Re: kern/56115: uvideo does not work on rpi4

[sc.dying%gmail.com@localhost]

On 2021/07/10 9:40, Michael van Elst wrote:
> The following reply was made to PR kern/56115; it has been noted by GNATS.
> 
> From: mlelstv%serpens.de@localhost (Michael van Elst)
> To: gnats-bugs%netbsd.org@localhost
> Cc: 
> Subject: Re: kern/56115: uvideo does not work on rpi4
> Date: Sat, 10 Jul 2021 09:38:32 -0000 (UTC)
> 
>  mlelstv%serpens.de@localhost (Michael van Elst) writes:
>  
>  >The following reply was made to PR kern/56115; it has been noted by GNATS.
>  
>  >From: mlelstv%serpens.de@localhost (Michael van Elst)
>  >To: gnats-bugs%netbsd.org@localhost
>  >Cc: 
>  >Subject: Re: kern/56115: uvideo does not work on rpi4
>  >Date: Sat, 10 Jul 2021 07:22:50 -0000 (UTC)
>  
>  > sc.dying%gmail.com@localhost writes:
>  > 
>  > >Currently Max ESIT Payload in periodic endpoint context is 0.
>  > >VL805 on rpi4 strictly treats this value as an upper limit of transfer
>  > >size for periodic endpoint, so the xfer fails with Bandwidth Overrun Error.
>  > 
>  > >Attached diff should fix it.
>  > 
>  > Also fixes USB audio.
>  > 
>  
>  
>  But it probably exposes a different issue then (uaudio has some
>  extra debug output):
>  
>  [  9769.030793] audio0(uaudio0): trigger_input failed: errno=5
>  
>  EIO. Either uaudio_chan_open() or uaudio_chan_alloc_buffers() failed.

Depending on size of buffer, large allocation may fail because of
fragmented DMA buffer.

>  
>  [  9769.030793] audio0(uaudio0): audio_drain: device timeout, seq=7, usrbuf=46336/H69120, outbuf=2880/11520
>  [  9769.030793] uaudio0: ptransfer error 6
>  
>  That's USBD_CANCELLED.
>  
>  
>  [  9769.030793] panic: kernel diagnostic assertion "xfer == SIMPLEQ_FIRST(&pipe->up_queue)" failed: file "/scratch/netbsd-current/src/sys/dev/usb/usbdi.c", line 1050 xfer 0xffff0000d6f2e580 is not start of queue (0xffff0000d6f2e440 is at start)
>  [  9769.030793] cpu0: Begin traceback...
>  [  9769.030793] trace fp ffffc0009de17af0
>  [  9769.030793] fp ffffc0009de17b20 vpanic() at ffffc0000056b5bc netbsd:vpanic+0x14c
>  [  9769.030793] fp ffffc0009de17b80 kern_assert() at ffffc000007dea88 netbsd:kern_assert+0x58
>  [  9769.030793] fp ffffc0009de17c10 usb_transfer_complete() at ffffc00000141600 netbsd:usb_transfer_complete+0x38c
>  [  9769.030793] fp ffffc0009de17c50 xhci_softintr() at ffffc000001ef69c netbsd:xhci_softintr+0x478
>  [  9769.030793] fp ffffc0009de17cd0 usb_soft_intr() at ffffc0000013d368 netbsd:usb_soft_intr+0x24
>  [  9769.030793] fp ffffc0009de17d30 softint_dispatch() at ffffc00000534fe0 netbsd:softint_dispatch+0xe0
>  [  9769.030793] fp ffffc0009dda8cc0 cpu_switchto_softint() at ffffc000000a5800 netbsd:cpu_switchto_softint+0x70
>  [  9769.030793] fp 0000000000000000 max_watchpoint() at ffffc00000c466fc ffffc00000c466fc
>  [  9769.030793] cpu0: End traceback...

I think this is an another problem.

https://mail-index.netbsd.org/netbsd-bugs/2021/04/28/msg071340.html

> Does xhci_event_transfer() forget to increment xx_isoc_done and
> avoid calling usb_transfer_comeplete() in error paths?
> When an error occurs while isoc transfer, i.e. completion code is not
> SUCCESS nor SHORT_PKT, usb_transfer_comeplete is called without
> incrementing xx_isoc_done and the xfer is removed from up_queue.
> Then, usb_transfer_comeplete is called at the last of transferring
> ux_frlengths[], but it cannot find the xfer in up_queue and fires KASSERT.

I managed to fix by following patch but it was incomplete.
The fix should also take care of MISSED_SRV, RING_UNDERRUN and RING_OVERRUN
errors.

--- src/sys/dev/usb/xhci.c.orig	2021-01-05 22:12:39.918386246 +0000
+++ src/sys/dev/usb/xhci.c	2021-04-28 22:13:30.751444109 +0000
@@ -2050,8 +2050,6 @@ xhci_event_transfer(struct xhci_softc * 
 			xfer->ux_frlengths[xx->xx_isoc_done] -=
 			    XHCI_TRB_2_REM_GET(trb_2);
 			xfer->ux_actlen += xfer->ux_frlengths[xx->xx_isoc_done];
-			if (++xx->xx_isoc_done < xfer->ux_nframes)
-				return;
 		} else
 		if ((trb_3 & XHCI_TRB_3_ED_BIT) == 0) {
 			if (xfer->ux_actlen == 0)
@@ -2107,6 +2105,19 @@ xhci_event_transfer(struct xhci_softc * 
 		break;
 	}
 
+	if (xfertype == UE_ISOCHRONOUS) {
+		switch (trbcode) {
+		case XHCI_TRB_ERROR_SHORT_PKT:
+		case XHCI_TRB_ERROR_SUCCESS:
+			break;
+		default:
+			xfer->ux_frlengths[xx->xx_isoc_done] = 0;
+			break;
+		}
+		if (++xx->xx_isoc_done < xfer->ux_nframes)
+			return;
+	}
+
 	/*
 	 * Try to claim this xfer for completion.  If it has already
 	 * completed or aborted, drop it on the floor.