dev/usb/xhci.c, assertion "sc->sc_cmd_trb == trb" failed

classic Classic list List threaded Threaded
3 messages Options
Reply | Threaded
Open this post in threaded view
|

dev/usb/xhci.c, assertion "sc->sc_cmd_trb == trb" failed

Stuart Henderson
I have a uaudio that sometimes detaches/reattaches itself from my
workstation. I think it maybe a problem with the cable, anyway the
more interesting thing is that this acts as a "chaos monkey" and seems
good at triggering problems in various parts of the stack :)

Here's an xhci panic I encountered after a detach.

Unfortunately I pressed enter at the ddb prompt and it went straight to
"syncing disks..." before I collected more information from ddb, but
I'm sending what I have.

audio1 detached
uaudio0 detached
uhid0 detached
uhidev0 detached
uaudio0 at uhub7 port 3 configuration 1 interface 1 "GN Netcom GN 9350" rev 2.00/1.00 addr 14
uaudio0: class v1, full-speed, sync, channels: 1 play, 1 rec, 4 ctls
audio1 at uaudio0
uhidev0 at uhub7 port 3 configuration 1 interface 3 "GN Netcom GN 9350" rev 2.00/1.00 addr 14
uhidev0: iclass 3/0
uhid0 at uhidev0: input=2, output=2, feature=0
audio1 detached
uaudio0 detached
uhid0 detached
uhidev0 detached
panic: kernel diagnostic assertion "sc->sc_cmd_trb == trb" failed: file "/sys/dev/usb/xhci.c", line 1052
Stopped at      db_enter+0x10:  popq    %rbp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
db_enter() at db_enter+0x10
panic(ffffffff81de8bf3) at panic+0x128
__assert(ffffffff81e4f198,ffffffff81dda9a5,41c,ffffffff81e4bfc7) at __assert+0x2b
xhci_event_command(ffff800000128000,d2f77020) at xhci_event_command+0x2ff
xhci_event_dequeue(ffff800000128000) at xhci_event_dequeue+0x12d
xhci_softintr(ffff800000128000) at xhci_softintr+0x2d
softintr_dispatch(1) at softintr_dispatch+0xf2
Xsoftnet() at Xsoftnet+0x1f
acpicpu_idle() at acpicpu_idle+0x1e9
sched_idle(ffffffff82103ff0) at sched_idle+0x225
end trace frame: 0x0, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> [-- sthen@localhost attached -- Sat Jun 27 11:36:27 2020]
syncing disks...

Copyright (c) 1982, 1986, 1989, 1991, 1993
        The Regents of the University of California.  All rights reserved.
Copyright (c) 1995-2020 OpenBSD. All rights reserved.  https://www.OpenBSD.org

