NetBSD Problem Report #59678

From www@netbsd.org  Tue Sep 30 11:50:33 2025
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id B562D1A923C
	for <gnats-bugs@gnats.NetBSD.org>; Tue, 30 Sep 2025 11:50:33 +0000 (UTC)
Message-Id: <20250930115032.ACD911A9241@mollari.NetBSD.org>
Date: Tue, 30 Sep 2025 11:50:32 +0000 (UTC)
From: abs@absd.org
Reply-To: abs@absd.org
To: gnats-bugs@NetBSD.org
Subject: "ring->queued > 0" panic from utwn
X-Send-Pr-Version: www-1.0

>Number:         59678
>Category:       kern
>Synopsis:       "ring->queued > 0" panic from utwn
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    nat
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Sep 30 11:55:00 +0000 2025
>Last-Modified:  Sat Oct 11 10:45:01 +0000 2025
>Originator:     David Brownlee
>Release:        11.0_BETA
>Organization:
>Environment:
NetBSD forsaken.absd.org 11.0_BETA NetBSD 11.0_BETA (GENERIC) #0: Wed Sep 24 12:39:13 UTC 2025  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64

>Description:
Since running netbsd-11 (beta) on a ThinkPad T14 have had three panics, two from netbsd-11 and one from an (earlier) -current kernel from a

urtwn0 at uhub1 port 4
urtwn0: Realtek (0x0b05) 802.11n NIC (0x18f0), rev 2.00/0.00, addr 12
urtwn0: MAC/BB RTL8188EU, RF 6052 1T1R, address 58:11:22:53:0c:44
urtwn0: 1 rx pipe, 2 tx pipes

kernel diagnostic assertion "ring->queued > 0" failed: file "/usr/src/sys/dev/usb/if_urtwn.c"

I've been tracking the releng builds and have crashdumps and kernels to match

NetBSD 11.0_BETA (GENERIC) #0: Wed Sep 24 12:39:13 UTC 2025
panic: kernel diagnostic assertion "ring->queued > 0" failed: file "/usr/src/sys/dev/usb/if_urtwn.c", line 927 urtwn0: cur=5 next=4 queued=0

NetBSD 11.0_BETA (GENERIC) #0: Fri Aug  8 16:37:51 UTC 2025
panic: kernel diagnostic assertion "ring->queued > 0" failed: file "/usr/src/sys/dev/usb/if_urtwn.c", line 926 urtwn0: cur=9 next=8 queued=0

NetBSD 10.99.14 (GENERIC) #0: Thu Jun 12 10:23:43 UTC 2025
panic: kernel diagnostic assertion "ring->queued > 0" failed: file "/usr/src/sys/dev/usb/if_urtwn.c", line 926 urtwn0: cur=19 next=18 queued=0

>How-To-Repeat:
Run with a RTL8188EU
>Fix:

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: kern-bug-people->nat
Responsible-Changed-By: nat@NetBSD.org
Responsible-Changed-When: Thu, 02 Oct 2025 08:28:05 +0000
Responsible-Changed-Why:
I'm looking into this...It possibily requires another change to xhci.


From: David Brownlee <abs@absd.org>
To: gnats-bugs@netbsd.org
Cc: nat@netbsd.org, kern-bug-people@netbsd.org, netbsd-bugs@netbsd.org, 
	gnats-admin@netbsd.org
Subject: Re: kern/59678 ("ring->queued > 0" panic from utwn)
Date: Thu, 2 Oct 2025 09:48:00 +0100

 On Thu, 2 Oct 2025 at 09:28, <nat@netbsd.org> wrote:
 > I'm looking into this...It possibily requires another change to xhci.

 Thanks - I'll keep the kernel & crashdumps around in case they can be
 mined for additional info :)

 David

From: Nathanial Sloss <nathanialsloss@yahoo.com.au>
To: David Brownlee <abs@absd.org>
Cc: gnats-bugs@netbsd.org,
 kern-bug-people@netbsd.org,
 netbsd-bugs@netbsd.org,
 gnats-admin@netbsd.org
Subject: Re: kern/59678 ("ring->queued > 0" panic from utwn)
Date: Sat, 4 Oct 2025 05:53:58 +1000

 --Boundary-00=_XnC4oBWPMRmYAbf
 Content-Type: Text/Plain;
   charset="utf-8"
 Content-Transfer-Encoding: 7bit

 Hi David,

 I've received patches from sc_dying for better handing of xhci events with 
 regards to the ZLP that is now added on every USBD_FORCE_SHORT_XFER.

 Please apply this patch to your -11 srcs and let me know if it works better.

 This way it'll will quicken my testing and hopefully the patch will be 
 commited soon.


