[PATCH] cmd: usb: Prevent reset in usb tree/info command

[PATCH] cmd: usb: Prevent reset in usb tree/info command

[Xavier Drudis Ferran]

When DISTRO_DEFAULTS is not set, the default environment has
bootcmd=bootflow and this will cause a UCLASS_BOOTDEV device to be
added as sibling of those UCLASS_BLK devices in boot_targets, until
boot succeeds from some device. If none succeeds, and usb is in
boot_targets, and an usb storage device is plugged to some usb port at
boot time, its UCLASS_MASS_STORAGE device will have a UCLASS_BOOTDEV
device as child, besides a UCLASS_BLK child.

If once the boot fails the user enters at the U-Boot shell prompt:

usb info

or

usb tree

The code in cmd/usb.c will eventually recurse into the UCLASS_BOOTDEV
and pass a null pointer to usb_device (because it has no parent_priv_).
This causes a reset.

Fix it (twice) by checking for null parent_priv_ and adding
UCLASS_BOOTDEV to the list of ignored class ids before the recursive
call.

This prevents the current particular problem with UCLASS_BOOTDEV, even
in case it ever gets some parent_priv_ struct which is not an
usb_device, despite being the child of a usb_device->dev. And it also
prevents possible future problems if other children are added to usb
devices that don't have parent_priv_ because they are not part of the
usb tree, just abstractions of functionality (like UCLASS_BLK and
UCLASS_BOOTDEV are now).

Signed-off-by: Xavier Drudis Ferran <xdrudis@tinet.cat>
---

v2: added UCLASS_BOOTDEV check (discussion of v1 dried up without much
    evident consensus, so hopefully Simon Glass likes it better now)
    [ https://patchwork.ozlabs.org/project/uboot/patch/ZH39SVA1vbZR3+Gk@xdrudis.tinet.cat/ ]
---

Apologies to the people in Cc: for resending this. I had a typo in the
email list address.

---
 cmd/usb.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/cmd/usb.c b/cmd/usb.c
index 6193728384..23253f2223 100644
--- a/cmd/usb.c
+++ b/cmd/usb.c
@@ -421,7 +421,9 @@ static void usb_show_tree_graph(struct usb_device *dev, char *pre)
 		 * Ignore emulators and block child devices, we only want
 		 * real devices
 		 */
-		if ((device_get_uclass_id(child) != UCLASS_USB_EMUL) &&
+		if (udev &&
+		    (device_get_uclass_id(child) != UCLASS_BOOTDEV) &&
+		    (device_get_uclass_id(child) != UCLASS_USB_EMUL) &&
 		    (device_get_uclass_id(child) != UCLASS_BLK)) {
 			usb_show_tree_graph(udev, pre);
 			pre[index] = 0;
@@ -604,10 +606,12 @@ static void usb_show_info(struct usb_device *udev)
 	     child;
 	     device_find_next_child(&child)) {
 		if (device_active(child) &&
+		    (device_get_uclass_id(child) != UCLASS_BOOTDEV) &&
 		    (device_get_uclass_id(child) != UCLASS_USB_EMUL) &&
 		    (device_get_uclass_id(child) != UCLASS_BLK)) {
 			udev = dev_get_parent_priv(child);
-			usb_show_info(udev);
+			if (udev)
+				usb_show_info(udev);
 		}
 	}
 }
-- 
2.20.1

Re: [PATCH] cmd: usb: Prevent reset in usb tree/info command

[Marek Vasut]

On 6/19/23 12:26, Xavier Drudis Ferran wrote:
> When DISTRO_DEFAULTS is not set, the default environment has
> bootcmd=bootflow and this will cause a UCLASS_BOOTDEV device to be
> added as sibling of those UCLASS_BLK devices in boot_targets, until
> boot succeeds from some device. If none succeeds, and usb is in
> boot_targets, and an usb storage device is plugged to some usb port at
> boot time, its UCLASS_MASS_STORAGE device will have a UCLASS_BOOTDEV
> device as child, besides a UCLASS_BLK child.
> 
> If once the boot fails the user enters at the U-Boot shell prompt:
> 
> usb info
> 
> or
> 
> usb tree
> 
> The code in cmd/usb.c will eventually recurse into the UCLASS_BOOTDEV
> and pass a null pointer to usb_device (because it has no parent_priv_).
> This causes a reset.
> 
> Fix it (twice) by checking for null parent_priv_ and adding
> UCLASS_BOOTDEV to the list of ignored class ids before the recursive
> call.
> 
> This prevents the current particular problem with UCLASS_BOOTDEV, even
> in case it ever gets some parent_priv_ struct which is not an
> usb_device, despite being the child of a usb_device->dev. And it also
> prevents possible future problems if other children are added to usb
> devices that don't have parent_priv_ because they are not part of the
> usb tree, just abstractions of functionality (like UCLASS_BLK and
> UCLASS_BOOTDEV are now).
> 
> Signed-off-by: Xavier Drudis Ferran <xdrudis@tinet.cat>
> ---
> 
> v2: added UCLASS_BOOTDEV check (discussion of v1 dried up without much
>      evident consensus, so hopefully Simon Glass likes it better now)
>      [ https://patchwork.ozlabs.org/project/uboot/patch/ZH39SVA1vbZR3+Gk@xdrudis.tinet.cat/ ]
> ---
> 
> Apologies to the people in Cc: for resending this. I had a typo in the
> email list address.

git send-email -v2 would help

Also you can add a CC list into the commit message below --- , then git 
send-email will automatically pick the CC list up. To get a list of 
people to CC , use get-maintainer script.

