#302 System MMR Error USB gadget modules and configfs

[iabdalkader]

FWIW, the same happens with all usb gadgets (g_serial, g_webcam and g_mass_storage)

Also newer configfs+functionfs fail when gadget is enabled (i.e echo musb-hdrc.1.auto > UDC)

If the usb cable is not plugged I can load modules without problems, but as soon as it's plugged kernel panic.

Linux version 4.0.0-rc3-ADI-2014R1-pre-00471-ga729c65-dirty (gcc version 4.3.5 (ADI-2014R1-RC2) ) #1 Fri Mar 27 15:24:54 EET 2015
register early platform devices
bootconsole [early_shadow0] enabled
bootconsole [early_BFuart0] enabled
early printk enabled on early_BFuart0
Board Memory: 32MB
Kernel Managed Memory: 32MB
Memory map:
fixedcode = 0x00000400-0x00000490
text = 0x00100000-0x002962d0
rodata = 0x002962d0-0x003449bc
bss = 0x00345000-0x00359898
data = 0x003598a0-0x00378000
stack = 0x00376000-0x00378000
init = 0x00378000-0x00391000
available = 0x00391000-0x01c00000
DMA Zone = 0x01c00000-0x02000000
Hardware Trace active and enabled
Boot Mode: 13
Blackfin support (C) 2004-2010 Analog Devices, Inc.
Compiled for ADSP-BF527 Rev 0.2
Blackfin Linux support by http://blackfin.uclinux.org/
Processor Speed: 600 MHz core clock and 120 MHz System Clock
NOMPU: setting up cplb tables
Instruction Cache Enabled for CPU0
External memory: cacheable in instruction cache
Data Cache Enabled for CPU0
External memory: cacheable (write-back) in data cache
Built 1 zonelists in Zone order, mobility grouping off. Total pages: 7112
Kernel command line: root=/dev/mtdblock2 rootfstype=jffs2 ro clkin_hz=24000000 earlyprintk=serial,uart0,115200 console=ttyBF0,115200
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 24692K/28672K available (1624K kernel code, 121K rwdata, 697K rodata, 100K init, 82K bss, 3980K reserved, 0K cma-reserved, 4096K DMA)
NR_IRQS:159
Configuring Blackfin Priority Driven Interrupts
Console: colour dummy device 80x25
Calibrating delay loop... 1191.93 BogoMIPS (lpj=2383872)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
Initializing cgroup subsys freezer
devtmpfs: initialized
Blackfin Scratchpad data SRAM: 4 KB
Blackfin L1 Data A SRAM: 16 KB (9 KB free)
Blackfin L1 Data B SRAM: 16 KB (16 KB free)
Blackfin L1 Instruction SRAM: 48 KB (33 KB free)
Blackfin DMA Controller
ezkit_init(): registering device resources
SCSI subsystem initialized
bfin-spi bfin-spi.0: master is unqueued, this is deprecated
spi spi0.1: Warning: SPI CPHA not set: Slave Select not under software control!
See Documentation/blackfin/bfin-spi-notes.txt
bfin-spi bfin-spi.0: Blackfin on-chip SPI Controller Driver, Version 1.0, regs@ffc00500, dma channel@7
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
i2c-bfin-twi i2c-bfin-twi.0: Blackfin on-chip I2C TWI Contoller, regs_base@ffc01400
media: Linux media interface: v0.10
Linux video capture interface: v2.00
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
io scheduler noop registered (default)
bfin-uart: Blackfin serial driver
bfin-uart.0: ttyBF0 at MMIO 0xffc00400 (irq = 29, base_baud = 7500000) is a BFIN-UART
console [ttyBF0] enabled
console [ttyBF0] enabled
bootconsole [early_BFuart0] disabled
bootconsole [early_BFuart0] disabled
bootconsole [early_shadow0] disabled
bfin-dma: initialized
brd: module loaded
bf5xx-nand bf5xx-nand.0: data_width=8, wr_dly=3, rd_dly=3
nand: device found, Manufacturer ID: 0x01, Chip ID: 0xf1
nand: AMD/Spansion S34ML01G2
nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
nand: WARNING: S34ML01G2: the ECC used on your system is too weak compared to the one required by the NAND chip
Creating 4 MTD partitions on "S34ML01G2":
0x000000000000-0x000000040000 : "uboot(nand)"
0x000000040000-0x000000440000 : "linux kernel(nand)"
0x000000440000-0x000000e40000 : "rootfs(nand)"
0x000000e40000-0x000008000000 : "file system(nand)"
usbcore: registered new interface driver usb-storage
musb-hdrc musb-hdrc.1.auto: MUSB HDRC host driver
musb-hdrc musb-hdrc.1.auto: new USB bus registered, assigned bus number 1
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: MUSB HDRC host driver
usb usb1: Manufacturer: Linux 4.0.0-rc3-ADI-2014R1-pre-00471-ga729c65-dirty musb-hcd
usb usb1: SerialNumber: musb-hdrc.1.auto
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
i2c /dev entries driver
ppi probe success
bfin_capture bfin_capture.0: v4l2 device registered
bfin_capture bfin_capture.0: video device registered as: video0
mt9v032 0-005c: Probing MT9V032 at address 0x5c
mt9v032 0-005c: MT9V034 rev1 detected at address 0x5c
bfin_capture bfin_capture.0: v4l2 sub device registered
bfin_wdt: initialized: timeout=20 sec (nowayout=0)
hidraw: raw HID events driver (C) Jiri Kosina
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
dma_alloc_init: dma_page @ 0x01189000 - 1024 pages at 0x01c00000
VFS: Mounted root (jffs2 filesystem) readonly on device 31:2.
devtmpfs: mounted
Freeing unused kernel memory: 100K (00378000 - 00391000)
random: nonblocking pool is initialized

