NetBSD Problem Report #53503

From www@NetBSD.org  Mon Aug  6 12:01:56 2018
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 78E877A1A1
	for <gnats-bugs@gnats.NetBSD.org>; Mon,  6 Aug 2018 12:01:56 +0000 (UTC)
Message-Id: <20180806120155.2A6797A1F9@mollari.NetBSD.org>
Date: Mon,  6 Aug 2018 12:01:55 +0000 (UTC)
From: rokuyama@rk.phys.keio.ac.jp
Reply-To: rokuyama@rk.phys.keio.ac.jp
To: gnats-bugs@NetBSD.org
Subject: dwctwo(4) panic triggered by usmsc(4) only in aarch64 mode
X-Send-Pr-Version: www-1.0

>Number:         53503
>Category:       port-evbarm
>Synopsis:       dwctwo(4) panic triggered by usmsc(4) only in aarch64 mode
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-evbarm-maintainer
>State:          analyzed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 06 12:05:00 +0000 2018
>Closed-Date:    
>Last-Modified:  Sun Sep 19 04:45:03 +0000 2021
>Originator:     Rin Okuyama
>Release:        8.99.23
>Organization:
School of Science and Technology, Meiji University
>Environment:
NetBSD rpi3b 8.99.23 NetBSD 8.99.23 (RPI3-64) #2: Mon Aug  6 20:36:22 JST 2018  rin@latipes:/var/build/obj/sys/arch/evbarm/compile.evbarm-aarch64/RPI3-64 evbarm aarch64
>Description:
On Raspberry Pi 3 Model B running in aarch64 mode, reproducible
diagnostic assertion failure occurs in dwctwo(4) code:

    % ifconfig usmsc0 up
    panic: kernel diagnostic assertion "len > 0 && offset + len <= map->dm_mapsize" failed: file "/var/build/src/sys/arch/arm/arm32/bus_dma.c", line 1054 len 0 offset 0 mapsize 20480
    cpu0: Begin traceback...
    trace fp ffffffc047bfa980
    fp ffffffc047bfa9a0 vpanic() at ffffffc0003354e0 netbsd:vpanic+0x190
    fp ffffffc047bfaa00 kern_assert() at ffffffc000445840 netbsd:kern_assert+0x58
    fp ffffffc047bfaa90 _bus_dmamap_sync() at ffffffc000013714 netbsd:_bus_dmamap_sync+0x10c
    fp ffffffc047bfab10 dwc2_host_complete() at ffffffc0002056b4 netbsd:dwc2_host_complete+0x13c
    fp ffffffc047bfab50 dwc2_hc_xfercomp_intr() at ffffffc00020e718 netbsd:dwc2_hc_xfercomp_intr+0x3a8
    fp ffffffc047bfaba0 dwc2_handle_hcd_intr() at ffffffc00020f324 netbsd:dwc2_handle_hcd_intr+0x4a4
    fp ffffffc047bfac20 dwc2_intr() at ffffffc00020526c netbsd:dwc2_intr+0xfc
    fp ffffffc047bfac50 pic_dispatch() at ffffffc0000026bc netbsd:pic_dispatch+0x84
    fp ffffffc047bfac80 pic_do_pending_ints() at ffffffc000002b50 netbsd:pic_do_pending_ints+0x380
    fp ffffffc047bfae28 cpu_idle() at ffffffc000023aa8 netbsd:cpu_idle+0x3c
    fp ffffffc047bfae70 idle_loop() at ffffffc0002e8594 netbsd:idle_loop+0x194
    cpu0: End traceback...
    rebooting...

This panic does not take place in aarch32 mode (evbearmv7hf-el)
on the same h/w.

The followings are full dmesg's as well as kernel config files:

http://www.netbsd.org/~rin/dmesg-aarch64-20180806
http://www.netbsd.org/~rin/RPI3-64

http://www.netbsd.org/~rin/dmesg-aarch32-20180806
http://www.netbsd.org/~rin/RPI3
>How-To-Repeat:
Boot RPI3 Model B in aarch64 mode, then "ifconfig usmsc0 up"
triggers panic. In aarch32 mode (evbearmv7hf-el), the panic
does not occur in the same procedure. Also, axen(4) works fine
both in aarch64 and 32 modes.
>Fix:
A straightforward workaround should be:

Index: sys/external/bsd/dwc2/dwc2.c
===================================================================
RCS file: /home/netbsd/src/sys/external/bsd/dwc2/dwc2.c,v
retrieving revision 1.49
diff -p -u -r1.49 dwc2.c
--- sys/external/bsd/dwc2/dwc2.c	9 Apr 2018 16:21:11 -0000	1.49
+++ sys/external/bsd/dwc2/dwc2.c	6 Aug 2018 11:35:38 -0000
@@ -1475,7 +1475,8 @@ void dwc2_host_complete(struct dwc2_hsot
 		 * everything else does.
 		 */
 		if (!(xfertype == UE_CONTROL &&
-		    UGETW(xfer->ux_request.wLength) == 0)) {
+		    UGETW(xfer->ux_request.wLength) == 0) &&
+		    xfer->ux_actlen > 0) {
 			int rd = usbd_xfer_isread(xfer);

 			usb_syncmem(&xfer->ux_dmabuf, 0, xfer->ux_actlen,

This works for me; usmsc(4) and other USB devices work fine,
and it does not harm aarch32 mode, as far as I can see.
Although I'm not sure whether this is the right fix...