Re: [PATCH] cmd: usb: Prevent reset in usb tree/info command

[Marek Vasut]

On 6/19/23 12:12, Xavier Drudis Ferran wrote:

It seems the email addresses are being constantly corrupted in each 
email. This time the ML address is wrong and missing an e at the end. 
There is some e@ nonexistent address which I have to keep removing.

> When DISTRO_DEFAULTS is not set, the default environment has
> bootcmd=bootflow

That is not right, on $randomboard I picked the bootcmd is something else.

? and this will cause a UCLASS_BOOTDEV device to be
> added as sibling of those UCLASS_BLK devices in boot_targets, until
> boot succeeds from some device. If none succeeds, and usb is in
> boot_targets, and an usb storage device is plugged to some usb port at
> boot time, its UCLASS_MASS_STORAGE device will have a UCLASS_BOOTDEV
> device as child, besides a UCLASS_BLK child.
> 
> If once the boot fails the user enters at the U-Boot shell prompt:
> 
> usb info
> 
> or
> 
> usb tree
> 
> The code in cmd/usb.c will eventually recurse into the UCLASS_BOOTDEV
> and pass a null pointer to usb_device (because it has no parent_priv_).
> This causes a reset.

Does this happen if you set empty bootcmd ('=> setenv bootcmd 'echo 
hello' for example), then 'saveenv' , then 'reset' , then drop into 
U-Boot shell and run 'usb reset ; usb info' too ?

[...]

Re: [PATCH] cmd: usb: Prevent reset in usb tree/info command

[Xavier Drudis Ferran]

El Mon, Jun 19, 2023 at 11:49:18PM +0200, Marek Vasut deia:
> On 6/19/23 12:12, Xavier Drudis Ferran wrote:
> 
> It seems the email addresses are being constantly corrupted in each email.
> This time the ML address is wrong and missing an e at the end. There is some
> e@ nonexistent address which I have to keep removing.
>

Yes, that's my fault. I'm sorry. I apologize to you and others.  I
resent my mail with the proper address. Please just look for my mail
with the wrong address and delete it from your mail archive to prevent
further such problems. You can reply to the other mail I sent (June
19th), because it has the same content, just with an added
apology. Sorry again.

> > When DISTRO_DEFAULTS is not set, the default environment has
> > bootcmd=bootflow
> 
> That is not right, on $randomboard I picked the bootcmd is something else.
>

And how default is your default environment for your $randomboard ?

Almost half the configs/* redefine CONFIG_BOOTCOMMAND (524/1268)

When DISTRO_DEFAULTS is not set, that makes BOOTSTD_BOOTCOMMAND default to y
and the default for BOOTCMD is not "run distro_boootcmd", but "bootflow scan"
or (for sandbox) "bootflow scan -lb". When there's bootcmd at all.

But this is only the default for the default environment. It can be
overriden and the Kconfig is not exactly simple. An extract:

next branch:

arch/Arm/Kconfig:

config ARCH_ROCKCHIP
	[...]
	imply BOOTSTD_DEFAULTS
	[...]


cmd/Kconfig:

config CMD_BOOTFLOW
        bool "bootflow"
        depends on BOOTSTD
        default y
	[...]

config CMD_BOOTFLOW_FULL
        bool "bootflow - extract subcommands"
        depends on BOOTSTD_FULL
        default y
	[...]

boot/Kconfig:

config BOOT_DEFAULTS
        bool  # Common defaults for standard boot and distroboot
        imply USE_BOOTCOMMAND
	[...]

config BOOTSTD
        bool "Standard boot support"
        default y
	[...]

config BOOTSTD_FULL
        bool "Enhanced features for standard boot"
        default y if SANDBOX
        [...]


if BOOTSTD
[...]

config BOOTSTD_DEFAULTS
        bool "Select some common defaults for standard boot"
        depends on BOOTSTD
        imply USE_BOOTCOMMAND
        select BOOT_DEFAULTS
        select BOOTMETH_DISTRO
	[...]

config BOOTSTD_BOOTCOMMAND
        bool "Use bootstd to boot"
        default y if !DISTRO_DEFAULTS
	[...]
[...]
endif
[...]
config DISTRO_DEFAULTS
        bool "Select defaults suitable for booting general purpose Linux distributions"
        select BOOT_DEFAULTS
	[...]

