diff mbox series

[v5,4/4] usb: typec: ucsi: Always set number of alternate modes

Message ID 20240510201244.2968152-5-jthies@google.com (mailing list archive)
State Accepted
Commit c313a44ac9cda60431bdc7dcdb4b135eaef31785
Headers show
Series usb: typec: ucsi: Update UCSI alternate mode | expand

Commit Message

Jameson Thies May 10, 2024, 8:12 p.m. UTC 
Providing the number of known alternate modes allows user space to
determine when device registration has completed. Always register a
number of known alternate modes for the partner and cable plug, even
when the number of supported alternate modes is 0.

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Benson Leung <bleung@chromium.org>
Signed-off-by: Jameson Thies <jthies@google.com>
---
Changes in V5:
- None.

Changes in V4:
- None.

Changes in V3:
- None.

Changes in V2:
- None.

 drivers/usb/typec/ucsi/ucsi.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

Comments

Dmitry Baryshkov May 31, 2024, 7:43 p.m. UTC | #1 
On Fri, May 10, 2024 at 08:12:44PM +0000, Jameson Thies wrote:
> Providing the number of known alternate modes allows user space to
> determine when device registration has completed. Always register a
> number of known alternate modes for the partner and cable plug, even
> when the number of supported alternate modes is 0.
> 
> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> Reviewed-by: Benson Leung <bleung@chromium.org>
> Signed-off-by: Jameson Thies <jthies@google.com>
> ---

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Jon Hunter June 24, 2024, 12:51 p.m. UTC | #2 
Hi Jameson,

On 10/05/2024 21:12, Jameson Thies wrote:
> Providing the number of known alternate modes allows user space to
> determine when device registration has completed. Always register a
> number of known alternate modes for the partner and cable plug, even
> when the number of supported alternate modes is 0.
> 
> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> Reviewed-by: Benson Leung <bleung@chromium.org>
> Signed-off-by: Jameson Thies <jthies@google.com>
> ---
> Changes in V5:
> - None.
> 
> Changes in V4:
> - None.
> 
> Changes in V3:
> - None.
> 
> Changes in V2:
> - None.
> 
>   drivers/usb/typec/ucsi/ucsi.c | 14 +++++++++++---
>   1 file changed, 11 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index bb6e57064513d..52a14bfe4107e 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -812,10 +812,11 @@ static int ucsi_check_altmodes(struct ucsi_connector *con)
>   	/* Ignoring the errors in this case. */
>   	if (con->partner_altmode[0]) {
>   		num_partner_am = ucsi_get_num_altmode(con->partner_altmode);
> -		if (num_partner_am > 0)
> -			typec_partner_set_num_altmodes(con->partner, num_partner_am);
> +		typec_partner_set_num_altmodes(con->partner, num_partner_am);
>   		ucsi_altmode_update_active(con);
>   		return 0;
> +	} else {
> +		typec_partner_set_num_altmodes(con->partner, 0);
>   	}
>   
>   	return ret;
> @@ -1138,7 +1139,7 @@ static int ucsi_check_connection(struct ucsi_connector *con)
>   static int ucsi_check_cable(struct ucsi_connector *con)
>   {
>   	u64 command;
> -	int ret;
> +	int ret, num_plug_am;
>   
>   	if (con->cable)
>   		return 0;
> @@ -1172,6 +1173,13 @@ static int ucsi_check_cable(struct ucsi_connector *con)
>   			return ret;
>   	}
>   
> +	if (con->plug_altmode[0]) {
> +		num_plug_am = ucsi_get_num_altmode(con->plug_altmode);
> +		typec_plug_set_num_altmodes(con->plug, num_plug_am);
> +	} else {
> +		typec_plug_set_num_altmodes(con->plug, 0);
> +	}
> +
>   	return 0;
>   }
>   

I am seeing the following panic on linux-next and bisect is pointing to
this commit.

