NetBSD Problem Report #60815

From www@netbsd.org  Sun Sep 27 22:03:22 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 712731A923B
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 27 Sep 2026 22:03:22 +0000 (UTC)
Message-Id: <20260927220320.CB7DB1A923C@mollari.NetBSD.org>
Date: Sun, 27 Sep 2026 22:03:20 +0000 (UTC)
From: apovalixin@bk.ru
Reply-To: apovalixin@bk.ru
To: gnats-bugs@NetBSD.org
Subject: Request pull-up of Raspberry Pi 5 SDIO Wi-Fi fixes to netbsd-11
X-Send-Pr-Version: www-1.0
X-From4GNATS: "apovalixin@bk.ru via gnats" <gnats-admin@NetBSD.org>

>Number:         60815
>Category:       port-evbarm
>Synopsis:       Request pull-up of Raspberry Pi 5 SDIO Wi-Fi fixes to netbsd-11
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-evbarm-maintainer
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Sun Sep 27 22:05:04 +0000 2026
>Originator:     Anton Povalikhin
>Release:        NetBSD 11.0
>Organization:
LLC OXTECH
>Environment:
NetBSD pi5-netbsd 11.0 NetBSD 11.0 (OXTORG64) #0: Fri Sep 25 01:31:55 UTC 2026  root@arm64:/root/build/usr/src/sys/arch/evbarm/compile/OXTORG64 evbarm
>Description:
DRAFT FACTS FOR THE SUBMITTER — rewrite the report in your own words before submission.

On two Raspberry Pi 5 boards with BCM2712 C1 and CYW43455 Wi-Fi over SDIO, NetBSD 11.0 does not attach bwfm: the module reports product 0x4345, which the netbsd-11 if_bwfm_sdio.c match table lacks. We booted through eotics RPi5 UEFI rpi5-20260730.1 with local SDIO power fixes.

With the BCM4345 match from trunk if_bwfm_sdio.c 1.34 alone, the first SDIO CMD53 read caused a kernel fault in sdhc_start_command() on the ADMA2-capable host. The command had no DMA map; the netbsd-11 driver attempted to use the NULL c_dmamap. We observed this on 24 September 2026.

Adding the relevant DMA guard from trunk sdhc.c 1.125 allowed the module to attach and connect to WPA2 on 5 GHz with DHCP. Our test kernel also included trunk if_bwfm_sdio.c 1.33 and separate local Raspberry Pi 5, UEFI, and Wi-Fi fixes. Thus these tests do not establish that the three trunk pull-ups alone provide full stock Pi 5 Wi-Fi support. We did not observe the corrupt-frame panic addressed by 1.33; we saw one 'bwfm0: rx_glom empty packet' message.

On 25 September, a 3-hour-20-minute load run completed 49 cycles: 57-114 Mbit/s from the board, 49-61 Mbit/s to the board, with no lost pings. The full 24-hour log was not retained, so we make no overnight stability claim. Additional reboot and network-switch tests exercised local bwfm state-machine changes, which should be reported separately.