config BOOTCOMMAND
        string "bootcmd value"
        depends on USE_BOOTCOMMAND && !USE_DEFAULT_ENV_FILE
        default "bootflow scan -lb" if BOOTSTD_DEFAULTS && CMD_BOOTFLOW_FULL
        default "bootflow scan" if BOOTSTD_DEFAULTS && !CMD_BOOTFLOW_FULL
        default "run distro_bootcmd" if !BOOTSTD_BOOTCOMMAND && DISTRO_DEFAULTS
> 
> Does this happen if you set empty bootcmd ('=> setenv bootcmd 'echo hello'
> for example), then 'saveenv' , then 'reset' , then drop into U-Boot shell
> and run 'usb reset ; usb info' too ?
>

I haven't tested it. If bootflow scan is not run it might not happen.
Someone has to hang the UCLASS_BOOTDEV on the usb mass storage device,
for it to fail. But as far as I know the idea is to make bootflow the
default in more and more cases. You'll always be able to avoid it
running in your board by setting your own environment at runtime or
changing the configuration, yes, but what's the point ?

I thought that failing one scenario was enough to fix things.  When
one finds a bug it tries to help others to reproduce it.  When others
help the bug finder to run other scenarios that don't have the bug,
what's that useful for ?

Note that it won't fail if the boot succeeds, because then you won't
have a shell to run usb info/tree. It won't fail if usb is not in
boot_targets. It won't fail if there's no mass storage device
connected to usb when bootflow scan is run...

But I still think the failing case is worth fixing. Someone may be
wondering why bootflow fails, run usb info and find a reset, when
setting up a new board, or trying to boot from the wrong usb stick
after the system partition has been corrupted, or whatever. It's not
something that breaks any board in production, but it's not something
to leave forever broken. In theory a null pointer dereference might be
used by some attacker, but in this case I don't really see any useful
attack, maybe it's my lack of imagination. So I'm not claiming it's a
severe bug. It's just a normal bug that needs fixing when possible.

Or are you trying to hint that the solution shouldn't be changing
cmd/usb.c but cleaning up the UCLASS_BOOTDEVs after bootflow scan
somehow ?

Or I should change the commit message because the point is not so much
what's the default environment or the default default environment, but
simply that bootflow scan is run with an usb mass storage device
connected and no boot content present in any of the boot_targets
media, and then usb tree/info is run ?

If it's just that you can't reproduce it, can you try to ?:

- set up a board with no boot media (I tested like this but it might
  not be needed),

- put usb in boot_targets (if you put only usb there you may not need
  the previous step):
  setenv boot_targets usb  

- plug a non-booting usb mass storage device to an usb port,

- run usb reset in case you already had usb initialized at boot, or
  skip this if usb is not initialized yet. If in doubt, run usb reset.

- run bootflow scan

- run usb info

It should list some devices, but give you a reset just after listing the
usb mass storage device without my patch, and it should just list all
usb devices and go back to the prompt with my patch.

Re: [PATCH] cmd: usb: Prevent reset in usb tree/info command

[Marek Vasut]

On 6/20/23 11:17, Xavier Drudis Ferran wrote:
> El Mon, Jun 19, 2023 at 11:49:18PM +0200, Marek Vasut deia:
>> On 6/19/23 12:12, Xavier Drudis Ferran wrote:
>>
>> It seems the email addresses are being constantly corrupted in each email.
>> This time the ML address is wrong and missing an e at the end. There is some
>> e@ nonexistent address which I have to keep removing.
>>
> 
> Yes, that's my fault. I'm sorry. I apologize to you and others.  I
> resent my mail with the proper address. Please just look for my mail
> with the wrong address and delete it from your mail archive to prevent
> further such problems. You can reply to the other mail I sent (June
> 19th), because it has the same content, just with an added
> apology. Sorry again.

That's fine

>>> When DISTRO_DEFAULTS is not set, the default environment has
>>> bootcmd=bootflow
>>
>> That is not right, on $randomboard I picked the bootcmd is something else.
>>
> 
> And how default is your default environment for your $randomboard ?

