Re: kern/56115: uvideo does not work on rpi4

[sc.dying%gmail.com@localhost]

The following reply was made to PR kern/56115; it has been noted by GNATS.

From: sc.dying%gmail.com@localhost
To: gnats-bugs%netbsd.org@localhost, kern-bug-people%netbsd.org@localhost,
 gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/56115: uvideo does not work on rpi4
Date: Sat, 10 Jul 2021 13:29:53 +0000

 On 2021/07/10 9:40, Michael van Elst wrote:
 > The following reply was made to PR kern/56115; it has been noted by GNATS.
 > 
 > From: mlelstv%serpens.de@localhost (Michael van Elst)
 > To: gnats-bugs%netbsd.org@localhost
 > Cc: 
 > Subject: Re: kern/56115: uvideo does not work on rpi4
 > Date: Sat, 10 Jul 2021 09:38:32 -0000 (UTC)
 > 
 >  mlelstv%serpens.de@localhost (Michael van Elst) writes:
 >  
 >  >The following reply was made to PR kern/56115; it has been noted by GNATS.
 >  
 >  >From: mlelstv%serpens.de@localhost (Michael van Elst)
 >  >To: gnats-bugs%netbsd.org@localhost
 >  >Cc: 
 >  >Subject: Re: kern/56115: uvideo does not work on rpi4
 >  >Date: Sat, 10 Jul 2021 07:22:50 -0000 (UTC)
 >  
 >  > sc.dying%gmail.com@localhost writes:
 >  > 
 >  > >Currently Max ESIT Payload in periodic endpoint context is 0.
 >  > >VL805 on rpi4 strictly treats this value as an upper limit of transfer
 >  > >size for periodic endpoint, so the xfer fails with Bandwidth Overrun Error.
 >  > 
 >  > >Attached diff should fix it.
 >  > 
 >  > Also fixes USB audio.
 >  > 
 >  
 >  
 >  But it probably exposes a different issue then (uaudio has some
 >  extra debug output):
 >  
 >  [  9769.030793] audio0(uaudio0): trigger_input failed: errno=5
 >  
 >  EIO. Either uaudio_chan_open() or uaudio_chan_alloc_buffers() failed.
 
 Depending on size of buffer, large allocation may fail because of
 fragmented DMA buffer.
 
 >  
 >  [  9769.030793] audio0(uaudio0): audio_drain: device timeout, seq=7, usrbuf=46336/H69120, outbuf=2880/11520
 >  [  9769.030793] uaudio0: ptransfer error 6
 >  
 >  That's USBD_CANCELLED.
 >  
 >  
 >  [  9769.030793] panic: kernel diagnostic assertion "xfer == SIMPLEQ_FIRST(&pipe->up_queue)" failed: file "/scratch/netbsd-current/src/sys/dev/usb/usbdi.c", line 1050 xfer 0xffff0000d6f2e580 is not start of queue (0xffff0000d6f2e440 is at start)
 >  [  9769.030793] cpu0: Begin traceback...
 >  [  9769.030793] trace fp ffffc0009de17af0
 >  [  9769.030793] fp ffffc0009de17b20 vpanic() at ffffc0000056b5bc netbsd:vpanic+0x14c
 >  [  9769.030793] fp ffffc0009de17b80 kern_assert() at ffffc000007dea88 netbsd:kern_assert+0x58
 >  [  9769.030793] fp ffffc0009de17c10 usb_transfer_complete() at ffffc00000141600 netbsd:usb_transfer_complete+0x38c
 >  [  9769.030793] fp ffffc0009de17c50 xhci_softintr() at ffffc000001ef69c netbsd:xhci_softintr+0x478
 >  [  9769.030793] fp ffffc0009de17cd0 usb_soft_intr() at ffffc0000013d368 netbsd:usb_soft_intr+0x24
 >  [  9769.030793] fp ffffc0009de17d30 softint_dispatch() at ffffc00000534fe0 netbsd:softint_dispatch+0xe0
 >  [  9769.030793] fp ffffc0009dda8cc0 cpu_switchto_softint() at ffffc000000a5800 netbsd:cpu_switchto_softint+0x70
 >  [  9769.030793] fp 0000000000000000 max_watchpoint() at ffffc00000c466fc ffffc00000c466fc
 >  [  9769.030793] cpu0: End traceback...
 
 I think this is an another problem.
 
 https://mail-index.netbsd.org/netbsd-bugs/2021/04/28/msg071340.html
 
 > Does xhci_event_transfer() forget to increment xx_isoc_done and
 > avoid calling usb_transfer_comeplete() in error paths?
 > When an error occurs while isoc transfer, i.e. completion code is not
 > SUCCESS nor SHORT_PKT, usb_transfer_comeplete is called without
 > incrementing xx_isoc_done and the xfer is removed from up_queue.
 > Then, usb_transfer_comeplete is called at the last of transferring
 > ux_frlengths[], but it cannot find the xfer in up_queue and fires KASSERT.
 
 I managed to fix by following patch but it was incomplete.
 The fix should also take care of MISSED_SRV, RING_UNDERRUN and RING_OVERRUN
 errors.
 
 --- src/sys/dev/usb/xhci.c.orig	2021-01-05 22:12:39.918386246 +0000
 +++ src/sys/dev/usb/xhci.c	2021-04-28 22:13:30.751444109 +0000
 @@ -2050,8 +2050,6 @@ xhci_event_transfer(struct xhci_softc * 
  			xfer->ux_frlengths[xx->xx_isoc_done] -=
  			    XHCI_TRB_2_REM_GET(trb_2);
  			xfer->ux_actlen += xfer->ux_frlengths[xx->xx_isoc_done];
 -			if (++xx->xx_isoc_done < xfer->ux_nframes)
 -				return;
  		} else
  		if ((trb_3 & XHCI_TRB_3_ED_BIT) == 0) {
  			if (xfer->ux_actlen == 0)
 @@ -2107,6 +2105,19 @@ xhci_event_transfer(struct xhci_softc * 
  		break;
  	}
  
 +	if (xfertype == UE_ISOCHRONOUS) {
 +		switch (trbcode) {
 +		case XHCI_TRB_ERROR_SHORT_PKT:
 +		case XHCI_TRB_ERROR_SUCCESS:
 +			break;
 +		default:
 +			xfer->ux_frlengths[xx->xx_isoc_done] = 0;
 +			break;
 +		}
 +		if (++xx->xx_isoc_done < xfer->ux_nframes)
 +			return;
 +	}
 +
  	/*
  	 * Try to claim this xfer for completion.  If it has already
  	 * completed or aborted, drop it on the floor.