Re: [PATCH v5 4/4] usb: typec: ucsi: Always set number of alternate modes

[Jon Hunter <jonathanh@nvidia.com>]

On 24/06/2024 13:51, Jon Hunter wrote:
> Hi Jameson,
> 
> On 10/05/2024 21:12, Jameson Thies wrote:
>> Providing the number of known alternate modes allows user space to
>> determine when device registration has completed. Always register a
>> number of known alternate modes for the partner and cable plug, even
>> when the number of supported alternate modes is 0.
>>
>> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
>> Reviewed-by: Benson Leung <bleung@chromium.org>
>> Signed-off-by: Jameson Thies <jthies@google.com>
>> ---
>> Changes in V5:
>> - None.
>>
>> Changes in V4:
>> - None.
>>
>> Changes in V3:
>> - None.
>>
>> Changes in V2:
>> - None.
>>
>>   drivers/usb/typec/ucsi/ucsi.c | 14 +++++++++++---
>>   1 file changed, 11 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/usb/typec/ucsi/ucsi.c 
>> b/drivers/usb/typec/ucsi/ucsi.c
>> index bb6e57064513d..52a14bfe4107e 100644
>> --- a/drivers/usb/typec/ucsi/ucsi.c
>> +++ b/drivers/usb/typec/ucsi/ucsi.c
>> @@ -812,10 +812,11 @@ static int ucsi_check_altmodes(struct 
>> ucsi_connector *con)
>>       /* Ignoring the errors in this case. */
>>       if (con->partner_altmode[0]) {
>>           num_partner_am = ucsi_get_num_altmode(con->partner_altmode);
>> -        if (num_partner_am > 0)
>> -            typec_partner_set_num_altmodes(con->partner, 
>> num_partner_am);
>> +        typec_partner_set_num_altmodes(con->partner, num_partner_am);
>>           ucsi_altmode_update_active(con);
>>           return 0;
>> +    } else {
>> +        typec_partner_set_num_altmodes(con->partner, 0);
>>       }
>>       return ret;
>> @@ -1138,7 +1139,7 @@ static int ucsi_check_connection(struct 
>> ucsi_connector *con)
>>   static int ucsi_check_cable(struct ucsi_connector *con)
>>   {
>>       u64 command;
>> -    int ret;
>> +    int ret, num_plug_am;
>>       if (con->cable)
>>           return 0;
>> @@ -1172,6 +1173,13 @@ static int ucsi_check_cable(struct 
>> ucsi_connector *con)
>>               return ret;
>>       }
>> +    if (con->plug_altmode[0]) {
>> +        num_plug_am = ucsi_get_num_altmode(con->plug_altmode);
>> +        typec_plug_set_num_altmodes(con->plug, num_plug_am);
>> +    } else {
>> +        typec_plug_set_num_altmodes(con->plug, 0);
>> +    }
>> +
>>       return 0;
>>   }
> 
> I am seeing the following panic on linux-next and bisect is pointing to
> this commit.
> 
> [   16.411135] Unable to handle kernel NULL pointer dereference at 
> virtual address 0000000000000310
> [   16.411716] Mem abort info:
> [   16.411806]   ESR = 0x0000000096000044
> [   16.412147]   EC = 0x25: DABT (current EL), IL = 32 bits
> [   16.412465]   SET = 0, FnV = 0
> [   16.412530]   EA = 0, S1PTW = 0
> [   16.412778]   FSC = 0x04: level 0 translation fault
> [   16.413084] Data abort info:
> [   16.413149]   ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
> [   16.413534]   CM = 0, WnR = 1, TnD = 0, TagAccess = 0
> [   16.414163]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> [   16.414649] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101b2b000
> [   16.414784] [0000000000000310] pgd=0000000000000000, 
> p4d=0000000000000000
> [   16.414940] Internal error: Oops: 0000000096000044 [#1] PREEMPT SMP
> [   16.414946] Modules linked in: tegra210_adma(+) 
> snd_soc_tegra210_ahub(+) drm backlight snd_soc_tegra_audio_graph_card 
> snd_soc_audio_graph_card ucsi_ccg typec_ucsi crct10dif_ce 
> snd_soc_simple_card_utils typec pwm_fan snd_soc_rt5659(+) snd_soc_rl6231 
> ina3221 pwm_tegra tegra_aconnect phy_tegra194_p2u snd_hda_codec_hdmi 
> at24 snd_hda_tegra snd_hda_codec snd_hda_core lm90 tegra_xudc host1x 
> pcie_tegra194 tegra_bpmp_thermal ip_tables x_tables ipv6
> [   16.415056] CPU: 0 PID: 290 Comm: kworker/0:4 Not tainted 
> 6.10.0-rc4-next-20240617-g76db4c64526c #1
> [   16.415063] Hardware name: NVIDIA Jetson AGX Xavier Developer Kit (DT)
> [   16.415067] Workqueue: events_long ucsi_init_work [typec_ucsi]
> [   16.415082] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS 
> BTYPE=--)
> [   16.415091] pc : typec_plug_set_num_altmodes+0x18/0x6c [typec]
> [   16.415112] lr : ucsi_check_cable.part.0+0x228/0x280 [typec_ucsi]
> [   16.415120] sp : ffff8000848bbca0
> [   16.415123] x29: ffff8000848bbca0 x28: ffff000080e66000 x27: 
> ffff80007adc96e8
> [   16.415140] x26: ffff80007adc96f8 x25: ffff0000834510c0 x24: 
> ffff000080e66010
> [   16.415150] x23: ffff000080e6638c x22: ffff000080e664c0 x21: 
> ffff000089c95800
> [   16.415160] x20: 0000000000000000 x19: 0000000000000000 x18: 
> ffffffffffffffff
> [   16.415170] x17: 1e00000001000000 x16: c203000000000000 x15: 
> 00656c6261632d30
> [   16.415180] x14: ffff800082c922d8 x13: 0000000000000040 x12: 
> 0000000000000228
> [   16.415191] x11: 0000000000000000 x10: 0000000000000000 x9 : 
> 0000000000000000
> [   16.415201] x8 : 3d45505954564544 x7 : 0063657079743d4d x6 : 
> 0000000000000000
> [   16.415212] x5 : ffff0000835ee780 x4 : ffff000080e66288 x3 : 
> 0000000000000000
> [   16.415223] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 
> 0000000000000000
> [   16.415233] Call trace:
> [   16.415236]  typec_plug_set_num_altmodes+0x18/0x6c [typec]
> [   16.415255]  ucsi_check_cable.part.0+0x228/0x280 [typec_ucsi]
> [   16.415264]  ucsi_init_work+0x8b4/0x9b8 [typec_ucsi]
> [   16.415271]  process_one_work+0x150/0x294
> [   16.415282]  worker_thread+0x2f4/0x3fc
> [   16.415289]  kthread+0x118/0x11c
> [   16.415296]  ret_from_fork+0x10/0x20
> [   16.415310] Code: a9be7bfd 910003fd f9000bf3 aa0003f3 (b9031001)
> [   16.521018] ata1: SATA link down (SStatus 0 SControl 300)
> [   16.524401] ---[ end trace 0000000000000000 ]---
> 
> 
> I have not looked any further yet, but wanted to report this. If you have
> any thoughts let me know.


It is crashing because 'con->plug' is not initialised when 
typec_plug_set_num_altmodes() is called. Do we need to add a check to 
see if 'con->plug' is valid in ucsi_check_cable()?

Jon

-- 
nvpublic