Default, see:
$ git grep CONFIG_BOOTCOMMAND configs/

> Almost half the configs/* redefine CONFIG_BOOTCOMMAND (524/1268)
> 
> When DISTRO_DEFAULTS is not set, that makes BOOTSTD_BOOTCOMMAND default to y
> and the default for BOOTCMD is not "run distro_boootcmd", but "bootflow scan"
> or (for sandbox) "bootflow scan -lb". When there's bootcmd at all.
> 
> But this is only the default for the default environment. It can be
> overriden and the Kconfig is not exactly simple. An extract:
> 
> next branch:
> 
> arch/Arm/Kconfig:
> 
> config ARCH_ROCKCHIP
> 	[...]
> 	imply BOOTSTD_DEFAULTS
> 	[...]
> 
> 
> cmd/Kconfig:
> 
> config CMD_BOOTFLOW
>          bool "bootflow"
>          depends on BOOTSTD
>          default y
> 	[...]
> 
> config CMD_BOOTFLOW_FULL
>          bool "bootflow - extract subcommands"
>          depends on BOOTSTD_FULL
>          default y
> 	[...]
> 
> boot/Kconfig:
> 
> config BOOT_DEFAULTS
>          bool  # Common defaults for standard boot and distroboot
>          imply USE_BOOTCOMMAND
> 	[...]
> 
> config BOOTSTD
>          bool "Standard boot support"
>          default y
> 	[...]
> 
> config BOOTSTD_FULL
>          bool "Enhanced features for standard boot"
>          default y if SANDBOX
>          [...]
> 
> 
> if BOOTSTD
> [...]
> 
> config BOOTSTD_DEFAULTS
>          bool "Select some common defaults for standard boot"
>          depends on BOOTSTD
>          imply USE_BOOTCOMMAND
>          select BOOT_DEFAULTS
>          select BOOTMETH_DISTRO
> 	[...]
> 
> config BOOTSTD_BOOTCOMMAND
>          bool "Use bootstd to boot"
>          default y if !DISTRO_DEFAULTS
> 	[...]
> [...]
> endif
> [...]
> config DISTRO_DEFAULTS
>          bool "Select defaults suitable for booting general purpose Linux distributions"
>          select BOOT_DEFAULTS
> 	[...]
> 
> config BOOTCOMMAND
>          string "bootcmd value"
>          depends on USE_BOOTCOMMAND && !USE_DEFAULT_ENV_FILE
>          default "bootflow scan -lb" if BOOTSTD_DEFAULTS && CMD_BOOTFLOW_FULL
>          default "bootflow scan" if BOOTSTD_DEFAULTS && !CMD_BOOTFLOW_FULL
>          default "run distro_bootcmd" if !BOOTSTD_BOOTCOMMAND && DISTRO_DEFAULTS
>>
>> Does this happen if you set empty bootcmd ('=> setenv bootcmd 'echo hello'
>> for example), then 'saveenv' , then 'reset' , then drop into U-Boot shell
>> and run 'usb reset ; usb info' too ?
>>
> 
> I haven't tested it. If bootflow scan is not run it might not happen.

So, what is the minimal test case ?
I have been asking for that for a while.

> Someone has to hang the UCLASS_BOOTDEV on the usb mass storage device,
> for it to fail. But as far as I know the idea is to make bootflow the
> default in more and more cases. You'll always be able to avoid it
> running in your board by setting your own environment at runtime or
> changing the configuration, yes, but what's the point ?
> 
> I thought that failing one scenario was enough to fix things.  When
> one finds a bug it tries to help others to reproduce it.  When others
> help the bug finder to run other scenarios that don't have the bug,
> what's that useful for ?
> 
> Note that it won't fail if the boot succeeds, because then you won't
> have a shell to run usb info/tree. It won't fail if usb is not in
> boot_targets. It won't fail if there's no mass storage device
> connected to usb when bootflow scan is run...
> 
> But I still think the failing case is worth fixing. Someone may be
> wondering why bootflow fails, run usb info and find a reset, when
> setting up a new board, or trying to boot from the wrong usb stick
> after the system partition has been corrupted, or whatever. It's not
> something that breaks any board in production, but it's not something
> to leave forever broken. In theory a null pointer dereference might be
> used by some attacker, but in this case I don't really see any useful
> attack, maybe it's my lack of imagination. So I'm not claiming it's a
> severe bug. It's just a normal bug that needs fixing when possible.
> 
> Or are you trying to hint that the solution shouldn't be changing
> cmd/usb.c but cleaning up the UCLASS_BOOTDEVs after bootflow scan
> somehow ?

I would really like a minimal test case. Empty your env and figure out 
the commands which need to be executed to trigger this. Without any 
interference from other commands/scripting/...

> Or I should change the commit message because the point is not so much
> what's the default environment or the default default environment, but
> simply that bootflow scan is run with an usb mass storage device
> connected and no boot content present in any of the boot_targets
> media, and then usb tree/info is run ?
> 
> If it's just that you can't reproduce it, can you try to ?:
> 
> - set up a board with no boot media (I tested like this but it might
>    not be needed),
> 
> - put usb in boot_targets (if you put only usb there you may not need
>    the previous step):
>    setenv boot_targets usb

Here you assume distro bootcommand or some such . Can we remove that 
assumption ? (I think yes, and we should)

> - plug a non-booting usb mass storage device to an usb port,
> 
> - run usb reset in case you already had usb initialized at boot, or
>    skip this if usb is not initialized yet. If in doubt, run usb reset.
> 
> - run bootflow scan
> 
> - run usb info
> 
> It should list some devices, but give you a reset just after listing the
> usb mass storage device without my patch, and it should just list all
> usb devices and go back to the prompt with my patch.

Does it crash if you empty your env and run simply

=> usb reset ; bootflow scan ; usb info

?

[PATCH] cmd: usb: Prevent reset in usb tree/info command

[Xavier Drudis Ferran]

Add a check to avoid dommed (by null pointer dereference) recursive
call, not only for UCLASS_BLK.

