Re: 7.8 cpu0: kernel diagnostic assertion "dxfer->xfer.status == USBD_IN_PROGRESS" failed

[Marcus Glocker]

On Mon, Dec 15, 2025 at 10:14:28PM +0100, Schuh Andreas wrote:

> Hi,
> 
> I know, the Raspberry Pi Zero 2 is officially not supported by OpenBSD,
> but in general, it runs fine with the correct dtb. The Pi Zero 2 is connected
> to an Waveshare PoE Ethernet/USB hub, with an RTL8152B ethernet chip.
> Usually after a day or two, OpenBSD 7.8 panics. These panics also
> happened with OpenBSD 7.7.
> Machine is just running a standard OpenBSD installation with ssh and
> AdGuardHome, no other services are running.
> 
> ddb{0}> show panic
> *cpu0: kernel diagnostic assertion "dxfer->xfer.status == USBD_IN_PROGRESS" 
> fai
> led: file "/usr/src/sys/dev/usb/dwc2/dwc2.c", line 308
> 
> ddb{0}> trace
> db_enter() at panic+0x138
> panic() at __assert+0x28
> panic() at dwc2_softintr+0x194
> dwc2_softintr() at softintr_dispatch+0xc8
> softintr_dispatch() at arm_do_pending_intr+0xb8
> arm_do_pending_intr() at bcm_intc_irq_handler+0x188
> bcm_intc_irq_handler() at arm_cpu_irq+0x44
> arm_cpu_irq() at handle_el1h_irq+0x68
> handle_el1h_irq() at _kernel_lock+0xac
> --- interrupt ---
> _kernel_lock() at vn_write+0x3c
> vn_write() at dofilewritev+0x118
> dofilewritev() at sys_write+0x50
> sys_write() at svc_handler+0x450
> svc_handler() at do_el0_sync+0x1cc
> do_el0_sync() at handle_el0_sync+0x70
> handle_el0_sync() at 0x4f593bbcc
> --- trap ---
> end of kernel
> 
> ddb{0}> machine ddbcpu 1
> After executing this, the Pi Zero 2 just hangs, no further output.

What I can see, is that the dwc2(4) code would always panic if an USB
transfer fails, since the current KASSERT check in dwc2_softintr() is
a bit odd.

You could try this (untested) patch, and see if it helps.  At least the
system shouldn't panic, but your ure(4) device still may fail without
recovery.


Index: sys/dev/usb/dwc2/dwc2.c
===================================================================
RCS file: /cvs/src/sys/dev/usb/dwc2/dwc2.c,v
diff -u -p -u -p -r1.68 dwc2.c
--- sys/dev/usb/dwc2/dwc2.c     18 Sep 2022 21:12:19 -0000      1.68
+++ sys/dev/usb/dwc2/dwc2.c     16 Dec 2025 09:19:06 -0000
@@ -305,9 +305,14 @@ dwc2_softintr(void *v)
         */
        mtx_enter(&hsotg->lock);
        TAILQ_FOREACH_SAFE(dxfer, &sc->sc_complete, xnext, next) {
+               if (dxfer->xfer.status == USBD_CANCELLED ||
+                   dxfer->xfer.status == USBD_TIMEOUT) {
+                       DPRINTF(("dwc2_process_done: cancel/timeout %p\n",
+                           dxfer));
+                       /* Handled by abort routine. */
+                       continue;
+               }
                KASSERT(dxfer->xfer.status == USBD_IN_PROGRESS);
-               KASSERT(dxfer->intr_status != USBD_CANCELLED);
-               KASSERT(dxfer->intr_status != USBD_TIMEOUT);
                TAILQ_REMOVE(&sc->sc_complete, dxfer, xnext);
                TAILQ_INSERT_TAIL(&claimed, dxfer, xnext);
        }
@@ -316,9 +321,6 @@ dwc2_softintr(void *v)
        /* Now complete them.  */
        while (!TAILQ_EMPTY(&claimed)) {
                dxfer = TAILQ_FIRST(&claimed);
-               KASSERT(dxfer->xfer.status == USBD_IN_PROGRESS);
-               KASSERT(dxfer->intr_status != USBD_CANCELLED);
-               KASSERT(dxfer->intr_status != USBD_TIMEOUT);
                TAILQ_REMOVE(&claimed, dxfer, xnext);
 
                dxfer->xfer.status = dxfer->intr_status;