New: thunderbolt: hard system freeze from repeated DP tunnel activation failures (LG UltraFine 5K dual-tile + active TB3 cable, Meteor Lake-P)

https://bugzilla.kernel.org/show_bug.cgi?id=221633

Bug ID: 221633
Summary: thunderbolt: hard system freeze from repeated DP
tunnel activation failures (LG UltraFine 5K dual-tile
+ active TB3 cable, Meteor Lake-P)
Product: Drivers
Version: 2.5
Hardware: Intel
OS: Linux
Status: NEW
Severity: high
Priority: P3
Component: USB
Assignee: [email protected]
Reporter: [email protected]
Regression: No

SUMMARY

Connecting an LG UltraFine 5K (dual-tile Thunderbolt 3 display, internal Titan Ridge JHL7540) to a Meteor Lake-P host with the display's stock active TB3 cable causes the TB link to flap in a tight loop (connect -> tunnel activation failures -> disconnect, every ~3 s). After seconds to minutes of this churn the machine hard-freezes (no oops reaches the journal, no pstore record; only a power cycle recovers it).

Reproduced on two kernels:
- 6.17.0-35-generic (Ubuntu 24.04 HWE) - froze twice
- 6.19.14 mainline (kernel.ubuntu.com build) - froze once; additionally emits a repeating WARN at drivers/thunderbolt/path.c:589 in tb_path_activate()

A freeze triggered by a misbehaving/marginal external device + cable is still a host-side robustness bug: hotplug churn should never take down the machine.

HARDWARE

- Host: Lenovo ThinkPad T14 Gen 5 (21MLCTO1WW), BIOS N47ET28W (1.17), 12/05/2025
- TB controller: Intel Meteor Lake-P Thunderbolt 4 NHI #0/#1 [8086:7ec2 / 8086:7ec3]
- Display: LG UltraFine 5K (TB vendor 0x1e, device 0x1114; internal Intel JHL7540 Titan Ridge bridge [8086:15ef]); dual-tile 2x 2560x2880
- Cable: LG's bundled active TB3 cable (trigger); reproduced with two different LG cables and three different UltraFine 5K units, on both host TB ports
- Secure Boot disabled; no out-of-tree modules

FAILURE SIGNATURE (each ~3 s cycle)

thunderbolt 0-1: new device found, vendor=0x1e device=0x1114 thunderbolt 0-1: LG Electronics UltraFine 5K
thunderbolt 0000:00:0d.2: 1: failed to enable CL states thunderbolt 0000:00:0d.2: 1:1: hop deactivation failed for hop 1, index 8 thunderbolt 0000:00:0d.2: PCIe Down path activation failed: -107 thunderbolt 0000:00:0d.2: 0:8 <-> 1:8 (PCI): activation failed thunderbolt 0000:00:0d.2: 1:8: PCIe tunnel activation failed, aborting thunderbolt 0000:00:0d.2: 1:10: DP tunnel activation failed, aborting thunderbolt 0-1: device disconnected

The 6.19.14 boot that froze contains 84 "DP tunnel activation failed" lines in ~21 minutes. Other recurring messages:

thunderbolt 0000:00:0d.2: 0:5 <-> 1:10 (DP): not enough bandwidth available thunderbolt 0000:00:0d.2: 0:5: timeout waiting for DPTX request to clear thunderbolt 0000:00:0d.2: 0:5 <-> 1:10 (DP): failed to change bandwidth allocation
thunderbolt 0-0:1.1: failed to add NVM devices: -19
i915 0000:00:02.0: [drm] *ERROR* [CONNECTOR:280:DP-1][ENCODER:279:DDI TC1/PHY TC1][DPRX] Can't reduce link training parameters after failure

WARN ON 6.19.14 (repeats on every flap cycle)

WARNING: drivers/thunderbolt/path.c:589 at tb_path_activate+0x118/0x540
[thunderbolt]
Workqueue: thunderbolt0 tb_handle_hotplug [thunderbolt]
RIP: 0010:tb_path_activate+0x121/0x540 [thunderbolt]
 tb_tunnel_activate+0xba/0x2e0 [thunderbolt]
 tb_tunnel_one_dp+0x29d/0x3b0 [thunderbolt]
 tb_tunnel_dp+0xbb/0x300 [thunderbolt]
 tb_dp_resource_available+0xda/0x250 [thunderbolt]
 tb_handle_hotplug+0x429/0x770 [thunderbolt]

The same WARN also fires via tb_domain_approve_switch / authorized_store (boltd authorization path) - full splat attached.

