffd16 <_EIP+0xfffffd16>
Code; c011781e <schedule+33e/350>
d: 0f 0b ud2a
Code; c0117820 <schedule+340/350>
f: 2d 02 62 d7 24 sub $0x24d76202,%eax

<0>Kernel panic: Aiee, killing interrupt handler!

3 warnings and 2 errors issued. Results may not be reliable.

Does the same thing happen if you use the uhci.o driver instead of the usb-uhci.o driver?

thanks,

greg k-h

I replaced usb-uhci with uhci, and tried to recreate the problem. While this is easily recreated with usb-uhci, even after 30 attempts uhci operated without error.

It definitely appears to be a problem with usb-uhci.

Mace

Great, I'd recommend sticking with uhci then :)

Glad it's working for you,

greg k-h