NetBSD Problem Report #57255

From www@netbsd.org  Fri Mar  3 11:11:12 2023
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 8B9BC1A9239
	for <gnats-bugs@gnats.NetBSD.org>; Fri,  3 Mar 2023 11:11:12 +0000 (UTC)
Message-Id: <20230303111110.9901D1A923C@mollari.NetBSD.org>
Date: Fri,  3 Mar 2023 11:11:10 +0000 (UTC)
From: abs@absd.org
Reply-To: abs@absd.org
To: gnats-bugs@NetBSD.org
Subject: usbdi SIMPLEQ_FIRST(&pipe->up_queue) panic in NetBSD-10
X-Send-Pr-Version: www-1.0

>Number:         57255
>Category:       kern
>Synopsis:       usbdi SIMPLEQ_FIRST(&pipe->up_queue) panic in NetBSD-10
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Mar 03 11:15:00 +0000 2023
>Last-Modified:  Wed May 31 19:55:01 +0000 2023
>Originator:     David Brownlee
>Release:        10.0_BETA
>Organization:
-
>Environment:
NetBSD forsaken.absd.org 10.0_BETA NetBSD 10.0_BETA (GENERIC) #0: Fri Feb 24 14:16:10 UTC 2023  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64

>Description:
System panics on startup, shortly after login to X. First seen shortly after Jan 6, but appeared to clear up. Now seen with 2023-02-24 netbsd-10 build from ntftp

Three successive panics this morning:
- After first the machine was shut down before booting
- After second USB mouse dongles were removed
- After third external USB multifunction hub was disconnected, and system booted without panic. I _may_ have seen the similar panic in early January without hub, so while likely relevant, its not 100%.

panic: kernel diagnostic assertion "xfer == SIMPLEQ_FIRST(&pipe->up_queue)" failed: file "/usr/src/sys/dev/usb/usbdi.c", line 1142 xfer 0xffff915f802a2198 is not start of queue (0xffff915f802a2058 is at start)
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x183
kern_assert() at netbsd:kern_assert+0x4b
usb_transfer_complete() at netbsd:usb_transfer_complete+0x44d
xhci_softintr() at netbsd:xhci_softintr+0x4ea
usb_soft_intr() at netbsd:usb_soft_intr+0x25
softint_dispatch() at netbsd:softint_dispatch+0x10b
DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffa2884e9d90f0
Xsoftintr() at netbsd:Xsoftintr+0x4c

panic: kernel diagnostic assertion "xfer == SIMPLEQ_FIRST(&pipe->up_queue)" failed: file "/usr/src/sys/dev/usb/usbdi.c", line 1142 xfer 0xffff8fb629250698 is not start of queue (0xffff8fb6275df688 is at start)
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x183
kern_assert() at netbsd:kern_assert+0x4b
usb_transfer_complete() at netbsd:usb_transfer_complete+0x44d
xhci_softintr() at netbsd:xhci_softintr+0x4ea
usb_soft_intr() at netbsd:usb_soft_intr+0x25
softint_dispatch() at netbsd:softint_dispatch+0x10b
cpu0: End traceback...

panic: kernel diagnostic assertion "xfer == SIMPLEQ_FIRST(&pipe->up_queue)" failed: file "/usr/src/sys/dev/usb/usbdi.c", line 1142 xfer 0xfffffc557e570698 is not start of queue (0xfffffc557a389400 is at start)
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x183
kern_assert() at netbsd:kern_assert+0x4b
usb_transfer_complete() at netbsd:usb_transfer_complete+0x44d
xhci_softintr() at netbsd:xhci_softintr+0x4ea
usb_soft_intr() at netbsd:usb_soft_intr+0x25
softint_dispatch() at netbsd:softint_dispatch+0x10b
DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffa3884e9d90f0
Xsoftintr() at netbsd:Xsoftintr+0x4c

If it is the hub, this is how it identifies - definitely "multifunction"