 Best regards,

 Nat

 --Boundary-00=_XnC4oBWPMRmYAbf
 Content-Type: text/x-patch;
   charset="ISO-8859-1";
   name="xhci-zlp.patch.1"
 Content-Transfer-Encoding: 7bit
 Content-Disposition: attachment;
 	filename="xhci-zlp.patch.1"

 --- sys/dev/usb/xhci.c.orig	2025-08-24 09:59:43.231022329 +0000
 +++ sys/dev/usb/xhci.c	2025-09-10 08:27:57.172289557 +0000
 @@ -2576,6 +2576,20 @@ xhci_event_transfer(struct xhci_softc * 
  			return;
  	}

 +	/*
 +	 * If next event will be from zero-length packet,
 +	 * suppress notification of first event.
 +	 */
 +	if (xfertype == UE_BULK &&
 +	    err == USBD_NORMAL_COMPLETION &&
 +	    (xfer->ux_flags & USBD_FORCE_SHORT_XFER) &&
 +	    XHCI_TRB_2_REM_GET(le32toh(xr->xr_trb[idx].trb_2)) != 0) {
 +		DPRINTFN(100, "short xfer %#jx: suppress notification status "
 +		    "%ju pipe %#jx", (uintptr_t)xfer, xfer->ux_status,
 +		    (uintptr_t)xfer->ux_pipe, 0);
 +		return;
 +	}
 +
  	if ((trb_3 & XHCI_TRB_3_ED_BIT) == 0 ||
  	    (trb_0 & 0x3) == 0x0) {
  		/*

 --Boundary-00=_XnC4oBWPMRmYAbf--

From: David Brownlee <abs@absd.org>
To: Nathanial Sloss <nathanialsloss@yahoo.com.au>
Cc: gnats-bugs@netbsd.org, kern-bug-people@netbsd.org, netbsd-bugs@netbsd.org, 
	gnats-admin@netbsd.org
Subject: Re: kern/59678 ("ring->queued > 0" panic from utwn)
Date: Sun, 5 Oct 2025 16:25:33 +0100

 On Fri, 3 Oct 2025 at 20:54, Nathanial Sloss
 <nathanialsloss@yahoo.com.au> wrote:
 > [...]
 > Please apply this patch to your -11 srcs and let me know if it works better.
 > [...]

 Running for a day or so without any panic, but will need to have run
 for longer to get any confidence. I've not seen any "short xfer" in
 dmesg or /var/log/messages, but will keep an eye out for it

 Thanks

 David

From: David Brownlee <abs@absd.org>
To: gnats-bugs@netbsd.org
Cc: nat@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/59678 ("ring->queued > 0" panic from utwn)
Date: Fri, 10 Oct 2025 14:39:19 +0100

 I've been running now for a week with this patch without any urtwn
 crashes (disclosure, I've also been running with the subr_time patches
 from pr59691 which sold a different type of crash).

 I don't know if that is enough of a datapoint to warrant a pullup, but
 I'm a happy camper regardless :)

 Thanks

 David

From: Nathanial Sloss <nathanialsloss@yahoo.com.au>
To: David Brownlee <abs@absd.org>
Cc: gnats-bugs@netbsd.org,
 gnats-admin@netbsd.org,
 netbsd-bugs@netbsd.org
Subject: Re: kern/59678 ("ring->queued > 0" panic from utwn)
Date: Sat, 11 Oct 2025 07:13:58 +1100

 On Sat, 11 Oct 2025 00:39:19 David Brownlee wrote:
 > I've been running now for a week with this patch without any urtwn
 > crashes (disclosure, I've also been running with the subr_time patches
 > from pr59691 which sold a different type of crash).
 > 
 > I don't know if that is enough of a datapoint to warrant a pullup, but
 > I'm a happy camper regardless :)

 Great I'll commit the patch and submit a pullup for -11.

 Thanks for testing and thanks to sc_dying for the patch.

 Best regards,

 Nat

From: "Nathanial Sloss" <nat@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/59678 CVS commit: src/sys/dev/usb
Date: Fri, 10 Oct 2025 20:21:05 +0000

 Module Name:	src
 Committed By:	nat
 Date:		Fri Oct 10 20:21:05 UTC 2025

 Modified Files:
 	src/sys/dev/usb: xhci.c

 Log Message:
 Don't generate duplicate events when sending ZLP.

 Patch from sc_dying as posted to tech-kern.

 Addresses PR/59678.

 XXX pullup -11, pullup -10.


 To generate a diff of this commit:
 cvs rdiff -u -r1.191 -r1.192 src/sys/dev/usb/xhci.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/59678 CVS commit: [netbsd-11] src/sys/dev/usb
Date: Sat, 11 Oct 2025 10:43:26 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Sat Oct 11 10:43:26 UTC 2025

 Modified Files:
 	src/sys/dev/usb [netbsd-11]: xhci.c

 Log Message:
 Pull up following revision(s) (requested by nat in ticket #50):

 	sys/dev/usb/xhci.c: revision 1.192

 Don't generate duplicate events when sending ZLP.

 Patch from sc_dying as posted to tech-kern.
 Addresses PR/59678.


 To generate a diff of this commit:
 cvs rdiff -u -r1.188.2.1 -r1.188.2.2 src/sys/dev/usb/xhci.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search