OpenBSD 6.7-current (GENERIC.MP) #8: Sun Jun 21 18:08:58 BST 2020
    [hidden email]:/sys/arch/amd64/compile/GENERIC.MP
real mem = 34247069696 (32660MB)
avail mem = 33194196992 (31656MB)
random: good seed from bootblocks
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 2.7 @ 0xec400 (92 entries)
bios0: vendor Dell Inc. version "A12" date 05/11/2017
bios0: Dell Inc. PowerEdge T20
acpi0 at bios0: ACPI 5.0
acpi0: sleep states S0 S4 S5
acpi0: tables DSDT FACP APIC FPDT SLIC LPIT SSDT SSDT SSDT HPET SSDT MCFG SSDT ASF! DMAR
acpi0: wakeup devices UAR1(S4) RP01(S4) PXSX(S4) RP02(S4) PXSX(S4) PXSX(S4) RP05(S4) PXSX(S4) PXSX(S4) PXSX(S4) PXSX(S4) GLAN(S4) EHC1(S3) EHC2(S3) XHC_(S4) HDEF(S4) [...]
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz, 3392.64 MHz, 06-3c-03
cpu0: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,MD_CLEAR,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,MELTDOWN
cpu0: 256KB 64b/line 8-way L2 cache
tsc_timecounter_init: TSC skew=0 observed drift=0
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 10 var ranges, 88 fixed ranges
cpu0: apic clock running at 99MHz
cpu0: mwait min=64, max=64, C-substates=0.2.1.2.4, IBE
cpu1 at mainbus0: apid 2 (application processor)
TSC skew=-39
cpu1: Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz, 3392.17 MHz, 06-3c-03
cpu1: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,MD_CLEAR,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,MELTDOWN
cpu1: 256KB 64b/line 8-way L2 cache
tsc_timecounter_init: TSC skew=-39 observed drift=0
cpu1: smt 0, core 1, package 0
cpu2 at mainbus0: apid 4 (application processor)
TSC skew=-30
cpu2: Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz, 3392.17 MHz, 06-3c-03
cpu2: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,MD_CLEAR,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,MELTDOWN
cpu2: 256KB 64b/line 8-way L2 cache
tsc_timecounter_init: TSC skew=-30 observed drift=0
cpu2: smt 0, core 2, package 0
cpu3 at mainbus0: apid 6 (application processor)
TSC skew=-38
cpu3: Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz, 3392.16 MHz, 06-3c-03
cpu3: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,MD_CLEAR,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,MELTDOWN
cpu3: 256KB 64b/line 8-way L2 cache
tsc_timecounter_init: TSC skew=-38 observed drift=0
cpu3: smt 0, core 3, package 0
ioapic0 at mainbus0: apid 8 pa 0xfec00000, version 20, 24 pins
acpihpet0 at acpi0: 14318179 Hz
acpimcfg0 at acpi0
acpimcfg0: addr 0xf8000000, bus 0-63
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus 2 (RP01)
acpiprt2 at acpi0: bus 3 (RP02)
acpiprt3 at acpi0: bus 5 (RP05)
acpiprt4 at acpi0: bus 1 (PEG0)
acpiprt5 at acpi0: bus -1 (PEG1)
acpiprt6 at acpi0: bus -1 (PEG2)
acpiec0 at acpi0: not present
acpicpu0 at acpi0: C2(200@148 mwait.1@0x33), C1(1000@1 mwait.1), PSS
acpicpu1 at acpi0: C2(200@148 mwait.1@0x33), C1(1000@1 mwait.1), PSS
acpicpu2 at acpi0: C2(200@148 mwait.1@0x33), C1(1000@1 mwait.1), PSS
acpicpu3 at acpi0: C2(200@148 mwait.1@0x33), C1(1000@1 mwait.1), PSS
acpitz0 at acpi0: critical temperature is 105 degC
acpitz1 at acpi0: critical temperature is 105 degC
acpipci0 at acpi0 PCI0: 0x00000000 0x00000011 0x00000001
extent `acpipci0 pcibus' (0x0 - 0xff), flags=0
     0x3f - 0xff
extent `acpipci0 pciio' (0x0 - 0xffffffff), flags=0
     0xcf8 - 0xcff
     0x10000 - 0xffffffff
extent `acpipci0 pcimem' (0x0 - 0xffffffffffffffff), flags=0
     0x0 - 0x9ffff
     0xc0000 - 0xd3fff
     0xe8000 - 0xdf1fffff
     0xfeb00000 - 0xffffffffffffffff
acpicmos0 at acpi0
acpibtn0 at acpi0: PWRB
"PNP0C14" at acpi0 not configured
acpivideo0 at acpi0: GFX0
acpivout0 at acpivideo0: DD1F
cpu0: using VERW MDS workaround (except on vmm entry)
cpu0: Enhanced SpeedStep 3392 MHz: speeds: 3201, 3200, 3000, 2900, 2700, 2500, 2300, 2200, 2000, 1800, 1700, 1500, 1300, 1100, 1000, 800 MHz
pci0 at mainbus0 bus 0
pchb0 at pci0 dev 0 function 0 "Intel Xeon E3-1200 v3 Host" rev 0x06
ppb0 at pci0 dev 1 function 0 "Intel Core 4G PCIE" rev 0x06: msi
pci1 at ppb0 bus 1
em0 at pci1 dev 0 function 0 "Intel 82572EI" rev 0x06: apic 8 int 16, address 00:15:17:8e:79:85
inteldrm0 at pci0 dev 2 function 0 "Intel HD Graphics P4600" rev 0x06
drm0 at inteldrm0
inteldrm0: msi, HASWELL, gen 7
xhci0 at pci0 dev 20 function 0 "Intel 8 Series xHCI" rev 0x04: msi, xHCI 1.0
usb0 at xhci0: USB revision 3.0
uhub0 at usb0 configuration 1 interface 0 "Intel xHCI root hub" rev 3.00/1.00 addr 1
"Intel 8 Series MEI" rev 0x04 at pci0 dev 22 function 0 not configured
puc0 at pci0 dev 22 function 3 "Intel 8 Series KT" rev 0x04: ports: 16 com
com4 at puc0 port 0 apic 8 int 19: ns16550a, 16 byte fifo
com4: probed fifo depth: 0 bytes
em1 at pci0 dev 25 function 0 "Intel I217-LM" rev 0x04: msi, address f8:b1:56:ac:32:76
ehci0 at pci0 dev 26 function 0 "Intel 8 Series USB" rev 0x04: apic 8 int 16
usb1 at ehci0: USB revision 2.0
uhub1 at usb1 configuration 1 interface 0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
azalia0 at pci0 dev 27 function 0 "Intel 8 Series HD Audio" rev 0x04: msi
azalia0: codecs: Realtek/0x0280
audio0 at azalia0
ppb1 at pci0 dev 28 function 0 "Intel 8 Series PCIE" rev 0xd4
pci2 at ppb1 bus 2
ppb2 at pci0 dev 28 function 1 "Intel 8 Series PCIE" rev 0xd4: msi
pci3 at ppb2 bus 3
ppb3 at pci3 dev 0 function 0 "TI XIO2001 PCIE-PCI" rev 0x00
pci4 at ppb3 bus 4
ppb4 at pci0 dev 28 function 4 "Intel 8 Series PCIE" rev 0xd4: msi
pci5 at ppb4 bus 5
nvme0 at pci5 dev 0 function 0 "Samsung SM961/PM961 NVMe" rev 0x00: msix, NVMe 1.2
nvme0: SAMSUNG MZVLW256HEHP-000L7, firmware 4L7QCXB7, serial S35ENX0J765205
scsibus1 at nvme0: 2 targets, initiator 0
sd0 at scsibus1 targ 1 lun 0: <NVMe, SAMSUNG MZVLW256, 4L7Q>
sd0: 244198MB, 512 bytes/sector, 500118192 sectors
ehci1 at pci0 dev 29 function 0 "Intel 8 Series USB" rev 0x04: apic 8 int 23
usb2 at ehci1: USB revision 2.0
uhub2 at usb2 configuration 1 interface 0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
pcib0 at pci0 dev 31 function 0 "Intel C226 LPC" rev 0x04
ahci0 at pci0 dev 31 function 2 "Intel 8 Series AHCI" rev 0x04: msi, AHCI 1.3
ahci0: port 0: 6.0Gb/s
scsibus2 at ahci0: 32 targets
sd1 at scsibus2 targ 0 lun 0: <ATA, Samsung SSD 860, RVT0> naa.5002538e9984204d
sd1: 476940MB, 512 bytes/sector, 976773168 sectors, thin
ichiic0 at pci0 dev 31 function 3 "Intel 8 Series SMBus" rev 0x04: apic 8 int 18
iic0 at ichiic0
sdtemp0 at iic0 addr 0x18: stts2002
sdtemp1 at iic0 addr 0x19: stts2002
sdtemp2 at iic0 addr 0x1a: stts2002
sdtemp3 at iic0 addr 0x1b: stts2002
spdmem0 at iic0 addr 0x50: 8GB DDR3 SDRAM ECC PC3-12800 with thermal sensor
spdmem1 at iic0 addr 0x51: 8GB DDR3 SDRAM ECC PC3-12800 with thermal sensor
spdmem2 at iic0 addr 0x52: 8GB DDR3 SDRAM ECC PC3-12800 with thermal sensor
spdmem3 at iic0 addr 0x53: 8GB DDR3 SDRAM ECC PC3-12800 with thermal sensor
isa0 at pcib0
isadma0 at isa0
com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
com0: console
pckbc0 at isa0 port 0x60/5 irq 1 irq 12
pckbd0 at pckbc0 (kbd slot)
wskbd0 at pckbd0 mux 1
vga0 at isa0 port 0x3b0/48 iomem 0xa0000/131072
wsdisplay at vga0 not configured
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
vmm0 at mainbus0: VMX/EPT
uhub3 at uhub0 port 3 configuration 1 interface 0 "Genesys Logic USB2.0 Hub" rev 2.00/77.64 addr 2
uhub4 at uhub3 port 4 configuration 1 interface 0 "Genesys Logic USB2.0 Hub" rev 2.00/77.64 addr 3
uhub5 at uhub0 port 4 configuration 1 interface 0 "Texas Instruments product 0x8142" rev 2.10/1.00 addr 4
uhub6 at uhub5 port 4 configuration 1 interface 0 "Texas Instruments product 0x8142" rev 2.10/1.00 addr 5
uhub7 at uhub0 port 5 configuration 1 interface 0 "GenesysLogic USB2.0 Hub" rev 2.00/92.24 addr 6
uftdi0 at uhub7 port 1 configuration 1 interface 0 "FTDI FT232R USB UART" rev 2.00/6.00 addr 7
ucom0 at uftdi0 portno 1
uhub7: device problem, disabling port 2
uaudio0 at uhub7 port 3 configuration 1 interface 1 "GN Netcom GN 9350" rev 2.00/1.00 addr 8
uaudio0: failed to get ranges for level control
uaudio0: class v1, full-speed, sync, channels: 1 play, 1 rec, 3 ctls
audio1 at uaudio0
uhidev0 at uhub7 port 3 configuration 1 interface 3 "GN Netcom GN 9350" rev 2.00/1.00 addr 8
uhidev0: iclass 3/0
uhid0 at uhidev0: input=2, output=2, feature=0
uhidev1 at uhub7 port 4 configuration 1 interface 0 "Yubico Yubico Yubikey II" rev 2.00/2.12 addr 9
uhidev1: iclass 3/1
ukbd0 at uhidev1: 8 variable keys, 6 key codes
wskbd1 at ukbd0 mux 1
umass0 at uhub0 port 6 configuration 1 interface 0 "Realtek USB3.0 Card Reader" rev 2.10/1.32 addr 10
umass0: using SCSI over Bulk-Only
scsibus3 at umass0: 2 targets, initiator 0
sd2 at scsibus3 targ 1 lun 0: <Generic-, USB3.0 CRW-CF/MD, 1.00> removable
sd3 at scsibus3 targ 1 lun 1: <Generic-, USB3.0 CRW-SM/xD, 1.00> removable
sd4 at scsibus3 targ 1 lun 2: <Generic-, USB3.0 CRW-SD, 1.00> removable
sd5 at scsibus3 targ 1 lun 3: <Generic-, USB3.0 CRW-MS, 1.00> removable
sd6 at scsibus3 targ 1 lun 4: <Generic-, USB3.0 CRW-SD/MS, 1.00> removable
uhidev2 at uhub0 port 10 configuration 1 interface 0 "Lite-On Technology Corp. ThinkPad USB Keyboard with TrackPoint" rev 1.10/1.27 addr 11
uhidev2: iclass 3/1
ukbd1 at uhidev2: 8 variable keys, 6 key codes
wskbd2 at ukbd1 mux 1
uhidev3 at uhub0 port 10 configuration 1 interface 1 "Lite-On Technology Corp. ThinkPad USB Keyboard with TrackPoint" rev 1.10/1.27 addr 11
uhidev3: iclass 3/0, 4 report ids
ums0 at uhidev3 reportid 1: 3 buttons
wsmouse0 at ums0 mux 0
uhid1 at uhidev3 reportid 2: input=1, output=0, feature=0
uhid2 at uhidev3 reportid 3: input=3, output=1, feature=0
uhid3 at uhidev3 reportid 4: input=0, output=0, feature=4
uhidev4 at uhub0 port 11 configuration 1 interface 0 "LIEBERT PowerSure Personal XT" rev 1.10/0.00 addr 12
uhidev4: iclass 3/0, 22 report ids
upd0 at uhidev4
uhub8 at uhub0 port 21 configuration 1 interface 0 "Texas Instruments product 0x8140" rev 3.00/1.00 addr 13
uhub9 at uhub8 port 4 configuration 1 interface 0 "Texas Instruments product 0x8140" rev 3.00/1.00 addr 14
uhub10 at uhub1 port 1 configuration 1 interface 0 "Intel Rate Matching Hub" rev 2.00/0.04 addr 2
uhub11 at uhub2 port 1 configuration 1 interface 0 "Intel Rate Matching Hub" rev 2.00/0.04 addr 2
vscsi0 at root
scsibus4 at vscsi0: 256 targets
softraid0 at root
scsibus5 at softraid0: 256 targets
root on sd1a (2b4432fd9000a5b7.a) swap on sd1b dump on sd1b
inteldrm0: 1920x1200, 32bpp
wsdisplay0 at inteldrm0 mux 1
pckbd_enable: command error
wskbd1: connecting to wsdisplay0
wskbd2: connecting to wsdisplay0
wsdisplay0: screen 0-5 added (std, vt100 emulation)
Automatic boot in progress: starting file system checks.