[   16.411135] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000310
[   16.411716] Mem abort info:
[   16.411806]   ESR = 0x0000000096000044
[   16.412147]   EC = 0x25: DABT (current EL), IL = 32 bits
[   16.412465]   SET = 0, FnV = 0
[   16.412530]   EA = 0, S1PTW = 0
[   16.412778]   FSC = 0x04: level 0 translation fault
[   16.413084] Data abort info:
[   16.413149]   ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
[   16.413534]   CM = 0, WnR = 1, TnD = 0, TagAccess = 0
[   16.414163]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[   16.414649] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101b2b000
[   16.414784] [0000000000000310] pgd=0000000000000000, p4d=0000000000000000
[   16.414940] Internal error: Oops: 0000000096000044 [#1] PREEMPT SMP
[   16.414946] Modules linked in: tegra210_adma(+) snd_soc_tegra210_ahub(+) drm backlight snd_soc_tegra_audio_graph_card snd_soc_audio_graph_card ucsi_ccg typec_ucsi crct10dif_ce snd_soc_simple_card_utils typec pwm_fan snd_soc_rt5659(+) snd_soc_rl6231 ina3221 pwm_tegra tegra_aconnect phy_tegra194_p2u snd_hda_codec_hdmi at24 snd_hda_tegra snd_hda_codec snd_hda_core lm90 tegra_xudc host1x pcie_tegra194 tegra_bpmp_thermal ip_tables x_tables ipv6
[   16.415056] CPU: 0 PID: 290 Comm: kworker/0:4 Not tainted 6.10.0-rc4-next-20240617-g76db4c64526c #1
[   16.415063] Hardware name: NVIDIA Jetson AGX Xavier Developer Kit (DT)
[   16.415067] Workqueue: events_long ucsi_init_work [typec_ucsi]
[   16.415082] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   16.415091] pc : typec_plug_set_num_altmodes+0x18/0x6c [typec]
[   16.415112] lr : ucsi_check_cable.part.0+0x228/0x280 [typec_ucsi]
[   16.415120] sp : ffff8000848bbca0
[   16.415123] x29: ffff8000848bbca0 x28: ffff000080e66000 x27: ffff80007adc96e8
[   16.415140] x26: ffff80007adc96f8 x25: ffff0000834510c0 x24: ffff000080e66010
[   16.415150] x23: ffff000080e6638c x22: ffff000080e664c0 x21: ffff000089c95800
[   16.415160] x20: 0000000000000000 x19: 0000000000000000 x18: ffffffffffffffff
[   16.415170] x17: 1e00000001000000 x16: c203000000000000 x15: 00656c6261632d30
[   16.415180] x14: ffff800082c922d8 x13: 0000000000000040 x12: 0000000000000228
[   16.415191] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
[   16.415201] x8 : 3d45505954564544 x7 : 0063657079743d4d x6 : 0000000000000000
[   16.415212] x5 : ffff0000835ee780 x4 : ffff000080e66288 x3 : 0000000000000000
[   16.415223] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
[   16.415233] Call trace:
[   16.415236]  typec_plug_set_num_altmodes+0x18/0x6c [typec]
[   16.415255]  ucsi_check_cable.part.0+0x228/0x280 [typec_ucsi]
[   16.415264]  ucsi_init_work+0x8b4/0x9b8 [typec_ucsi]
[   16.415271]  process_one_work+0x150/0x294
[   16.415282]  worker_thread+0x2f4/0x3fc
[   16.415289]  kthread+0x118/0x11c
[   16.415296]  ret_from_fork+0x10/0x20
[   16.415310] Code: a9be7bfd 910003fd f9000bf3 aa0003f3 (b9031001)
[   16.521018] ata1: SATA link down (SStatus 0 SControl 300)
[   16.524401] ---[ end trace 0000000000000000 ]---


I have not looked any further yet, but wanted to report this. If you have
any thoughts let me know.

