Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Kernel Panic: DM9601 Fast Ethernet Adapter #1045

Closed
strongly-typed opened this issue Jul 3, 2015 · 46 comments
Closed

Kernel Panic: DM9601 Fast Ethernet Adapter #1045

strongly-typed opened this issue Jul 3, 2015 · 46 comments

Comments

@strongly-typed
Copy link

@strongly-typed strongly-typed commented Jul 3, 2015

Hello,

I'm experiencing kernel panics with a Noname USB to Ethernet Adapter. It is marked "USB2.0 to Fast Ethernet Adapter Model No:KY-RD9700". It uses a probably faked DM9601 chipset. Modules loaded are sr9700 and dm9601.

3% [2 Release 11[   63.202645] skbuff: skb_over_panic: text:803b8208 len:1536 put:1536 head:bb638200 data:bb638242 tail:0xbb638842 end:0xbb638840 dev:eth1
[   63.216228] ------------[ cut here ]------------
[   63.220838] kernel BUG at net/core/skbuff.c:102!
[   63.225449] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
18 B/58.5 kB 2%]
Entering kdb (current=0x8080c6e8, pid 0) on processor 0 Oops: (null)
due to oops @ 0x80547544
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.0.7-v7+ #801
Hardware name: BCM2709
task: 8080c6e8 ti: 807ea000 task.ti: 807ea000
PC is at skb_panic+0x64/0x70
LR is at console_unlock+0x2f8/0x550
pc : [<80547544>]    lr : [<80066de8>]    psr: 20000193
sp : 807ebd70  ip : 807ebc70  fp : 807ebda4
r10: 00000000  r9 : 00000101  r8 : 00000000
r7 : 806c9e6c  r6 : bb638200  r5 : 00000600  r4 : bb638242
r3 : 807ea000  r2 : 00000101  r1 : 60000193  r0 : 0000007b
Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 3c2e806a  DAC: 00000015
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.0.7-v7+ #801
Hardware name: BCM2709

lsusb output is:

 Bus 001 Device 004: ID 0fe6:9700 Kontron (Industrial Computer Source / ICS Advent) DM9601 Fast Ethernet Adapter

The adapter works with a Ubuntu x86-64 with kernel version 3.13.0-53-generic.

Connected to a RPi Model B and RPi 2 Model B I get kernel panics as soon as there is some significant traffic. Ping works ok, but apt-get for example oops the kernel. This applies to the latest kernel (4.0.7-v7+) and an older version (3.18.16-v7+)

I am using a serial console to login into my RPis. See the full log attached

Uncompressing Linux... done, booting the kernel.
[    0.000000] Booting Linux on physical CPU 0xf00
[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 4.0.7-v7+ (dc4@dc4-XPS13-9333) (gcc version 4.8.3 20140303 (prerelease) (crosstool-NG linaro-1.13.1+bzr2650 - Linaro GCC 2014.03) ) #801 SMP PREEMPT Tue Jun 30 18:38:23 BST 2015
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine model: Raspberry Pi 2 Model B Rev 1.1
[    0.000000] cma: Reserved 8 MiB at 0x3d800000
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] [bcm2709_smp_init_cpus] enter (8660->f3003010)
[    0.000000] [bcm2709_smp_init_cpus] ncores=4
[    0.000000] PERCPU: Embedded 11 pages/cpu @bcf01000 s16128 r8192 d20736 u45056
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 251720
[    0.000000] Kernel command line: dma.dmachans=0x7f35 bcm2708_fb.fbwidth=656 bcm2708_fb.fbheight=416 bcm2709.boardrev=0xa01041 bcm2709.serial=0xfe71a4bc smsc95xx.macaddr=B8:27:EB:71:A4:BC bcm2708_fb.fbswap=1 bcm2709.disk_led_gpio=47 bcm2709.disk_led_active_low=0 sdhci-bcm2708.emmc_clock_freq=250000000 vc_mem.mem_base=0x3ea00000 vc_mem.mem_size=0x3f000000  dwc_otg.lpm_enable=0 console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 root=/dev/mmcblk0p2 rootfstype=ext4 rootwait
[    0.000000] PID hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
[    0.000000] Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Memory: 988384K/1015808K available (5885K kernel code, 378K rwdata, 1784K rodata, 400K init, 757K bss, 19232K reserved, 8192K cma-reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xbe800000 - 0xff000000   (1032 MB)
[    0.000000]     lowmem  : 0x80000000 - 0xbe000000   ( 992 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x8078575c   (7670 kB)
[    0.000000]       .init : 0x80786000 - 0x807ea000   ( 400 kB)
[    0.000000]       .data : 0x807ea000 - 0x80848a64   ( 379 kB)
[    0.000000]        .bss : 0x80848a64 - 0x809061cc   ( 758 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000]  Additional per-CPU info printed with stalls.
[    0.000000] NR_IRQS:608
[    0.000000] Architected cp15 timer(s) running at 19.20MHz (virt).
[    0.000014] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 3579139424256ns
[    0.000036] Switching to timer-based delay loop, resolution 52ns
[    0.000319] Console: colour dummy device 80x30
[    0.000362] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000)
[    0.000390] pid_max: default: 32768 minimum: 301
[    0.000721] Mount-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000742] Mountpoint-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.002020] Initializing cgroup subsys blkio
[    0.002061] Initializing cgroup subsys memory
[    0.002094] Initializing cgroup subsys devices
[    0.002121] Initializing cgroup subsys freezer
[    0.002160] Initializing cgroup subsys net_cls
[    0.002244] CPU: Testing write buffer coherency: ok
[    0.002331] ftrace: allocating 20007 entries in 59 pages
[    0.051131] CPU0: update cpu_capacity 1024
[    0.051169] CPU0: thread -1, cpu 0, socket 15, mpidr 80000f00
[    0.051186] [bcm2709_smp_prepare_cpus] enter
[    0.051317] Setting up static identity map for 0x54e9f0 - 0x54ea24
[    0.111022] [bcm2709_boot_secondary] cpu:1 started (0) 17
[    0.111332] [bcm2709_secondary_init] enter cpu:1
[    0.111385] CPU1: update cpu_capacity 1024
[    0.111394] CPU1: thread -1, cpu 1, socket 15, mpidr 80000f01
[    0.131013] [bcm2709_boot_secondary] cpu:2 started (0) 17
[    0.131274] [bcm2709_secondary_init] enter cpu:2
[    0.131304] CPU2: update cpu_capacity 1024
[    0.131312] CPU2: thread -1, cpu 2, socket 15, mpidr 80000f02
[    0.151053] [bcm2709_boot_secondary] cpu:3 started (0) 18
[    0.151293] [bcm2709_secondary_init] enter cpu:3
[    0.151320] CPU3: update cpu_capacity 1024
[    0.151328] CPU3: thread -1, cpu 3, socket 15, mpidr 80000f03
[    0.151421] Brought up 4 CPUs
[    0.151452] SMP: Total of 4 processors activated (153.60 BogoMIPS).
[    0.151463] CPU: All CPU(s) started in SVC mode.
[    0.152463] devtmpfs: initialized
[    0.172084] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[    0.173290] pinctrl core: initialized pinctrl subsystem
[    0.177975] NET: Registered protocol family 16
[    0.183699] DMA: preallocated 4096 KiB pool for atomic coherent allocations
[    0.184855] bcm2709.uart_clock = 3000000
[    0.189217] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
[    0.189235] hw-breakpoint: maximum watchpoint size is 8 bytes.
[    0.189373] Serial: AMBA PL011 UART driver
[    0.189565] 3f201000.uart: ttyAMA0 at MMIO 0x3f201000 (irq = 83, base_baud = 0) is a PL011 rev2
[    0.665364] console [ttyAMA0] enabled
[    0.669793] bcm2708_vcio 3f00b880.mailbox: mailbox at f300b880
[    0.743319] bcm2708-dmaengine 3f007000.dma: DMA legacy API manager at f3007000, dmachans=0x7f35
[    0.752606] bcm2708-dmaengine 3f007000.dma: Load BCM2835 DMA engine driver
[    0.759477] bcm2708-dmaengine 3f007000.dma: dma_debug:0
[    0.764822] bcm_power: Broadcom power driver
[    0.769090] bcm_power_open() -> 0
[    0.772399] bcm_power_request(0, 8)
[    0.801558] bcm_mailbox_read -> 00000080, 0
[    0.805762] bcm_power_request -> 0
[    0.809806] SCSI subsystem initialized
[    0.813789] usbcore: registered new interface driver usbfs
[    0.819402] usbcore: registered new interface driver hub
[    0.824843] usbcore: registered new device driver usb
[    0.831818] Switched to clocksource arch_sys_counter
[    0.866706] FS-Cache: Loaded
[    0.869947] CacheFiles: Loaded
[    0.884552] NET: Registered protocol family 2
[    0.890193] TCP established hash table entries: 8192 (order: 3, 32768 bytes)
[    0.897419] TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
[    0.904098] TCP: Hash tables configured (established 8192 bind 8192)
[    0.910547] TCP: reno registered
[    0.913813] UDP hash table entries: 512 (order: 2, 16384 bytes)
[    0.919775] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes)
[    0.926604] NET: Registered protocol family 1
[    0.931392] RPC: Registered named UNIX socket transport module.
[    0.937385] RPC: Registered udp transport module.
[    0.942121] RPC: Registered tcp transport module.
[    0.946819] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.954332] hw perfevents: enabled with armv7_cortex_a7 PMU driver, 5 counters available
[    0.963856] futex hash table entries: 1024 (order: 4, 65536 bytes)
[    0.985358] VFS: Disk quotas dquot_6.5.2
[    0.989643] VFS: Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
[    0.999355] FS-Cache: Netfs 'nfs' registered for caching
[    1.005876] NFS: Registering the id_resolver key type
[    1.011031] Key type id_resolver registered
[    1.015236] Key type id_legacy registered
[    1.022015] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    1.029588] io scheduler noop registered
[    1.033547] io scheduler deadline registered
[    1.038132] io scheduler cfq registered (default)
[    1.045351] BCM2708FB: allocated DMA memory fdc00000
[    1.050342] BCM2708FB: allocated DMA channel 0 @ f3007000
[    1.061321] Console: switching to colour frame buffer device 82x26
[    1.071136] Serial: 8250/16550 driver, 0 ports, IRQ sharing disabled
[    1.077784] uart-pl011 3f201000.uart: no DMA platform data
[    1.083577] KGDB: Registered I/O driver kgdboc
[    1.122617] vc-cma: Videocore CMA driver
[    1.126539] vc-cma: vc_cma_base      = 0x00000000
[    1.131235] vc-cma: vc_cma_size      = 0x00000000 (0 MiB)
[    1.136655] vc-cma: vc_cma_initial   = 0x00000000 (0 MiB)
[    1.142299] vc-mem: phys_addr:0x00000000 mem_base=0x3ea00000 mem_size:0x3f000000(1008 MiB)