When booting my Rock Pi 4B+ with a USB mass storage stick plugged
into one of the USB 2 ports (EHCI), when it is plugged before power
on, when issuing a

usb tree

or

usb info

command I get a "Synchronous Error" and a reset just after printing the
mass storage device in the usb tree or usb info. It might depend on the
contents of the USB stick too, I'm not sure.

It seems like I have two devices as children of the mass storage
device.  When there's only a UCLASS_BLK it works fine, but when there's
a UCLASS_BLK and a UCLASS_BOOTDEV, it recurses with a null udev as
first parameter and fails.

Likewise for usb_show_info().

Not sure if this should be a patch, an RFC or a bug report.  There may
be a better way to solve this, I haven't researched commit
201417d700a2ab09 ("bootstd: Add the bootdev uclass") and bootdev flow
properly, or thought about cases where udev is not null but the
recursive call might need preventing too. Feel free to think it over
before merging (or after). But this at least fixes a reset at an
innocent looking usb tree or usb info command. Maybe we can improve it
later?

Cc: Simon Glass <sjg@chromium.org>
Cc: Lukasz Majewski <lukma@denx.de>
Cc: Marek Vasut <marex@denx.de>


Signed-off-by: Xavier Drudis Ferran <xdrudis@tinet.cat>
---
 cmd/usb.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/cmd/usb.c b/cmd/usb.c
index 73addb04c4..7e6065aa51 100644
--- a/cmd/usb.c
+++ b/cmd/usb.c
@@ -421,7 +421,8 @@ static void usb_show_tree_graph(struct usb_device *dev, char *pre)
 		 * Ignore emulators and block child devices, we only want
 		 * real devices
 		 */
-		if ((device_get_uclass_id(child) != UCLASS_USB_EMUL) &&
+		if (udev &&
+		    (device_get_uclass_id(child) != UCLASS_USB_EMUL) &&
 		    (device_get_uclass_id(child) != UCLASS_BLK)) {
 			usb_show_tree_graph(udev, pre);
 			pre[index] = 0;
@@ -607,7 +608,8 @@ static void usb_show_info(struct usb_device *udev)
 		    (device_get_uclass_id(child) != UCLASS_USB_EMUL) &&
 		    (device_get_uclass_id(child) != UCLASS_BLK)) {
 			udev = dev_get_parent_priv(child);
-			usb_show_info(udev);
+			if (udev)
+				usb_show_info(udev);
 		}
 	}
 }
-- 
2.20.1

Re: [PATCH] cmd: usb: Prevent reset in usb tree/info command

[Marek Vasut]

On 6/5/23 17:20, Xavier Drudis Ferran wrote:
> Add a check to avoid dommed (by null pointer dereference) recursive
> call, not only for UCLASS_BLK.
> 
> When booting my Rock Pi 4B+ with a USB mass storage stick plugged
> into one of the USB 2 ports (EHCI), when it is plugged before power
> on, when issuing a
> 
> usb tree
> 
> or
> 
> usb info

I cannot reproduce the problem. Do you perform any other interaction 
with the USB stack, like e.g. 'usb start' or 'usb reset' before issuing 
the aforementioned commands ?

What kind of USB stick is used here, please share model, VID, PID.

> command I get a "Synchronous Error" and a reset just after printing the
> mass storage device in the usb tree or usb info. It might depend on the
> contents of the USB stick too, I'm not sure.
> 
> It seems like I have two devices as children of the mass storage
> device.  When there's only a UCLASS_BLK it works fine, but when there's
> a UCLASS_BLK and a UCLASS_BOOTDEV, it recurses with a null udev as
> first parameter and fails.
> 
> Likewise for usb_show_info().
> 
> Not sure if this should be a patch, an RFC or a bug report.  There may
> be a better way to solve this, I haven't researched commit
> 201417d700a2ab09 ("bootstd: Add the bootdev uclass") and bootdev flow
> properly, or thought about cases where udev is not null but the
> recursive call might need preventing too. Feel free to think it over
> before merging (or after).

It is unclear what the real issue is, so until that is sorted out, no 
merging will occur, sorry.

> But this at least fixes a reset at an
> innocent looking usb tree or usb info command. Maybe we can improve it
> later?

NAK, please let's not add ad-hoc poorly understood changes into core code.

Re: [PATCH] cmd: usb: Prevent reset in usb tree/info command

[Xavier Drudis Ferran]

El Thu, Jun 08, 2023 at 12:05:18AM +0200, Marek Vasut deia:
> On 6/5/23 17:20, Xavier Drudis Ferran wrote:
> > Add a check to avoid dommed (by null pointer dereference) recursive
> > call, not only for UCLASS_BLK.
> > 
> > When booting my Rock Pi 4B+ with a USB mass storage stick plugged
> > into one of the USB 2 ports (EHCI), when it is plugged before power
> > on, when issuing a
> > 
> > usb tree
> > 
> > or
> > 
> > usb info
> 
> I cannot reproduce the problem. Do you perform any other interaction with
> the USB stack, like e.g. 'usb start' or 'usb reset' before issuing the
> aforementioned commands ?
>

No. Well, in some tests yes and some no, but I got the error in all cases.