Thanks
Jon
Jon Hunter June 24, 2024, 1:42 p.m. UTC | #3 
On 24/06/2024 13:51, Jon Hunter wrote:
> Hi Jameson,
> 
> On 10/05/2024 21:12, Jameson Thies wrote:
>> Providing the number of known alternate modes allows user space to
>> determine when device registration has completed. Always register a
>> number of known alternate modes for the partner and cable plug, even
>> when the number of supported alternate modes is 0.
>>
>> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
>> Reviewed-by: Benson Leung <bleung@chromium.org>
>> Signed-off-by: Jameson Thies <jthies@google.com>
>> ---
>> Changes in V5:
>> - None.
>>
>> Changes in V4:
>> - None.
>>
>> Changes in V3:
>> - None.
>>
>> Changes in V2:
>> - None.
>>
>>   drivers/usb/typec/ucsi/ucsi.c | 14 +++++++++++---
>>   1 file changed, 11 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/usb/typec/ucsi/ucsi.c 
>> b/drivers/usb/typec/ucsi/ucsi.c
>> index bb6e57064513d..52a14bfe4107e 100644
>> --- a/drivers/usb/typec/ucsi/ucsi.c
>> +++ b/drivers/usb/typec/ucsi/ucsi.c
>> @@ -812,10 +812,11 @@ static int ucsi_check_altmodes(struct 
>> ucsi_connector *con)
>>       /* Ignoring the errors in this case. */
>>       if (con->partner_altmode[0]) {
>>           num_partner_am = ucsi_get_num_altmode(con->partner_altmode);
>> -        if (num_partner_am > 0)
>> -            typec_partner_set_num_altmodes(con->partner, 
>> num_partner_am);
>> +        typec_partner_set_num_altmodes(con->partner, num_partner_am);
>>           ucsi_altmode_update_active(con);
>>           return 0;
>> +    } else {
>> +        typec_partner_set_num_altmodes(con->partner, 0);
>>       }
>>       return ret;
>> @@ -1138,7 +1139,7 @@ static int ucsi_check_connection(struct 
>> ucsi_connector *con)
>>   static int ucsi_check_cable(struct ucsi_connector *con)
>>   {
>>       u64 command;
>> -    int ret;
>> +    int ret, num_plug_am;
>>       if (con->cable)
>>           return 0;
>> @@ -1172,6 +1173,13 @@ static int ucsi_check_cable(struct 
>> ucsi_connector *con)
>>               return ret;
>>       }
>> +    if (con->plug_altmode[0]) {
>> +        num_plug_am = ucsi_get_num_altmode(con->plug_altmode);
>> +        typec_plug_set_num_altmodes(con->plug, num_plug_am);
>> +    } else {
>> +        typec_plug_set_num_altmodes(con->plug, 0);
>> +    }
>> +
>>       return 0;
>>   }
> 
> I am seeing the following panic on linux-next and bisect is pointing to
> this commit.
> 
> [   16.411135] Unable to handle kernel NULL pointer dereference at 
> virtual address 0000000000000310
> [   16.411716] Mem abort info:
> [   16.411806]   ESR = 0x0000000096000044
> [   16.412147]   EC = 0x25: DABT (current EL), IL = 32 bits
> [   16.412465]   SET = 0, FnV = 0
> [   16.412530]   EA = 0, S1PTW = 0
> [   16.412778]   FSC = 0x04: level 0 translation fault
> [   16.413084] Data abort info:
> [   16.413149]   ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
> [   16.413534]   CM = 0, WnR = 1, TnD = 0, TagAccess = 0
> [   16.414163]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> [   16.414649] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101b2b000
> [   16.414784] [0000000000000310] pgd=0000000000000000, 
> p4d=0000000000000000
> [   16.414940] Internal error: Oops: 0000000096000044 [#1] PREEMPT SMP
> [   16.414946] Modules linked in: tegra210_adma(+) 
> snd_soc_tegra210_ahub(+) drm backlight snd_soc_tegra_audio_graph_card 
> snd_soc_audio_graph_card ucsi_ccg typec_ucsi crct10dif_ce 
> snd_soc_simple_card_utils typec pwm_fan snd_soc_rt5659(+) snd_soc_rl6231 
> ina3221 pwm_tegra tegra_aconnect phy_tegra194_p2u snd_hda_codec_hdmi 
> at24 snd_hda_tegra snd_hda_codec snd_hda_core lm90 tegra_xudc host1x 
> pcie_tegra194 tegra_bpmp_thermal ip_tables x_tables ipv6
> [   16.415056] CPU: 0 PID: 290 Comm: kworker/0:4 Not tainted 
> 6.10.0-rc4-next-20240617-g76db4c64526c #1
> [   16.415063] Hardware name: NVIDIA Jetson AGX Xavier Developer Kit (DT)
> [   16.415067] Workqueue: events_long ucsi_init_work [typec_ucsi]
> [   16.415082] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS 
> BTYPE=--)
> [   16.415091] pc : typec_plug_set_num_altmodes+0x18/0x6c [typec]
> [   16.415112] lr : ucsi_check_cable.part.0+0x228/0x280 [typec_ucsi]
> [   16.415120] sp : ffff8000848bbca0
> [   16.415123] x29: ffff8000848bbca0 x28: ffff000080e66000 x27: 
> ffff80007adc96e8
> [   16.415140] x26: ffff80007adc96f8 x25: ffff0000834510c0 x24: 
> ffff000080e66010
> [   16.415150] x23: ffff000080e6638c x22: ffff000080e664c0 x21: 
> ffff000089c95800
> [   16.415160] x20: 0000000000000000 x19: 0000000000000000 x18: 
> ffffffffffffffff
> [   16.415170] x17: 1e00000001000000 x16: c203000000000000 x15: 
> 00656c6261632d30
> [   16.415180] x14: ffff800082c922d8 x13: 0000000000000040 x12: 
> 0000000000000228
> [   16.415191] x11: 0000000000000000 x10: 0000000000000000 x9 : 
> 0000000000000000
> [   16.415201] x8 : 3d45505954564544 x7 : 0063657079743d4d x6 : 
> 0000000000000000
> [   16.415212] x5 : ffff0000835ee780 x4 : ffff000080e66288 x3 : 
> 0000000000000000
> [   16.415223] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 
> 0000000000000000
> [   16.415233] Call trace:
> [   16.415236]  typec_plug_set_num_altmodes+0x18/0x6c [typec]
> [   16.415255]  ucsi_check_cable.part.0+0x228/0x280 [typec_ucsi]
> [   16.415264]  ucsi_init_work+0x8b4/0x9b8 [typec_ucsi]
> [   16.415271]  process_one_work+0x150/0x294
> [   16.415282]  worker_thread+0x2f4/0x3fc
> [   16.415289]  kthread+0x118/0x11c
> [   16.415296]  ret_from_fork+0x10/0x20
> [   16.415310] Code: a9be7bfd 910003fd f9000bf3 aa0003f3 (b9031001)
> [   16.521018] ata1: SATA link down (SStatus 0 SControl 300)
> [   16.524401] ---[ end trace 0000000000000000 ]---
> 
> 
> I have not looked any further yet, but wanted to report this. If you have
> any thoughts let me know.