[    1.166069] brd: module loaded
[    1.178483] loop: module loaded
[    1.182703] vchiq: vchiq_init_state: slot_zero = 0xbdc80000, is_master = 0
[    1.190503] Loading iSCSI transport class v2.0-870.
[    1.196388] usbcore: registered new interface driver smsc95xx
[    1.202244] dwc_otg: version 3.00a 10-AUG-2012 (platform bus)
[    1.408303] Core Release: 2.80a
[    1.411448] Setting default values for core params
[    1.416303] Finished setting default values for core params
[    1.622283] Using Buffer DMA mode
[    1.625598] Periodic Transfer Interrupt Enhancement - disabled
[    1.631419] Multiprocessor Interrupt Enhancement - disabled
[    1.637003] OTG VER PARAM: 0, OTG VER FLAG: 0
[    1.641358] Dedicated Tx FIFOs mode
[    1.645204] WARN::dwc_otg_hcd_init:1047: FIQ DMA bounce buffers: virt = 0xbdc14000 dma = 0xfdc14000 len=9024
[    1.655065] FIQ FSM acceleration enabled for :
[    1.655065] Non-periodic Split Transactions
[    1.655065] Periodic Split Transactions
[    1.655065] High-Speed Isochronous Endpoints
[    1.671847] WARN::hcd_init_fiq:412: FIQ on core 1 at 0x803f36f4
[    1.677764] WARN::hcd_init_fiq:413: FIQ ASM at 0x803f3a50 length 36
[    1.684027] WARN::hcd_init_fiq:438: MPHI regs_base at 0xbe89a000
[    1.690081] dwc_otg 3f980000.usb: DWC OTG Controller
[    1.695098] dwc_otg 3f980000.usb: new USB bus registered, assigned bus number 1
[    1.702464] dwc_otg 3f980000.usb: irq 32, io mem 0x00000000
[    1.708069] Init: Port Power? op_state=1
[    1.712009] Init: Power Port (0)
[    1.715511] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[    1.722322] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    1.729538] usb usb1: Product: DWC OTG Controller
[    1.734260] usb usb1: Manufacturer: Linux 4.0.7-v7+ dwc_otg_hcd
[    1.740175] usb usb1: SerialNumber: 3f980000.usb
[    1.745640] hub 1-0:1.0: USB hub found
[    1.749440] hub 1-0:1.0: 1 port detected
[    1.754294] usbcore: registered new interface driver usb-storage
[    1.760560] mousedev: PS/2 mouse device common for all mice
[    1.767092] bcm2835-cpufreq: min=600000 max=900000
[    1.772262] Driver 'mmcblk' needs updating - please use bus_type methods
[    1.779023] sdhci: Secure Digital Host Controller Interface driver
[    1.785258] sdhci: Copyright(c) Pierre Ossman
[    1.790072] mmc-bcm2835 3f300000.mmc: mmc_debug:0 mmc_debug2:0
[    1.795969] mmc-bcm2835 3f300000.mmc: DMA channels allocated
[    1.842163] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.852125] ledtrig-cpu: registered to indicate activity on CPUs
[    1.858323] hidraw: raw HID events driver (C) Jiri Kosina
[    1.863995] usbcore: registered new interface driver usbhid
[    1.869559] usbhid: USB HID core driver
[    1.873733] TCP: cubic registered
[    1.877055] Initializing XFRM netlink socket
[    1.881351] NET: Registered protocol family 17
[    1.885983] Key type dns_resolver registered
[    1.890657] Registering SWP/SWPB emulation handler
[    1.891235] mmc0: host does not support reading read-only switch, assuming write-enable
[    1.894809] mmc0: new high speed SDHC card at address e624
[    1.895496] mmcblk0: mmc0:e624 SU08G 7.40 GiB
[    1.905120]  mmcblk0: p1 p2
[    1.917165] registered taskstats version 1
[    1.921570] vc-sm: Videocore shared memory driver
[    1.926311] [vc_sm_connected_init]: start
[    1.930624] vc_vchi_sm_init: failed to open VCHI service (-1)
[    1.936260] [vc_sm_connected_init]: failed to initialize shared memory service
[    1.943716] [vc_sm_connected_init]: end - returning -1
[    1.952012] Indeed it is in host mode hprt0 = 00021501
[    1.968575] EXT4-fs (mmcblk0p2): mounted filesystem with ordered data mode. Opts: (null)
[    1.976793] VFS: Mounted root (ext4 filesystem) readonly on device 179:2.
[    1.992109] devtmpfs: mounted
[    1.995845] Freeing unused kernel memory: 400K (80786000 - 807ea000)
[    2.131953] usb 1-1: new high-speed USB device number 2 using dwc_otg
[    2.138573] Indeed it is in host mode hprt0 = 00001101
Mount failed for selinuxfs on /sys/fs/selinux:  No such file or directory
[    2.342280] usb 1-1: New USB device found, idVendor=0424, idProduct=9514
[    2.348995] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[    2.357148] hub 1-1:1.0: USB hub found
[    2.361067] hub 1-1:1.0: 5 ports detected
[    2.381385] random: init urandom read with 47 bits of entropy available
[    2.551575] init: plymouth-upstart-bridge main process (63) terminated with status 1
[    2.559646] init: plymouth-upstart-bridge main process ended, respawning
[    2.612007] init: plymouth-upstart-bridge main process (74) terminated with status 1
[    2.619888] init: plymouth-upstart-bridge main process ended, respawning
[    2.642252] usb 1-1.1: new high-speed USB device number 3 using dwc_otg
[    2.762241] usb 1-1.1: New USB device found, idVendor=0424, idProduct=ec00
[    2.769166] usb 1-1.1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[    2.780032] smsc95xx v1.0.4
[    2.852683] smsc95xx 1-1.1:1.0 eth0: register 'smsc95xx' at usb-3f980000.usb-1.1, smsc95xx USB 2.0 Ethernet, b8:27:eb:71:a4:bc
[    2.942181] usb 1-1.5: new full-speed USB device number 4 using dwc_otg
[    3.064541] usb 1-1.5: New USB device found, idVendor=0fe6, idProduct=9700
[    3.071435] usb 1-1.5: New USB device strings: Mfr=0, Product=2, SerialNumber=0
[    3.078998] usb 1-1.5: Product: USB 2.0 10/100M Ethernet Adaptor
 * Starting Mount filesystems on boot                                    [ OK ]
 * Stopping Send an event to indicate plymouth is up                     [ OK ]
 * Starting Populate /dev filesystem                                     [ OK ]
 * Stopping Populate /dev filesystem                                     [ OK ]
 * Starting Populate and link to /run filesystem                         [ OK ]
 * Stopping Populate and link to /run filesystem                         [ OK ]
 * Stopping Track if upstart is running in a container                   [ OK ]
 * Starting set console keymap                                           [ OK ]
 * Starting Signal sysvinit that virtual filesystems are mounted         [ OK ]
 * Starting Signal sysvinit that virtual filesystems are mounted         [ OK ]
 * Starting Bridge udev events into upstart                              [ OK ]
 * Stopping set console keymap                                           [ OK ]
 * Starting Signal sysvinit that remote filesystems are mounted          [ OK ]
 * Starting device node and kernel event manager                         [ OK ]
 * Starting load modules from /etc/modules                               [ OK ]
 * Starting cold plug devices                                            [ OK ]
 * Starting log initial device creation                                  [ OK ]
 * Stopping load modules from /etc/modules                               [ OK ]
 * Starting set console font                                             [ OK ]
 * Stopping set console font                                             [ OK ]
 * Starting userspace bootsplash                                         [ OK ]
 * Stopping userspace bootsplash                                         [ OK ]
 * Starting Send an event to indicate plymouth is up                     [ OK ]
 * Starting configure network device security                            [ OK ]
 * Stopping cold plug devices                                            [ OK ]
 * Stopping log initial device creation                                  [ OK ]
 * Stopping Send an event to indicate plymouth is up                     [ OK ]
 * Starting Mount network filesystems                                    [ OK ]
 * Starting Signal sysvinit that the rootfs is mounted                   [ OK ]
 * Starting configure network device security                            [ OK ]
 * Starting configure network device security                            [ OK ]
 * Stopping Mount network filesystems                                    [ OK ]
 * Starting configure network device                                     [ OK ]
 * Starting configure network device                                     [ OK ]
 * Starting Clean /tmp directory                                         [ OK ]
 * Stopping Clean /tmp directory                                         [ OK ]
 * Starting Signal sysvinit that local filesystems are mounted           [ OK ]
 * Starting configure network device security                            [ OK ]
 * Starting Failsafe Boot Delay                                          [ OK ]
 * Starting flush early job output to logs                               [ OK ]
 * Starting save udev log and update rules                               [ OK ]
 * Starting Mount network filesystems                                    [ OK ]
 * Stopping Mount filesystems on boot                                    [ OK ]
 * Stopping save udev log and update rules                               [ OK ]
 * Starting configure network device                                     [ OK ]
 * Stopping Failsafe Boot Delay                                          [ OK ]
 * Stopping flush early job output to logs                               [ OK ]
 * Starting System V initialisation compatibility                        [ OK ]
 * Starting configure virtual network devices                            [ OK ]
 * Stopping System V initialisation compatibility                        [ OK ]
 * Starting System V runlevel compatibility                              [ OK ]
 * Stopping Mount network filesystems                                    [ OK ]
 * Starting NTP server ntpd        * Starting OpenSSH server             [ OK ]
                                                                         [ OK ]
 * Stopping System V runlevel compatibility                              [ OK ]