Reply | Threaded
Open this post in threaded view
|

Re: dev/usb/xhci.c, assertion "sc->sc_cmd_trb == trb" failed

Gerhard Roth-2
Hi Stuart,

what happens here is that the timeout kicks in and xhci_command_submit()
resets sc_cmd_trb to NULL. But that doesn't retire the TRB that is still
active in the controller and when it is done later, the KASSERT() in
xhci_event_command() is bound to fail.

My proposed fix would be:

1) xhci_event_command() should just ignore events from a TRB that is not
        the expected (sc_cmd_trb) one.

2) xhci_command_submit() should abort the TRB in case a timeout happened
        and thus prevent the interrupt from happening later on. For this
        we shouldn't give up the CPU in xhci_command_abort(). Therefore
        replace usb_delay_ms() with DELAY().

Another problem would be that the softintr can kick in after the timeout
already happened but before the context of xhci_command_submit() is
scheduled. In that case, xhci_command_submit() should accept that
sc_cmd_trb is NULL even though there was a timeout.

Could you please try the patch at the end of this mail to see if it
fixes your problem.

Gerhard


On Mon, 29 Jun 2020 12:31:47 +0100 Stuart Henderson <[hidden email]> wrote:

> I have a uaudio that sometimes detaches/reattaches itself from my
> workstation. I think it maybe a problem with the cable, anyway the
> more interesting thing is that this acts as a "chaos monkey" and seems
> good at triggering problems in various parts of the stack :)
>
> Here's an xhci panic I encountered after a detach.
>
> Unfortunately I pressed enter at the ddb prompt and it went straight to
> "syncing disks..." before I collected more information from ddb, but
> I'm sending what I have.
>
> audio1 detached
> uaudio0 detached
> uhid0 detached
> uhidev0 detached
> uaudio0 at uhub7 port 3 configuration 1 interface 1 "GN Netcom GN 9350" rev 2.00/1.00 addr 14
> uaudio0: class v1, full-speed, sync, channels: 1 play, 1 rec, 4 ctls
> audio1 at uaudio0
> uhidev0 at uhub7 port 3 configuration 1 interface 3 "GN Netcom GN 9350" rev 2.00/1.00 addr 14
> uhidev0: iclass 3/0
> uhid0 at uhidev0: input=2, output=2, feature=0
> audio1 detached
> uaudio0 detached
> uhid0 detached
> uhidev0 detached
> panic: kernel diagnostic assertion "sc->sc_cmd_trb == trb" failed: file "/sys/dev/usb/xhci.c", line 1052
> Stopped at      db_enter+0x10:  popq    %rbp
>     TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
> db_enter() at db_enter+0x10
> panic(ffffffff81de8bf3) at panic+0x128
> __assert(ffffffff81e4f198,ffffffff81dda9a5,41c,ffffffff81e4bfc7) at __assert+0x2b
> xhci_event_command(ffff800000128000,d2f77020) at xhci_event_command+0x2ff
> xhci_event_dequeue(ffff800000128000) at xhci_event_dequeue+0x12d
> xhci_softintr(ffff800000128000) at xhci_softintr+0x2d
> softintr_dispatch(1) at softintr_dispatch+0xf2
> Xsoftnet() at Xsoftnet+0x1f
> acpicpu_idle() at acpicpu_idle+0x1e9
> sched_idle(ffffffff82103ff0) at sched_idle+0x225
> end trace frame: 0x0, count: 5
> https://www.openbsd.org/ddb.html describes the minimum info required in bug
> reports.  Insufficient info makes it difficult to find and fix bugs.
> ddb{0}> [-- sthen@localhost attached -- Sat Jun 27 11:36:27 2020]  
> syncing disks...
>
> Copyright (c) 1982, 1986, 1989, 1991, 1993
> The Regents of the University of California.  All rights reserved.
> Copyright (c) 1995-2020 OpenBSD. All rights reserved.  https://www.OpenBSD.org
>
> OpenBSD 6.7-current (GENERIC.MP) #8: Sun Jun 21 18:08:58 BST 2020
>     [hidden email]:/sys/arch/amd64/compile/GENERIC.MP
> real mem = 34247069696 (32660MB)
> avail mem = 33194196992 (31656MB)
> random: good seed from bootblocks
> mpath0 at root
> scsibus0 at mpath0: 256 targets
> mainbus0 at root
> bios0 at mainbus0: SMBIOS rev. 2.7 @ 0xec400 (92 entries)
> bios0: vendor Dell Inc. version "A12" date 05/11/2017
> bios0: Dell Inc. PowerEdge T20
> acpi0 at bios0: ACPI 5.0
> acpi0: sleep states S0 S4 S5
> acpi0: tables DSDT FACP APIC FPDT SLIC LPIT SSDT SSDT SSDT HPET SSDT MCFG SSDT ASF! DMAR
> acpi0: wakeup devices UAR1(S4) RP01(S4) PXSX(S4) RP02(S4) PXSX(S4) PXSX(S4) RP05(S4) PXSX(S4) PXSX(S4) PXSX(S4) PXSX(S4) GLAN(S4) EHC1(S3) EHC2(S3) XHC_(S4) HDEF(S4) [...]
> acpitimer0 at acpi0: 3579545 Hz, 24 bits
> acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
> cpu0 at mainbus0: apid 0 (boot processor)
> cpu0: Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz, 3392.64 MHz, 06-3c-03
> cpu0: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,MD_CLEAR,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,MELTDOWN
> cpu0: 256KB 64b/line 8-way L2 cache
> tsc_timecounter_init: TSC skew=0 observed drift=0
> cpu0: smt 0, core 0, package 0
> mtrr: Pentium Pro MTRR support, 10 var ranges, 88 fixed ranges
> cpu0: apic clock running at 99MHz
> cpu0: mwait min=64, max=64, C-substates=0.2.1.2.4, IBE
> cpu1 at mainbus0: apid 2 (application processor)
> TSC skew=-39
> cpu1: Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz, 3392.17 MHz, 06-3c-03
> cpu1: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,MD_CLEAR,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,MELTDOWN
> cpu1: 256KB 64b/line 8-way L2 cache
> tsc_timecounter_init: TSC skew=-39 observed drift=0
> cpu1: smt 0, core 1, package 0
> cpu2 at mainbus0: apid 4 (application processor)
> TSC skew=-30
> cpu2: Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz, 3392.17 MHz, 06-3c-03
> cpu2: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,MD_CLEAR,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,MELTDOWN
> cpu2: 256KB 64b/line 8-way L2 cache
> tsc_timecounter_init: TSC skew=-30 observed drift=0
> cpu2: smt 0, core 2, package 0
> cpu3 at mainbus0: apid 6 (application processor)
> TSC skew=-38
> cpu3: Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz, 3392.16 MHz, 06-3c-03
> cpu3: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,MD_CLEAR,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,MELTDOWN
> cpu3: 256KB 64b/line 8-way L2 cache
> tsc_timecounter_init: TSC skew=-38 observed drift=0
> cpu3: smt 0, core 3, package 0
> ioapic0 at mainbus0: apid 8 pa 0xfec00000, version 20, 24 pins
> acpihpet0 at acpi0: 14318179 Hz
> acpimcfg0 at acpi0
> acpimcfg0: addr 0xf8000000, bus 0-63
> acpiprt0 at acpi0: bus 0 (PCI0)
> acpiprt1 at acpi0: bus 2 (RP01)
> acpiprt2 at acpi0: bus 3 (RP02)
> acpiprt3 at acpi0: bus 5 (RP05)
> acpiprt4 at acpi0: bus 1 (PEG0)
> acpiprt5 at acpi0: bus -1 (PEG1)
> acpiprt6 at acpi0: bus -1 (PEG2)
> acpiec0 at acpi0: not present
> acpicpu0 at acpi0: C2(200@148 mwait.1@0x33), C1(1000@1 mwait.1), PSS
> acpicpu1 at acpi0: C2(200@148 mwait.1@0x33), C1(1000@1 mwait.1), PSS
> acpicpu2 at acpi0: C2(200@148 mwait.1@0x33), C1(1000@1 mwait.1), PSS
> acpicpu3 at acpi0: C2(200@148 mwait.1@0x33), C1(1000@1 mwait.1), PSS
> acpitz0 at acpi0: critical temperature is 105 degC
> acpitz1 at acpi0: critical temperature is 105 degC
> acpipci0 at acpi0 PCI0: 0x00000000 0x00000011 0x00000001
> extent `acpipci0 pcibus' (0x0 - 0xff), flags=0
>      0x3f - 0xff
> extent `acpipci0 pciio' (0x0 - 0xffffffff), flags=0
>      0xcf8 - 0xcff
>      0x10000 - 0xffffffff
> extent `acpipci0 pcimem' (0x0 - 0xffffffffffffffff), flags=0
>      0x0 - 0x9ffff
>      0xc0000 - 0xd3fff
>      0xe8000 - 0xdf1fffff
>      0xfeb00000 - 0xffffffffffffffff
