dwc2: distorted 44.1 kHz isoc OUT audio to full-speed DAC behind hub; WARN in dwc2_assign_and_init_hc (regression from "better handle hardware length & alignment issues")

[DenisVanyushkin]

Describe the bug

USB audio playback at 44100 Hz to a full-speed DAC connected behind the on-board
high-speed hub is audibly distorted (crackling/garbled). Playback at 48000 Hz on the
same device is clean. First 44.1 kHz playback after boot triggers a
WARN_ON_ONCE at drivers/usb/dwc2/hcd.c:2684 in dwc2_assign_and_init_hc()
(the "split OUT is assumed aligned" check firing on an unaligned xfer_dma).

This is a regression: identical hardware and use case work correctly on Ubuntu 24.04's
6.8-raspi kernel; broken on Ubuntu 26.04's 7.0.0-1011-raspi and 7.0.0-1014-raspi
(both carry the raspberrypi.com downstream patchset).

Steps to reproduce

1. Raspberry Pi 3 Model B, full-speed USB audio DAC (here: SMSL Q5, 0451:0003,
   TI, adaptive isoc OUT, S24_3LE) plugged into any port (topologically behind the
   built-in LAN9514 high-speed hub).
2. aplay -D plughw:CARD=smsl /usr/share/sounds/alsa/... (any 44.1 kHz material,
   e.g. a 44100 Hz 24-bit WAV).
3. Audio is distorted; dmesg shows the WARNING below (once per boot).
4. Repeat with 48 kHz material → clean audio, no WARNING.

Why 44.1 kHz specifically (analysis)

At full speed, 44100 Hz gives alternating 44/45-sample isoc packets. With S24_3LE
stereo (6 bytes/frame) that is 264/270-byte packets. 264 % 4 = 0 but 270 % 4 = 2,
so every other packet's DMA offset lands 2 bytes off word alignment. At 48 kHz the
packet is a constant 288 bytes (word-multiple), so everything stays aligned — which
matches the observed good/bad behaviour exactly.

snd-usb-audio submits its URBs with URB_NO_TRANSFER_DMA_MAP (pre-mapped coherent
buffers). Since commit 279fbca ("drivers: dwc2: better handle hardware length &
alignment issues", June 2025) such URBs bypass dwc2_alloc_dma_aligned_buffer()'s
bounce/realign path entirely, relying on the BCM283x whole-word-write behaviour being
benign. For isoc OUT split transfers that assumption doesn't hold: the unaligned
xfer_dma reaches dwc2_assign_and_init_hc(), trips
WARN_ON_ONCE(hsotg->params.host_dma && (chan->xfer_dma & 0x3)), and the data
actually transmitted is byte-shifted → garbled audio.

I verified the running Ubuntu 7.0.0-1014-raspi kernel contains this commit
(strings on vmlinuz shows its "Unaligned DMA-mapped buffer" message); the working
6.8-raspi kernels predate the whole June-2025 dwc2 split series (also
a63acce, 53eec62, ec2d895 — cf. follow-up fixes in PR #7290 and
PR #6906). Possibly related to #4915 (same WARN, isoc IN capture, 5.10 era).

Environment

• Hardware: Raspberry Pi 3 Model B Rev 1.2 (BCM2837, dwc2 at 3f980000.usb)
• OS/kernel: Ubuntu 26.04 LTS, 7.0.0-1014-raspi Ramdisk files for emergency kernel #14-Ubuntu (also 7.0.0-1011-raspi);
  last known good: Ubuntu 24.04, 6.8.0-1050-raspi
• DAC: SMSL Q5 AMP, 0451:0003 (TI), full speed, behind LAN9514 hub port 4
• lsusb -t:

  /:  Bus 001.Port 001: Dev 001, Class=root_hub, Driver=dwc2/1p, 480M
      |__ Port 001: Dev 002, If 0, Class=Hub, Driver=hub/5p, 480M
          |__ Port 001: Dev 003, If 0, Class=Vendor Specific Class, Driver=smsc95xx, 480M
          |__ Port 004: Dev 004, If 0, Class=Audio, Driver=snd-usb-audio, 12M
          |__ Port 004: Dev 004, If 1, Class=Audio, Driver=snd-usb-audio, 12M
  

• Stream (/proc/asound/card1/stream0): Interface 1, Altset 1, S24_3LE, 2ch,
  EP 0x01 OUT ADAPTIVE, rates 44100/48000/88200/96000

Kernel log

usb 1-1.4: 1:1: cannot get freq at ep 0x1
------------[ cut here ]------------
WARNING: drivers/usb/dwc2/hcd.c:2684 at dwc2_assign_and_init_hc+0x260/0x580, CPU#2: swapper/2/0
Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)
pc : dwc2_assign_and_init_hc+0x260/0x580
lr : dwc2_assign_and_init_hc+0x210/0x580
Call trace:
 dwc2_assign_and_init_hc+0x260/0x580 (P)
 dwc2_hcd_select_transactions+0x88/0x340
 dwc2_handle_hcd_intr+0x384/0xa20
 _dwc2_hcd_irq+0x1c/0x30
 usb_hcd_irq+0x38/0x60
 __handle_irq_event_percpu+0x74/0x400
 handle_irq_event+0x4c/0x110
 handle_level_irq+0xe0/0x180
 handle_irq_desc+0x3c/0x68
 generic_handle_domain_irq+0x20/0x40
 bcm2836_chained_handle_irq+0x30/0x60
 handle_irq_desc+0x3c/0x68
 generic_handle_domain_irq+0x20/0x40
 bcm2836_arm_irqchip_handle_irq+0xa4/0x100
 call_on_irq_stack+0x30/0x48
 do_interrupt_handler+0x88/0x98
 el1_interrupt+0x48/0xb0
 el1h_64_irq_handler+0x18/0x30
 el1h_64_irq+0x84/0x88
 default_idle_call+0x38/0x178 (P)
 cpuidle_idle_call+0xbc/0x240
 do_idle+0xb0/0x128
 cpu_startup_entry+0x40/0x50
 secondary_start_kernel+0xe4/0x128
 __secondary_switched+0xc0/0xc8
---[ end trace 0000000000000000 ]---

The WARN is once-per-boot; subsequent 44.1 kHz playback only logs
cannot get freq at ep 0x1, but audio stays distorted.

Full trace with register dump (journalctl -k)