Ubuntu 14.04 LTS debug ttyAMA0

debug login: root
Password:
Last login: Thu Jan  1 01:00:16 CET 1970 on ttyAMA0
Welcome to Ubuntu 14.04 LTS (GNU/Linux 4.0.7-v7+ armv7l)

 * Documentation:  https://help.ubuntu.com/
root@debug:~# lsusb
Bus 001 Device 004: ID 0fe6:9700 Kontron (Industrial Computer Source / ICS Advent) DM9601 Fast Ethernet Adapter
Bus 001 Device 003: ID 0424:ec00 Standard Microsystems Corp. SMSC9512/9514 Fast Ethernet Adapter
Bus 001 Device 002: ID 0424:9514 Standard Microsystems Corp.
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
root@debug:~# uname -a
Linux debug 4.0.7-v7+ #801 SMP PREEMPT Tue Jun 30 18:38:23 BST 2015 armv7l armv7l armv7l GNU/Linux
root@debug:~# dhclient -v eth1
Internet Systems Consortium DHCP Client 4.2.4
Copyright 2004-2012 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/

Corrupt lease file - possible data loss!
[   42.716919] dm9601 1-1.5:1.0 eth1: kevent 4 may have been dropped
[   42.723389] dm9601 1-1.5:1.0 eth1: kevent 4 may have been dropped
Listening on LPF/eth1/00:e0:4c:53:44:58
Sending on   LPF/eth1/00:e0:4c:53:44:58
Sending on   Socket/fallback
DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 3 (xid=0x304ea24f)
DHCPREQUEST of 134.xxx.xxx.xxx on eth1 to 255.255.255.255 port 67 (xid=0x304ea24f)
DHCPOFFER of 134.xxx.xxx.xxx from 134.xxx.xxx.xxx
DHCPACK of 134.xxx.xxx.xxx from 134.xxx.xxx.xxx
 * Stopping NTP server ntpd
   ...done.
 * Starting NTP server ntpd
   ...done.
bound to 134.xxx.xxx.xx -- renewal in 41527 seconds.
root@debug:~# apt-get update
Ign http://ftp.tu-chemnitz.de trusty InRelease
Get:1 http://ftp.tu-chemnitz.de trusty Release.gpg [933 B]
Get:2 http://ftp.tu-chemnitz.de trusty Release [58.5 kB]
3% [2 Release 11[   63.202645] skbuff: skb_over_panic: text:803b8208 len:1536 put:1536 head:bb638200 data:bb638242 tail:0xbb638842 end:0xbb638840 dev:eth1
[   63.216228] ------------[ cut here ]------------
[   63.220838] kernel BUG at net/core/skbuff.c:102!
[   63.225449] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
18 B/58.5 kB 2%]
Entering kdb (current=0x8080c6e8, pid 0) on processor 0 Oops: (null)
due to oops @ 0x80547544
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.0.7-v7+ #801
Hardware name: BCM2709
task: 8080c6e8 ti: 807ea000 task.ti: 807ea000
PC is at skb_panic+0x64/0x70
LR is at console_unlock+0x2f8/0x550
pc : [<80547544>]    lr : [<80066de8>]    psr: 20000193
sp : 807ebd70  ip : 807ebc70  fp : 807ebda4
r10: 00000000  r9 : 00000101  r8 : 00000000
r7 : 806c9e6c  r6 : bb638200  r5 : 00000600  r4 : bb638242
r3 : 807ea000  r2 : 00000101  r1 : 60000193  r0 : 0000007b
Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 3c2e806a  DAC: 00000015
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.0.7-v7+ #801
Hardware name: BCM2709
[<800175bc>] (unwind_backtrace) from [<80012fd4>] (show_stack+0x20/0x24)
[<80012fd4>] (show_stack) from [<80546adc>] (dump_stack+0x98/0xe0)
[<80546adc>] (dump_stack) from [<80010008>] (show_regs+0x1c/0x20)
[<80010008>] (show_regs) from [<800ad564>] (kdb_main_loop+0x3fc/0x77c)
[<800ad564>] (kdb_main_loop) from [<800b0218>] (kdb_stub+0x22c/0x49c)
[<800b0218>] (kdb_stub) from [<800a6038>] (kgdb_cpu_enter+0x434/0x78c)
[<800a6038>] (kgdb_cpu_enter) from [<800a65d4>] (kgdb_handle_exception+0xf4/0x20c)
[<800a65d4>] (kgdb_handle_exception) from [<80016b28>] (kgdb_notify+0x3c/0x90)
[<80016b28>] (kgdb_notify) from [<800414f4>] (notifier_call_chain+0x54/0x94)
[<800414f4>] (notifier_call_chain) from [<80041830>] (atomic_notifier_call_chain+0x44/0x58)
[<80041830>] (atomic_notifier_call_chain) from [<80041884>] (notify_die+0x40/0x4c)
[<80041884>] (notify_die) from [<800130d4>] (die+0xfc/0x410)
[<800130d4>] (die) from [<80013414>] (arm_notify_die+0x2c/0x64)
[<80013414>] (arm_notify_die) from [<80008384>] (do_undefinstr+0x144/0x1a0)
[<80008384>] (do_undefinstr) from [<8054c790>] (__und_svc_finish+0x0/0x30)
Exception stack(0x807ebce8 to 0x807ebd30)
bce0:                   0000007b 60000193 00000101 807ea000 bb638242 00000600
bd00: bb638200 806c9e6c 00000000 00000101 00000000 807ebda4 807ebc70 807ebd70
bd20: 80066de8 80547544 20000193 ffffffff
[<8054c790>] (__und_svc_finish) from [<80547544>] (skb_panic+0x64/0x70)
[<80547544>] (skb_panic) from [<8045e89c>] (skb_put+0x5c/0x60)
[<8045e89c>] (skb_put) from [<803b8208>] (rx_complete+0x34/0x1fc)
[<803b8208>] (rx_complete) from [<803c0384>] (__usb_hcd_giveback_urb+0x80/0x154)
[<803c0384>] (__usb_hcd_giveback_urb) from [<803c04a8>] (usb_hcd_giveback_urb+0x50/0x118)
[<803c04a8>] (usb_hcd_giveback_urb) from [<803e6ad0>] (completion_tasklet_func+0x6c/0x98)
[<803e6ad0>] (completion_tasklet_func) from [<803f4fac>] (tasklet_callback+0x20/0x24)
[<803f4fac>] (tasklet_callback) from [<80029348>] (tasklet_hi_action+0x7c/0x114)
[<80029348>] (tasklet_hi_action) from [<80028850>] (__do_softirq+0x124/0x3d4)
[<80028850>] (__do_softirq) from [<80028eb8>] (irq_exit+0xcc/0x13c)
[<80028eb8>] (irq_exit) from [<800685d8>] (__handle_domain_irq+0x8c/0xec)
[<800685d8>] (__handle_domain_irq) from [<8000857c>] (asm_do_IRQ+0x2c/0x30)
[<8000857c>] (asm_do_IRQ) from [<8054c5f4>] (__irq_svc+0x34/0x14c)
Exception stack(0x807ebf28 to 0x807ebf70)
bf20:                   80809cec 00000000 00000000 00000000 807ea000 80808dd8
bf40: 00000001 ffffffff 80843a9c 80808d78 8055223c 807ebf7c 807ebf70 807ebf70
bf60: 8000fc80 8000fc84 60000013 ffffffff
[<8054c5f4>] (__irq_svc) from [<8000fc84>] (arch_cpu_idle+0x30/0x4c)
[<8000fc84>] (arch_cpu_idle) from [<8005cb54>] (cpu_startup_entry+0x200/0x280)
[<8005cb54>] (cpu_startup_entry) from [<80542134>] (rest_init+0x80/0x98)
[<80542134>] (rest_init) from [<80786cd0>] (start_kernel+0x38c/0x3f8)

After a reboot I downgraded to 33a6707cf1c96b8a2b5dac2ac9dead590db9fcaa which gives the same problem:

root@debug:~# rpi-update 33a6707cf1c96b8a2b5dac2ac9dead590db9fcaa
 *** Raspberry Pi firmware updater by Hexxeh, enhanced by AndrewS and Dom
 *** Performing self-update
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 10185  100 10185    0     0  44449      0 --:--:-- --:--:-- --:--:-- 44671
 *** Relaunching after update
 *** Raspberry Pi firmware updater by Hexxeh, enhanced by AndrewS and Dom
 *** Downloading specific firmware revision (this will take a few minutes)
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   168    0   168    0     0    385      0 --:--:-- --:--:-- --:--:--   387
  0     0    0 46.2M    0     0  2699k      0 --:--:--  0:00:17 --:--:-- 2477k
 *** Updating firmware
 *** Updating kernel modules
 *** depmod 3.18.16-v7+
 *** depmod 3.18.16+
 *** Updating VideoCore libraries
 *** Using HardFP libraries
 *** Updating SDK
 *** Running ldconfig
 *** Storing current firmware revision
 *** Deleting downloaded files
 *** Syncing changes to disk
 *** If no errors appeared, your firmware was successfully updated to 33a6707cf1c96b8a2b5dac2ac9dead590db9fcaa
 *** A reboot is needed to activate the new firmware