Btw, I was testing on the next branch. I had those two commits on top
https://patchwork.ozlabs.org/project/uboot/patch/202013db5a47ecbac4a53c360ed1ca91ca663996.1685974993.git.xdrudis@tinet.cat/
https://patchwork.ozlabs.org/project/uboot/patch/464111fca83008503022e8ada5305e69ffd1afbd.1685974993.git.xdrudis@tinet.cat/

And minor configuration changes (but I had bootstage active, might or might not be related)

U-Boot was in a microSD card. 


> What kind of USB stick is used here, please share model, VID, PID.
>

It may only happen with ext4 partitions or something...

Or it might have to do with other media not being bootable (they used
to be for some old and customized version of U-boot, but not the
current one)

This is the lsusb -v output of the same USB stick in another computer

Bus 007 Device 008: ID 0718:070a Imation Corp. TF10
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x0718 Imation Corp.
  idProduct          0x070a 
  bcdDevice            1.00
  iManufacturer           1 TDK LoR
  iProduct                2 TF10
  iSerial                 3 07032B6B1D0ACB96
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0020
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              200mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
can't get debug descriptor: Resource temporarily unavailable
Device Status:     0x0000
  (Bus Powered)

Partitions:

Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) p                                                                
Model: TDK LoR TF10 (scsi)
Disk /dev/sda: 32,0GB
Sector size (logical/physical): 512B/512B
Partition Table: loop
Disk Flags: 

Number  Start  End     Size    File system  Flags
 1      0,00B  32,0GB  32,0GB  ext4


The content in the ext4 partition is just data, 3 files,
lost+found and another directory

Let me get to my logs... (I added a printf here uclass_id=22 is UCLASS_BLK
uclass_id=25 is UCLASS_BOOTDEV )

U-Boot TPL 2023.07-rc2-00089-gab17b3d648-dirty (Jun 05 2023 - 10:42:52)
lpddr4_set_rate: change freq to 400MHz 0, 1
Channel 0: LPDDR4, 400MHz
BW=32 Col=10 Bk=8 CS0 Row=15 CS1 Row=15 CS=2 Die BW=16 Size=2048MB
Channel 1: LPDDR4, 400MHz
BW=32 Col=10 Bk=8 CS0 Row=15 CS1 Row=15 CS=2 Die BW=16 Size=2048MB
256B stride
lpddr4_set_rate: change freq to 800MHz 1, 0
Trying to boot from BOOTROM
Returning to boot ROM...

U-Boot SPL 2023.07-rc2-00089-gab17b3d648-dirty (Jun 05 2023 - 10:42:52 +0200)
Trying to boot from MMC1
NOTICE:  BL31: v2.1(release):v2.1-728-ged01e0c4-dirty
NOTICE:  BL31: Built : 18:29:11, Mar 22 2022


U-Boot 2023.07-rc2-00089-gab17b3d648-dirty (Jun 05 2023 - 10:42:52 +0200)

SoC: Rockchip rk3399
Reset cause: POR
Model: Radxa ROCK Pi 4B
DRAM:  4 GiB (effective 3.9 GiB)
PMIC:  RK808 
Core:  284 devices, 29 uclasses, devicetree: separate
MMC:   mmc@fe310000: 2, mmc@fe320000: 1, mmc@fe330000: 0
Loading Environment from MMC... *** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Model: Radxa ROCK Pi 4B
Net:   eth0: ethernet@fe300000
Hit any key to stop autoboot:  2 \b\b\b 1 \b\b\b 0 
rockchip_pcie pcie@f8000000: PCIe link training gen1 timeout!
Bus usb@fe380000: USB EHCI 1.00
Bus usb@fe3c0000: USB EHCI 1.00
Bus usb@fe800000: Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.10
Bus usb@fe900000: Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.10
scanning bus usb@fe380000 for devices... 1 USB Device(s) found
scanning bus usb@fe3c0000 for devices... 2 USB Device(s) found
scanning bus usb@fe800000 for devices... 1 USB Device(s) found
scanning bus usb@fe900000 for devices... 1 USB Device(s) found
rockchip_pcie pcie@f8000000: failed to find ep-gpios property
ethernet@fe300000 Waiting for PHY auto negotiation to complete......... TIMEOUT !
Could not initialize PHY ethernet@fe300000
rockchip_pcie pcie@f8000000: failed to find ep-gpios property
ethernet@fe300000 Waiting for PHY auto negotiation to complete......... TIMEOUT !
Could not initialize PHY ethernet@fe300000
=> usb tree
USB device tree:
  1  Hub (480 Mb/s, 0mA)
     u-boot EHCI Host Controller 
   