After many plug cycles the Type-C side also corrupts:

sysfs: cannot create duplicate filename '/devices/platform/USBC000:00/typec/port1/port1.2/partner' typec_displayport port1-partner.1: probe with driver typec_displayport failed with error -17

FREEZE TIMELINE (6.19.14)

- 09:01:18 LG connected, DP tunnel "not enough bandwidth", flap loop resumes
- 09:01:46 last journal line (thunderbolt 0-1: device disconnected)
- Machine completely unresponsive (UI, keyboard); no oops/panic captured; hard power-off required. Same pattern on 6.17.0-35 (froze 08:17 same day).

WORKAROUNDS TESTED (no effect)

- thunderbolt.clx=0 - removes "failed to enable CL states", tunnels still fail
- thunderbolt.bw_alloc_mode=0 - no change
- Both host TB ports, multiple LG cables/units - identical behaviour

WHAT WORKS (isolation data)

- Same LG display + certified TB4/USB4 cable (Apple Thunderbolt cable): link comes up at 40 Gb/s and is fully stable - dual-tile 5K, PCIe tunnel (display's JHL7540 + xHCI visible), no errors. So the trigger is the active TB3 cable + Meteor Lake USB4 host combination.
- Apple Studio Display works flawlessly on the same host - including through the LG active TB3 cable. The flap only occurs with LG display + LG cable.
- The LG display + LG cable combination works normally on macOS hosts.

EXPECTED BEHAVIOUR

Repeated tunnel activation failures from a marginal link should result in the device being dropped/ignored (rate-limited retries), not an unbounded connect/teardown loop that eventually hard-freezes the host.

Full kernel logs from both freeze boots, the complete WARN splat and lspci inventory are attached. Happy to test patches or provide further debug output (thunderbolt.dyndbg). Bisection between 6.17 and 6.19 is not possible since both fail.

You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.kernel.org/show_bug.cgi?id=221633

--- Comment #1 from Allan Petersen ([email protected]) --- Created attachment 310289
--> https://bugzilla.kernel.org/attachment.cgi?id=310289&action=edit
Full kernel log, freeze boot #2 (mainline 6.19.14, incl. tb_path_activate WARNs)

You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.kernel.org/show_bug.cgi?id=221633

--- Comment #2 from Allan Petersen ([email protected]) --- Created attachment 310292
--> https://bugzilla.kernel.org/attachment.cgi?id=310292&action=edit
Full kernel log, freeze boot #1 (Ubuntu 6.17.0-35-generic)

You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.kernel.org/show_bug.cgi?id=221633

--- Comment #3 from Allan Petersen ([email protected]) --- Created attachment 310293
--> https://bugzilla.kernel.org/attachment.cgi?id=310293&action=edit
Complete WARN backtrace, drivers/thunderbolt/path.c:589 tb_path_activate (6.19.14)

You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.kernel.org/show_bug.cgi?id=221633

--- Comment #4 from Allan Petersen ([email protected]) --- Created attachment 310294
--> https://bugzilla.kernel.org/attachment.cgi?id=310294&action=edit
lspci -nn: host TB4 controllers + display's Titan Ridge bridge/xHCI (working session)

You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.kernel.org/show_bug.cgi?id=221633

Mika Westerberg ([email protected]) changed:

What |Removed |Added
----------------------------------------------------------------------------

                 CC|                            |[email protected]
                   |                            |.com

--- Comment #5 from Mika Westerberg ([email protected]) --- Drop pcie_aspm=off from the command line and see if that helps. That flag disables pretty much whole native PCIe.

You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.