It is crashing because 'con->plug' is not initialised when 
typec_plug_set_num_altmodes() is called. Do we need to add a check to 
see if 'con->plug' is valid in ucsi_check_cable()?

Jon
Dmitry Baryshkov June 24, 2024, 2:33 p.m. UTC | #4 
On Mon, 24 Jun 2024 at 16:42, Jon Hunter <jonathanh@nvidia.com> wrote:
>
>
> On 24/06/2024 13:51, Jon Hunter wrote:
> > Hi Jameson,
> >
> > On 10/05/2024 21:12, Jameson Thies wrote:
> >> Providing the number of known alternate modes allows user space to
> >> determine when device registration has completed. Always register a
> >> number of known alternate modes for the partner and cable plug, even
> >> when the number of supported alternate modes is 0.
> >>
> >> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> >> Reviewed-by: Benson Leung <bleung@chromium.org>
> >> Signed-off-by: Jameson Thies <jthies@google.com>
> >> ---
> >> Changes in V5:
> >> - None.
> >>
> >> Changes in V4:
> >> - None.
> >>
> >> Changes in V3:
> >> - None.
> >>
> >> Changes in V2:
> >> - None.
> >>
> >>   drivers/usb/typec/ucsi/ucsi.c | 14 +++++++++++---
> >>   1 file changed, 11 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/drivers/usb/typec/ucsi/ucsi.c
> >> b/drivers/usb/typec/ucsi/ucsi.c
> >> index bb6e57064513d..52a14bfe4107e 100644
> >> --- a/drivers/usb/typec/ucsi/ucsi.c
> >> +++ b/drivers/usb/typec/ucsi/ucsi.c
> >> @@ -812,10 +812,11 @@ static int ucsi_check_altmodes(struct
> >> ucsi_connector *con)
> >>       /* Ignoring the errors in this case. */
> >>       if (con->partner_altmode[0]) {
> >>           num_partner_am = ucsi_get_num_altmode(con->partner_altmode);
> >> -        if (num_partner_am > 0)
> >> -            typec_partner_set_num_altmodes(con->partner,
> >> num_partner_am);
> >> +        typec_partner_set_num_altmodes(con->partner, num_partner_am);
> >>           ucsi_altmode_update_active(con);
> >>           return 0;
> >> +    } else {
> >> +        typec_partner_set_num_altmodes(con->partner, 0);
> >>       }
> >>       return ret;
> >> @@ -1138,7 +1139,7 @@ static int ucsi_check_connection(struct
> >> ucsi_connector *con)
> >>   static int ucsi_check_cable(struct ucsi_connector *con)
> >>   {
> >>       u64 command;
> >> -    int ret;
> >> +    int ret, num_plug_am;
> >>       if (con->cable)
> >>           return 0;
> >> @@ -1172,6 +1173,13 @@ static int ucsi_check_cable(struct
> >> ucsi_connector *con)
> >>               return ret;
> >>       }
> >> +    if (con->plug_altmode[0]) {
> >> +        num_plug_am = ucsi_get_num_altmode(con->plug_altmode);
> >> +        typec_plug_set_num_altmodes(con->plug, num_plug_am);
> >> +    } else {
> >> +        typec_plug_set_num_altmodes(con->plug, 0);
> >> +    }
> >> +
> >>       return 0;
> >>   }
> >
> > I am seeing the following panic on linux-next and bisect is pointing to
> > this commit.
> >
> > [   16.411135] Unable to handle kernel NULL pointer dereference at
> > virtual address 0000000000000310
> > [   16.411716] Mem abort info:
> > [   16.411806]   ESR = 0x0000000096000044
> > [   16.412147]   EC = 0x25: DABT (current EL), IL = 32 bits
> > [   16.412465]   SET = 0, FnV = 0
> > [   16.412530]   EA = 0, S1PTW = 0
> > [   16.412778]   FSC = 0x04: level 0 translation fault
> > [   16.413084] Data abort info:
> > [   16.413149]   ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
> > [   16.413534]   CM = 0, WnR = 1, TnD = 0, TagAccess = 0
> > [   16.414163]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> > [   16.414649] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101b2b000
> > [   16.414784] [0000000000000310] pgd=0000000000000000,
> > p4d=0000000000000000
> > [   16.414940] Internal error: Oops: 0000000096000044 [#1] PREEMPT SMP
> > [   16.414946] Modules linked in: tegra210_adma(+)
> > snd_soc_tegra210_ahub(+) drm backlight snd_soc_tegra_audio_graph_card
> > snd_soc_audio_graph_card ucsi_ccg typec_ucsi crct10dif_ce
> > snd_soc_simple_card_utils typec pwm_fan snd_soc_rt5659(+) snd_soc_rl6231
> > ina3221 pwm_tegra tegra_aconnect phy_tegra194_p2u snd_hda_codec_hdmi
> > at24 snd_hda_tegra snd_hda_codec snd_hda_core lm90 tegra_xudc host1x
> > pcie_tegra194 tegra_bpmp_thermal ip_tables x_tables ipv6
> > [   16.415056] CPU: 0 PID: 290 Comm: kworker/0:4 Not tainted
> > 6.10.0-rc4-next-20240617-g76db4c64526c #1
> > [   16.415063] Hardware name: NVIDIA Jetson AGX Xavier Developer Kit (DT)
> > [   16.415067] Workqueue: events_long ucsi_init_work [typec_ucsi]
> > [   16.415082] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS
> > BTYPE=--)
> > [   16.415091] pc : typec_plug_set_num_altmodes+0x18/0x6c [typec]
> > [   16.415112] lr : ucsi_check_cable.part.0+0x228/0x280 [typec_ucsi]
> > [   16.415120] sp : ffff8000848bbca0
> > [   16.415123] x29: ffff8000848bbca0 x28: ffff000080e66000 x27:
> > ffff80007adc96e8
> > [   16.415140] x26: ffff80007adc96f8 x25: ffff0000834510c0 x24:
> > ffff000080e66010
> > [   16.415150] x23: ffff000080e6638c x22: ffff000080e664c0 x21:
> > ffff000089c95800
> > [   16.415160] x20: 0000000000000000 x19: 0000000000000000 x18:
> > ffffffffffffffff
> > [   16.415170] x17: 1e00000001000000 x16: c203000000000000 x15:
> > 00656c6261632d30
> > [   16.415180] x14: ffff800082c922d8 x13: 0000000000000040 x12:
> > 0000000000000228
> > [   16.415191] x11: 0000000000000000 x10: 0000000000000000 x9 :
> > 0000000000000000
> > [   16.415201] x8 : 3d45505954564544 x7 : 0063657079743d4d x6 :
> > 0000000000000000
> > [   16.415212] x5 : ffff0000835ee780 x4 : ffff000080e66288 x3 :
> > 0000000000000000
> > [   16.415223] x2 : 0000000000000000 x1 : 0000000000000000 x0 :
> > 0000000000000000
> > [   16.415233] Call trace:
> > [   16.415236]  typec_plug_set_num_altmodes+0x18/0x6c [typec]
> > [   16.415255]  ucsi_check_cable.part.0+0x228/0x280 [typec_ucsi]
> > [   16.415264]  ucsi_init_work+0x8b4/0x9b8 [typec_ucsi]
> > [   16.415271]  process_one_work+0x150/0x294
> > [   16.415282]  worker_thread+0x2f4/0x3fc
> > [   16.415289]  kthread+0x118/0x11c
> > [   16.415296]  ret_from_fork+0x10/0x20
> > [   16.415310] Code: a9be7bfd 910003fd f9000bf3 aa0003f3 (b9031001)
> > [   16.521018] ata1: SATA link down (SStatus 0 SControl 300)
> > [   16.524401] ---[ end trace 0000000000000000 ]---
> >
> >
> > I have not looked any further yet, but wanted to report this. If you have
> > any thoughts let me know.
>
>
> It is crashing because 'con->plug' is not initialised when
> typec_plug_set_num_altmodes() is called. Do we need to add a check to
> see if 'con->plug' is valid in ucsi_check_cable()?

