From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752329AbcI1Jum (ORCPT <rfc822;w@1wt.eu>);
        Wed, 28 Sep 2016 05:50:42 -0400
Received: from szxga03-in.huawei.com ([119.145.14.66]:41436 "EHLO
        szxga03-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751648AbcI1Juk (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 28 Sep 2016 05:50:40 -0400
From: Chen Yu <chenyu56@huawei.com>
Subject: Re: BUG: scheduling while atomic in f_fs when gadget remove driver
To: Felipe Balbi <felipe.balbi@linux.intel.com>,
        <gregkh@linuxfoundation.org>
References: <205cfce1-d54c-262d-f939-ad9f37b0c52c@huawei.com>
 <878tud4q6x.fsf@linux.intel.com>
CC: <wangbinghui@hisilicon.com>, <linux-kernel@vger.kernel.org>,
        <linux-usb@vger.kernel.org>, John Stultz <john.stultz@linaro.org>,
        "Amit Pundir" <amit.pundir@linaro.org>,
        Guodong Xu <guodong.xu@linaro.org>, <mina86@mina86.com>
Message-ID: <261ada71-8a5d-6e89-7fac-6b6ba88218d7@huawei.com>
Date: Wed, 28 Sep 2016 17:47:07 +0800
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <878tud4q6x.fsf@linux.intel.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
X-Originating-IP: [10.142.63.192]
X-CFilter-Loop: Reflected
X-Mirapoint-Virus-RAPID-Raw: score=unknown(0),
        refid=str=0001.0A020201.57EB91A7.0113,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0,
        ip=0.0.0.0,
        so=2013-05-26 15:14:31,
        dmn=2013-03-21 17:37:32
X-Mirapoint-Loop-Id: dc51e95ca5c9680cfccf7669a7a9be13
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi,

在 2016/9/27 18:01, Felipe Balbi 写道:
> 
> Hi,
> 
> Chen Yu <chenyu56@huawei.com> writes:
>> Hi All,
>>
>> I'm working on Hikey board based around the HiSilicon Kirin 620, with
>> linaro kernel version 4.8.rc1 and I get below BUG error while
>> extracting USB cable from PC.
> 
> which peripheral controller does this one have? Is it dwc3?
> 
> I'm very interested in knowing about throughtput of adb push with dwc3 + f_fs.
> 

Sorry for a delay, the peripheral controller on HiSilicon Kirin 620 is dwc2.

> Also, do you know if adb can run outside of android environment? I've
> been looking for a proper functionfs user for quite some time now :-(
> 

I'm not sure if adb can run outside of android environment, there are some requirements:
1.adbd can run outside of android environment.
2.Do initialization for configfs and f_fs as android. There is an example on Hikey:
  https://github.com/96boards-hikey/android_device_linaro_hikey/blob/android-5.0/init.hikey.rc
  line 46-65 and line 161-163.

Hope this can help to you!

>> The funtion using f_fs is adb and usb_gadget_unregister_driver will be
>> called after extracting USB cable from PC.
>>
>> [   89.456512s][pid:1,cpu1,init]BUG: scheduling while atomic: init/1/0x00000002
>> [   89.456573s]Modules linked in:
>> [   89.456604s]Preemption disabled at:[<ffffffc0006a6dc0>] composite_disconnect+0x30/0xac
>> [   89.456665s][pid:1,cpu1,init]TGID: 1 Comm: init
>> [   89.456695s][pid:1,cpu1,init]Call trace:
>> [   89.456726s][pid:1,cpu1,init][<ffffffc00008a5e0>] dump_backtrace+0x0/0x15c
>> [   89.456756s][pid:1,cpu1,init][<ffffffc00008a75c>] show_stack+0x20/0x28
>> [   89.456756s][pid:1,cpu1,init][<ffffffc001153714>] dump_stack+0x84/0xa8
>> [   89.456787s][pid:1,cpu1,init][<ffffffc0000cfc5c>] __schedule_bug+0x88/0xdc
>> [   89.456817s][pid:1,cpu1,init][<ffffffc00115c4f0>] __schedule+0x714/0x854
>> [   89.456817s][pid:1,cpu1,init][<ffffffc00115c678>] schedule+0x48/0xa4
>> [   89.456817s][pid:1,cpu1,init][<ffffffc00115cbf0>] schedule_preempt_disabled+0x4c/0xf4
>> [   89.456848s][pid:1,cpu1,init][<ffffffc00115ea90>] __mutex_lock_slowpath+0xbc/0x1a4
>> [   89.456878s][pid:1,cpu1,init][<ffffffc00115ebd8>] mutex_lock+0x60/0x64
>> [   89.456878s][pid:1,cpu1,init][<ffffffc0006beb00>] ffs_func_eps_disable.isra.17+0x54/0x114
>> [   89.456909s][pid:1,cpu1,init][<ffffffc0006c05a4>] ffs_func_disable+0x30/0xa0
>> [   89.456909s][pid:1,cpu1,init][<ffffffc0006a6c4c>] reset_config.isra.8+0x44/0x78
>> [   89.456939s][pid:1,cpu1,init][<ffffffc0006a6dd8>] composite_disconnect+0x48/0xac
>> [   89.456939s][pid:1,cpu1,init][<ffffffc0006aafd4>] android_disconnect+0x48/0x54
>> [   89.456970s][pid:1,cpu1,init][<ffffffc0006ad9d0>] usb_gadget_remove_driver+0x58/0xa0
>> [   89.456970s][pid:1,cpu1,init][<ffffffc0006ada90>] usb_gadget_unregister_driver+0x78/0xc4
>>
>> I checked the codes of composite_disconnect and found
>> spin_lock_irqsave called before reset_config in which
>> ffs_func_eps_disable is called.
>>
>> void composite_disconnect(struct usb_gadget *gadget)
>> {
>>         struct usb_composite_dev        *cdev = get_gadget_data(gadget);
>>         unsigned long                   flags;
>>
>>         /* REVISIT:  should we have config and device level
>>          * disconnect callbacks?
>>          */
>>         spin_lock_irqsave(&cdev->lock, flags);
>>         if (cdev->config)
>>                 reset_config(cdev);
>>         if (cdev->driver->disconnect)
>>                 cdev->driver->disconnect(cdev);
>>         spin_unlock_irqrestore(&cdev->lock, flags);
>> }
>>
>> static void ffs_func_eps_disable(struct ffs_function *func)
>> {
>>         struct ffs_ep *ep         = func->eps;
>>         struct ffs_epfile *epfile = func->ffs->epfiles;
>>         unsigned count            = func->ffs->eps_count;
>>         unsigned long flags;
>>
>>         do {
>>                 if (epfile)
>>                         mutex_lock(&epfile->mutex);
>>                 spin_lock_irqsave(&func->ffs->eps_lock, flags);
>>                 /* pending requests get nuked */
>>                 if (likely(ep->ep))
>>                         usb_ep_disable(ep->ep);
>>                 ++ep;
>>                 spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
>>
>>                 if (epfile) {
>>                         epfile->ep = NULL;
>>                         kfree(epfile->read_buffer);
>>                         epfile->read_buffer = NULL;
>>                         mutex_unlock(&epfile->mutex);
>>                         ++epfile;
>>                 }
>>         } while (--count);
>> }
>>
>> Should the epfile->read_buffer be cleared another place and the
>> mutex_lock can be removed in ffs_func_eps_disable?
> 
> You are correct. There's a bug there. Can you try to propose a fix for
> it?
> 
> thanks
> 

I will try to fix it, but I'm engaged in other tasks and can not spend much time on it.

Do you have any suggestions about how to fix it?

thanks