> acpicmos0 at acpi0
> acpibtn0 at acpi0: PWRB
> "PNP0C14" at acpi0 not configured
> acpivideo0 at acpi0: GFX0
> acpivout0 at acpivideo0: DD1F
> cpu0: using VERW MDS workaround (except on vmm entry)
> cpu0: Enhanced SpeedStep 3392 MHz: speeds: 3201, 3200, 3000, 2900, 2700, 2500, 2300, 2200, 2000, 1800, 1700, 1500, 1300, 1100, 1000, 800 MHz
> pci0 at mainbus0 bus 0
> pchb0 at pci0 dev 0 function 0 "Intel Xeon E3-1200 v3 Host" rev 0x06
> ppb0 at pci0 dev 1 function 0 "Intel Core 4G PCIE" rev 0x06: msi
> pci1 at ppb0 bus 1
> em0 at pci1 dev 0 function 0 "Intel 82572EI" rev 0x06: apic 8 int 16, address 00:15:17:8e:79:85
> inteldrm0 at pci0 dev 2 function 0 "Intel HD Graphics P4600" rev 0x06
> drm0 at inteldrm0
> inteldrm0: msi, HASWELL, gen 7
> xhci0 at pci0 dev 20 function 0 "Intel 8 Series xHCI" rev 0x04: msi, xHCI 1.0
> usb0 at xhci0: USB revision 3.0
> uhub0 at usb0 configuration 1 interface 0 "Intel xHCI root hub" rev 3.00/1.00 addr 1
> "Intel 8 Series MEI" rev 0x04 at pci0 dev 22 function 0 not configured
> puc0 at pci0 dev 22 function 3 "Intel 8 Series KT" rev 0x04: ports: 16 com
> com4 at puc0 port 0 apic 8 int 19: ns16550a, 16 byte fifo
> com4: probed fifo depth: 0 bytes
> em1 at pci0 dev 25 function 0 "Intel I217-LM" rev 0x04: msi, address f8:b1:56:ac:32:76
> ehci0 at pci0 dev 26 function 0 "Intel 8 Series USB" rev 0x04: apic 8 int 16
> usb1 at ehci0: USB revision 2.0
> uhub1 at usb1 configuration 1 interface 0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
> azalia0 at pci0 dev 27 function 0 "Intel 8 Series HD Audio" rev 0x04: msi
> azalia0: codecs: Realtek/0x0280
> audio0 at azalia0
> ppb1 at pci0 dev 28 function 0 "Intel 8 Series PCIE" rev 0xd4
> pci2 at ppb1 bus 2
> ppb2 at pci0 dev 28 function 1 "Intel 8 Series PCIE" rev 0xd4: msi
> pci3 at ppb2 bus 3
> ppb3 at pci3 dev 0 function 0 "TI XIO2001 PCIE-PCI" rev 0x00
> pci4 at ppb3 bus 4
> ppb4 at pci0 dev 28 function 4 "Intel 8 Series PCIE" rev 0xd4: msi
> pci5 at ppb4 bus 5
> nvme0 at pci5 dev 0 function 0 "Samsung SM961/PM961 NVMe" rev 0x00: msix, NVMe 1.2
> nvme0: SAMSUNG MZVLW256HEHP-000L7, firmware 4L7QCXB7, serial S35ENX0J765205
> scsibus1 at nvme0: 2 targets, initiator 0
> sd0 at scsibus1 targ 1 lun 0: <NVMe, SAMSUNG MZVLW256, 4L7Q>
> sd0: 244198MB, 512 bytes/sector, 500118192 sectors
> ehci1 at pci0 dev 29 function 0 "Intel 8 Series USB" rev 0x04: apic 8 int 23
> usb2 at ehci1: USB revision 2.0
> uhub2 at usb2 configuration 1 interface 0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
> pcib0 at pci0 dev 31 function 0 "Intel C226 LPC" rev 0x04
> ahci0 at pci0 dev 31 function 2 "Intel 8 Series AHCI" rev 0x04: msi, AHCI 1.3
> ahci0: port 0: 6.0Gb/s
> scsibus2 at ahci0: 32 targets
> sd1 at scsibus2 targ 0 lun 0: <ATA, Samsung SSD 860, RVT0> naa.5002538e9984204d
> sd1: 476940MB, 512 bytes/sector, 976773168 sectors, thin
> ichiic0 at pci0 dev 31 function 3 "Intel 8 Series SMBus" rev 0x04: apic 8 int 18
> iic0 at ichiic0
> sdtemp0 at iic0 addr 0x18: stts2002
> sdtemp1 at iic0 addr 0x19: stts2002
> sdtemp2 at iic0 addr 0x1a: stts2002
> sdtemp3 at iic0 addr 0x1b: stts2002
> spdmem0 at iic0 addr 0x50: 8GB DDR3 SDRAM ECC PC3-12800 with thermal sensor
> spdmem1 at iic0 addr 0x51: 8GB DDR3 SDRAM ECC PC3-12800 with thermal sensor
> spdmem2 at iic0 addr 0x52: 8GB DDR3 SDRAM ECC PC3-12800 with thermal sensor
> spdmem3 at iic0 addr 0x53: 8GB DDR3 SDRAM ECC PC3-12800 with thermal sensor
> isa0 at pcib0
> isadma0 at isa0
> com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
> com0: console
> pckbc0 at isa0 port 0x60/5 irq 1 irq 12
> pckbd0 at pckbc0 (kbd slot)
> wskbd0 at pckbd0 mux 1
> vga0 at isa0 port 0x3b0/48 iomem 0xa0000/131072
> wsdisplay at vga0 not configured
> pcppi0 at isa0 port 0x61
> spkr0 at pcppi0
> vmm0 at mainbus0: VMX/EPT
> uhub3 at uhub0 port 3 configuration 1 interface 0 "Genesys Logic USB2.0 Hub" rev 2.00/77.64 addr 2
> uhub4 at uhub3 port 4 configuration 1 interface 0 "Genesys Logic USB2.0 Hub" rev 2.00/77.64 addr 3
> uhub5 at uhub0 port 4 configuration 1 interface 0 "Texas Instruments product 0x8142" rev 2.10/1.00 addr 4
> uhub6 at uhub5 port 4 configuration 1 interface 0 "Texas Instruments product 0x8142" rev 2.10/1.00 addr 5
> uhub7 at uhub0 port 5 configuration 1 interface 0 "GenesysLogic USB2.0 Hub" rev 2.00/92.24 addr 6
> uftdi0 at uhub7 port 1 configuration 1 interface 0 "FTDI FT232R USB UART" rev 2.00/6.00 addr 7
> ucom0 at uftdi0 portno 1
> uhub7: device problem, disabling port 2
> uaudio0 at uhub7 port 3 configuration 1 interface 1 "GN Netcom GN 9350" rev 2.00/1.00 addr 8
> uaudio0: failed to get ranges for level control
> uaudio0: class v1, full-speed, sync, channels: 1 play, 1 rec, 3 ctls
> audio1 at uaudio0
> uhidev0 at uhub7 port 3 configuration 1 interface 3 "GN Netcom GN 9350" rev 2.00/1.00 addr 8
> uhidev0: iclass 3/0
> uhid0 at uhidev0: input=2, output=2, feature=0
> uhidev1 at uhub7 port 4 configuration 1 interface 0 "Yubico Yubico Yubikey II" rev 2.00/2.12 addr 9
> uhidev1: iclass 3/1
> ukbd0 at uhidev1: 8 variable keys, 6 key codes
> wskbd1 at ukbd0 mux 1
> umass0 at uhub0 port 6 configuration 1 interface 0 "Realtek USB3.0 Card Reader" rev 2.10/1.32 addr 10
> umass0: using SCSI over Bulk-Only
> scsibus3 at umass0: 2 targets, initiator 0
> sd2 at scsibus3 targ 1 lun 0: <Generic-, USB3.0 CRW-CF/MD, 1.00> removable
> sd3 at scsibus3 targ 1 lun 1: <Generic-, USB3.0 CRW-SM/xD, 1.00> removable
> sd4 at scsibus3 targ 1 lun 2: <Generic-, USB3.0 CRW-SD, 1.00> removable
> sd5 at scsibus3 targ 1 lun 3: <Generic-, USB3.0 CRW-MS, 1.00> removable
> sd6 at scsibus3 targ 1 lun 4: <Generic-, USB3.0 CRW-SD/MS, 1.00> removable
> uhidev2 at uhub0 port 10 configuration 1 interface 0 "Lite-On Technology Corp. ThinkPad USB Keyboard with TrackPoint" rev 1.10/1.27 addr 11
> uhidev2: iclass 3/1
> ukbd1 at uhidev2: 8 variable keys, 6 key codes
> wskbd2 at ukbd1 mux 1
> uhidev3 at uhub0 port 10 configuration 1 interface 1 "Lite-On Technology Corp. ThinkPad USB Keyboard with TrackPoint" rev 1.10/1.27 addr 11
> uhidev3: iclass 3/0, 4 report ids
> ums0 at uhidev3 reportid 1: 3 buttons
> wsmouse0 at ums0 mux 0
> uhid1 at uhidev3 reportid 2: input=1, output=0, feature=0
> uhid2 at uhidev3 reportid 3: input=3, output=1, feature=0
> uhid3 at uhidev3 reportid 4: input=0, output=0, feature=4
> uhidev4 at uhub0 port 11 configuration 1 interface 0 "LIEBERT PowerSure Personal XT" rev 1.10/0.00 addr 12
> uhidev4: iclass 3/0, 22 report ids
> upd0 at uhidev4
> uhub8 at uhub0 port 21 configuration 1 interface 0 "Texas Instruments product 0x8140" rev 3.00/1.00 addr 13
> uhub9 at uhub8 port 4 configuration 1 interface 0 "Texas Instruments product 0x8140" rev 3.00/1.00 addr 14
> uhub10 at uhub1 port 1 configuration 1 interface 0 "Intel Rate Matching Hub" rev 2.00/0.04 addr 2
> uhub11 at uhub2 port 1 configuration 1 interface 0 "Intel Rate Matching Hub" rev 2.00/0.04 addr 2
> vscsi0 at root
> scsibus4 at vscsi0: 256 targets
> softraid0 at root
> scsibus5 at softraid0: 256 targets
> root on sd1a (2b4432fd9000a5b7.a) swap on sd1b dump on sd1b
> inteldrm0: 1920x1200, 32bpp
> wsdisplay0 at inteldrm0 mux 1
> pckbd_enable: command error
> wskbd1: connecting to wsdisplay0
> wskbd2: connecting to wsdisplay0
> wsdisplay0: screen 0-5 added (std, vt100 emulation)
> Automatic boot in progress: starting file system checks.