  1  Hub (480 Mb/s, 0mA)
  |  u-boot EHCI Host Controller 
  |
                       uclass_id=64
  |\b+-2  Mass Storage (480 Mb/s, 200mA)
       TDK LoR TF10 07032B6B1D0ACB96
     
                       uclass_id=22
                       uclass_id=25
     "Synchronous Abort" handler, esr 0x96000010, far 0x948
elr: 00000000002157d4 lr : 00000000002157d4 (reloc)
elr: 00000000f3f4f7d4 lr : 00000000f3f4f7d4
x0 : 0000000000000005 x1 : 0000000000000000
x2 : 0000000000000020 x3 : 00000000ff1a0000
x4 : 00000000ff1a0000 x5 : 0000000000000000
x6 : 00000000f1f1c000 x7 : 0000000000000001
x8 : 0000000000000001 x9 : 00000000ffffffd0
x10: 0000000000000006 x11: 000000000001869f
x12: 0000000000000200 x13: 0000000000000000
x14: 00000000ffffffff x15: 00000000f1f1bbc9
x16: 000000007e4f2113 x17: 000000009a11f13e
x18: 00000000f1f31d80 x19: 0000000000000000
x20: 00000000f1f1c110 x21: 0000000000000004
x22: 00000000f1f1c114 x23: 00000000f1f65398
x24: 00000000f1f653b8 x25: 0000000000000000
x26: 0000000000000000 x27: 0000000000000000
x28: 0000000000000000 x29: 00000000f1f1c000

Code: aa0003f5 900003c0 9123b800 940191f5 (f944a660) 
Resetting CPU ...

resetting ...


> > command I get a "Synchronous Error" and a reset just after printing the
> > mass storage device in the usb tree or usb info. It might depend on the
> > contents of the USB stick too, I'm not sure.
> > 
> > It seems like I have two devices as children of the mass storage
> > device.  When there's only a UCLASS_BLK it works fine, but when there's
> > a UCLASS_BLK and a UCLASS_BOOTDEV, it recurses with a null udev as
> > first parameter and fails.
> > 
> > Likewise for usb_show_info().
> > 
> > Not sure if this should be a patch, an RFC or a bug report.  There may
> > be a better way to solve this, I haven't researched commit
> > 201417d700a2ab09 ("bootstd: Add the bootdev uclass") and bootdev flow
> > properly, or thought about cases where udev is not null but the
> > recursive call might need preventing too. Feel free to think it over
> > before merging (or after).
> 
> It is unclear what the real issue is, so until that is sorted out, no
> merging will occur, sorry.
>

That's ok.
I'm guessing the issue may be some mismatched assumption on what is
under USB devices between the bootdev code and the cmd/usb.c code.


> > But this at least fixes a reset at an
> > innocent looking usb tree or usb info command. Maybe we can improve it
> > later?
> 
> NAK, please let's not add ad-hoc poorly understood changes into core code.

Ok, sorry.

I'll reply back if/when I get a clearer theory.

Thanks.

Re: [PATCH] cmd: usb: Prevent reset in usb tree/info command

[Marek Vasut]

On 6/8/23 09:39, Xavier Drudis Ferran wrote:
> El Thu, Jun 08, 2023 at 12:05:18AM +0200, Marek Vasut deia:
>> On 6/5/23 17:20, Xavier Drudis Ferran wrote:
>>> Add a check to avoid dommed (by null pointer dereference) recursive
>>> call, not only for UCLASS_BLK.
>>>
>>> When booting my Rock Pi 4B+ with a USB mass storage stick plugged
>>> into one of the USB 2 ports (EHCI), when it is plugged before power
>>> on, when issuing a
>>>
>>> usb tree
>>>
>>> or
>>>
>>> usb info
>>
>> I cannot reproduce the problem. Do you perform any other interaction with
>> the USB stack, like e.g. 'usb start' or 'usb reset' before issuing the
>> aforementioned commands ?
>>
> 
> No. Well, in some tests yes and some no, but I got the error in all cases.

This is doubtful. It is mandatory to run 'usb start' or 'usb reset' 
before you would get any meaningful result out of 'usb info'. Without 
either, you would get 'USB is stopped.' message. Could it be there are 
some extra scripts in your environment that manipulate the USB ?

> Btw, I was testing on the next branch. I had those two commits on top
> https://patchwork.ozlabs.org/project/uboot/patch/202013db5a47ecbac4a53c360ed1ca91ca663996.1685974993.git.xdrudis@tinet.cat/
> https://patchwork.ozlabs.org/project/uboot/patch/464111fca83008503022e8ada5305e69ffd1afbd.1685974993.git.xdrudis@tinet.cat/
> 
> And minor configuration changes (but I had bootstage active, might or might not be related)
> 
> U-Boot was in a microSD card.

Can you test with stock U-Boot ?

Can you test with another USB stick, i.e. is the issue specific to this 
USB stick ?

Is the issue specific to this partition layout of this USB stick, i.e. 
if you clone (dd if=... of=...) the content of the USB stick to another 
USB stick, does the error still occur.

[...]