Reboot

[    0.000000] Booting Linux on physical CPU 0xf00
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.18.16-v7+ (dc4@dc4-XPS13-9333) (gcc version 4.8.3 20140303 (prerelease) (crosstool-NG linaro-1.13.1+bzr2650 - Linaro GCC 2014.03) ) #795 SMP PREEMPT Wed Jun 17 13:24:01 BST 2015
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine model: Raspberry Pi 2 Model B Rev 1.1
[    0.000000] cma: Reserved 8 MiB at 0x3d800000
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] [bcm2709_smp_init_cpus] enter (8620->f3003010)
[    0.000000] [bcm2709_smp_init_cpus] ncores=4
[    0.000000] PERCPU: Embedded 10 pages/cpu @bd001000 s11456 r8192 d21312 u40960
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 251968
[    0.000000] Kernel command line: dma.dmachans=0x7f35 bcm2708_fb.fbwidth=656 bcm2708_fb.fbheight=416 bcm2709.boardrev=0xa01041 bcm2709.serial=0xfe71a4bc smsc95xx.macaddr=B8:27:EB:71:A4:BC bcm2708_fb.fbswap=1 bcm2709.disk_led_gpio=47 bcm2709.disk_led_active_low=0 sdhci-bcm2708.emmc_clock_freq=250000000 vc_mem.mem_base=0x3ea00000 vc_mem.mem_size=0x3f000000  dwc_otg.lpm_enable=0 console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 root=/dev/mmcblk0p2 rootfstype=ext4 rootwait
[    0.000000] PID hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
[    0.000000] Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Memory: 989568K/1015808K available (5739K kernel code, 397K rwdata, 1756K rodata, 388K init, 763K bss, 26240K reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xffe00000   (2048 kB)
[    0.000000]     vmalloc : 0xbe800000 - 0xff000000   (1032 MB)
[    0.000000]     lowmem  : 0x80000000 - 0xbe000000   ( 992 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x8075a024   (7497 kB)
[    0.000000]       .init : 0x8075b000 - 0x807bc000   ( 388 kB)
[    0.000000]       .data : 0x807bc000 - 0x8081f6bc   ( 398 kB)
[    0.000000]        .bss : 0x8081f6bc - 0x808de494   ( 764 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:608
[    0.000000] Architected cp15 timer(s) running at 19.20MHz (virt).
[    0.000013] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 3579139424256ns
[    0.000036] Switching to timer-based delay loop, resolution 52ns
[    0.000335] Console: colour dummy device 80x30
[    0.000371] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000)
[    0.000398] pid_max: default: 32768 minimum: 301
[    0.000775] Mount-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000797] Mountpoint-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.002032] Initializing cgroup subsys memory
[    0.002083] Initializing cgroup subsys devices
[    0.002109] Initializing cgroup subsys freezer
[    0.002151] Initializing cgroup subsys net_cls
[    0.002176] Initializing cgroup subsys blkio
[    0.002262] CPU: Testing write buffer coherency: ok
[    0.002343] ftrace: allocating 19685 entries in 58 pages
[    0.050966] CPU0: update cpu_capacity 1024
[    0.051005] CPU0: thread -1, cpu 0, socket 15, mpidr 80000f00
[    0.051021] [bcm2709_smp_prepare_cpus] enter
[    0.051153] Setting up static identity map for 0x52d1f8 - 0x52d22c
[    0.110890] [bcm2709_boot_secondary] cpu:1 started (0) 16
[    0.111192] CPU1: Booted secondary processor
[    0.111201] [bcm2709_secondary_init] enter cpu:1
[    0.111251] CPU1: update cpu_capacity 1024
[    0.111259] CPU1: thread -1, cpu 1, socket 15, mpidr 80000f01
[    0.130851] [bcm2709_boot_secondary] cpu:2 started (0) 18
[    0.131104] CPU2: Booted secondary processor
[    0.131111] [bcm2709_secondary_init] enter cpu:2
[    0.131140] CPU2: update cpu_capacity 1024
[    0.131148] CPU2: thread -1, cpu 2, socket 15, mpidr 80000f02
[    0.150906] [bcm2709_boot_secondary] cpu:3 started (0) 17
[    0.151147] CPU3: Booted secondary processor
[    0.151154] [bcm2709_secondary_init] enter cpu:3
[    0.151182] CPU3: update cpu_capacity 1024
[    0.151190] CPU3: thread -1, cpu 3, socket 15, mpidr 80000f03
[    0.151284] Brought up 4 CPUs
[    0.151322] SMP: Total of 4 processors activated (153.60 BogoMIPS).
[    0.151333] CPU: All CPU(s) started in SVC mode.
[    0.152297] devtmpfs: initialized
[    0.177198] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[    0.179148] pinctrl core: initialized pinctrl subsystem
[    0.182379] NET: Registered protocol family 16
[    0.187951] DMA: preallocated 4096 KiB pool for atomic coherent allocations
[    0.189067] bcm2709.uart_clock = 3000000
[    0.192076] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
[    0.192094] hw-breakpoint: maximum watchpoint size is 8 bytes.
[    0.192136] mailbox: Broadcom VideoCore Mailbox driver
[    0.192249] bcm2708_vcio: mailbox at f300b880
[    0.192606] bcm_power: Broadcom power driver
[    0.192624] bcm_power_open() -> 0
[    0.192636] bcm_power_request(0, 8)
[    0.693300] bcm_mailbox_read -> 00000080, 0
[    0.693314] bcm_power_request -> 0
[    0.693455] Serial: AMBA PL011 UART driver
[    0.693602] dev:f1: ttyAMA0 at MMIO 0x3f201000 (irq = 83, base_baud = 0) is a PL011 rev3
[    1.198342] console [ttyAMA0] enabled
[    1.274162] SCSI subsystem initialized
[    1.278143] usbcore: registered new interface driver usbfs
[    1.283791] usbcore: registered new interface driver hub
[    1.289227] usbcore: registered new device driver usb
[    1.296096] Switched to clocksource arch_sys_counter
[    1.331010] FS-Cache: Loaded
[    1.334213] CacheFiles: Loaded
[    1.348750] NET: Registered protocol family 2
[    1.354370] TCP established hash table entries: 8192 (order: 3, 32768 bytes)
[    1.361591] TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
[    1.368294] TCP: Hash tables configured (established 8192 bind 8192)
[    1.374745] TCP: reno registered
[    1.378015] UDP hash table entries: 512 (order: 2, 16384 bytes)
[    1.383979] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes)
[    1.390722] NET: Registered protocol family 1
[    1.395705] RPC: Registered named UNIX socket transport module.
[    1.401659] RPC: Registered udp transport module.
[    1.406380] RPC: Registered tcp transport module.
[    1.411077] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    1.418450] hw perfevents: enabled with armv7_cortex_a7 PMU driver, 5 counters available
[    1.426823] bcm2708_dma: DMA manager at f3007000
[    1.431613] vc-mem: phys_addr:0x00000000 mem_base=0x3ea00000 mem_size:0x3f000000(1008 MiB)
[    1.441403] futex hash table entries: 1024 (order: 4, 65536 bytes)
[    1.447861] audit: initializing netlink subsys (disabled)
[    1.453308] audit: type=2000 audit(1.239:1): initialized
[    1.474894] VFS: Disk quotas dquot_6.5.2
[    1.479219] Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
[    1.488770] FS-Cache: Netfs 'nfs' registered for caching
[    1.495118] NFS: Registering the id_resolver key type
[    1.500285] Key type id_resolver registered
[    1.504464] Key type id_legacy registered
[    1.509690] msgmni has been set to 1948
[    1.515266] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    1.522888] io scheduler noop registered
[    1.526850] io scheduler deadline registered
[    1.531451] io scheduler cfq registered (default)
[    1.538817] BCM2708FB: allocated DMA memory fdc00000
[    1.543825] BCM2708FB: allocated DMA channel 0 @ f3007000
[    1.554776] Console: switching to colour frame buffer device 82x26
[    1.565062] bcm2708-dmaengine bcm2708-dmaengine: Load BCM2835 DMA engine driver
[    1.572700] uart-pl011 dev:f1: no DMA platform data
[    1.577653] kgdb: Registered I/O driver kgdboc.
[    1.606623] vc-cma: Videocore CMA driver
[    1.610544] vc-cma: vc_cma_base      = 0x00000000
[    1.615240] vc-cma: vc_cma_size      = 0x00000000 (0 MiB)
[    1.620659] vc-cma: vc_cma_initial   = 0x00000000 (0 MiB)
[    1.637974] brd: module loaded
[    1.646938] loop: module loaded
[    1.650933] vchiq: vchiq_init_state: slot_zero = 0xbdc80000, is_master = 0
[    1.658681] Loading iSCSI transport class v2.0-870.
[    1.664519] usbcore: registered new interface driver smsc95xx
[    1.670366] dwc_otg: version 3.00a 10-AUG-2012 (platform bus)
[    1.876471] Core Release: 2.80a
[    1.879617] Setting default values for core params
[    1.884438] Finished setting default values for core params
[    2.090436] Using Buffer DMA mode
[    2.093750] Periodic Transfer Interrupt Enhancement - disabled
[    2.099591] Multiprocessor Interrupt Enhancement - disabled
[    2.105156] OTG VER PARAM: 0, OTG VER FLAG: 0
[    2.109530] Dedicated Tx FIFOs mode
[    2.113298] WARN::dwc_otg_hcd_init:1047: FIQ DMA bounce buffers: virt = 0xbdc14000 dma = 0xfdc14000 len=9024
[    2.123164] FIQ FSM acceleration enabled for :
[    2.123164] Non-periodic Split Transactions
[    2.123164] Periodic Split Transactions
[    2.123164] High-Speed Isochronous Endpoints
[    2.139929] WARN::hcd_init_fiq:412: FIQ on core 1 at 0x803db878
[    2.145848] WARN::hcd_init_fiq:413: FIQ ASM at 0x803dbbd4 length 36
[    2.152112] WARN::hcd_init_fiq:438: MPHI regs_base at 0xbe80a000
[    2.158153] dwc_otg bcm2708_usb: DWC OTG Controller
[    2.163067] dwc_otg bcm2708_usb: new USB bus registered, assigned bus number 1
[    2.170338] dwc_otg bcm2708_usb: irq 32, io mem 0x00000000
[    2.175858] Init: Port Power? op_state=1
[    2.179797] Init: Power Port (0)
[    2.183305] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[    2.190117] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    2.197353] usb usb1: Product: DWC OTG Controller
[    2.202055] usb usb1: Manufacturer: Linux 3.18.16-v7+ dwc_otg_hcd
[    2.208162] usb usb1: SerialNumber: bcm2708_usb
[    2.213618] hub 1-0:1.0: USB hub found
[    2.217507] hub 1-0:1.0: 1 port detected
[    2.222316] usbcore: registered new interface driver usb-storage
[    2.228674] mousedev: PS/2 mouse device common for all mice
[    2.234836] bcm2835-cpufreq: min=600000 max=900000
[    2.240048] sdhci: Secure Digital Host Controller Interface driver
[    2.246318] sdhci: Copyright(c) Pierre Ossman
[    2.251105] mmc-bcm2835 3f300000.mmc: DMA channels allocated
[    2.296433] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.308101] ledtrig-cpu: registered to indicate activity on CPUs
[    2.314361] hidraw: raw HID events driver (C) Jiri Kosina
[    2.321127] usbcore: registered new interface driver usbhid
[    2.327806] usbhid: USB HID core driver
[    2.333108] TCP: cubic registered
[    2.336536] Initializing XFRM netlink socket
[    2.342005] NET: Registered protocol family 17
[    2.348847] Key type dns_resolver registered
[    2.353627] Registering SWP/SWPB emulation handler
[    2.359389] registered taskstats version 1
[    2.363819] vc-sm: Videocore shared memory driver
[    2.368584] [vc_sm_connected_init]: start
[    2.372913] vc_vchi_sm_init: failed to open VCHI service (-1)
[    2.378587] [vc_sm_connected_init]: failed to initialize shared memory service
[    2.386047] [vc_sm_connected_init]: end - returning -1
[    2.392876] Waiting for root device /dev/mmcblk0p2...
[    2.404969] mmc0: host does not support reading read-only switch, assuming write-enable
[    2.416247] Indeed it is in host mode hprt0 = 00021501
[    2.416841] mmc0: new high speed SDHC card at address e624
[    2.417486] mmcblk0: mmc0:e624 SU08G 7.40 GiB
[    2.428562]  mmcblk0: p1 p2
[    2.518688] EXT4-fs (mmcblk0p2): mounted filesystem with ordered data mode. Opts: (null)
[    2.526946] VFS: Mounted root (ext4 filesystem) readonly on device 179:2.
[    2.542950] devtmpfs: mounted
[    2.546821] Freeing unused kernel memory: 388K (8075b000 - 807bc000)
[    2.606219] usb 1-1: new high-speed USB device number 2 using dwc_otg
[    2.612934] Indeed it is in host mode hprt0 = 00001101
Mount failed for selinuxfs on /sys/fs/selinux:  No such file or directory
[    2.816556] usb 1-1: New USB device found, idVendor=0424, idProduct=9514
[    2.823271] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[    2.831337] hub 1-1:1.0: USB hub found
[    2.835266] hub 1-1:1.0: 5 ports detected
[    2.937447] random: init urandom read with 54 bits of entropy available
[    3.101337] init: plymouth-upstart-bridge main process (62) terminated with status 1
[    3.110626] init: plymouth-upstart-bridge main process ended, respawning
[    3.126442] usb 1-1.1: new high-speed USB device number 3 using dwc_otg
[    3.174418] init: plymouth-upstart-bridge main process (71) terminated with status 1
[    3.182510] init: plymouth-upstart-bridge main process ended, respawning
[    3.236809] usb 1-1.1: New USB device found, idVendor=0424, idProduct=ec00
[    3.243748] usb 1-1.1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[    3.254249] smsc95xx v1.0.4
[    3.321076] smsc95xx 1-1.1:1.0 eth0: register 'smsc95xx' at usb-bcm2708_usb-1.1, smsc95xx USB 2.0 Ethernet, b8:27:eb:71:a4:bc
 * Starting Mount filesystems on boot                                    [ OK ]
 * Stopping Send an event to indicate plymouth is up                     [ OK ]
 * Starting Populate /dev filesystem                                     [ OK ]
 * Stopping Populate /dev filesystem                                     [ OK ]
 * Starting Populate and link to /run filesystem                         [ OK ]
 * Stopping Populate and link to /run filesystem                         [ OK ]
 * Stopping Track if upstart is running in a container                   [ OK ]
 * Starting set console keymap                                           [ OK ]
 * Starting Signal sysvinit that virtual filesystems are mounted         [ OK ]
 * Starting Signal sysvinit that virtual filesystems are mounted         [ OK ]
 * Starting Bridge udev events into upstart                              [ OK ]
 * Stopping set console keymap                                           [ OK ]
 * Starting device node and kernel event manager                         [ OK ]
 * Starting Signal sysvinit that remote filesystems are mounted          [ OK ]
 * Starting load modules from /etc/modules                               [ OK ]
 * Starting cold plug devices                                            [ OK ]
 * Starting log initial device creation                                  [ OK ]
 * Stopping load modules from /etc/modules                               [ OK ]
 * Starting set console font                                             [ OK ]
 * Starting set console font                                             [fail]
 * Starting userspace bootsplash                                         [ OK ]
 * Starting configure network device security                            [ OK ]
 * Stopping cold plug devices                                            [ OK ]
 * Stopping userspace bootsplash                                         [ OK ]
 * Starting Send an event to indicate plymouth is up                     [ OK ]
 * Stopping log initial device creation                                  [ OK ]
 * Stopping Send an event to indicate plymouth is up                     [ OK ]
 * Starting Signal sysvinit that the rootfs is mounted                   [ OK ]
 * Starting Mount network filesystems                                    [ OK ]
 * Starting configure network device security                            [ OK ]
 * Starting Clean /tmp directory                                         [ OK ]
 * Stopping Mount network filesystems                                    [ OK ]
 * Starting configure network device                                     [ OK ]
 * Stopping Clean /tmp directory                                         [ OK ]
 * Starting Signal sysvinit that local filesystems are mounted           [ OK ]
 * Starting configure network device security                            [ OK ]
 * Starting Failsafe Boot Delay                                          [ OK ]
 * Starting flush early job output to logs                               [ OK ]
 * Starting save udev log and update rules                               [ OK ]
 * Stopping Mount filesystems on boot                                    [ OK ]
 * Stopping save udev log and update rules                               [ OK ]
 * Stopping flush early job output to logs                               [ OK ]
 * Starting configure virtual network devices                            [ OK ]
 * Starting Mount network filesystems                                    [ OK ]
 * Starting configure network device                                     [ OK ]
 * Stopping Failsafe Boot Delay                                          [ OK ]
 * Starting System V initialisation compatibility                        [ OK ]
 * Stopping Mount network filesystems                                    [ OK ]
 * Stopping System V initialisation compatibility                        [ OK ]
 * Starting System V runlevel compatibility                              [ OK ]
 * Starting regular background program processing daemon                 [ OK ]
 * Starting NTP server ntpd                                              [ OK ]
 * Starting OpenSSH server                                               [ OK ]
 * Starting Bridge file events into upstart                              [ OK ]
 * Stopping System V runlevel compatibility                              [ OK ]
 * Starting Bridge socket events into upstart                            [ OK ]

