From: Felipe Balbi <balbi@kernel.org>
To: Jim Lin <jilin@nvidia.com>
Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] usb: gadget: f_fs: Fix kernel panic for SuperSpeed
In-Reply-To: <571E0058.6020007@nvidia.com>
References: <1461321780-3226-1-git-send-email-jilin@nvidia.com> <87bn51uagb.fsf@intel.com> <571E0058.6020007@nvidia.com>
User-Agent: Notmuch/0.21+96~g9bbc54b (http://notmuchmail.org) Emacs/25.0.90.3 (x86_64-pc-linux-gnu)
Date: Mon, 25 Apr 2016 15:01:12 +0300
Message-ID: <87r3dtrj7b.fsf@intel.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha1; protocol="application/pgp-signature"
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 4874
Lines: 148

--=-=-=
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


Hi,

Jim Lin <jilin@nvidia.com> writes:
> On 2016=E5=B9=B404=E6=9C=8822=E6=97=A5 19:52, Felipe Balbi wrote:
>> * PGP Signed by an unknown key
>>
>>
>> Hi Jim,
>>
>> Jim Lin <jilin@nvidia.com> writes:
>>> Android N adds os_desc_compat in v2_descriptor by init_functionfs()
>>> (system/core/adb/usb_linux_client.cpp) to support automatic install
>>> of MTP driver on Windows for USB device mode.
>>>
>>> Current __ffs_data_do_os_desc() of f_fs.c will check reserved1 field
>>> and return -EINVAL.
>>> This results in a second adb_write of usb_linux_client.cpp
>>> (system/core/adb/) which doesn't have ss_descriptors filled.
>>> Then later kernel_panic (composite.c) occurs when ss_descriptors
>>> as a pointer with NULL is being accessed.
>> where exactly in composite.c are we dereferencing a NULL pointer ?
> In set_config
>
> for (; *descriptors; ++descriptors) {
>
>
>
> Here is the link which shows reserved (at offset 1, e.g., Function=20
> Section 2) as  1.
> https://msdn.microsoft.com/en-us/library/windows/hardware/gg463179.aspx

thanks

>> Is this happening on set_config() ? If that's the case, why is
>> gadget->speed set to USB_SPEED_SUPER to start with ? Your controller
>> should already have negotiated highspeed which means
>> function_descriptors() should have returned highspeed descriptors, not a
>> NULL superspeed.
>>
>> Care to explain why you haven't negotiated Highspeed ? The only thing I
>> can think of is that you're using a Superspeed-capable peripheral
>> controller (dwc3?) with maximum-speed set to Superspeed, with a
>> Superspeed-capable cable connected to an XHCI PC, but loading a
>> high-speed gadget driver (which you got from Android, written with f_fs)
>> and this gadget doesn't tell composite that its maximum speed is
>> Highspeed, instead of super-speed.
>>
>> We can add a check, sure, to avoid a kernel oops; however, you should
>> really fix up the gadget implementation and/or set dwc3's maximum-speed
>> property accordingly.
>>
>> Can you check if this patch makes your scenario work while still being
>> fully functional ?
>>
>> diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composi=
te.c
>> index de9ffd60fcfa..3d3cdc5ed20d 100644
>> --- a/drivers/usb/gadget/composite.c
>> +++ b/drivers/usb/gadget/composite.c
>> @@ -66,20 +66,36 @@ function_descriptors(struct usb_function *f,
>>   {
>>   	struct usb_descriptor_header **descriptors;
>>=20=20=20
>> +	/*
>> +	 * NOTE: we try to help gadget drivers which might not be setting
>> +	 * max_speed appropriately.
>> +	 */
>> +
>>   	switch (speed) {
>>   	case USB_SPEED_SUPER_PLUS:
>>   		descriptors =3D f->ssp_descriptors;
>> -		break;
>> +		if (descriptors)
>> +			break;
>> +		/* FALLTHROUGH */
>>   	case USB_SPEED_SUPER:
>>   		descriptors =3D f->ss_descriptors;
>> -		break;
>> +		if (descriptors)
>> +			break;
>> +		/* FALLTHROUGH */
>>   	case USB_SPEED_HIGH:
>>   		descriptors =3D f->hs_descriptors;
>> -		break;
>> +		if (descriptors)
>> +			break;
>> +		/* FALLTHROUGH */
>>   	default:
>>   		descriptors =3D f->fs_descriptors;
>>   	}
>>=20=20=20
>> +	/*
>> +	 * if we can't find any descriptors at all, then this gadget deserves =
to
>> +	 * Oops with a NULL pointer dereference
>> +	 */
>> +
>>   	return descriptors;
>>   }
>>=20=20=20
> After trying your change, no kernel panic, but SuperSpeed device (device=
=20
> mode) is not enumerated by ubuntu 14.04 USB 3.0 host controller as MTP=20
> device with USB3.0 cable.

what do you get on dmesg on host side ? Are you running dwc3 ? If you
are, please capture trace logs of the failure:

# mount -t debugfs none /sys/kernel/debug
# cd /sys/kernel/debug/tracing
# echo 2048 > buffer_size_kb
# echo 1 > events/dwc3/enable

(now connect your cable to host pc)

# cp trace /path/to/non-volatile/storage/trace.txt

Please reply with this trace.txt file and dmesg from host side.

=2D-=20
balbi

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJXHgcJAAoJEIaOsuA1yqREPJgP/iaMgWZfHzUVrZcWb9pDuhyM
O+hXNPoRgWyGem1S08KNKnJDhgMxa6Hr7mE63zDjHITMPMdzPaXM8y/t18Irm1GB
NBvvEJf/qIoFXI6VvqX+BzZZRB5b7+SyXBd5f4k8sfklYn5hRDxdX2PBTDIrLuVZ
piKxCHbTFVc1kAitkIkZ4E99Quhiw2JS12ADSIfgY5jQ67wNYaNpdyMAto8yGY7R
EWY4+Y5abRWRjA2vt9v/pTrUzAawqEdtV1/FWAfRoMR/XlWnkqQnCXMrgWHuGenx
teGsST0Tro3ZTFb8y0UDtcgKLEG7rb9nC8kM8+oSxFNQ75UZcC3Kre6Q+FnUkI0B
5Q91knW1YTh3D29Rx/gZTl9KrqBA4rSrnCG4+pzIPJRofUDYrSIh1vB4YQpBtfwp
51XoQ0GTbgsz3fGyx1qEwDlYtzyU+AT9spIh4dWNWZ6SagFRAp8Q9KQb+1vGQFmk
+cyPLIet86VMjJV9IQcAPE81q9gPgFyjVGZLJl+KcPO+S+ZcyiKvJUjaj3djKsKA
dtlgZISwU1fqKId7jTJSsv8gGxoQMt9rL9Du08XbhLQ+sgNcehn5A57AXD3juM00
tqMlsEUzOIV/I3QRJAepIe290ocLp8b7X3yUeF715srZeXcNpM+dX5lRRUUZ+aLm
UTVKkuwKsbDSLL1r2nsL
=nH+u
-----END PGP SIGNATURE-----
--=-=-=--