[Bug 221633] New: thunderbolt: hard system freeze from repeated DP tunnel activation failures (LG UltraFine 5K dual-tile + active TB3 cable, Meteor Lake-P)

[bugzilla-daemon@kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=221633

            Bug ID: 221633
           Summary: thunderbolt: hard system freeze from repeated DP
                    tunnel activation failures (LG UltraFine 5K dual-tile
                    + active TB3 cable, Meteor Lake-P)
           Product: Drivers
           Version: 2.5
          Hardware: Intel
                OS: Linux
            Status: NEW
          Severity: high
          Priority: P3
         Component: USB
          Assignee: drivers_usb@kernel-bugs.kernel.org
          Reporter: allan.petersen@vocast.com
        Regression: No

SUMMARY

Connecting an LG UltraFine 5K (dual-tile Thunderbolt 3 display, internal Titan
Ridge JHL7540) to a Meteor Lake-P host with the display's stock active TB3
cable causes the TB link to flap in a tight loop (connect -> tunnel activation
failures -> disconnect, every ~3 s). After seconds to minutes of this churn the
machine hard-freezes (no oops reaches the journal, no pstore record; only a
power cycle recovers it).

Reproduced on two kernels:
- 6.17.0-35-generic (Ubuntu 24.04 HWE) - froze twice
- 6.19.14 mainline (kernel.ubuntu.com build) - froze once; additionally emits a
repeating WARN at drivers/thunderbolt/path.c:589 in tb_path_activate()

A freeze triggered by a misbehaving/marginal external device + cable is still a
host-side robustness bug: hotplug churn should never take down the machine.

HARDWARE

- Host: Lenovo ThinkPad T14 Gen 5 (21MLCTO1WW), BIOS N47ET28W (1.17),
12/05/2025
- TB controller: Intel Meteor Lake-P Thunderbolt 4 NHI #0/#1 [8086:7ec2 /
8086:7ec3]
- Display: LG UltraFine 5K (TB vendor 0x1e, device 0x1114; internal Intel
JHL7540 Titan Ridge bridge [8086:15ef]); dual-tile 2x 2560x2880
- Cable: LG's bundled active TB3 cable (trigger); reproduced with two different
LG cables and three different UltraFine 5K units, on both host TB ports
- Secure Boot disabled; no out-of-tree modules

FAILURE SIGNATURE (each ~3 s cycle)

thunderbolt 0-1: new device found, vendor=0x1e device=0x1114
thunderbolt 0-1: LG Electronics UltraFine 5K
thunderbolt 0000:00:0d.2: 1: failed to enable CL states
thunderbolt 0000:00:0d.2: 1:1: hop deactivation failed for hop 1, index 8
thunderbolt 0000:00:0d.2: PCIe Down path activation failed: -107
thunderbolt 0000:00:0d.2: 0:8 <-> 1:8 (PCI): activation failed
thunderbolt 0000:00:0d.2: 1:8: PCIe tunnel activation failed, aborting
thunderbolt 0000:00:0d.2: 1:10: DP tunnel activation failed, aborting
thunderbolt 0-1: device disconnected

The 6.19.14 boot that froze contains 84 "DP tunnel activation failed" lines in
~21 minutes. Other recurring messages:

thunderbolt 0000:00:0d.2: 0:5 <-> 1:10 (DP): not enough bandwidth available
thunderbolt 0000:00:0d.2: 0:5: timeout waiting for DPTX request to clear
thunderbolt 0000:00:0d.2: 0:5 <-> 1:10 (DP): failed to change bandwidth
allocation
thunderbolt 0-0:1.1: failed to add NVM devices: -19
i915 0000:00:02.0: [drm] *ERROR* [CONNECTOR:280:DP-1][ENCODER:279:DDI TC1/PHY
TC1][DPRX] Can't reduce link training parameters after failure

WARN ON 6.19.14 (repeats on every flap cycle)

WARNING: drivers/thunderbolt/path.c:589 at tb_path_activate+0x118/0x540
[thunderbolt]
Workqueue: thunderbolt0 tb_handle_hotplug [thunderbolt]
RIP: 0010:tb_path_activate+0x121/0x540 [thunderbolt]
 tb_tunnel_activate+0xba/0x2e0 [thunderbolt]
 tb_tunnel_one_dp+0x29d/0x3b0 [thunderbolt]
 tb_tunnel_dp+0xbb/0x300 [thunderbolt]
 tb_dp_resource_available+0xda/0x250 [thunderbolt]
 tb_handle_hotplug+0x429/0x770 [thunderbolt]

The same WARN also fires via tb_domain_approve_switch / authorized_store (boltd
authorization path) - full splat attached.

After many plug cycles the Type-C side also corrupts:

sysfs: cannot create duplicate filename
'/devices/platform/USBC000:00/typec/port1/port1.2/partner'
typec_displayport port1-partner.1: probe with driver typec_displayport failed
with error -17

FREEZE TIMELINE (6.19.14)

- 09:01:18  LG connected, DP tunnel "not enough bandwidth", flap loop resumes
- 09:01:46  last journal line (thunderbolt 0-1: device disconnected)
- Machine completely unresponsive (UI, keyboard); no oops/panic captured; hard
power-off required. Same pattern on 6.17.0-35 (froze 08:17 same day).

WORKAROUNDS TESTED (no effect)

- thunderbolt.clx=0 - removes "failed to enable CL states", tunnels still fail
- thunderbolt.bw_alloc_mode=0 - no change
- Both host TB ports, multiple LG cables/units - identical behaviour

WHAT WORKS (isolation data)

- Same LG display + certified TB4/USB4 cable (Apple Thunderbolt cable): link
comes up at 40 Gb/s and is fully stable - dual-tile 5K, PCIe tunnel (display's
JHL7540 + xHCI visible), no errors. So the trigger is the active TB3 cable +
Meteor Lake USB4 host combination.
- Apple Studio Display works flawlessly on the same host - including through
the LG active TB3 cable. The flap only occurs with LG display + LG cable.
- The LG display + LG cable combination works normally on macOS hosts.

EXPECTED BEHAVIOUR

Repeated tunnel activation failures from a marginal link should result in the
device being dropped/ignored (rate-limited retries), not an unbounded
connect/teardown loop that eventually hard-freezes the host.

Full kernel logs from both freeze boots, the complete WARN splat and lspci
inventory are attached. Happy to test patches or provide further debug output
(thunderbolt.dyndbg). Bisection between 6.17 and 6.19 is not possible since
both fail.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.