Ubuntu 14.04 LTS debug ttyAMA0

debug login:

And then

root@debug:~# ping google.com
PING google.com (173.194.116.195): 56 data bytes
64 bytes from 173.194.116.195: icmp_seq=0 ttl=55 time=6.215 ms
^C--- google.com ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/stddev = 6.215/6.215/6.215/0.000 ms
root@debug:~# apt-get update
Ign http://ftp.tu-chemnitz.de trusty InRelease
Get:1 http://ftp.tu-chemnitz.de trusty Release.gpg [933 B]
Get:2 http://ftp.tu-chemnitz.de trusty Release [58.5 kB]
2% [2 Release 0 B/58.5 kB[   29.807097] skbuff: skb_over_panic: text:803a04b4 len:1536 put:1536 head:bb310000 data:bb310042 tail:0xbb310642 end:0xbb310640 dev:eth1
[   29.820218] ------------[ cut here ]------------
[   29.824829] kernel BUG at net/core/skbuff.c:100!
[   29.829440] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
 0%]
Entering kdb (current=0x807e47e0, pid 0) on processor 0 Oops: (null)
due to oops @ 0x80525e18
dCPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.18.16-v7+ #795
dtask: 807e47e0 ti: 807bc000 task.ti: 807bc000
PC is at skb_panic+0x64/0x70
LR is at console_unlock+0x2cc/0x510
pc : [<80525e18>]    lr : [<80064fe0>]    psr: 20000193
sp : 807bdd60  ip : 807bdc78  fp : 807bdd94
r10: 8052f828  r9 : 00000101  r8 : 00000000
r7 : 806a1860  r6 : bb310000  r5 : 00000600  r4 : bb310042
r3 : 00000101  r2 : 00000102  r1 : 60000193  r0 : 0000007b
Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 3b35406a  DAC: 00000015
dCPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.18.16-v7+ #795
[<800172e4>] (unwind_backtrace) from [<80012fa4>] (show_stack+0x20/0x24)
[<80012fa4>] (show_stack) from [<805256e8>] (dump_stack+0x98/0xd8)
[<805256e8>] (dump_stack) from [<8001002c>] (show_regs+0x1c/0x20)
[<8001002c>] (show_regs) from [<800a92c4>] (kdb_dumpregs+0x38/0x60)
[<800a92c4>] (kdb_dumpregs) from [<800ac77c>] (kdb_main_loop+0x36c/0x744)
[<800ac77c>] (kdb_main_loop) from [<800af420>] (kdb_stub+0x1e4/0x454)
[<800af420>] (kdb_stub) from [<800a54dc>] (kgdb_cpu_enter+0x3fc/0x734)
[<800a54dc>] (kgdb_cpu_enter) from [<800a5adc>] (kgdb_handle_exception+0x178/0x1e0)
[<800a5adc>] (kgdb_handle_exception) from [<800168c0>] (kgdb_notify+0x3c/0x90)
[<800168c0>] (kgdb_notify) from [<80040f98>] (notifier_call_chain+0x54/0x94)
[<80040f98>] (notifier_call_chain) from [<800412d4>] (atomic_notifier_call_chain+0x44/0x58)
[<800412d4>] (atomic_notifier_call_chain) from [<80041328>] (notify_die+0x40/0x4c)
[<80041328>] (notify_die) from [<800130a4>] (die+0xfc/0x3e8)
[<800130a4>] (die) from [<800133bc>] (arm_notify_die+0x2c/0x64)
[<800133bc>] (arm_notify_die) from [<80008384>] (do_undefinstr+0x144/0x1a8)
[<80008384>] (do_undefinstr) from [<8052b0d0>] (__und_svc_finish+0x0/0x30)
Exception stack(0x807bdcd8 to 0x807bdd20)
dcc0:                                                       0000007b 60000193
dce0: 00000102 00000101 bb310042 00000600 bb310000 806a1860 00000000 00000101
dd00: 8052f828 807bdd94 807bdc78 807bdd60 80064fe0 80525e18 20000193 ffffffff
[<8052b0d0>] (__und_svc_finish) from [<80525e18>] (skb_panic+0x64/0x70)
[<80525e18>] (skb_panic) from [<80441f20>] (skb_put+0x5c/0x60)
[<80441f20>] (skb_put) from [<803a04b4>] (rx_complete+0x34/0x1fc)
[<803a04b4>] (rx_complete) from [<803a8630>] (__usb_hcd_giveback_urb+0x80/0x154)
[<803a8630>] (__usb_hcd_giveback_urb) from [<803a8754>] (usb_hcd_giveback_urb+0x50/0x118)
[<803a8754>] (usb_hcd_giveback_urb) from [<803cecd4>] (completion_tasklet_func+0x6c/0x98)
[<803cecd4>] (completion_tasklet_func) from [<803dd130>] (tasklet_callback+0x20/0x24)
[<803dd130>] (tasklet_callback) from [<80029640>] (tasklet_hi_action+0x7c/0x114)
[<80029640>] (tasklet_hi_action) from [<80028c08>] (__do_softirq+0x12c/0x384)
[<80028c08>] (__do_softirq) from [<800291e4>] (irq_exit+0xc0/0x110)
[<800291e4>] (irq_exit) from [<80066e50>] (__handle_domain_irq+0x8c/0xdc)
[<80066e50>] (__handle_domain_irq) from [<80008564>] (asm_do_IRQ+0x2c/0x30)
[<80008564>] (asm_do_IRQ) from [<8052af34>] (__irq_svc+0x34/0x14c)
Exception stack(0x807bdf20 to 0x807bdf68)
df20: 807e1ccc 00000000 00000000 00000000 807bc000 8081f6c0 807e0dd4 ffffffff
df40: 8081aadc 807e0d74 8052f828 807bdf74 807bdf68 807bdf68 8000fca0 8000fca4
df60: 60000013 ffffffff
[<8052af34>] (__irq_svc) from [<8000fca4>] (arch_cpu_idle+0x30/0x4c)
[<8000fca4>] (arch_cpu_idle) from [<8005b8fc>] (cpu_startup_entry+0x1e4/0x264)
[<8005b8fc>] (cpu_startup_entry) from [<80521068>] (rest_init+0x80/0x98)
[<80521068>] (rest_init) from [<8075bcb4>] (start_kernel+0x370/0x3d8)
@popcornmix

This comment has been minimized.

Copy link
Collaborator

@popcornmix popcornmix commented Jul 3, 2015

Some info:
https://www.raspberrypi.org/forums/viewtopic.php?f=28&t=39567
https://www.raspberrypi.org/forums/viewtopic.php?f=66&t=34557

Seems to be a bug with the hardware/driver writing beyond the end of the buffer.

ping @P33M

@P33M

This comment has been minimized.

Copy link
Contributor

@P33M P33M commented Jul 3, 2015

The driver for the hardware is broken. Devices using this chipset are few and far between, as there are superior devices available from SMSC and ASIX.

The chipset itself is registering as a full-speed device (max 12mbit/s, including overhead) which is a severe constraint to ethernet throughput.

It'd be easier and simpler to just buy a high-speed adapter that can do fast ethernet.

@strongly-typed

This comment has been minimized.

Copy link
Author

@strongly-typed strongly-typed commented Jul 6, 2015

Thanks for clarifying. The 12 MBit USB 1.1 is no problem for my application.

If the driver is broken, the issue is known and no effort is made to fix these problems, this broken and useless driver should be removed from the kernel tree, asap.

@popcornmix

This comment has been minimized.

Copy link
Collaborator

@popcornmix popcornmix commented Jul 6, 2015

That would be better reported upstream:
https://www.kernel.org/pub/linux/docs/lkml/reporting-bugs.html

@OmgImAlexis

This comment has been minimized.

Copy link

@OmgImAlexis OmgImAlexis commented Oct 16, 2015

Any updates on this?

@strongly-typed

This comment has been minimized.

Copy link
Author

@strongly-typed strongly-typed commented Oct 21, 2015

I'm still able to reproduce this bug with

 Linux raspberrypi 4.1.10-v7+ #821 SMP PREEMPT Sat Oct 10 00:16:28 BST 2015 armv7l GNU/Linux

 [  240.955434] ------------[ cut here ]------------
 [  240.961501] kernel BUG at net/core/skbuff.c:102!
 [  240.967571] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM

However, I did not yet reported the bug upstream. I may do this today.

@strongly-typed

This comment has been minimized.

Copy link
Author

@strongly-typed strongly-typed commented Oct 22, 2015

Actually, the device works with OpenWRT without oopsing with

Linux OpenWrt 4.1.10 #12 Thu Oct 22 18:30:56 CEST 2015 mips GNU/Linux

on TPLink WR703

 root@OpenWrt:/tmp# cat /proc/cpuinfo
 system type        : Atheros AR9330 rev 1
 machine            : TP-LINK TL-WR703N v1
 processor      : 0
 cpu model      : MIPS 24Kc V7.4
 BogoMIPS       : 265.42
 wait instruction   : yes
 microsecond timers : yes
 tlb_entries        : 16
 extra interrupt vector : yes
 hardware watchpoint    : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
 isa            : mips1 mips2 mips32r1 mips32r2
 ASEs implemented   : mips16
 shadow register sets   : 1
 kscratch registers : 0
 package            : 0
 core           : 0
 VCED exceptions        : not available
 VCEI exceptions        : not available