Index: sys/dev/usb/xhci.c
===================================================================
RCS file: /cvs/src/sys/dev/usb/xhci.c,v
retrieving revision 1.115
diff -u -p -u -p -r1.115 xhci.c
--- sys/dev/usb/xhci.c 24 Jun 2020 09:43:20 -0000 1.115
+++ sys/dev/usb/xhci.c 29 Jun 2020 12:10:20 -0000
@@ -1048,10 +1048,16 @@ xhci_event_command(struct xhci_softc *sc
  case XHCI_CMD_ADDRESS_DEVICE:
  case XHCI_CMD_EVAL_CTX:
  case XHCI_CMD_NOOP:
- /* All these commands are synchronous. */
- KASSERT(sc->sc_cmd_trb == trb);
- sc->sc_cmd_trb = NULL;
- wakeup(&sc->sc_cmd_trb);
+ /*
+ * All these commands are synchronous.
+ *
+ * If TRBs differ, this could be a delayed result after we
+ * gave up waiting for the expected TRB due to timeout.
+ */
+ if (sc->sc_cmd_trb == trb) {
+ sc->sc_cmd_trb = NULL;
+ wakeup(&sc->sc_cmd_trb);
+ }
  break;
  default:
  DPRINTF(("%s: unexpected command %x\n", DEVNAME(sc), flags));
@@ -1874,7 +1880,14 @@ xhci_command_submit(struct xhci_softc *s
  printf("cmd = %d ", XHCI_TRB_TYPE(letoh32(trb->trb_flags)));
  xhci_dump_trb(trb);
 #endif
- KASSERT(sc->sc_cmd_trb == trb);
+ KASSERT(sc->sc_cmd_trb == trb || sc->sc_cmd_trb == NULL);
+ /*
+ * Just because the timeout expired this does not mean that the
+ * TRB isn't active anymore! We could get an interrupt from
+ * this TRB later on and then wonder what to do with it.
+ * We'd rather abort it.
+ */
+ xhci_command_abort(sc);
  sc->sc_cmd_trb = NULL;
  splx(s);
  return (error);
@@ -1908,8 +1921,8 @@ xhci_command_abort(struct xhci_softc *sc
  XOWRITE4(sc, XHCI_CRCR_LO, reg | XHCI_CRCR_LO_CA);
  XOWRITE4(sc, XHCI_CRCR_HI, 0);
 
- for (i = 0; i < 250; i++) {
- usb_delay_ms(&sc->sc_bus, 1);
+ for (i = 0; i < 2500; i++) {
+ DELAY(100);
  reg = XOREAD4(sc, XHCI_CRCR_LO) & XHCI_CRCR_LO_CRR;
  if (!reg)
  break;