Jul 05 16:59:23 bedroom-speaker kernel: usb 1-1.4: 1:1: cannot get freq at ep 0x1
Jul 05 16:59:23 bedroom-speaker kernel: ------------[ cut here ]------------
Jul 05 16:59:23 bedroom-speaker kernel: WARNING: drivers/usb/dwc2/hcd.c:2684 at dwc2_assign_and_init_hc+0x260/0x580, CPU#2: swapper/2/0
Jul 05 16:59:23 bedroom-speaker kernel: Modules linked in: qrtr binfmt_misc vc4 snd_soc_hdmi_codec drm_exec drm_display_helper cec drm_client_lib drm_dma_helper drm_kms_helper brcmfmac_cyw snd_soc_core snd_usb_audio snd_compress brcmfmac hci_uart ac97_bus snd_usbmidi_lib snd_pcm_dmaengine snd_hwdep backlight bcm2835_codec(CE) bcm2835_isp brcmutil btqca snd_ump cfg80211 bcm2835_v4l2(CE) btrtl snd_rawmidi v4l2_mem2mem btbcm bcm2835_mmal_vchiq snd_seq_device btintel vc_sm_cma raspberrypi_hwmon bluetooth videobuf2_dma_contig videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common rfkill snd_bcm2835(CE) raspberrypi_gpiomem videodev snd_pcm mc snd_timer snd gpio_fan sch_fq_codel dm_multipath fuse dm_mod dax efi_pstore nfnetlink autofs4 btrfs libblake2b efivarfs raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor xor_neon raid6_pq raid1 raid0 linear md_mod spidev mmc_block rpmb_core i2c_bcm2835 bcm2835_mmc spi_bcm2835 phy_generic aes_neon_bs aes_neon_blk
Jul 05 16:59:23 bedroom-speaker kernel: CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Tainted: G         C  E       7.0.0-1014-raspi #14-Ubuntu PREEMPT(lazy) 
Jul 05 16:59:23 bedroom-speaker kernel: Tainted: [C]=CRAP, [E]=UNSIGNED_MODULE
Jul 05 16:59:23 bedroom-speaker kernel: Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)
Jul 05 16:59:23 bedroom-speaker kernel: pstate: 004000c5 (nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
Jul 05 16:59:23 bedroom-speaker kernel: pc : dwc2_assign_and_init_hc+0x260/0x580
Jul 05 16:59:23 bedroom-speaker kernel: lr : dwc2_assign_and_init_hc+0x210/0x580
Jul 05 16:59:23 bedroom-speaker kernel: sp : ffff800080013d70
Jul 05 16:59:23 bedroom-speaker kernel: x29: ffff800080013d70 x28: ffff00000346c280 x27: ffffa8988d665bcf
Jul 05 16:59:23 bedroom-speaker kernel: x26: ffff00000e3286b0 x25: ffff00000ddd4ec0 x24: ffff00000e328680
Jul 05 16:59:23 bedroom-speaker kernel: x23: ffff00000e328758 x22: ffff00000e328080 x21: ffff0000091484c8
Jul 05 16:59:23 bedroom-speaker kernel: x20: ffff000003c44000 x19: ffff000009148480 x18: 0000000000000002
Jul 05 16:59:23 bedroom-speaker kernel: x17: ffff5767ae25c000 x16: ffff800080010000 x15: ffffa8988d572878
Jul 05 16:59:23 bedroom-speaker kernel: x14: ffffa8988cf21440 x13: 0000000000000000 x12: 00000019fc97b327
Jul 05 16:59:23 bedroom-speaker kernel: x11: 00000000000000c0 x10: 0000000000001c80 x9 : ffffa8988bd0b6b8
Jul 05 16:59:23 bedroom-speaker kernel: x8 : 0000000000000000 x7 : 0000000000000200 x6 : ffff0000090db340
Jul 05 16:59:23 bedroom-speaker kernel: x5 : ffff0000090db300 x4 : 0000000000000426 x3 : ffff000009148480
Jul 05 16:59:23 bedroom-speaker kernel: x2 : 0000000000000001 x1 : 0000000000000001 x0 : 00000000c3b1a426
Jul 05 16:59:23 bedroom-speaker kernel: Call trace:
Jul 05 16:59:23 bedroom-speaker kernel:  dwc2_assign_and_init_hc+0x260/0x580 (P)
Jul 05 16:59:23 bedroom-speaker kernel:  dwc2_hcd_select_transactions+0x88/0x340
Jul 05 16:59:23 bedroom-speaker kernel:  dwc2_handle_hcd_intr+0x384/0xa20
Jul 05 16:59:23 bedroom-speaker kernel:  _dwc2_hcd_irq+0x1c/0x30
Jul 05 16:59:23 bedroom-speaker kernel:  usb_hcd_irq+0x38/0x60
Jul 05 16:59:23 bedroom-speaker kernel:  __handle_irq_event_percpu+0x74/0x400
Jul 05 16:59:23 bedroom-speaker kernel:  handle_irq_event+0x4c/0x110