> Model: Radxa ROCK Pi 4B
> Net:   eth0: ethernet@fe300000
> Hit any key to stop autoboot:  2 \b\b\b 1 \b\b\b 0
> rockchip_pcie pcie@f8000000: PCIe link training gen1 timeout!
> Bus usb@fe380000: USB EHCI 1.00
> Bus usb@fe3c0000: USB EHCI 1.00
> Bus usb@fe800000: Register 2000140 NbrPorts 2
> Starting the controller
> USB XHCI 1.10
> Bus usb@fe900000: Register 2000140 NbrPorts 2
> Starting the controller
> USB XHCI 1.10
> scanning bus usb@fe380000 for devices... 1 USB Device(s) found
> scanning bus usb@fe3c0000 for devices... 2 USB Device(s) found
> scanning bus usb@fe800000 for devices... 1 USB Device(s) found
> scanning bus usb@fe900000 for devices... 1 USB Device(s) found
> rockchip_pcie pcie@f8000000: failed to find ep-gpios property
> ethernet@fe300000 Waiting for PHY auto negotiation to complete......... TIMEOUT !
> Could not initialize PHY ethernet@fe300000
> rockchip_pcie pcie@f8000000: failed to find ep-gpios property
> ethernet@fe300000 Waiting for PHY auto negotiation to complete......... TIMEOUT !
> Could not initialize PHY ethernet@fe300000

Is this some $preboot script which initializes your hardware ?

=> printenv preboot

> => usb tree
> USB device tree:
>    1  Hub (480 Mb/s, 0mA)
>       u-boot EHCI Host Controller
>     
>    1  Hub (480 Mb/s, 0mA)
>    |  u-boot EHCI Host Controller
>    |
>                         uclass_id=64
>    |\b+-2  Mass Storage (480 Mb/s, 200mA)
>         TDK LoR TF10 07032B6B1D0ACB96
>       
>                         uclass_id=22
>                         uclass_id=25
>       "Synchronous Abort" handler, esr 0x96000010, far 0x948
> elr: 00000000002157d4 lr : 00000000002157d4 (reloc)
> elr: 00000000f3f4f7d4 lr : 00000000f3f4f7d4

Take the u-boot (unstripped elf) which matches this binary, and run 
aarch64-...objdump -lSD on it, then search for the $lr value, see 
doc/develop/crash_dumps.rst for details. That should tell you where 
exactly the crash occurred. Where did it occur ?

> x0 : 0000000000000005 x1 : 0000000000000000
> x2 : 0000000000000020 x3 : 00000000ff1a0000
> x4 : 00000000ff1a0000 x5 : 0000000000000000
> x6 : 00000000f1f1c000 x7 : 0000000000000001
> x8 : 0000000000000001 x9 : 00000000ffffffd0
> x10: 0000000000000006 x11: 000000000001869f
> x12: 0000000000000200 x13: 0000000000000000
> x14: 00000000ffffffff x15: 00000000f1f1bbc9
> x16: 000000007e4f2113 x17: 000000009a11f13e
> x18: 00000000f1f31d80 x19: 0000000000000000
> x20: 00000000f1f1c110 x21: 0000000000000004
> x22: 00000000f1f1c114 x23: 00000000f1f65398
> x24: 00000000f1f653b8 x25: 0000000000000000
> x26: 0000000000000000 x27: 0000000000000000
> x28: 0000000000000000 x29: 00000000f1f1c000
> 
> Code: aa0003f5 900003c0 9123b800 940191f5 (f944a660)
> Resetting CPU ...
> 
> resetting ...
> 
> 
>>> command I get a "Synchronous Error" and a reset just after printing the
>>> mass storage device in the usb tree or usb info. It might depend on the
>>> contents of the USB stick too, I'm not sure.
>>>
>>> It seems like I have two devices as children of the mass storage
>>> device.  When there's only a UCLASS_BLK it works fine, but when there's
>>> a UCLASS_BLK and a UCLASS_BOOTDEV, it recurses with a null udev as
>>> first parameter and fails.
>>>
>>> Likewise for usb_show_info().
>>>
>>> Not sure if this should be a patch, an RFC or a bug report.  There may
>>> be a better way to solve this, I haven't researched commit
>>> 201417d700a2ab09 ("bootstd: Add the bootdev uclass") and bootdev flow
>>> properly, or thought about cases where udev is not null but the
>>> recursive call might need preventing too. Feel free to think it over
>>> before merging (or after).
>>
>> It is unclear what the real issue is, so until that is sorted out, no
>> merging will occur, sorry.
>>
> 
> That's ok.
> I'm guessing the issue may be some mismatched assumption on what is
> under USB devices between the bootdev code and the cmd/usb.c code.
> 
> 
>>> But this at least fixes a reset at an
>>> innocent looking usb tree or usb info command. Maybe we can improve it
>>> later?
>>
>> NAK, please let's not add ad-hoc poorly understood changes into core code.
> 
> Ok, sorry.
> 
> I'll reply back if/when I get a clearer theory.

The NAK is really only to prevent this from accidentally going on.

Please see above, maybe it could be narrowed down ?