Reply | Threaded
Open this post in threaded view
|

Re: dev/usb/xhci.c, assertion "sc->sc_cmd_trb == trb" failed

Stuart Henderson
On 2020/06/29 14:32, Gerhard Roth wrote:

> Hi Stuart,
>
> what happens here is that the timeout kicks in and xhci_command_submit()
> resets sc_cmd_trb to NULL. But that doesn't retire the TRB that is still
> active in the controller and when it is done later, the KASSERT() in
> xhci_event_command() is bound to fail.
>
> My proposed fix would be:
>
> 1) xhci_event_command() should just ignore events from a TRB that is not
> the expected (sc_cmd_trb) one.
>
> 2) xhci_command_submit() should abort the TRB in case a timeout happened
> and thus prevent the interrupt from happening later on. For this
> we shouldn't give up the CPU in xhci_command_abort(). Therefore
> replace usb_delay_ms() with DELAY().
>
> Another problem would be that the softintr can kick in after the timeout
> already happened but before the context of xhci_command_submit() is
> scheduled. In that case, xhci_command_submit() should accept that
> sc_cmd_trb is NULL even though there was a timeout.
>
> Could you please try the patch at the end of this mail to see if it
> fixes your problem.

Thank you.

I can't trigger the panic on demand - of 1200-odd detaches in the
last month this is the only time I've hit this particular panic.

So while I can put the patch in my tree and see if it causes any new
problems, I can't do any meaningful tests to see if it's fixed it.