Russian-language summary of observations:
&#1041;&#1077;&#1079; 1.34 Wi-Fi &#1085;&#1077;&#1090;: bwfm &#1074; 11.0 &#1085;&#1077; &#1079;&#1085;&#1072;&#1077;&#1090; product 0x4345, &#1084;&#1086;&#1076;&#1091;&#1083;&#1100; CYW43455 &#1085;&#1072; Pi 5 &#1085;&#1077; &#1087;&#1086;&#1076;&#1082;&#1083;&#1102;&#1095;&#1072;&#1077;&#1090;&#1089;&#1103;. &#1057; 1.34, &#1085;&#1086; &#1073;&#1077;&#1079; &#1087;&#1088;&#1072;&#1074;&#1082;&#1080; sdhc.c &#1103;&#1076;&#1088;&#1086; 11.0 &#1087;&#1072;&#1076;&#1072;&#1077;&#1090;: &#1082;&#1086;&#1084;&#1072;&#1085;&#1076;&#1099; SDIO CMD53 &#1080;&#1076;&#1091;&#1090; &#1073;&#1077;&#1079; &#1082;&#1072;&#1088;&#1090;&#1099; DMA, &#1072; sdhc &#1088;&#1072;&#1079;&#1099;&#1084;&#1077;&#1085;&#1086;&#1074;&#1099;&#1074;&#1072;&#1077;&#1090; &#1087;&#1091;&#1089;&#1090;&#1086;&#1081; &#1091;&#1082;&#1072;&#1079;&#1072;&#1090;&#1077;&#1083;&#1100; &#1085;&#1072; &#1087;&#1077;&#1088;&#1074;&#1086;&#1084; &#1095;&#1090;&#1077;&#1085;&#1080;&#1080; &#1084;&#1086;&#1076;&#1091;&#10
 83;&#1103;. &#1057; &#1087;&#1088;&#1072;&#1074;&#1082;&#1086;&#1081; sdhc.c &#1084;&#1086;&#1076;&#1091;&#1083;&#1100; &#1087;&#1086;&#1076;&#1082;&#1083;&#1102;&#1095;&#1080;&#1083;&#1089;&#1103;, WPA2 &#1080; DHCP &#1088;&#1072;&#1073;&#1086;&#1090;&#1072;&#1083;&#1080;. &#1047;&#1072; 3 &#1095; 20 &#1084;&#1080;&#1085; &#1085;&#1072;&#1075;&#1088;&#1091;&#1079;&#1086;&#1095;&#1085;&#1086;&#1075;&#1086; &#1087;&#1088;&#1086;&#1075;&#1086;&#1085;&#1072; &#1087;&#1088;&#1086;&#1096;&#1083;&#1086; 49 &#1082;&#1088;&#1091;&#1075;&#1086;&#1074;, ping &#1073;&#1077;&#1079; &#1087;&#1086;&#1090;&#1077;&#1088;&#1100;. &#1055;&#1086;&#1083;&#1085;&#1099;&#1081; &#1089;&#1091;&#1090;&#1086;&#1095;&#1085;&#1099;&#1081; &#1078;&#1091;&#1088;&#1085;&#1072;&#1083; &#1085;&#1077; &#1089;&#1086;&#1093;&#1088;&#1072;&#1085;&#1080;&#1083;&#1089;&#1103;.
>How-To-Repeat:
DRAFT FACTS — rewrite before submission.
1. Boot NetBSD 11.0 on a Raspberry Pi 5 with UEFI that powers SDIO2. The CYW43455 reports product 0x4345, but bwfm does not attach.
2. Apply only trunk if_bwfm_sdio.c revision 1.34 and reboot. The first SDIO CMD53 read reaches sdhc_start_command() with a NULL c_dmamap on an ADMA2-capable host and the kernel faults.
3. Apply the sdhc_start_command() DMA guard from trunk sdhc.c revision 1.125. The module attaches; WPA2 connection and DHCP then worked on our locally patched test image.
>Fix:
DRAFT FACTS — rewrite the explanation in your own words before submission. The patch below consists of three existing NetBSD trunk changes for netbsd-11:
- if_bwfm_sdio.c 1.34 (44055db23a36): BCM4345 match.
- if_bwfm_sdio.c 1.33 (0bd35761fb5d): rounded RX glom frame reads. Its corrupt-frame panic was not reproduced here.
- The sdhc_start_command() hunk from sdhc.c 1.125 (a75847d5d6d7): ADMA2 setup only when the command uses DMA; assert that the DMA map exists. The rest of 1.125 is unrelated Wii U support.

The patch applied without offset or fuzz to netbsd-11 at 03d918f6d0e81fa05b8f1160eca0628ad39988a6.

--- sys/dev/sdmmc/if_bwfm_sdio.c
+++ sys/dev/sdmmc/if_bwfm_sdio.c
@@ -289,6 +289,11 @@
 		SDMMC_VENDOR_BROADCOM,
 		SDMMC_PRODUCT_BROADCOM_BCM4334,
 		SDMMC_CIS_BROADCOM_BCM4334
+	},
+	{
+		SDMMC_VENDOR_BROADCOM,
+		SDMMC_PRODUCT_BROADCOM_BCM4345,
+		SDMMC_CIS_BROADCOM_BCM4345
 	},
 	{
 		SDMMC_VENDOR_BROADCOM,
@@ -1898,7 +1903,7 @@
 	struct bwfm_sdio_swhdr swhdr;
 	struct bwfm_proto_bcdc_hdr *bcdc;
 	struct mbuf *m, *m0;
-	size_t flen, off, hoff;
+	size_t flen, off, hoff, slen;
 	int i;
 	const size_t hdrlen = sizeof(hwhdr) + sizeof(swhdr);

@@ -1916,18 +1921,19 @@
 			return;
 		}
 		bwfm_qput(&m0, m);
-		if (le16toh(sublen[i]) > m->m_len) {
+		slen = le16toh(sublen[i]);
+		if (roundup(slen,4) > m->m_len) {
 			m_freem(m0);
 			printf("%s: header larger than mbuf\n", DEVNAME(sc));
 			return;
 		}
 		if (bwfm_sdio_frame_read_write(sc, mtod(m, char *),
-		    le16toh(sublen[i]), 0)) {
+		    roundup(slen,4), 0)) {
 			m_freem(m0);
 			printf("%s: frame I/O error\n", DEVNAME(sc));
 			return;
 		}
-		m->m_len = m->m_pkthdr.len = le16toh(sublen[i]);
+		m->m_len = m->m_pkthdr.len = slen;
 	}

 	if (m0->m_len >= hdrlen) {
--- sys/dev/sdmmc/sdhc.c
+++ sys/dev/sdmmc/sdhc.c
@@ -1809,7 +1809,10 @@
 	}

 	/* Set DMA start address. */
-	if (ISSET(hp->flags, SHF_USE_ADMA2_MASK) && cmd->c_data != NULL) {
+	if (ISSET(mode, SDHC_DMA_ENABLE) &&
+	    ISSET(hp->flags, SHF_USE_ADMA2_MASK) &&
+	    cmd->c_data != NULL) {
+		KASSERT(cmd->c_dmamap != NULL);
 		for (int seg = 0; seg < cmd->c_dmamap->dm_nsegs; seg++) {
 			bus_addr_t paddr =
 			    cmd->c_dmamap->dm_segs[seg].ds_addr;

Home	PR Database Search