Jul 05 16:59:23 bedroom-speaker kernel:  handle_level_irq+0xe0/0x180
Jul 05 16:59:23 bedroom-speaker kernel:  handle_irq_desc+0x3c/0x68
Jul 05 16:59:23 bedroom-speaker kernel:  generic_handle_domain_irq+0x20/0x40
Jul 05 16:59:23 bedroom-speaker kernel:  bcm2836_chained_handle_irq+0x30/0x60
Jul 05 16:59:23 bedroom-speaker kernel:  handle_irq_desc+0x3c/0x68
Jul 05 16:59:23 bedroom-speaker kernel:  generic_handle_domain_irq+0x20/0x40
Jul 05 16:59:23 bedroom-speaker kernel:  bcm2836_arm_irqchip_handle_irq+0xa4/0x100
Jul 05 16:59:23 bedroom-speaker kernel:  call_on_irq_stack+0x30/0x48
Jul 05 16:59:23 bedroom-speaker kernel:  do_interrupt_handler+0x88/0x98
Jul 05 16:59:23 bedroom-speaker kernel:  el1_interrupt+0x48/0xb0
Jul 05 16:59:23 bedroom-speaker kernel:  el1h_64_irq_handler+0x18/0x30
Jul 05 16:59:23 bedroom-speaker kernel:  el1h_64_irq+0x84/0x88
Jul 05 16:59:23 bedroom-speaker kernel:  default_idle_call+0x38/0x178 (P)
Jul 05 16:59:23 bedroom-speaker kernel:  cpuidle_idle_call+0xbc/0x240
Jul 05 16:59:23 bedroom-speaker kernel:  do_idle+0xb0/0x128
Jul 05 16:59:23 bedroom-speaker kernel:  cpu_startup_entry+0x40/0x50
Jul 05 16:59:23 bedroom-speaker kernel:  secondary_start_kernel+0xe4/0x128
Jul 05 16:59:23 bedroom-speaker kernel:  __secondary_switched+0xc0/0xc8
Jul 05 16:59:23 bedroom-speaker kernel: ---[ end trace 0000000000000000 ]---
Jul 05 17:01:25 bedroom-speaker kernel: usb 1-1.4: 1:1: cannot get freq at ep 0x1
Jul 05 17:17:04 bedroom-speaker kernel: audit: type=1400 audit(1783253824.348:183): apparmor="DENIED" operation="open" class="file" profile="who" name="/usr/share/coreutils/locales/uucore/en-US.ftl" pid=2280 comm="who" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jul 05 17:17:05 bedroom-speaker kernel: audit: type=1400 audit(1783253825.342:184): apparmor="DENIED" operation="open" class="file" profile="who" name="/usr/share/coreutils/locales/uucore/en-US.ftl" pid=2285 comm="who" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jul 05 17:23:13 bedroom-speaker kernel: audit: type=1400 audit(1783254193.591:185): apparmor="DENIED" operation="open" class="file" profile="who" name="/usr/share/coreutils/locales/uucore/en-US.ftl" pid=2399 comm="who" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jul 05 17:46:22 bedroom-speaker kernel: audit: type=1400 audit(1783255582.541:186): apparmor="DENIED" operation="open" class="file" profile="who" name="/usr/share/coreutils/locales/uucore/en-US.ftl" pid=4349 comm="who" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jul 05 18:07:51 bedroom-speaker kernel: audit: type=1400 audit(1783256871.321:187): apparmor="DENIED" operation="open" class="file" profile="who" name="/usr/share/coreutils/locales/uucore/en-US.ftl" pid=5154 comm="who" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jul 05 18:07:53 bedroom-speaker kernel: audit: type=1400 audit(1783256873.283:188): apparmor="DENIED" operation="open" class="file" profile="lsusb" name="/sys/devices/platform/soc/3f980000.usb/uevent" pid=5262 comm="lsusb" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Jul 05 18:07:53 bedroom-speaker kernel: audit: type=1400 audit(1783256873.283:189): apparmor="DENIED" operation="open" class="file" profile="lsusb" name="/sys/devices/platform/soc/uevent" pid=5262 comm="lsusb" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

Happy to test patches or a revert of 279fbca on this hardware.

[pelwell]

#7477 is a PR with that commit reverted. In about 25 minutes there should be a trial build available to install using sudo rpi-update pulls/7476, but first read the caveats.