usb:composite: data abort on second ums launch

[Mattijs Korpershoek]

Hi,

Thank you for the report.

On lun., mars 24, 2025 at 15:03, Marek Vasut <marex at denx.de> wrote:

> On 3/24/25 11:42 AM, Zixun LI wrote:
>> Hi,
>> 
>> I encountered a data abort on the 2nd "ums 0 mmc 0" command on
>> u-boot-at91 2024.07 with sam9x60-curiosity board.
>> 
>> U-Boot> ums 0 mmc 0
>> UMS: LUN 0, dev mmc 0, hwpart 0, sector 0x0, count 0x1d29000
>> CTRL+C - Operation aborted
>> U-Boot> ums 0 mmc 0
>> UMS: LUN 0, dev mmc 0, hwpart 0, sector 0x0, count 0x1d29000
>> data abort
>> pc : [<27f93428>]          lr : [<27ef7e80>]
>> reloc pc : [<23f16428>]    lr : [<23e7ae80>]
>> sp : 27ef4cf0  ip : a5200000     fp : 23f6915c
>> r10: deadbeef  r9 : 27ef7e80     r8 : 27f7d2a0
>> r7 : a5200000  r6 : 00000000     r5 : 00000000  r4 : 27f01668
>> r3 : 00000000  r2 : 00000000     r1 : 27fe1d88  r0 : 27f01668
>> Flags: nzCV  IRQs off  FIQs off  Mode SVC_32 (T)
>> Code: 45ac d017 68c5 4667 (60fd) 60af
>> 
>>  From backtrace the abort happened in fREe_impl(), with some debugging
>> I've localized the abort in fact happened in fsg buffer allocation in
>> fsg_common_init() [1]
>> 
>> It looks like the buffer is not freed on driver unregister since
>> fsg_common_release() is only called if fsg_common_init() met an error.
> Can you reproduce this on u-boot/master too ?

I've tried to reproduce this on master (2025.04-rc4-g244e61fbb7f5) and I
don't reproduce this with the VIM3 board using khadas-vim3_android_ab_defconfig:

U-Boot 2025.04-rc4-g244e61fbb7f5 (Mar 24 2025 - 18:15:36 +0100) khadas-vim3

Model: Khadas VIM3
SoC:   Amlogic Meson G12B (A311D) Revision 29:b (10:2)
DRAM:  2 GiB (effective 3.8 GiB)
Core:  407 devices, 36 uclasses, devicetree: separate
MMC:   mmc at ffe03000: 0, mmc at ffe05000: 1, mmc at ffe07000: 2
Loading Environment from MMC... MMC Device -1 not found
*** Warning - No MMC card found, using default environment

In:    usbkbd,serial
Out:   vidconsole,serial
Err:   vidconsole,serial
Net:   eth0: ethernet at ff3f0000

Hit any key to stop autoboot:  0
=> ums 0 mmc 2
UMS: LUN 0, dev mmc 2, hwpart 0, sector 0x0, count 0x3a3e000
|crq->brequest:0x0
CTRL+C - Operation aborted
=> ums 0 mmc 2
UMS: LUN 0, dev mmc 2, hwpart 0, sector 0x0, count 0x3a3e000
CTRL+C - Operation aborted
=>

I'll try to understand why it's behaving differently between the
sam9x60-curiosity and the vim3.

Thanks,
Mattijs