NetBSD Problem Report #57255
From www@netbsd.org Fri Mar 3 11:11:12 2023
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id 8B9BC1A9239
for <gnats-bugs@gnats.NetBSD.org>; Fri, 3 Mar 2023 11:11:12 +0000 (UTC)
Message-Id: <20230303111110.9901D1A923C@mollari.NetBSD.org>
Date: Fri, 3 Mar 2023 11:11:10 +0000 (UTC)
From: abs@absd.org
Reply-To: abs@absd.org
To: gnats-bugs@NetBSD.org
Subject: usbdi SIMPLEQ_FIRST(&pipe->up_queue) panic in NetBSD-10
X-Send-Pr-Version: www-1.0
>Number: 57255
>Category: kern
>Synopsis: usbdi SIMPLEQ_FIRST(&pipe->up_queue) panic in NetBSD-10
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: kern-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Fri Mar 03 11:15:00 +0000 2023
>Last-Modified: Wed May 31 19:55:01 +0000 2023
>Originator: David Brownlee
>Release: 10.0_BETA
>Organization:
-
>Environment:
NetBSD forsaken.absd.org 10.0_BETA NetBSD 10.0_BETA (GENERIC) #0: Fri Feb 24 14:16:10 UTC 2023 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
System panics on startup, shortly after login to X. First seen shortly after Jan 6, but appeared to clear up. Now seen with 2023-02-24 netbsd-10 build from ntftp
Three successive panics this morning:
- After first the machine was shut down before booting
- After second USB mouse dongles were removed
- After third external USB multifunction hub was disconnected, and system booted without panic. I _may_ have seen the similar panic in early January without hub, so while likely relevant, its not 100%.
panic: kernel diagnostic assertion "xfer == SIMPLEQ_FIRST(&pipe->up_queue)" failed: file "/usr/src/sys/dev/usb/usbdi.c", line 1142 xfer 0xffff915f802a2198 is not start of queue (0xffff915f802a2058 is at start)
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x183
kern_assert() at netbsd:kern_assert+0x4b
usb_transfer_complete() at netbsd:usb_transfer_complete+0x44d
xhci_softintr() at netbsd:xhci_softintr+0x4ea
usb_soft_intr() at netbsd:usb_soft_intr+0x25
softint_dispatch() at netbsd:softint_dispatch+0x10b
DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffa2884e9d90f0
Xsoftintr() at netbsd:Xsoftintr+0x4c
panic: kernel diagnostic assertion "xfer == SIMPLEQ_FIRST(&pipe->up_queue)" failed: file "/usr/src/sys/dev/usb/usbdi.c", line 1142 xfer 0xffff8fb629250698 is not start of queue (0xffff8fb6275df688 is at start)
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x183
kern_assert() at netbsd:kern_assert+0x4b
usb_transfer_complete() at netbsd:usb_transfer_complete+0x44d
xhci_softintr() at netbsd:xhci_softintr+0x4ea
usb_soft_intr() at netbsd:usb_soft_intr+0x25
softint_dispatch() at netbsd:softint_dispatch+0x10b
cpu0: End traceback...
panic: kernel diagnostic assertion "xfer == SIMPLEQ_FIRST(&pipe->up_queue)" failed: file "/usr/src/sys/dev/usb/usbdi.c", line 1142 xfer 0xfffffc557e570698 is not start of queue (0xfffffc557a389400 is at start)
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x183
kern_assert() at netbsd:kern_assert+0x4b
usb_transfer_complete() at netbsd:usb_transfer_complete+0x44d
xhci_softintr() at netbsd:xhci_softintr+0x4ea
usb_soft_intr() at netbsd:usb_soft_intr+0x25
softint_dispatch() at netbsd:softint_dispatch+0x10b
DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffa3884e9d90f0
Xsoftintr() at netbsd:Xsoftintr+0x4c
If it is the hub, this is how it identifies - definitely "multifunction"
uhub4 at uhub1 port 4: VIA Labs, Inc. (0x2109) USB2.0 Hub (0x2822), class 9/0, rev 2.10/6.a3, addr 2
uhub4: multiple transaction translators
uhub4: 5 ports with 4 removable, self powered
uhub5 at uhub0 port 4: VIA Labs, Inc. (0x2109) USB3.1 Hub (0x0822), class 9/0, rev 3.20/6.a3, addr 3
uhub5: 4 ports with 4 removable, self powered
uhub6 at uhub4 port 1: VIA Labs, Inc. (0x2109) USB2.0 Hub (0x2815), class 9/0, rev 2.10/7.04, addr 4
uhub6: multiple transaction translators
uhub6: 4 ports with 4 removable, self powered
uhub7 at uhub5 port 1: VIA Labs, Inc. (0x2109) USB3.0 Hub (0x0815), class 9/0, rev 3.20/7.04, addr 5
uhub7: 4 ports with 4 removable, self powered
uaudio0 at uhub6 port 1 configuration 1 interface 0
uaudio0: vendor 0c76 (0x0c76) USB PnP Audio Device (0x153f), rev 1.10/1.00, addr 6
uaudio0: audio rev 1.00
audio2 at uaudio0: playback, capture, full duplex, independent
audio2: slinear_le:16 2ch 48000Hz, blk 11520 bytes (60ms) for playback
audio2: slinear_le:16 1ch 48000Hz, blk 12000 bytes (125ms) for recording
spkr3 at audio2: PC Speaker (synthesized)
wsbell at spkr3 not configured
uhidev0 at uhub6 port 1 configuration 1 interface 3