Yes. Either of  con->calbe and con->plug can be NULL.
Jon Hunter June 24, 2024, 3:52 p.m. UTC | #5 
On 24/06/2024 15:33, Dmitry Baryshkov wrote:
> On Mon, 24 Jun 2024 at 16:42, Jon Hunter <jonathanh@nvidia.com> wrote:
>>
>>
>> On 24/06/2024 13:51, Jon Hunter wrote:
>>> Hi Jameson,
>>>
>>> On 10/05/2024 21:12, Jameson Thies wrote:
>>>> Providing the number of known alternate modes allows user space to
>>>> determine when device registration has completed. Always register a
>>>> number of known alternate modes for the partner and cable plug, even
>>>> when the number of supported alternate modes is 0.
>>>>
>>>> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
>>>> Reviewed-by: Benson Leung <bleung@chromium.org>
>>>> Signed-off-by: Jameson Thies <jthies@google.com>
>>>> ---
>>>> Changes in V5:
>>>> - None.
>>>>
>>>> Changes in V4:
>>>> - None.
>>>>
>>>> Changes in V3:
>>>> - None.
>>>>
>>>> Changes in V2:
>>>> - None.
>>>>
>>>>    drivers/usb/typec/ucsi/ucsi.c | 14 +++++++++++---
>>>>    1 file changed, 11 insertions(+), 3 deletions(-)
>>>>
>>>> diff --git a/drivers/usb/typec/ucsi/ucsi.c
>>>> b/drivers/usb/typec/ucsi/ucsi.c
>>>> index bb6e57064513d..52a14bfe4107e 100644
>>>> --- a/drivers/usb/typec/ucsi/ucsi.c
>>>> +++ b/drivers/usb/typec/ucsi/ucsi.c
>>>> @@ -812,10 +812,11 @@ static int ucsi_check_altmodes(struct
>>>> ucsi_connector *con)
>>>>        /* Ignoring the errors in this case. */
>>>>        if (con->partner_altmode[0]) {
>>>>            num_partner_am = ucsi_get_num_altmode(con->partner_altmode);
>>>> -        if (num_partner_am > 0)
>>>> -            typec_partner_set_num_altmodes(con->partner,
>>>> num_partner_am);
>>>> +        typec_partner_set_num_altmodes(con->partner, num_partner_am);
>>>>            ucsi_altmode_update_active(con);
>>>>            return 0;
>>>> +    } else {
>>>> +        typec_partner_set_num_altmodes(con->partner, 0);
>>>>        }
>>>>        return ret;
>>>> @@ -1138,7 +1139,7 @@ static int ucsi_check_connection(struct
>>>> ucsi_connector *con)
>>>>    static int ucsi_check_cable(struct ucsi_connector *con)
>>>>    {
>>>>        u64 command;
>>>> -    int ret;
>>>> +    int ret, num_plug_am;
>>>>        if (con->cable)
>>>>            return 0;
>>>> @@ -1172,6 +1173,13 @@ static int ucsi_check_cable(struct
>>>> ucsi_connector *con)
>>>>                return ret;
>>>>        }
>>>> +    if (con->plug_altmode[0]) {
>>>> +        num_plug_am = ucsi_get_num_altmode(con->plug_altmode);
>>>> +        typec_plug_set_num_altmodes(con->plug, num_plug_am);
>>>> +    } else {
>>>> +        typec_plug_set_num_altmodes(con->plug, 0);
>>>> +    }
>>>> +
>>>>        return 0;
>>>>    }