uhub4 at uhub1 port 4: VIA Labs, Inc. (0x2109) USB2.0 Hub (0x2822), class 9/0, rev 2.10/6.a3, addr 2
uhub4: multiple transaction translators
uhub4: 5 ports with 4 removable, self powered
uhub5 at uhub0 port 4: VIA Labs, Inc. (0x2109) USB3.1 Hub (0x0822), class 9/0, rev 3.20/6.a3, addr 3
uhub5: 4 ports with 4 removable, self powered
uhub6 at uhub4 port 1: VIA Labs, Inc. (0x2109) USB2.0 Hub (0x2815), class 9/0, rev 2.10/7.04, addr 4
uhub6: multiple transaction translators
uhub6: 4 ports with 4 removable, self powered
uhub7 at uhub5 port 1: VIA Labs, Inc. (0x2109) USB3.0 Hub (0x0815), class 9/0, rev 3.20/7.04, addr 5
uhub7: 4 ports with 4 removable, self powered
uaudio0 at uhub6 port 1 configuration 1 interface 0
uaudio0: vendor 0c76 (0x0c76) USB PnP Audio Device (0x153f), rev 1.10/1.00, addr 6
uaudio0: audio rev 1.00
audio2 at uaudio0: playback, capture, full duplex, independent
audio2: slinear_le:16 2ch 48000Hz, blk 11520 bytes (60ms) for playback
audio2: slinear_le:16 1ch 48000Hz, blk 12000 bytes (125ms) for recording
spkr3 at audio2: PC Speaker (synthesized)
wsbell at spkr3 not configured
uhidev0 at uhub6 port 1 configuration 1 interface 3
uhidev0: vendor 0c76 (0x0c76) USB PnP Audio Device (0x153f), rev 1.10/1.00, addr 6, iclass 3/0
uhid0 at uhidev0: input=4, output=4, feature=0
umass1 at uhub7 port 2 configuration 1 interface 0
umass1: Generic (0x05e3) USB3.0 Card Reader (0x0749), rev 3.20/15.39, addr 7
umass1: using SCSI over Bulk-Only
scsibus1 at umass1: 2 targets, 2 luns per target
sd1 at scsibus1 target 0 lun 0: <Generic, MassStorageClass, 1539> disk removable
sd1: drive offline
sd2 at scsibus1 target 0 lun 1: <Generic, MassStorageClass, 1539> disk removable
sd2: drive offline
umass2 at uhub4 port 2 configuration 1 interface 0
umass2: Realtek (0x0bda) RTL9210B-CG (0x9210), rev 2.10/20.01, addr 8
umass2: using SCSI over Bulk-Only
scsibus2 at umass2: 2 targets, 1 lun per target
sd3 at scsibus2 target 0 lun 0: <Realtek, RTL9210, 1.00> disk fixed
sd3(umass2:0:0:0):  Check Condition on CDB: 0x23 00 00 00 00 00 00 00 0c 00
    SENSE KEY:  Illegal Request
     ASC/ASCQ:  Invalid Command Operation Code
sd3: drive offline
sd3(umass2:0:0:0):  Check Condition on CDB: 0x23 00 00 00 00 00 00 00 0c 00
    SENSE KEY:  Illegal Request
     ASC/ASCQ:  Invalid Command Operation Code
autoconfiguration error: sd3: unable to open device, error = 6
ure0 at uhub7 port 3
ure0: Realtek (0x0bda) USB 10/100/1000 LAN (0x8153), rev 3.00/30.00, addr 9
ure0: RTL8153 ver 5c30
rgephy0 at ure0 phy 0: RTL8251 1000BASE-T media interface, rev. 0
rgephy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, auto
ure0: Ethernet address 00:e0:4c:68:0d:e3
ugen0 at uhub4 port 5
ugen0: VIA Labs, Inc. (0x2109) USB Billboard Device (0x8818), rev 2.01/0.01, addr 10

Will try to test a current kernel, and a current kernel+DEBUG
>How-To-Repeat:
Boot netbsd-10 on ThinkPad T480 (most likely with attached hub), login & wait to see if panics
>Fix:
Never seen in kernel from Jan 6 (but may just be timing)

>Audit-Trail:
From: mlelstv@serpens.de (Michael van Elst)
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/57255: usbdi SIMPLEQ_FIRST(&pipe->up_queue) panic in NetBSD-10
Date: Sat, 27 May 2023 19:51:27 -0000 (UTC)

 abs@absd.org writes:

 >panic: kernel diagnostic assertion "xfer == SIMPLEQ_FIRST(&pipe->up_queue)" failed: file "/usr/src/sys/dev/usb/usbdi.c", line 1142 xfer 0xffff915f802a2198 is not start of queue (0xffff915f802a2058 is at start)
 >cpu0: Begin traceback...
 >vpanic() at netbsd:vpanic+0x183
 >kern_assert() at netbsd:kern_assert+0x4b
 >usb_transfer_complete() at netbsd:usb_transfer_complete+0x44d
 >xhci_softintr() at netbsd:xhci_softintr+0x4ea
 >usb_soft_intr() at netbsd:usb_soft_intr+0x25
 >softint_dispatch() at netbsd:softint_dispatch+0x10b
 >DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffa2884e9d90f0
 >Xsoftintr() at netbsd:Xsoftintr+0x4c


 That's looks like an xhci bug that I have seen. I use a patch that seems
 to prevent this (and some other problems):

 http://cdn.netbsd.org/pub/NetBSD/misc/mlelstv/xhci.diff


From: matthew green <mrg@eterna.com.au>
To: gnats-bugs@netbsd.org, mlelstv@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org,
    netbsd-bugs@netbsd.org, abs@absd.org
Subject: re: kern/57255: usbdi SIMPLEQ_FIRST(&pipe->up_queue) panic in NetBSD-10
Date: Thu, 01 Jun 2023 04:18:58 +1000

 >  http://cdn.netbsd.org/pub/NetBSD/misc/mlelstv/xhci.diff

 FWIW, i've been running with this patch on several systems for a few
 weeks now, without problem.  including that now-working usb audio2
 device Michael linked me this patch for...

 any reason not to commit?


 .mrg.

From: Michael van Elst <mlelstv@serpens.de>
To: matthew green <mrg@eterna.com.au>
Cc: gnats-bugs@netbsd.org, mlelstv@netbsd.org, kern-bug-people@netbsd.org,
	gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, abs@absd.org
Subject: Re: kern/57255: usbdi SIMPLEQ_FIRST(&pipe->up_queue) panic in
 NetBSD-10
Date: Wed, 31 May 2023 21:51:55 +0200

 On Thu, Jun 01, 2023 at 04:18:58AM +1000, matthew green wrote:
 > >  http://cdn.netbsd.org/pub/NetBSD/misc/mlelstv/xhci.diff
 > 
 > FWIW, i've been running with this patch on several systems for a few
 > weeks now, without problem.  including that now-working usb audio2
 > device Michael linked me this patch for...
 > 
 > any reason not to commit?

 The author of the original patch (sc.dying) seems to think it is not ready
 for comitting....

 Someone with better xhci-knowledge should at least review it.


 -- 
                                 Michael van Elst
 Internet: mlelstv@serpens.de
                                 "A potential Snark may lurk in every tree."

Home	PR Database Search