 root@OpenWrt:/tmp# wget -O -  http://cachefly.cachefly.net/100mb.test | md5sum
 Connecting to cachefly.cachefly.net (205.234.175.175:80)
 -                     18% |*****                          | 19317k  0:01:51 ETA[ 1700.380400] usb 1-1: unexpected tiny rx frame
 [ 1700.803401] usb 1-1: unexpected tiny rx frame
 -                     19% |******                         | 20095k  0:01:50 ETA[ 1701.356400] usb 1-1: unexpected tiny rx frame
 [ 1701.810399] usb 1-1: unexpected tiny rx frame
 -                     20% |******                         | 20863k  0:01:49 ETA[ 1702.395401] usb 1-1: unexpected tiny rx frame
 [ 1702.454399] usb 1-1: unexpected tiny rx frame
 [ 1702.512420] usb 1-1: unexpected tiny rx frame
 [ 1702.714398] usb 1-1: unexpected tiny rx frame
 [ 1702.932399] usb 1-1: unexpected tiny rx frame
 [ 1702.936377] usb 1-1: unexpected tiny rx frame
 [ 1703.279401] usb 1-1: unexpected tiny rx frame
 -                     21% |******                         | 21625k  0:01:48 ETA[ 1703.716399] usb 1-1: unexpected tiny rx frame
 [ 1703.800400] usb 1-1: unexpected tiny rx frame
 -                     23% |*******                        | 24549k  0:01:44 ETA[ 1707.939400] usb 1-1: unexpected tiny rx frame
 [ 1707.962410] usb 1-1: unexpected tiny rx frame
 -                     24% |*******                        | 24899k  0:01:45 ETA[ 1709.004399] usb 1-1: unexpected tiny rx frame
 -                     25% |*******                        | 25678k  0:01:44 ETA[ 1709.710421] usb 1-1: unexpected tiny rx frame
 [ 1710.323409] usb 1-1: unexpected tiny rx frame
 -                     25% |********                       | 26443k  0:01:43 ETA[ 1710.572399] usb 1-1: unexpected tiny rx frame
 [ 1710.962401] usb 1-1: unexpected tiny rx frame
 [ 1711.334399] usb 1-1: unexpected tiny rx frame
 -                     26% |********                       | 27221k  0:01:42 ETA[ 1712.006414] usb 1-1: unexpected tiny rx frame
 -                     27% |********                       | 28011k  0:01:40 ETA[ 1712.584400] usb 1-1: unexpected tiny rx frame
 -                     28% |********                       | 28783k  0:01:39 ETA[ 1714.334400] usb 1-1: unexpected tiny rx frame
 -                     29% |*********                      | 30326k  0:01:37 ETA[ 1716.017409] usb 1-1: unexpected tiny rx frame
 -                     30% |*********                      | 31104k  0:01:36 ETA[ 1716.614420] usb 1-1: unexpected tiny rx frame
 [ 1716.959400] usb 1-1: unexpected tiny rx frame
 -                     31% |*********                      | 32666k  0:01:33 ETA[ 1718.946400] usb 1-1: unexpected tiny rx frame
 -                     32% |**********                     | 33444k  0:01:32 ETA[ 1720.212400] usb 1-1: unexpected tiny rx frame
 -                     33% |**********                     | 34229k  0:01:31 ETA[ 1720.617409] usb 1-1: unexpected tiny rx frame
 [ 1721.138400] usb 1-1: unexpected tiny rx frame
 [ 1721.269399] usb 1-1: unexpected tiny rx frame
 -                     34% |**********                     | 34998k  0:01:30 ETA[ 1721.621400] usb 1-1: unexpected tiny rx frame
 -                     34% |**********                     | 35782k  0:01:29 ETA[ 1722.947402] usb 1-1: unexpected tiny rx frame
 -                     36% |***********                    | 37160k  0:01:27 ETA[ 1724.633406] usb 1-1: unexpected tiny rx frame
 -                     39% |************                   | 40271k  0:01:23 ETA[ 1728.641400] usb 1-1: unexpected tiny rx frame
 [ 1728.983400] usb 1-1: unexpected tiny rx frame
 [ 1729.340398] usb 1-1: unexpected tiny rx frame
 -                     40% |************                   | 41033k  0:01:22 ETA[ 1729.981399] usb 1-1: unexpected tiny rx frame
 -                     40% |************                   | 41822k  0:01:21 ETA[ 1730.397408] usb 1-1: unexpected tiny rx frame
 [ 1730.488410] usb 1-1: unexpected tiny rx frame
 [ 1730.498411] usb 1-1: unexpected tiny rx frame
 -                     41% |************                   | 42402k  0:01:20 ETA[ 1731.515401] usb 1-1: unexpected tiny rx frame
 -                     42% |*************                  | 43197k  0:01:19 ETA[ 1732.525399] usb 1-1: unexpected tiny rx frame
 [ 1732.640414] usb 1-1: unexpected tiny rx frame
 -                     42% |*************                  | 43972k  0:01:18 ETA[ 1733.662436] usb 1-1: unexpected tiny rx frame
 [ 1734.040407] usb 1-1: unexpected tiny rx frame
 -                     43% |*************                  | 44754k  0:01:17 ETA[ 1734.527402] usb 1-1: unexpected tiny rx frame
 -                     45% |*************                  | 46094k  0:01:15 ETA[ 1736.641415] usb 1-1: unexpected tiny rx frame
 -                     47% |**************                 | 48247k  0:01:12 ETA[ 1740.019400] usb 1-1: unexpected tiny rx frame
 -                     56% |*****************              | 57619k  0:01:00 ETA[ 1752.718401] usb 1-1: unexpected tiny rx frame
 -                     57% |*****************              | 58386k  0:00:59 ETA[ 1753.819407] usb 1-1: unexpected tiny rx frame
 -                     57% |*****************              | 59159k  0:00:58 ETA[ 1754.740421] usb 1-1: unexpected tiny rx frame
 [ 1754.813400] usb 1-1: unexpected tiny rx frame
 -                     59% |******************             | 60710k  0:00:56 ETA[ 1756.820411] usb 1-1: unexpected tiny rx frame
 -                     60% |******************             | 61488k  0:00:55 ETA[ 1757.668399] usb 1-1: unexpected tiny rx frame
 -                     60% |******************             | 62266k  0:00:54 ETA[ 1758.672420] usb 1-1: unexpected tiny rx frame
 [ 1758.714400] usb 1-1: unexpected tiny rx frame
 [ 1758.720393] usb 1-1: unexpected tiny rx frame
 [ 1759.043400] usb 1-1: unexpected tiny rx frame
 -                     61% |*******************            | 63042k  0:00:53 ETA[ 1760.060399] usb 1-1: unexpected tiny rx frame
 -                     62% |*******************            | 63826k  0:00:51 ETA[ 1761.050399] usb 1-1: unexpected tiny rx frame
 -                     63% |*******************            | 64598k  0:00:50 ETA[ 1761.651399] usb 1-1: unexpected tiny rx frame
 -                     63% |*******************            | 65367k  0:00:49 ETA[ 1762.651400] usb 1-1: unexpected tiny rx frame
 [ 1763.051400] usb 1-1: unexpected tiny rx frame
 -                     65% |********************           | 66901k  0:00:47 ETA[ 1764.645400] usb 1-1: unexpected tiny rx frame
 [ 1764.666407] usb 1-1: unexpected tiny rx frame
 [ 1765.261402] usb 1-1: unexpected tiny rx frame
 -                     70% |*********************          | 72040k  0:00:40 ETA[ 1771.889402] usb 1-1: unexpected tiny rx frame
 -                     72% |**********************         | 74078k  0:00:38 ETA[ 1774.912431] usb 1-1: unexpected tiny rx frame
 -                     75% |***********************        | 76982k  0:00:34 ETA[ 1778.927402] usb 1-1: unexpected tiny rx frame
 -                     79% |************************       | 81141k  0:00:28 ETA[ 1784.809400] usb 1-1: unexpected tiny rx frame
 -                     80% |*************************      | 82711k  0:00:26 ETA[ 1786.807402] usb 1-1: unexpected tiny rx frame
 -                     83% |*************************      | 85843k  0:00:22 ETA[ 1790.825401] usb 1-1: unexpected tiny rx frame
 -                     84% |**************************     | 86620k  0:00:21 ETA[ 1791.833401] usb 1-1: unexpected tiny rx frame
 -                     86% |**************************     | 88950k  0:00:18 ETA[ 1794.818401] usb 1-1: unexpected tiny rx frame
 -                     89% |***************************    | 92098k  0:00:13 ETA[ 1798.837419] usb 1-1: unexpected tiny rx frame
 -                     92% |****************************   | 94437k  0:00:10 ETA[ 1802.981401] usb 1-1: unexpected tiny rx frame
 -                    100% |*******************************|   100M  0:00:00 ETA
 9b5183f05b62ca114c467945467050be  -     

The md5sum is correct.

@OmgImAlexis

This comment has been minimized.

Copy link

@OmgImAlexis OmgImAlexis commented Oct 23, 2015

@strongly-typed are they using a patched version of the kernel?

@strongly-typed

This comment has been minimized.

Copy link
Author

@strongly-typed strongly-typed commented Oct 23, 2015

OpenWRT uses a lot of patches, but I was not able to spot one for the DM9601 driver

 https://dev.openwrt.org/browser/trunk/target/linux/ar71xx/patches-4.1
 https://dev.openwrt.org/browser/trunk/target/linux/ar71xx/files/arch/mips/ath79

To me, it seems that the stock version of the module is compiled.

@strongly-typed

This comment has been minimized.

Copy link
Author

@strongly-typed strongly-typed commented Oct 27, 2015

The maintainer Peter (....@sunsite.dk) is not reachable by mail

delivery temporarily suspended: lost connection with
@strongly-typed

This comment has been minimized.

Copy link
Author

@strongly-typed strongly-typed commented Nov 11, 2015

I reported the kernel crash to the Linux netdev mailing list [1] but did not receive any response until now. So I do not think this issue will get any attention by the Linux kernel developers.

[1] http://www.spinics.net/lists/netdev/msg350073.html

@IvanExpert

This comment has been minimized.

Copy link

@IvanExpert IvanExpert commented Dec 6, 2015

Even though it sounds like fixing this needs to happen upstream, I thought I'd mention that I'm seeing failure (unsurprisingly, given the above) with this chipset on a Raspberry Pi Zero using the current Jessie image, though with slightly different symptoms. I was hoping to use a single OTG USB hub + Ethernet adapter as the perfect companion, and I found this one: http://www.amazon.com/gp/product/B016ERI1JY

It uses the DM9601 chipset for the Ethernet. It doesn't work. The interface shows up, but it never receives an IP address, and there's a pages and pages of this from dmesg:

[ 282.195687] dm9601 1-1.2:1.0 eth0: link up, 100Mbps, full-duplex, lpa 0xFFFF
[ 282.212272] dm9601 1-1.2:1.0 eth0: kevent 11 may have been dropped
[ 282.301127] dm9601 1-1.2:1.0 eth0: link up, 100Mbps, full-duplex, lpa 0xFFFF
[ 287.140890] dm9601 1-1.2:1.0 eth0: kevent 4 may have been dropped
[ 287.142852] dm9601 1-1.2:1.0 eth0: kevent 4 may have been dropped
[ 287.152886] dm9601 1-1.2:1.0 eth0: kevent 4 may have been dropped
[ 287.183960] dm9601 1-1.2:1.0 eth0: link up, 100Mbps, full-duplex, lpa 0xFFFF
[ 287.289712] dm9601 1-1.2:1.0 eth0: link up, 100Mbps, full-duplex, lpa 0xFFFF

I tried a 2.1A power adapter but no improvement.

@DonHege

This comment has been minimized.

Copy link

@DonHege DonHege commented Jan 9, 2016

I'm experiencing the same issue. Ping, SSH etc. works, but apt-get update causes a Kernel panic. So a fix would be highly appreciated. ;)

Tried it with Raspberry Pi Zero, lastest Debian and a Micro-USB-Ethernet-Adapter labeled as "High Speed USB 2.0 to 10/100 Mbps RJ45 LAN", product code: "SKU154626".

@mw9

This comment has been minimized.

Copy link

@mw9 mw9 commented Jan 15, 2016

@popcornmix
You commented:

Seems to be a bug with the hardware/driver writing beyond the end of the buffer.

It seems to me that the dwc_otg driver is implicated in this.