BusyBox v1.23.1 (2015-03-27 10:58:02 EET) hush - the humble shell

root:/> modprobe g_mass_storage file=/dev/mtdblock3
Number of LUNs=8
Mass Storage Function, version: 2009/09/11
LUN: removable file: (no medium)
Number of LUNs=1
LUN: file: /dev/mtdblock3
Number of LUNs=1
g_mass_storage gadget: Mass Storage Gadget, version: 2009/09/11
g_mass_storage gadget: userspace failed to provide iSerialNumber
g_mass_storage gadget: g_mass_storage ready
root:/> System MMR Error

5 - An error occurred due to an invalid access to an System MMR location

5 Possible reason: a 32-bit register is accessed with a 16-bit instruction

5 or a 16-bit register is accessed with a 32-bit instruction.
Kernel OOPS in progress
HW Error context
No Valid process in current context
return address: [0x00264b32]; contents of:
0x00264b10: 3005 0062 e14f 0035 e10f 91a0 917a 3038
0x00264b20: 3005 6081 0062 3218 42f8 4818 101b 4810
0x00264b30: 1028 [6006] 4820 103c 0000 0000 0000 e4a8
0x00264b40: 1042 0e30 1c16 0001 e14a 0035 e10a 91ac

CPU: 0 PID: 0 Comm: swapper Not tainted 4.0.0-rc3-ADI-2014R1-pre-00471-ga729c65-dirty #1
task: 00359b7c ti: 00376000 task.ti: 00376000
ADSP-BF527-0.2 600(MHz CCLK) 120(MHz SCLK) (mpu off)
Linux version 4.0.0-rc3-ADI-2014R1-pre-00471-ga729c65-dirty (gcc version 4.3.5 (ADI-2014R1-RC2) ) #1 Fri Mar 27 15:24:54 EET 2015