uhidev0: vendor 0c76 (0x0c76) USB PnP Audio Device (0x153f), rev 1.10/1.00, addr 6, iclass 3/0
uhid0 at uhidev0: input=4, output=4, feature=0
umass1 at uhub7 port 2 configuration 1 interface 0
umass1: Generic (0x05e3) USB3.0 Card Reader (0x0749), rev 3.20/15.39, addr 7
umass1: using SCSI over Bulk-Only
scsibus1 at umass1: 2 targets, 2 luns per target
sd1 at scsibus1 target 0 lun 0: <Generic, MassStorageClass, 1539> disk removable
sd1: drive offline
sd2 at scsibus1 target 0 lun 1: <Generic, MassStorageClass, 1539> disk removable
sd2: drive offline
umass2 at uhub4 port 2 configuration 1 interface 0
umass2: Realtek (0x0bda) RTL9210B-CG (0x9210), rev 2.10/20.01, addr 8
umass2: using SCSI over Bulk-Only
scsibus2 at umass2: 2 targets, 1 lun per target
sd3 at scsibus2 target 0 lun 0: <Realtek, RTL9210, 1.00> disk fixed
sd3(umass2:0:0:0): Check Condition on CDB: 0x23 00 00 00 00 00 00 00 0c 00
SENSE KEY: Illegal Request
ASC/ASCQ: Invalid Command Operation Code
sd3: drive offline
sd3(umass2:0:0:0): Check Condition on CDB: 0x23 00 00 00 00 00 00 00 0c 00
SENSE KEY: Illegal Request
ASC/ASCQ: Invalid Command Operation Code
autoconfiguration error: sd3: unable to open device, error = 6
ure0 at uhub7 port 3
ure0: Realtek (0x0bda) USB 10/100/1000 LAN (0x8153), rev 3.00/30.00, addr 9
ure0: RTL8153 ver 5c30
rgephy0 at ure0 phy 0: RTL8251 1000BASE-T media interface, rev. 0
rgephy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, auto
ure0: Ethernet address 00:e0:4c:68:0d:e3
ugen0 at uhub4 port 5
ugen0: VIA Labs, Inc. (0x2109) USB Billboard Device (0x8818), rev 2.01/0.01, addr 10
Will try to test a current kernel, and a current kernel+DEBUG
>How-To-Repeat:
Boot netbsd-10 on ThinkPad T480 (most likely with attached hub), login & wait to see if panics
>Fix:
Never seen in kernel from Jan 6 (but may just be timing)
>Audit-Trail:
From: mlelstv@serpens.de (Michael van Elst)
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: kern/57255: usbdi SIMPLEQ_FIRST(&pipe->up_queue) panic in NetBSD-10
Date: Sat, 27 May 2023 19:51:27 -0000 (UTC)
abs@absd.org writes:
>panic: kernel diagnostic assertion "xfer == SIMPLEQ_FIRST(&pipe->up_queue)" failed: file "/usr/src/sys/dev/usb/usbdi.c", line 1142 xfer 0xffff915f802a2198 is not start of queue (0xffff915f802a2058 is at start)
>cpu0: Begin traceback...
>vpanic() at netbsd:vpanic+0x183
>kern_assert() at netbsd:kern_assert+0x4b
>usb_transfer_complete() at netbsd:usb_transfer_complete+0x44d
>xhci_softintr() at netbsd:xhci_softintr+0x4ea
>usb_soft_intr() at netbsd:usb_soft_intr+0x25
>softint_dispatch() at netbsd:softint_dispatch+0x10b
>DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffa2884e9d90f0
>Xsoftintr() at netbsd:Xsoftintr+0x4c
That's looks like an xhci bug that I have seen. I use a patch that seems
to prevent this (and some other problems):
http://cdn.netbsd.org/pub/NetBSD/misc/mlelstv/xhci.diff
From: matthew green <mrg@eterna.com.au>
To: gnats-bugs@netbsd.org, mlelstv@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org,
netbsd-bugs@netbsd.org, abs@absd.org
Subject: re: kern/57255: usbdi SIMPLEQ_FIRST(&pipe->up_queue) panic in NetBSD-10
Date: Thu, 01 Jun 2023 04:18:58 +1000
> http://cdn.netbsd.org/pub/NetBSD/misc/mlelstv/xhci.diff
FWIW, i've been running with this patch on several systems for a few
weeks now, without problem. including that now-working usb audio2
device Michael linked me this patch for...
any reason not to commit?
.mrg.
From: Michael van Elst <mlelstv@serpens.de>
To: matthew green <mrg@eterna.com.au>
Cc: gnats-bugs@netbsd.org, mlelstv@netbsd.org, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, abs@absd.org
Subject: Re: kern/57255: usbdi SIMPLEQ_FIRST(&pipe->up_queue) panic in
NetBSD-10
Date: Wed, 31 May 2023 21:51:55 +0200
On Thu, Jun 01, 2023 at 04:18:58AM +1000, matthew green wrote:
> > http://cdn.netbsd.org/pub/NetBSD/misc/mlelstv/xhci.diff
>
> FWIW, i've been running with this patch on several systems for a few
> weeks now, without problem. including that now-working usb audio2
> device Michael linked me this patch for...
>
> any reason not to commit?
The author of the original patch (sc.dying) seems to think it is not ready
for comitting....
Someone with better xhci-knowledge should at least review it.
--
Michael van Elst
Internet: mlelstv@serpens.de
"A potential Snark may lurk in every tree."
(Contact us)
$NetBSD: query-full-pr,v 1.47 2022/09/11 19:34:41 kim Exp $
$NetBSD: gnats_config.sh,v 1.9 2014/08/02 14:16:04 spz Exp $
Copyright © 1994-2023
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.