When I made an experimental switch from the dwc_otg driver to the dwc2 driver (in host mode) the kernel 'Oops' was replaced by kernel log lines of the the following nature:

[  336.364148] dwc2 20980000.usb: dwc2_update_urb_state(): trimming xfer length
[  337.366541] dwc2 20980000.usb: dwc2_update_urb_state(): trimming xfer length
[  344.851911] dwc2 20980000.usb: dwc2_update_urb_state(): trimming xfer length

The story seems to be this:

The dm9601 driver expects to receive a single encapsulated ethernet frame from the device in one URB transfer, and it provides an URB buffer of length 1,522 to receive it. This is not a round multiple of USB transfer packets.

The device in question [1] provides a stream of such frames and it does not conveniently slice them up as the dm9601 driver expects. We can end up with 1,536 (0x600) bytes returned by the device in response to the URB request. This may include several encapsulated ethernet frames, and/or fragments thereof.

It seems to me that the kernel 'Oops' arises because the dwc_otg driver does not notice that the destination buffer is too small to receive the full 1,536 bytes. Comparing dwc_otg's update_urb_state_xfer_comp with dwc2's dwc2_update_urb_state is suggestive.


if (urb->actual_length + xfer_length > urb->length) {

[1] ID 0fe6:9700 Kontron (Industrial Computer Source / ICS Advent) DM9601 Fast Ethernet Adapter

@popcornmix

This comment has been minimized.

Copy link
Collaborator

@popcornmix popcornmix commented Jan 15, 2016

ping @P33M

@campag

This comment has been minimized.

Copy link
Contributor

@campag campag commented Feb 11, 2016

@popcornmix Rebuilding the kernel with those lines alluded to by @mw9 does appear to work (I commented out the log message to get it to compile). I can't immediately see how to fix the log line, but no doubt someone who is familiar with the code could fix this in dwc_otg rather than upstream on the dm9601 side as reported in #1207.

Edited to add: I think @6by9 has one of these ridiculously cheap 3-port usb2.0 hub inc usb1.1 dm9601 ethernet devices if you need hardware to test.

@6by9

This comment has been minimized.

Copy link
Contributor

@6by9 6by9 commented Feb 11, 2016

I do have a couple of these hubs/LAN adapters if Pi Towers don't already have some.
@campag Can you add your diff just to save me a few minutes, and I'll rebuild a kernel to see what's going on. A PR with a fix is easier to deal with than having to hack through a hypothesis.

@campag

This comment has been minimized.

Copy link
Contributor

@campag campag commented Feb 11, 2016

Sure @6by9, with this I have success with the DM9601 hub/LAN on my RPi2. Lines copied straight from dwc2 hcd_initr.c as referenced above. No panics when I do an apt-get, large downloads etc.

--- /home/pi/dwc_otg_hcd_intr.c 2016-02-11 17:27:05.191326624 +0000
+++ linux/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c   2016-02-11 17:21:21.143342785 +0000
@@ -737,6 +737,11 @@
                         DWC_OTG_HC_XFER_COMPLETE,
                         &short_read);

+   if (urb->actual_length + xfer_length > urb->length) {
+   /*  dev_warn(hsotg->dev, "%s(): trimming xfer length\n", __func__);*/
+       xfer_length = urb->length - urb->actual_length;
+   }
+
    /* non DWORD-aligned buffer case handling. */
    if (hc->align_buff && xfer_length && hc->ep_is_in) {
        dwc_memcpy(urb->buf + urb->actual_length, hc->qh->dw_align_buf,
@mw9

This comment has been minimized.

Copy link

@mw9 mw9 commented Feb 11, 2016

@campag
I think there may be other places within the dwc_otg driver that would also need this treatment. Perhaps I should refile the dwc_otg issue under a more appropriate heading.

As far as the specific device is concerned, I would think the real solution is to create a modified driver that handles the device properly. I have a rough draft of that which I will endeavour to make available in some form.

I have two of these things, which were also ridiculously cheap, and despite their considerable shortcomings could work well enough with the Pi Zero in some circumstances.

Shortcomings include:
USB 1.1, despite marketing as USB 2. So slow transfer speeds.
Don't seem to carry out on chip CRC checking.
Don't seem to carry out filtering, so it's promiscuous mode if you want to participate in multicast.
Don't support MII interface, so existing drivers get lied to.
No EPROM, so they all have the same MAC address. So need to manually set if you have more than one on your network.
One of the devices seems to have a magnetics chip on board, the other (RD9700) seems to eschew such an arrangement.

Etc.

Oh, and all chips nicely sanded off, so no markings discernible.

@campag

This comment has been minimized.

Copy link
Contributor

@campag campag commented Feb 11, 2016

@mw9 with those patches you hinted at (thanks!), I've spent this evening surfing & downloading - the $4/£3 device seems quite usable there. In that time I've seen these in the kernel log:

[43757.720292] dm9601 1-1.5.2:1.0 eth1: kevent 4 may have been dropped
[43757.750845] dm9601 1-1.5.2:1.0 eth1: link up, 100Mbps, full-duplex, lpa 0xFFFF
[43757.854206] dm9601 1-1.5.2:1.0 eth1: link up, 100Mbps, full-duplex, lpa 0xFFFF
[44204.429655] usb 1-1.5.2: unexpected tiny rx frame
@mw9

This comment has been minimized.

Copy link

@mw9 mw9 commented Feb 11, 2016

@campag
I haven't hinted at any patch, yet ! When I do, it won't apply to dwc_otg, but it will prevent unexpected tiny rx frame. The dropped kevents may remain.

I've been a bit busy over the last three/four weeks, otherwise I would have already posted.

@6by9

This comment has been minimized.

Copy link
Contributor

@6by9 6by9 commented Feb 12, 2016

dwc_otg seems to be a Pi only driver (at least it's not upstreamed), so if there are issues then it is up to Pi Towers and the community to fix.
I'd say you have found a genuine issue there that needs fixing as it could hit almost any USB device driver that uses it as the transport layer.

Creating a new driver that works around the shortcomings of these specific USB devices (and that is quite a list!) would be nice, but I don't see how that new driver can work around the dwc_otg issue without just overallocating the packet buffer to be a multiple of the URB size.

@campag DWC_WARN("%s(): trimming xfer length\n", __func__); should give you the warning message. It is ugly as it is still using printk directly, but that seems to be how the whole driver is set up to do logging.

@popcornmix

This comment has been minimized.

Copy link
Collaborator

@popcornmix popcornmix commented Feb 12, 2016

I've no objection to adding the patch in #1045 (comment) to dwc_otg driver.
From @P33M

It is however a broken driver that's not allocating enough space and then either lying that it wants a URB of size N or failing to take into account the device may occasionally return more data than it thinks it's asked for.

So really the DM9601 device/driver should be fixed, but avoiding a crash when being given malformed data is good, so I'll add the patch to next kernel update.

@mw9

This comment has been minimized.

Copy link

@mw9 mw9 commented Feb 12, 2016

@popcornmix @campag

There is at least one other location that would need the same treatment, I think. Compare also:

static void dwc2_update_urb_state_abn(struct dwc2_hsotg *hsotg,

static void update_urb_state_xfer_intr(dwc_hc_t * hc,

There are other points at which get_actual_xfer_length is called. Figuring out if similar precautions are warranted in those cases is beyond beyond my pay grade.

@popcornmix

This comment has been minimized.

Copy link
Collaborator

@popcornmix popcornmix commented Feb 12, 2016

I've added second "trim" to rpi-4.4.y tree: 52d3149
If no problems reported will add to rpi-4.1.y soon.

popcornmix added a commit to raspberrypi/firmware that referenced this issue Feb 13, 2016
See: raspberrypi/linux@3856956

kernel: BCM270X_DT: Use bcm2835-sdhost as standard

kernel: dcw_otg: trim xfer length when buffer larger than allocated size is received
See: raspberrypi/linux#1045
popcornmix added a commit to Hexxeh/rpi-firmware that referenced this issue Feb 13, 2016
See: raspberrypi/linux@3856956

kernel: BCM270X_DT: Use bcm2835-sdhost as standard

kernel: dcw_otg: trim xfer length when buffer larger than allocated size is received
See: raspberrypi/linux#1045
@popcornmix

This comment has been minimized.

Copy link
Collaborator

@popcornmix popcornmix commented Feb 13, 2016

The trims have been added to both normal and BRANCH=next rpi-update firmware.
I suspect you will get dmesg warnings with DM9601, but does it fix the hangs?

@mw9

This comment has been minimized.

Copy link

@mw9 mw9 commented Feb 13, 2016

Hangs are fixed:

Feb 13 17:50:01 raspberrypi kernel: [  728.099408] WARN::update_urb_state_xfer_comp:741: update_urb_state_xfer_comp(): trimming xfer length
Feb 13 17:50:01 raspberrypi kernel: [  728.099408] 
Feb 13 17:50:01 raspberrypi kernel: [  728.800010] WARN::update_urb_state_xfer_comp:741: update_urb_state_xfer_comp(): trimming xfer length
Feb 13 17:50:01 raspberrypi kernel: [  728.800010] 
Feb 13 17:50:01 raspberrypi kernel: [  728.862762] WARN::update_urb_state_xfer_comp:741: update_urb_state_xfer_comp(): trimming xfer length
Feb 13 17:50:01 raspberrypi kernel: [  728.862762] 
Feb 13 17:50:01 raspberrypi kernel: [  728.919271] WARN::update_urb_state_xfer_comp:741: update_urb_state_xfer_comp(): trimming xfer length
Feb 13 17:50:01 raspberrypi kernel: [  728.919271] 

I don't see where the extra blank lines come from, perhaps something to do with how DWC_WARN operates.

No dm9601 dmesg warnings on this occasion, but that is likely to be a quirk of particular packet lengths present during the test.

The driver:

The 'correct' driver to use is the sr9700 driver, not the dm9601 driver. It appears to have been submitted by the manufacture. [https://lkml.org/lkml/2013/8/20/241]

sr9700 is based on dm9601 but handles the stream of frames that USB device ID 0fe6:9700 delivers. In other respects it is fundamentally the same as dm9601, so I suppose that the device manufacturer, Corechip Technology Shenzhen Co., chose to support the Davicom chip command set (at least to some extent). The buffer size is, unsurprisingly, a multiple of URB size. I would suppose that the overallocation wastage is unlikely to be of much consequence in such a slow device.

I assume that the author of dm9601 was unaware of the frame streaming feature when that driver was changed to claim USB 0fe6:9700. The dm9601 driver will simply silently drop frames when large transfers are in progress, and occasionally log unexpected tiny rx frame messages.

So it should be a simple matter of blacklisting dm9601, and allowing sr9700 to operate instead. Unfortunately sr9700 breaks at the first hurdle, through what appears to have been a simple typographical error in the code. This is easily fixed.

Perhaps the manufacturer's original chip would work without the fix, but the clones I have don't. Anyway, no one would have noticed because the dm9601 driver is run instead of the sr9700 driver (I assume an alphabetical preference somewhere, perhaps in udev).

So where to go from here ?

a) Assemble patches and submit them, and hope to get them accepted in due course.

b) In the meantime, would there be any mileage in including a fixed up 'son of sr9700' driver, named, say, 'clone9700', in the Rpi tree until such time as the upstream issues are fixed ?

@popcornmix

This comment has been minimized.

Copy link
Collaborator

@popcornmix popcornmix commented Feb 13, 2016

We really don't want to handle bug fixes in upstream code here.
If there are upstream bugs then please submit fixes upstream.
Assuming they are accepted we can cherry-pick them early (knowing they have been peer reviewed and will disappear with a future upstream bump).