> Gerhard
>
>
> On Mon, 29 Jun 2020 12:31:47 +0100 Stuart Henderson <[hidden email]> wrote:
> > I have a uaudio that sometimes detaches/reattaches itself from my
> > workstation. I think it maybe a problem with the cable, anyway the
> > more interesting thing is that this acts as a "chaos monkey" and seems
> > good at triggering problems in various parts of the stack :)
> >
> > Here's an xhci panic I encountered after a detach.
> >
> > Unfortunately I pressed enter at the ddb prompt and it went straight to
> > "syncing disks..." before I collected more information from ddb, but
> > I'm sending what I have.
> >
> > audio1 detached
> > uaudio0 detached
> > uhid0 detached
> > uhidev0 detached
> > uaudio0 at uhub7 port 3 configuration 1 interface 1 "GN Netcom GN 9350" rev 2.00/1.00 addr 14
> > uaudio0: class v1, full-speed, sync, channels: 1 play, 1 rec, 4 ctls
> > audio1 at uaudio0
> > uhidev0 at uhub7 port 3 configuration 1 interface 3 "GN Netcom GN 9350" rev 2.00/1.00 addr 14
> > uhidev0: iclass 3/0
> > uhid0 at uhidev0: input=2, output=2, feature=0
> > audio1 detached
> > uaudio0 detached
> > uhid0 detached
> > uhidev0 detached
> > panic: kernel diagnostic assertion "sc->sc_cmd_trb == trb" failed: file "/sys/dev/usb/xhci.c", line 1052
> > Stopped at      db_enter+0x10:  popq    %rbp
> >     TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
> > db_enter() at db_enter+0x10
> > panic(ffffffff81de8bf3) at panic+0x128
> > __assert(ffffffff81e4f198,ffffffff81dda9a5,41c,ffffffff81e4bfc7) at __assert+0x2b
> > xhci_event_command(ffff800000128000,d2f77020) at xhci_event_command+0x2ff
> > xhci_event_dequeue(ffff800000128000) at xhci_event_dequeue+0x12d
> > xhci_softintr(ffff800000128000) at xhci_softintr+0x2d
> > softintr_dispatch(1) at softintr_dispatch+0xf2
> > Xsoftnet() at Xsoftnet+0x1f
> > acpicpu_idle() at acpicpu_idle+0x1e9
> > sched_idle(ffffffff82103ff0) at sched_idle+0x225
> > end trace frame: 0x0, count: 5
> > https://www.openbsd.org/ddb.html describes the minimum info required in bug
> > reports.  Insufficient info makes it difficult to find and fix bugs.
> > ddb{0}> [-- sthen@localhost attached -- Sat Jun 27 11:36:27 2020]  
> > syncing disks...
> >
> > Copyright (c) 1982, 1986, 1989, 1991, 1993
> > The Regents of the University of California.  All rights reserved.
> > Copyright (c) 1995-2020 OpenBSD. All rights reserved.  https://www.OpenBSD.org
> >
> > OpenBSD 6.7-current (GENERIC.MP) #8: Sun Jun 21 18:08:58 BST 2020
> >     [hidden email]:/sys/arch/amd64/compile/GENERIC.MP
> > real mem = 34247069696 (32660MB)
> > avail mem = 33194196992 (31656MB)
> > random: good seed from bootblocks
> > mpath0 at root
> > scsibus0 at mpath0: 256 targets
> > mainbus0 at root
> > bios0 at mainbus0: SMBIOS rev. 2.7 @ 0xec400 (92 entries)
> > bios0: vendor Dell Inc. version "A12" date 05/11/2017
> > bios0: Dell Inc. PowerEdge T20
> > acpi0 at bios0: ACPI 5.0
> > acpi0: sleep states S0 S4 S5
> > acpi0: tables DSDT FACP APIC FPDT SLIC LPIT SSDT SSDT SSDT HPET SSDT MCFG SSDT ASF! DMAR
> > acpi0: wakeup devices UAR1(S4) RP01(S4) PXSX(S4) RP02(S4) PXSX(S4) PXSX(S4) RP05(S4) PXSX(S4) PXSX(S4) PXSX(S4) PXSX(S4) GLAN(S4) EHC1(S3) EHC2(S3) XHC_(S4) HDEF(S4) [...]
> > acpitimer0 at acpi0: 3579545 Hz, 24 bits
> > acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
> > cpu0 at mainbus0: apid 0 (boot processor)
> > cpu0: Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz, 3392.64 MHz, 06-3c-03
> > cpu0: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,MD_CLEAR,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,MELTDOWN
> > cpu0: 256KB 64b/line 8-way L2 cache
> > tsc_timecounter_init: TSC skew=0 observed drift=0
> > cpu0: smt 0, core 0, package 0
> > mtrr: Pentium Pro MTRR support, 10 var ranges, 88 fixed ranges
> > cpu0: apic clock running at 99MHz
> > cpu0: mwait min=64, max=64, C-substates=0.2.1.2.4, IBE
> > cpu1 at mainbus0: apid 2 (application processor)
> > TSC skew=-39
> > cpu1: Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz, 3392.17 MHz, 06-3c-03
> > cpu1: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,MD_CLEAR,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,MELTDOWN
> > cpu1: 256KB 64b/line 8-way L2 cache
> > tsc_timecounter_init: TSC skew=-39 observed drift=0
> > cpu1: smt 0, core 1, package 0
> > cpu2 at mainbus0: apid 4 (application processor)
> > TSC skew=-30
> > cpu2: Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz, 3392.17 MHz, 06-3c-03
> > cpu2: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,MD_CLEAR,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,MELTDOWN
> > cpu2: 256KB 64b/line 8-way L2 cache
> > tsc_timecounter_init: TSC skew=-30 observed drift=0
> > cpu2: smt 0, core 2, package 0
> > cpu3 at mainbus0: apid 6 (application processor)
> > TSC skew=-38
> > cpu3: Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz, 3392.16 MHz, 06-3c-03
> > cpu3: FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,SMX,EST,TM2,SSSE3,SDBG,FMA3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,NXE,PAGE1GB,RDTSCP,LONG,LAHF,ABM,PERF,ITSC,FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,MD_CLEAR,IBRS,IBPB,STIBP,L1DF,SSBD,SENSOR,ARAT,XSAVEOPT,MELTDOWN
> > cpu3: 256KB 64b/line 8-way L2 cache
> > tsc_timecounter_init: TSC skew=-38 observed drift=0
> > cpu3: smt 0, core 3, package 0
> > ioapic0 at mainbus0: apid 8 pa 0xfec00000, version 20, 24 pins
> > acpihpet0 at acpi0: 14318179 Hz
> > acpimcfg0 at acpi0
> > acpimcfg0: addr 0xf8000000, bus 0-63
> > acpiprt0 at acpi0: bus 0 (PCI0)
> > acpiprt1 at acpi0: bus 2 (RP01)
> > acpiprt2 at acpi0: bus 3 (RP02)
> > acpiprt3 at acpi0: bus 5 (RP05)
> > acpiprt4 at acpi0: bus 1 (PEG0)
> > acpiprt5 at acpi0: bus -1 (PEG1)
> > acpiprt6 at acpi0: bus -1 (PEG2)
> > acpiec0 at acpi0: not present
> > acpicpu0 at acpi0: C2(200@148 mwait.1@0x33), C1(1000@1 mwait.1), PSS
> > acpicpu1 at acpi0: C2(200@148 mwait.1@0x33), C1(1000@1 mwait.1), PSS
> > acpicpu2 at acpi0: C2(200@148 mwait.1@0x33), C1(1000@1 mwait.1), PSS
> > acpicpu3 at acpi0: C2(200@148 mwait.1@0x33), C1(1000@1 mwait.1), PSS
> > acpitz0 at acpi0: critical temperature is 105 degC
> > acpitz1 at acpi0: critical temperature is 105 degC
> > acpipci0 at acpi0 PCI0: 0x00000000 0x00000011 0x00000001
> > extent `acpipci0 pcibus' (0x0 - 0xff), flags=0
> >      0x3f - 0xff
> > extent `acpipci0 pciio' (0x0 - 0xffffffff), flags=0
> >      0xcf8 - 0xcff
> >      0x10000 - 0xffffffff
> > extent `acpipci0 pcimem' (0x0 - 0xffffffffffffffff), flags=0
> >      0x0 - 0x9ffff
> >      0xc0000 - 0xd3fff
> >      0xe8000 - 0xdf1fffff
> >      0xfeb00000 - 0xffffffffffffffff
> > acpicmos0 at acpi0
> > acpibtn0 at acpi0: PWRB
> > "PNP0C14" at acpi0 not configured
> > acpivideo0 at acpi0: GFX0
> > acpivout0 at acpivideo0: DD1F
> > cpu0: using VERW MDS workaround (except on vmm entry)
> > cpu0: Enhanced SpeedStep 3392 MHz: speeds: 3201, 3200, 3000, 2900, 2700, 2500, 2300, 2200, 2000, 1800, 1700, 1500, 1300, 1100, 1000, 800 MHz
> > pci0 at mainbus0 bus 0
> > pchb0 at pci0 dev 0 function 0 "Intel Xeon E3-1200 v3 Host" rev 0x06
> > ppb0 at pci0 dev 1 function 0 "Intel Core 4G PCIE" rev 0x06: msi
> > pci1 at ppb0 bus 1
> > em0 at pci1 dev 0 function 0 "Intel 82572EI" rev 0x06: apic 8 int 16, address 00:15:17:8e:79:85
> > inteldrm0 at pci0 dev 2 function 0 "Intel HD Graphics P4600" rev 0x06
> > drm0 at inteldrm0
> > inteldrm0: msi, HASWELL, gen 7
> > xhci0 at pci0 dev 20 function 0 "Intel 8 Series xHCI" rev 0x04: msi, xHCI 1.0
> > usb0 at xhci0: USB revision 3.0
> > uhub0 at usb0 configuration 1 interface 0 "Intel xHCI root hub" rev 3.00/1.00 addr 1
> > "Intel 8 Series MEI" rev 0x04 at pci0 dev 22 function 0 not configured
> > puc0 at pci0 dev 22 function 3 "Intel 8 Series KT" rev 0x04: ports: 16 com
> > com4 at puc0 port 0 apic 8 int 19: ns16550a, 16 byte fifo
> > com4: probed fifo depth: 0 bytes
> > em1 at pci0 dev 25 function 0 "Intel I217-LM" rev 0x04: msi, address f8:b1:56:ac:32:76
> > ehci0 at pci0 dev 26 function 0 "Intel 8 Series USB" rev 0x04: apic 8 int 16
> > usb1 at ehci0: USB revision 2.0