Looking at this some more, the plug is only registered in
ucsi_check_cable() if UCSI_CAP_ALT_MODE_DETAILS is specified
for the Type C controller. The Cypress CCG explicitly clears
this flag.

The following will only call typec_plug_set_num_altmodes()
if the call to ucsi_register_plug() is successful ...

diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index 134ef4e17d85..e268af88a7d2 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -1176,13 +1176,13 @@ static int ucsi_check_cable(struct ucsi_connector *con)
                 ret = ucsi_register_altmodes(con, UCSI_RECIPIENT_SOP_P);
                 if (ret < 0)
                         return ret;
-       }
  
-       if (con->plug_altmode[0]) {
-               num_plug_am = ucsi_get_num_altmode(con->plug_altmode);
-               typec_plug_set_num_altmodes(con->plug, num_plug_am);
-       } else {
-               typec_plug_set_num_altmodes(con->plug, 0);
+               if (con->plug_altmode[0]) {
+                       num_plug_am = ucsi_get_num_altmode(con->plug_altmode);
+                       typec_plug_set_num_altmodes(con->plug, num_plug_am);
+               } else {
+                       typec_plug_set_num_altmodes(con->plug, 0);
+               }
         }
  
         return 0;

>> It is crashing because 'con->plug' is not initialised when
>> typec_plug_set_num_altmodes() is called. Do we need to add a check to
>> see if 'con->plug' is valid in ucsi_check_cable()?
> 
> Yes. Either of  con->calbe and con->plug can be NULL.

Thanks for confirming.

Jon
Jameson Thies June 24, 2024, 4:32 p.m. UTC | #6 
Hi Jon,
thank you for catching this. I'll post a fix to address the null
pointer dereferencing.

Thanks,
Jameson
diff mbox series

Patch

diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index bb6e57064513d..52a14bfe4107e 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -812,10 +812,11 @@  static int ucsi_check_altmodes(struct ucsi_connector *con)
 	/* Ignoring the errors in this case. */
 	if (con->partner_altmode[0]) {
 		num_partner_am = ucsi_get_num_altmode(con->partner_altmode);
-		if (num_partner_am > 0)
-			typec_partner_set_num_altmodes(con->partner, num_partner_am);
+		typec_partner_set_num_altmodes(con->partner, num_partner_am);
 		ucsi_altmode_update_active(con);
 		return 0;
+	} else {
+		typec_partner_set_num_altmodes(con->partner, 0);
 	}
 
 	return ret;
@@ -1138,7 +1139,7 @@  static int ucsi_check_connection(struct ucsi_connector *con)
 static int ucsi_check_cable(struct ucsi_connector *con)
 {
 	u64 command;
-	int ret;
+	int ret, num_plug_am;
 
 	if (con->cable)
 		return 0;
@@ -1172,6 +1173,13 @@  static int ucsi_check_cable(struct ucsi_connector *con)
 			return ret;
 	}
 
+	if (con->plug_altmode[0]) {
+		num_plug_am = ucsi_get_num_altmode(con->plug_altmode);
+		typec_plug_set_num_altmodes(con->plug, num_plug_am);
+	} else {
+		typec_plug_set_num_altmodes(con->plug, 0);
+	}
+
 	return 0;
 }