NetBSD Problem Report #59576

From www@netbsd.org  Wed Aug  6 08:17:02 2025
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id C53621A923A
	for <gnats-bugs@gnats.NetBSD.org>; Wed,  6 Aug 2025 08:17:02 +0000 (UTC)
Message-Id: <20250806081701.A0EAD1A923C@mollari.NetBSD.org>
Date: Wed,  6 Aug 2025 08:17:01 +0000 (UTC)
From: alex14fr@gmail.com
Reply-To: alex14fr@gmail.com
To: gnats-bugs@NetBSD.org
Subject: viogpu causes race condition between pckbd_enable and pckbd_set_leds
X-Send-Pr-Version: www-1.0

>Number:         59576
>Category:       kern
>Synopsis:       viogpu causes race condition between pckbd_enable and pckbd_set_leds
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Aug 06 08:20:00 +0000 2025
>Last-Modified:  Tue Aug 12 22:30:02 +0000 2025
>Originator:     Alexandre Janon
>Release:        11
>Organization:
>Environment:
NetBSD netbsd 11.99.1 NetBSD 11.99.1 (GENERIC) #0: Mon Aug  4 11:53:52 UTC 2025  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
When using virtio-gpu-vga device of QEMU 10.3 with one vCPU with NetBSD as guest OS, pckbd_enable fails with the following in dmesg:

[     1.058498] viogpu0: 1920x1023, 32bpp
[     1.058498] wsdisplay0 at viogpu0 kbdmux 1
[     1.058498] wsmux1: connecting to wsdisplay0
[     1.529788] pckbd_enable: command error

and keyboard doesn't work in the viogpu display.

The problem doesn't arise with qemu's stdvga (-vga std), or virtio-gpu-vga with multiple vCPUs (-smp n with n>1).

>How-To-Repeat:
qemu command line:

qemu-system-x86_64 -enable-kvm -m1024 -drive if=virtio,file=NetBSD-11.99.1-amd64-live.img -vga virtio

>Fix:
The problem seems to be caused by a race condition with the pckbc interrupt handler and pckbd_enable (which uses pckbport_poll_cmd):

- pckbd_enable uses pckbport_poll_cmd to send KBC_ENABLE command
- pckbcintr fires, causing a call to pckbd_set_leds
- pckbd_set_leds sends a KBC_MODEIND keyboard command, waits for acknowledgement but eats the acknowledgement of KBC_ENABLE that should have been read by pckbd_enable/pckbport_poll_cmd
- pckbd_enable/pckbport_poll_cmd is unable to get acknowledgement, and reports failure.

Using spltty fixes the problem (see the diff below), not sure if this is the right thing to do though.

--- sys/dev/pckbport/pckbd.c	2024-02-09 23:08:36.000000000 +0100
+++ sys/dev/pckbport/pckbd.c	2025-08-06 09:33:56.097180758 +0200
@@ -459,6 +459,7 @@
 	struct pckbd_softc *sc = v;
 	int res;
 	u_char cmd[1];
+	int s;

 	if (on) {
 		if (sc->sc_enabled) {
@@ -466,18 +467,24 @@
 			return EBUSY;
 		}

+		s = spltty();
 		pckbport_slot_enable(sc->id->t_kbctag, sc->id->t_kbcslot, 1);

 		cmd[0] = KBC_ENABLE;
 		res = pckbport_poll_cmd(sc->id->t_kbctag, sc->id->t_kbcslot,
 		    cmd, 1, 0, NULL, 0);
+		splx(s);
+
 		if (res) {
 			printf("%s: command error\n", __func__);
 			return res;
 		}

+		s = spltty();
 		res = pckbd_set_xtscancode(sc->id->t_kbctag,
 		    sc->id->t_kbcslot, sc->id);
+		splx(s);
+
 		if (res)
 			return res;


>Audit-Trail:
From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/59576: viogpu causes race condition between pckbd_enable
 and pckbd_set_leds
Date: Tue, 12 Aug 2025 08:44:12 +0200

 On Wed, Aug 06, 2025 at 08:20:00AM +0000, alex14fr@gmail.com wrote:
 > - pckbd_enable uses pckbport_poll_cmd to send KBC_ENABLE command
 > - pckbcintr fires, causing a call to pckbd_set_leds
 > - pckbd_set_leds sends a KBC_MODEIND keyboard command, waits for acknowledgement but eats the acknowledgement of KBC_ENABLE that should have been read by pckbd_enable/pckbport_poll_cmd

 Wouldn't it be better to make pckbd_set_leds() return immediately if
 sc->sc_enabled is not yet set?

 Could you test that?

 Martin

From: alexandre janon <alex14fr@gmail.com>
To: gnats-bugs@netbsd.org,kern-bug-people@netbsd.org,gnats-admin@netbsd.org,netbsd-bugs@netbsd.org,alex14fr@gmail.com
Cc: 
Subject: Re: kern/59576: viogpu causes race condition between pckbd_enable and pckbd_set_leds
Date: Wed, 13 Aug 2025 00:27:27 +0200

 From: "Martin Husemann via gnats" <gnats-admin@NetBSD.org>
 Date: Tue, 12 Aug 2025 06:45:02 +0000 (UTC)
 On Wed, Aug 06, 2025 at 08:20:00AM +0000, alex14fr@gmail.com wrote:

 >> - pckbd_enable uses pckbport_poll_cmd to send KBC_ENABLE command
 >> - pckbcintr fires, causing a call to pckbd_set_leds
 >> - pckbd_set_leds sends a KBC_MODEIND keyboard command, waits for 
 >> acknowledgement but eats the acknowledgement of KBC_ENABLE that 
 >> should have been read by pckbd_enable/pckbport_poll_cmd 

 >  Wouldn't it be better to make pckbd_set_leds() return immediately if
 >  sc->sc_enabled is not yet set?
 >  
 >  Could you test that?

 I tested and it doesn't work (back to "command error" message). pckbcintr()
 fires between entry of pckbd_enable and the return from pckbport_poll_cmd,
 and calls bus_space_read_1 to read on KBC I/O ports 0x60 and 0x64 and 
 consume the ack.

 Alexandre

Home	PR Database Search