SEQUENCER STATUS: Not tainted
SEQSTAT: 0000803f IPEND: 8830 IMASK: 0000 SYSCFG: 0006
Global Interrupts Disabled (IPEND[4])
Peripheral interrupts masked off
Kernel interrupts masked off
HWERRCAUSE: 0x2
EXCAUSE : 0x3f
interrupts disabled
physical IVG5 asserted : <0xffa00a94> { _evt_ivhw + 0x0 }
physical IVG11 asserted : <0xffa00cd0> { _evt_evt11 + 0x0 }
physical IVG15 asserted : <0xffa00d84> { _evt_system_call + 0x0 }
logical irq 6 mapped : <0xffa002cc> { _bfin_coretmr_interrupt + 0x0 }
logical irq 27 mapped : <0x00271174> { _bfin_twi_interrupt_entry + 0x0 }
logical irq 29 mapped : <0x002121f8> { _bfin_serial_dma_rx_int + 0x0 }
logical irq 30 mapped : <0x00211ffc> { _bfin_serial_dma_tx_int + 0x0 }
logical irq 37 mapped : <0x002450e4> { _bf5xx_nand_dma_irq + 0x0 }
logical irq 59 mapped : <0x00267a6c> { _blackfin_interrupt + 0x0 }
logical irq 62 mapped : <0x002672e4> { _dma_controller_irq + 0x0 }
RETE: <0x00000000> / Maybe null pointer? /
RETN: <0x013fe000> / kernel dynamic memory (maybe user-space) /
RETX: <0x01603124> / kernel dynamic memory (maybe user-space) /
RETS: <0x00264b26> { _musb_g_ep0_irq + 0x3a }
PC : <0x00264b32> { _musb_g_ep0_irq + 0x46 }
PROCESSOR STATE:
R0 : 00000000 R1 : 00000010 R2 : 00000000 R3 : 00000000
R4 : ffc03800 R5 : ffc03900 R6 : 00000008 R7 : 00000000
P0 : 002972d4 P1 : 0029728c P2 : ffc03910 P3 : 00000000
P4 : 003591a8 P5 : 010ec00c FP : 003591a0 SP : 00377ca4
LB0: ffa01288 LT0: ffa01286 LC0: 00000000
LB1: 001557c8 LT1: 001557be LC1: 00000000
B0 : 00000000 L0 : 00000000 M0 : 00000050 I0 : 0035a898
B1 : ffffffff L1 : 00000000 M1 : ffffffff I1 : 003d5288
B2 : 00000000 L2 : 00000000 M2 : 00100100 I2 : 00351c64
B3 : 003d527c L3 : 00000000 M3 : 00200200 I3 : 003d5288
A0.w: 00000001 A0.x: 00000000 A1.w: 00000001 A1.x: 00000000
USP : 00378000 ASTAT: 02002021

Kernel Stack
Stack info:
SP: [0x00377f18] <0x00377f18> / kernel dynamic memory (maybe user-space) /
Memory from 0x00377f10 to 00378000
00377f10: 00000000 ffffffff [00000000] 00000000 00000000 00000000 00000000 00200200
00377f30:<00100100> ffffffff 00000050 003d5288 00351c64 003d5288 0035a898 00378000
00377f50: 0035a898 00376008 00349c38 00376008 0035a898 013ee380 ffa007ac 0012345c
00377f70: 00123458 00376000 003756f2 00000065 00000001 ffffffc0 0000ffff 0000ffff
00377f90: ffa007ac 00000006 00377fb0 ffa01c24 00351bf8 00378000 003787cc 00351bf8
00377fb0: 00345000 00345009 ffffffff 00000000 00100000 01603124 002fdc44 00385d34
00377fd0: 00344584 00000043 ffffffff ffffffff 00378390 00388598 0037b182 ffe00000
00377ff0: 00000001 01f67a6c ffb00000 00000000
Return addresses in stack:
address : <0x00100100> { _do_one_initcall + 0x100 }
Modules linked in: g_mass_storage usb_f_mass_storage libcomposite
Kernel panic - not syncing: Kernel exception
---[ end Kernel panic - not syncing: Kernel exception

[iabdalkader]

It seems the wrong ep_offset is set, I narrowed down this to:

static u32 musb_flat_ep_offset(u8 epnum, u16 offset)
{
     return 0x100 + (0x10 * epnum) + offset;
}

It should be

return (USB_OFFSET(USB_EP_NI0_TXMAXP) + (0x40 * (epnum)) + (offset));

I can set ep_offset in musb_platform_ops but it gets overwritten in musb_init_controller:

/* At least tusb6010 has it's own offsets.. */
if (musb->ops->ep_offset)
    musb->io.ep_offset = musb->ops->ep_offset;
if (musb->ops->ep_select)
    musb->io.ep_select = musb->ops->ep_select;

/* ..and some devices use indexed offset or flat offset */
if (musb->io.quirks & MUSB_INDEXED_EP) {
    musb->io.ep_offset = musb_indexed_ep_offset;
    musb->io.ep_select = musb_indexed_ep_select;
} else {
    musb->io.ep_offset = musb_flat_ep_offset;
    musb->io.ep_select = musb_flat_ep_select;
}

Any advice ?