>Release-Note:

>Audit-Trail:
From: "Rin Okuyama" <rin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/53503 CVS commit: src/sys/external/bsd/dwc2
Date: Tue, 7 Aug 2018 08:36:31 +0000

 Module Name:	src
 Committed By:	rin
 Date:		Tue Aug  7 08:36:31 UTC 2018

 Modified Files:
 	src/sys/external/bsd/dwc2: dwc2.c

 Log Message:
 Do not call usb_syncmem(9) with len = 0 to avoid diagnostic assertion
 failure in bus_dmamap_sync(9) on Raspberry Pi 3 Model B running in
 aarch64 mode.

 Workaround for PR port-evbarm/53503.


 To generate a diff of this commit:
 cvs rdiff -u -r1.49 -r1.50 src/sys/external/bsd/dwc2/dwc2.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Rin Okuyama <rokuyama@rk.phys.keio.ac.jp>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: port-evbarm/53503: dwctwo(4) panic triggered by usmsc(4) only in
 aarch64 mode
Date: Wed, 8 Aug 2018 17:01:53 +0900

 We still need the workaround after this commit.

 On 2018/08/08 16:20, Simon Burge wrote:
 > Module Name:	src
 > Committed By:	simonb
 > Date:		Wed Aug  8 07:20:44 UTC 2018
 > 
 > Modified Files:
 > 	src/sys/external/bsd/dwc2/dist: dwc2_core.h dwc2_hcd.c dwc2_hcd.h
 > 	    dwc2_hcdintr.c dwc2_hcdqueue.c
 > 
 > Log Message:
 > Merge
 > https://github.com/torvalds/linux/commit/38d2b5fb75c15923fb89c32134516a623515bce4
 > to mitigate USB NAK interrupt storms, with an extra change from
 > skrll@ to also mitigate interrupt storms on the non-split case with
 > older DWC2 cores.
 > 
 > Fixes woeful USB disk performance on an ERLITE.
 > 
 > Much thanks to skrll@ for pointer to the above patch, handling the
 > non-split case and testing.
 > 
 > 
 > To generate a diff of this commit:
 > cvs rdiff -u -r1.8 -r1.9 src/sys/external/bsd/dwc2/dist/dwc2_core.h
 > cvs rdiff -u -r1.20 -r1.21 src/sys/external/bsd/dwc2/dist/dwc2_hcd.c
 > cvs rdiff -u -r1.14 -r1.15 src/sys/external/bsd/dwc2/dist/dwc2_hcd.h \
 >      src/sys/external/bsd/dwc2/dist/dwc2_hcdqueue.c
 > cvs rdiff -u -r1.13 -r1.14 src/sys/external/bsd/dwc2/dist/dwc2_hcdintr.c
 > 
 > Please note that diffs are not public domain; they are subject to the
 > copyright notices on the relevant files.

From: Nick Hudson <nick.hudson@gmx.co.uk>
To: gnats-bugs@NetBSD.org, port-evbarm-maintainer@netbsd.org,
 gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, rokuyama@rk.phys.keio.ac.jp
Cc: 
Subject: Re: port-evbarm/53503: dwctwo(4) panic triggered by usmsc(4) only in
 aarch64 mode
Date: Wed, 8 Aug 2018 11:32:21 +0100

 On 08/08/2018 10:40, Rin Okuyama wrote:
 > The following reply was made to PR port-evbarm/53503; it has been noted by GNATS.
 > 
 > From: Rin Okuyama <rokuyama@rk.phys.keio.ac.jp>
 > To: gnats-bugs@NetBSD.org
 > Cc:
 > Subject: Re: port-evbarm/53503: dwctwo(4) panic triggered by usmsc(4) only in
 >   aarch64 mode
 > Date: Wed, 8 Aug 2018 17:01:53 +0900
 > 
 >   We still need the workaround after this commit.

 Can you provide DWC2_DEBUG for the problem please?

From: Rin Okuyama <rokuyama@rk.phys.keio.ac.jp>
To: Nick Hudson <nick.hudson@gmx.co.uk>, gnats-bugs@NetBSD.org
Cc: 
Subject: Re: port-evbarm/53503: dwctwo(4) panic triggered by usmsc(4) only in
 aarch64 mode
Date: Thu, 9 Aug 2018 02:26:14 +0900

 On 2018/08/08 19:32, Nick Hudson wrote:
 > Can you provide DWC2_DEBUG for the problem please?

 Here's dmesg from kernel with DWC2_DEBUG and USB_DEBUG enabled:

 http://www.netbsd.org/~rin/dmesg-aarch64-20180809

 The procedure is as follows:

 (1) Boot RPI3B into single user mode.
 (2) sysctl -w ddb.onpanic=0
 (3) Entering ddb from USB keyboard, then
      > w/l smsc_debug 1
      > w/l dwc2debug 10
      > c
 (4) ifconfig usmsc0 up

 Thus, first few debug output is due to input from USB keyboard.
 I need (2) because recursive panic occurs on entering ddb...

 Thanks,
 rin

State-Changed-From-To: open->analyzed
State-Changed-By: rin@NetBSD.org
State-Changed-When: Sun, 19 Sep 2021 04:45:03 +0000
State-Changed-Why:
Workaround committed.


>Unformatted:

Home	PR Database Search