@campag

This comment has been minimized.

Copy link
Contributor

@campag campag commented Feb 17, 2016

@popcornmix all working well, but the kernel log gets spammed frequently by the current log message, which itself is not fully informative. I propose:

--- dwc_otg_hcd_intr.c  2016-02-16 11:29:14.618359617 +0000
+++ linux/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c   2016-02-17 08:05:47.762555196 +0000
@@ -738,7 +738,8 @@
                         &short_read);

    if (urb->actual_length + xfer_length > urb->length) {
-       DWC_WARN("%s(): trimming xfer length\n", __func__);
+       printk_once(KERN_DEBUG "dwc_otg: DEVICE:%03d : %s:%d:trimming xfer length\n",
+           hc->dev_addr, __func__, __LINE__);
        xfer_length = urb->length - urb->actual_length;
    }

@@ -1430,7 +1431,8 @@
                                halt_status, NULL);

    if (urb->actual_length + bytes_transferred > urb->length) {
-       DWC_WARN("%s(): trimming xfer length\n", __func__);
+       printk_once(KERN_DEBUG "dwc_otg: DEVICE:%03d : %s:%d:trimming xfer length\n",
+           hc->dev_addr, __func__, __LINE__);
        bytes_transferred = urb->length - urb->actual_length;
    }

The old log lines (with function name printed twice, double line-feed)

WARN::update_urb_state_xfer_comp:741: update_urb_state_xfer_comp(): trimming xfer length

become a once-only kernel message of

dwc_otg: DEVICE:008 : update_urb_state_xfer_comp:742:trimming xfer length

showing which module it came from, which USB device etc.

@mw9

This comment has been minimized.

Copy link

@mw9 mw9 commented Feb 17, 2016

For completeness, I have drafted and attached three patches to the existing sr700 driver. These seem to be working ok.

It seems clear to me that the output of lsusb misidentifies the device [1], and that the (patched) sr9700 driver is better suited than the dm9601 driver. Issues around packet filtering, etc., still remain, but the dm9601 driver offers no solution to those.

[1] ID 0fe6:9700 Kontron (Industrial Computer Source / ICS Advent) DM9601 Fast Ethernet Adapter

0001-usbnet-sr9700-Fix-incorrect-write-command.patch.txt
0002-usbnet-sr9700-Work-around-skb_try_coalesce-kernel-wa.patch.txt
0003-usbnet-sr9700-Add-packet-integrity-checks.patch.txt

@popcornmix

This comment has been minimized.

Copy link
Collaborator

@popcornmix popcornmix commented Feb 17, 2016

@campag I've added your suggested patch to kernel tree.

@mw9 Your patches would be best submitted upstream. I'm not the best person to review them. I can cherry-pick them when they have been reviewed.

@sej7278

This comment has been minimized.

Copy link

@sej7278 sej7278 commented May 13, 2016

is this fixed in the new 4.4 kernel?

@popcornmix

This comment has been minimized.

Copy link
Collaborator

@popcornmix popcornmix commented May 14, 2016

The patch from @campag is present in 4.4 tree, so I expect it is still fixed (but I don't have a DM9601 to test).
@strongly-typed is this still an issue with latest 4.4 kernel?

@campag

This comment has been minimized.

Copy link
Contributor

@campag campag commented May 14, 2016

@sej7278 @popcornmix I'm seeing the patch's printk_once() kernel log message in 4.4, so the patch is there and working to prevent the crash. All OK here.

@sej7278

This comment has been minimized.

Copy link

@sej7278 sej7278 commented May 14, 2016

yup, i rsynced the entire sdcard on my zero and it didn't crash, so i'd say its fixed in 4.4 thanks!

@Daveke

This comment has been minimized.

Copy link

@Daveke Daveke commented Jun 15, 2016

It's fixed the problem for me, too, thanks (DM9601).

@popcornmix

This comment has been minimized.

Copy link
Collaborator

@popcornmix popcornmix commented Jun 15, 2016

Closing as believed to be fixed.

@edd3a

This comment has been minimized.

Copy link

@edd3a edd3a commented Dec 26, 2016

Is this supposed to be solved because a different module is being used (sr9700) iso dm9601?
I am using Linux LibreELEC 4.4.13 #1 Sat Jun 25 04:53:15 BST 2016 armv6l GNU/Linux on a pi zero with Kontron DM9601 (USB: 0fe6:9700). On the mentioned kernel, dm9601 is still loaded, and still crashes the system.

@6by9

This comment has been minimized.

Copy link
Contributor

@6by9 6by9 commented Dec 26, 2016

It's fixed on this kernel tree. Whether it is fixed on a LibreELEC release is up to the LibreELEC developers to have pulled in the change.
The workaround was in the USB host driver, not the network device driver, so it shouldn't matter that the driver has changed from dm9601 to sr9700.

Seeing as LibreELEC is now seemingly using a 4.9 kernel, I'd make sure you're using an up to date image before trying to chase down an issue.

@popcornmix

This comment has been minimized.

Copy link
Collaborator

@popcornmix popcornmix commented Dec 27, 2016

Yes, I'd suggest updating to a Krypton build which is using a newer kernel.
There will be no more updates to Jarvis builds.

@edd3a

This comment has been minimized.

Copy link

@edd3a edd3a commented Dec 27, 2016

Problem continues to exist on LibreELEC-RPi.arm-7.90.010.img with a 4.9 kernel. It crashes the network, and results in complete lock up.

So, this device will go the the trash and I will get a ASIX AX88772B based one.

[ 1093.507337] ERROR::handle_hc_chhltd_intr_dma:2214: handle_hc_chhltd_intr_dma: Channel 2, DMA Mode -- ChHltd set, but reason for halting is unknown, hcint 0x00000002, intsts 0x06200021
[ 1093.507337]
[ 1093.507398] ERROR::handle_hc_chhltd_intr_dma:2214: handle_hc_chhltd_intr_dma: Channel 7, DMA Mode -- ChHltd set, but reason for halting is unknown, hcint 0x00000002, intsts 0x06200001
[ 1093.507398]
[ 1093.507435] ERROR::handle_hc_chhltd_intr_dma:2214: handle_hc_chhltd_intr_dma: Channel 3, DMA Mode -- ChHltd set, but reason for halting is unknown, hcint 0x00000002, intsts 0x06200001
[ 1093.507435]
[ 1093.530352] usb usb1-port1: disabled by hub (EMI?), re-enabling...
[ 1093.530384] usb 1-1: USB disconnect, device number 62
[ 1093.530732] dm9601 1-1:1.0 eth0: unregister 'dm9601' usb-20980000.usb-1, Davicom DM96xx USB 10/100 Ethernet
[ 1093.673673] Indeed it is in host mode hprt0 = 00021d01
[ 1094.070263] usb 1-1: new full-speed USB device number 63 using dwc_otg
[ 1094.072954] Indeed it is in host mode hprt0 = 00021d01
[ 1094.431149] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9700
[ 1094.431168] usb 1-1: New USB device strings: Mfr=0, Product=2, SerialNumber=0
[ 1094.431176] usb 1-1: Product: USB 2.0 10/100M Ethernet Adaptor
[ 1094.521999] dm9601 1-1:1.0 eth0: register 'dm9601' at usb-20980000.usb-1, Davicom DM96xx USB 10/100 Ethernet, 00:e0:4c:53:44:58
[ 1094.621164] dm9601 1-1:1.0 eth0: link up, 100Mbps, full-duplex, lpa 0xFFFF
[ 1095.742135] dm9601 1-1:1.0 eth0: kevent 4 may have been dropped
[ 1095.752150] dm9601 1-1:1.0 eth0: kevent 4 may have been dropped
[ 1095.758138] dm9601 1-1:1.0 eth0: kevent 4 may have been dropped
[ 1095.767167] dm9601 1-1:1.0 eth0: kevent 4 may have been dropped
[ 1095.824200] dm9601 1-1:1.0 eth0: link up, 100Mbps, full-duplex, lpa 0xFFFF
[ 1095.959331] dm9601 1-1:1.0 eth0: link up, 100Mbps, full-duplex, lpa 0xFFFF
[ 1112.731934] usb 1-1: unexpected tiny rx frame
[ 1120.601305] usb 1-1: unexpected tiny rx frame
[ 1121.573243] usb 1-1: unexpected tiny rx frame
[ 1127.033208] usb 1-1: unexpected tiny rx frame
[ 1132.215250] usb 1-1: unexpected tiny rx frame
[ 1146.698286] usb 1-1: unexpected tiny rx frame
[ 1151.109939] usb 1-1: unexpected tiny rx frame

@locngy

This comment has been minimized.

Copy link

@locngy locngy commented Dec 28, 2016

The problem still exist in Raspbian Jessie Lite:

Version: November 2016
Release date: 2016-11-25
Kernel version: 4.4

@6by9

This comment has been minimized.

Copy link
Contributor

@6by9 6by9 commented Dec 28, 2016

Doing a quick test with my Pi Zero and DM9601 I'm not currently seeing any problems.
Admittedly my Raspbian Lite release is an old one, but I've done an rpi-update to grab kernel and firmware from 15th Dec and that is all happy. Transfers are running at 420-430KB/s as limited by USB1.1.

(I did manage to have two of them connected to my LAN at the same time, which isn't the best idea seeing as they all share the same MAC address. That shouldn't have any link to this issue anyway.)

Ntemis added a commit to Ntemis/openwrtcc that referenced this issue Dec 29, 2016
The dm9601 driver expects to receive a single encapsulated ethernet
frame from the device in one URB transfer, and it provides an URB
buffer of length 1,522 to receive it. This is not a round multiple
of USB transfer packets.

The device in question [1] provides a stream of such frames and it
does not conveniently slice them up as the dm9601 driver expects. We
can end up with 1,536 (0x600) bytes returned by the device in response
to the URB request. This may include several encapsulated ethernet
frames, and/or fragments thereof.

It seems to me that the kernel 'Oops' arises because the dwc_otg driver
does not notice that the destination buffer is too small to receive the
full 1,536 bytes. Comparing dwc_otg's update_urb_state_xfer_comp with
dwc2's dwc2_update_urb_state is suggestive.

More details: raspberrypi/linux#1045
All Credits to: https://github.com/mw9

Signed-off-by: Marian Hello <marian.hello@gmail.com>
Reviewed-by: Zoltan HERPAI <wigyori@uid0.hu>
neuschaefer pushed a commit to neuschaefer/raspi-binary-firmware that referenced this issue Feb 27, 2017
See: raspberrypi/linux@3856956

kernel: BCM270X_DT: Use bcm2835-sdhost as standard

kernel: dcw_otg: trim xfer length when buffer larger than allocated size is received
See: raspberrypi/linux#1045
@sentriz

This comment has been minimized.

Copy link

@sentriz sentriz commented May 6, 2017

how would I go about updating to the latest version of the kernel to fix this issue? I get the kernel panic during rpi-update. seems like a bit of a catch 22.
thank you.

@campag

This comment has been minimized.

Copy link
Contributor

@campag campag commented May 6, 2017

Hi - as you have realised, there's no way round it. You'll have to use another network adapter to update your system, just the once.

btw if running Raspbian, there's no need for rpi-update: running "sudo apt-get dist-upgrade" will update your distro and kernel with stable releases.

@sentriz

This comment has been minimized.

Copy link

@sentriz sentriz commented May 6, 2017

@campag
ok, thank you for the info

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
You can’t perform that action at this time.