> > uhub1 at usb1 configuration 1 interface 0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
> > azalia0 at pci0 dev 27 function 0 "Intel 8 Series HD Audio" rev 0x04: msi
> > azalia0: codecs: Realtek/0x0280
> > audio0 at azalia0
> > ppb1 at pci0 dev 28 function 0 "Intel 8 Series PCIE" rev 0xd4
> > pci2 at ppb1 bus 2
> > ppb2 at pci0 dev 28 function 1 "Intel 8 Series PCIE" rev 0xd4: msi
> > pci3 at ppb2 bus 3
> > ppb3 at pci3 dev 0 function 0 "TI XIO2001 PCIE-PCI" rev 0x00
> > pci4 at ppb3 bus 4
> > ppb4 at pci0 dev 28 function 4 "Intel 8 Series PCIE" rev 0xd4: msi
> > pci5 at ppb4 bus 5
> > nvme0 at pci5 dev 0 function 0 "Samsung SM961/PM961 NVMe" rev 0x00: msix, NVMe 1.2
> > nvme0: SAMSUNG MZVLW256HEHP-000L7, firmware 4L7QCXB7, serial S35ENX0J765205
> > scsibus1 at nvme0: 2 targets, initiator 0
> > sd0 at scsibus1 targ 1 lun 0: <NVMe, SAMSUNG MZVLW256, 4L7Q>
> > sd0: 244198MB, 512 bytes/sector, 500118192 sectors
> > ehci1 at pci0 dev 29 function 0 "Intel 8 Series USB" rev 0x04: apic 8 int 23
> > usb2 at ehci1: USB revision 2.0
> > uhub2 at usb2 configuration 1 interface 0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
> > pcib0 at pci0 dev 31 function 0 "Intel C226 LPC" rev 0x04
> > ahci0 at pci0 dev 31 function 2 "Intel 8 Series AHCI" rev 0x04: msi, AHCI 1.3
> > ahci0: port 0: 6.0Gb/s
> > scsibus2 at ahci0: 32 targets
> > sd1 at scsibus2 targ 0 lun 0: <ATA, Samsung SSD 860, RVT0> naa.5002538e9984204d
> > sd1: 476940MB, 512 bytes/sector, 976773168 sectors, thin
> > ichiic0 at pci0 dev 31 function 3 "Intel 8 Series SMBus" rev 0x04: apic 8 int 18
> > iic0 at ichiic0
> > sdtemp0 at iic0 addr 0x18: stts2002
> > sdtemp1 at iic0 addr 0x19: stts2002
> > sdtemp2 at iic0 addr 0x1a: stts2002
> > sdtemp3 at iic0 addr 0x1b: stts2002
> > spdmem0 at iic0 addr 0x50: 8GB DDR3 SDRAM ECC PC3-12800 with thermal sensor
> > spdmem1 at iic0 addr 0x51: 8GB DDR3 SDRAM ECC PC3-12800 with thermal sensor
> > spdmem2 at iic0 addr 0x52: 8GB DDR3 SDRAM ECC PC3-12800 with thermal sensor
> > spdmem3 at iic0 addr 0x53: 8GB DDR3 SDRAM ECC PC3-12800 with thermal sensor
> > isa0 at pcib0
> > isadma0 at isa0
> > com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
> > com0: console
> > pckbc0 at isa0 port 0x60/5 irq 1 irq 12
> > pckbd0 at pckbc0 (kbd slot)
> > wskbd0 at pckbd0 mux 1
> > vga0 at isa0 port 0x3b0/48 iomem 0xa0000/131072
> > wsdisplay at vga0 not configured
> > pcppi0 at isa0 port 0x61
> > spkr0 at pcppi0
> > vmm0 at mainbus0: VMX/EPT
> > uhub3 at uhub0 port 3 configuration 1 interface 0 "Genesys Logic USB2.0 Hub" rev 2.00/77.64 addr 2
> > uhub4 at uhub3 port 4 configuration 1 interface 0 "Genesys Logic USB2.0 Hub" rev 2.00/77.64 addr 3
> > uhub5 at uhub0 port 4 configuration 1 interface 0 "Texas Instruments product 0x8142" rev 2.10/1.00 addr 4
> > uhub6 at uhub5 port 4 configuration 1 interface 0 "Texas Instruments product 0x8142" rev 2.10/1.00 addr 5
> > uhub7 at uhub0 port 5 configuration 1 interface 0 "GenesysLogic USB2.0 Hub" rev 2.00/92.24 addr 6
> > uftdi0 at uhub7 port 1 configuration 1 interface 0 "FTDI FT232R USB UART" rev 2.00/6.00 addr 7
> > ucom0 at uftdi0 portno 1
> > uhub7: device problem, disabling port 2
> > uaudio0 at uhub7 port 3 configuration 1 interface 1 "GN Netcom GN 9350" rev 2.00/1.00 addr 8
> > uaudio0: failed to get ranges for level control
> > uaudio0: class v1, full-speed, sync, channels: 1 play, 1 rec, 3 ctls
> > audio1 at uaudio0
> > uhidev0 at uhub7 port 3 configuration 1 interface 3 "GN Netcom GN 9350" rev 2.00/1.00 addr 8
> > uhidev0: iclass 3/0
> > uhid0 at uhidev0: input=2, output=2, feature=0
> > uhidev1 at uhub7 port 4 configuration 1 interface 0 "Yubico Yubico Yubikey II" rev 2.00/2.12 addr 9
> > uhidev1: iclass 3/1
> > ukbd0 at uhidev1: 8 variable keys, 6 key codes
> > wskbd1 at ukbd0 mux 1
> > umass0 at uhub0 port 6 configuration 1 interface 0 "Realtek USB3.0 Card Reader" rev 2.10/1.32 addr 10
> > umass0: using SCSI over Bulk-Only
> > scsibus3 at umass0: 2 targets, initiator 0
> > sd2 at scsibus3 targ 1 lun 0: <Generic-, USB3.0 CRW-CF/MD, 1.00> removable
> > sd3 at scsibus3 targ 1 lun 1: <Generic-, USB3.0 CRW-SM/xD, 1.00> removable
> > sd4 at scsibus3 targ 1 lun 2: <Generic-, USB3.0 CRW-SD, 1.00> removable
> > sd5 at scsibus3 targ 1 lun 3: <Generic-, USB3.0 CRW-MS, 1.00> removable
> > sd6 at scsibus3 targ 1 lun 4: <Generic-, USB3.0 CRW-SD/MS, 1.00> removable
> > uhidev2 at uhub0 port 10 configuration 1 interface 0 "Lite-On Technology Corp. ThinkPad USB Keyboard with TrackPoint" rev 1.10/1.27 addr 11
> > uhidev2: iclass 3/1
> > ukbd1 at uhidev2: 8 variable keys, 6 key codes
> > wskbd2 at ukbd1 mux 1
> > uhidev3 at uhub0 port 10 configuration 1 interface 1 "Lite-On Technology Corp. ThinkPad USB Keyboard with TrackPoint" rev 1.10/1.27 addr 11
> > uhidev3: iclass 3/0, 4 report ids
> > ums0 at uhidev3 reportid 1: 3 buttons
> > wsmouse0 at ums0 mux 0
> > uhid1 at uhidev3 reportid 2: input=1, output=0, feature=0
> > uhid2 at uhidev3 reportid 3: input=3, output=1, feature=0
> > uhid3 at uhidev3 reportid 4: input=0, output=0, feature=4
> > uhidev4 at uhub0 port 11 configuration 1 interface 0 "LIEBERT PowerSure Personal XT" rev 1.10/0.00 addr 12
> > uhidev4: iclass 3/0, 22 report ids
> > upd0 at uhidev4
> > uhub8 at uhub0 port 21 configuration 1 interface 0 "Texas Instruments product 0x8140" rev 3.00/1.00 addr 13
> > uhub9 at uhub8 port 4 configuration 1 interface 0 "Texas Instruments product 0x8140" rev 3.00/1.00 addr 14
> > uhub10 at uhub1 port 1 configuration 1 interface 0 "Intel Rate Matching Hub" rev 2.00/0.04 addr 2
> > uhub11 at uhub2 port 1 configuration 1 interface 0 "Intel Rate Matching Hub" rev 2.00/0.04 addr 2
> > vscsi0 at root
> > scsibus4 at vscsi0: 256 targets
> > softraid0 at root
> > scsibus5 at softraid0: 256 targets
> > root on sd1a (2b4432fd9000a5b7.a) swap on sd1b dump on sd1b
> > inteldrm0: 1920x1200, 32bpp
> > wsdisplay0 at inteldrm0 mux 1
> > pckbd_enable: command error
> > wskbd1: connecting to wsdisplay0
> > wskbd2: connecting to wsdisplay0
> > wsdisplay0: screen 0-5 added (std, vt100 emulation)
> > Automatic boot in progress: starting file system checks.
>
>
>
> Index: sys/dev/usb/xhci.c
> ===================================================================
> RCS file: /cvs/src/sys/dev/usb/xhci.c,v
> retrieving revision 1.115
> diff -u -p -u -p -r1.115 xhci.c
> --- sys/dev/usb/xhci.c 24 Jun 2020 09:43:20 -0000 1.115
> +++ sys/dev/usb/xhci.c 29 Jun 2020 12:10:20 -0000
> @@ -1048,10 +1048,16 @@ xhci_event_command(struct xhci_softc *sc
>   case XHCI_CMD_ADDRESS_DEVICE:
>   case XHCI_CMD_EVAL_CTX:
>   case XHCI_CMD_NOOP:
> - /* All these commands are synchronous. */
> - KASSERT(sc->sc_cmd_trb == trb);
> - sc->sc_cmd_trb = NULL;
> - wakeup(&sc->sc_cmd_trb);
> + /*
> + * All these commands are synchronous.
> + *
> + * If TRBs differ, this could be a delayed result after we
> + * gave up waiting for the expected TRB due to timeout.
> + */
> + if (sc->sc_cmd_trb == trb) {
> + sc->sc_cmd_trb = NULL;
> + wakeup(&sc->sc_cmd_trb);
> + }
>   break;
>   default:
>   DPRINTF(("%s: unexpected command %x\n", DEVNAME(sc), flags));
> @@ -1874,7 +1880,14 @@ xhci_command_submit(struct xhci_softc *s
>   printf("cmd = %d ", XHCI_TRB_TYPE(letoh32(trb->trb_flags)));
>   xhci_dump_trb(trb);
>  #endif
> - KASSERT(sc->sc_cmd_trb == trb);
> + KASSERT(sc->sc_cmd_trb == trb || sc->sc_cmd_trb == NULL);
> + /*
> + * Just because the timeout expired this does not mean that the
> + * TRB isn't active anymore! We could get an interrupt from
> + * this TRB later on and then wonder what to do with it.
> + * We'd rather abort it.
> + */
> + xhci_command_abort(sc);
>   sc->sc_cmd_trb = NULL;
>   splx(s);
>   return (error);
> @@ -1908,8 +1921,8 @@ xhci_command_abort(struct xhci_softc *sc
>   XOWRITE4(sc, XHCI_CRCR_LO, reg | XHCI_CRCR_LO_CA);
>   XOWRITE4(sc, XHCI_CRCR_HI, 0);
>  
> - for (i = 0; i < 250; i++) {
> - usb_delay_ms(&sc->sc_bus, 1);
> + for (i = 0; i < 2500; i++) {
> + DELAY(100);
>   reg = XOREAD4(sc, XHCI_CRCR_LO) & XHCI_CRCR_LO_CRR;
>   if (!reg)
>   break;