http://wiki.jackslab.org/index.php?action=history&feed=atom&title=%E6%8D%89%E8%99%AB%E6%97%A5%E8%AE%B0_0015%3A_Freescale_8360e_Gadget_%E6%8F%92%E7%94%B5%E5%BC%95%E8%B5%B7_Kernel_panic
捉虫日记 0015: Freescale 8360e Gadget 插电引起 Kernel panic - 版本历史
2026-09-11T05:20:21Z
本wiki的该页面的版本历史
MediaWiki 1.19.2
http://wiki.jackslab.org/index.php?title=%E6%8D%89%E8%99%AB%E6%97%A5%E8%AE%B0_0015:_Freescale_8360e_Gadget_%E6%8F%92%E7%94%B5%E5%BC%95%E8%B5%B7_Kernel_panic&diff=18578&oldid=prev
Comcat：/* Analysis */
2025-12-04T03:42:53Z
<p><span dir="auto"><span class="autocomment">Analysis</span></span></p>
<table class='diff diff-contentalign-left'>
<col class='diff-marker' />
<col class='diff-content' />
<col class='diff-marker' />
<col class='diff-content' />
<tr valign='top'>
<td colspan='2' style="background-color: white; color:black;">←上一版本</td>
<td colspan='2' style="background-color: white; color:black;">2025年12月4日 (四) 03:42的版本</td>
</tr><tr><td colspan="2" class="diff-lineno">第130行：</td>
<td colspan="2" class="diff-lineno">第130行：</td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div><br><br></div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div><br><br></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline"><br><br></del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div> </div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline"><br><br></del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">== Reference ==</ins></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline"><br><br></del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div> </div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline"><br><br></del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">* [[GNU/Linux 内核移植捉虫笔记 (Linux Kernel Debug Notes)]]</ins></div></td></tr>
<tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del class="diffchange diffchange-inline"><br><br></del></div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div> </div></td></tr>
<tr><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div><br><br></div></td><td class='diff-marker'> </td><td style="background: #eee; color:black; font-size: smaller;"><div><br><br></div></td></tr>
</table>
Comcat
http://wiki.jackslab.org/index.php?title=%E6%8D%89%E8%99%AB%E6%97%A5%E8%AE%B0_0015:_Freescale_8360e_Gadget_%E6%8F%92%E7%94%B5%E5%BC%95%E8%B5%B7_Kernel_panic&diff=2297&oldid=prev
Comcat：以“== Phenomenon == 环境： * Freescale 8360e * Linux 2.6.34.6 产品内核版本从 2.6.27 升级到 2.6.34.6，内核启动后手动加载 Gadget Ether 模块 g...”为内容创建页面
2014-05-19T08:59:49Z
<p>以“== Phenomenon == 环境： * Freescale 8360e * Linux 2.6.34.6 产品内核版本从 2.6.27 升级到 2.6.34.6，内核启动后手动加载 Gadget Ether 模块 g...”为内容创建页面</p>
<p><b>新页面</b></p><div>== Phenomenon ==<br />
<br />
环境：<br />
<br />
* Freescale 8360e<br />
<br />
* Linux 2.6.34.6<br />
<br />
产品内核版本从 2.6.27 升级到 2.6.34.6，内核启动后手动加载 Gadget Ether 模块 g_ether.ko，成功后显示：<br />
<br />
<pre><br />
$ dmesg | tail<br />
<br />
g_ether gadget: using random self ethernet address<br />
g_ether gadget: using random host ethernet address<br />
usb0: MAC 8a:13:2e:1b:03:4f<br />
usb0: HOST MAC 4a:25:7f:fd:8f:c4<br />
g_ether gadget: Ethernet Gadget, version: Memorial Day 2008<br />
g_ether gadget: g_ether ready<br />
fsl_qe_udc e01006c0.usb: fsl_qe_udc bind to driver g_ether <br />
</pre><br />
<br />
<br />
但一插 USB 电缆到 PC，内核立刻 panic:<br />
<br />
<pre><br />
Unable to handle kernel paging request for data at address 0x00000000<br />
Faulting instruction address: 0xc02a0d04<br />
Oops: Kernel access of bad area, sig: 11 [#1]<br />
NIP: c02a0d04LR: c02a0cd8 CTR: c029976c<br />
REGS: c051bcc0 TRAP: 0300 Not tainted (2.6.34.6-WR4.0.0.0_standard)<br />
MSR: 00001032 <ME,IR,DR> CR: 22008042 XER: 20000000<br />
DAR: 00000000, DSISR: 20000000<br />
TASK = c04ee450[0] 'swapper' THREAD: c051a000<br />
GPR00: 00000003 c051bd70 c04ee450 0000003f 000022f5 ffffffff c0260f98 0000000<br />
GPR08: 00000000 cf9679c0 00000000 c051a000 22008044 9a6c7e8a 00000001 2000000<br />
GPR16: 40000000 00800000 00400000 cf98c0f0 0c000000 cf98c0d8 00000000 0000000<br />
GPR24: c050d560 00000000 cf98c000 00000000 c050d560 cf98c000 cf9785c0 cf97860<br />
NIP [c02a0d04] composite_setup+0xa68/0xb58<br />
LR [c02a0cd8] composite_setup+0xa3c/0xb58<br />
Call Trace:<br />
[c051bd70] [c02a0cd8] composite_setup+0xa3c/0xb58 (unreliable)<br />
[c051bdb0] [c029d23c] qe_udc_irq+0xbbc/0xe10<br />
[c051be20] [c0092e48] handle_IRQ_event+0xb8/0x30c<br />
[c051be70] [c0095f7c] handle_level_irq+0xb8/0x184<br />
[c051be90] [c0030138] qe_ic_cascade_low_ipic+0x3c/0x50<br />
[c051bea0] [c00064e4] native_do_IRQ+0x98/0xb4<br />
[c051bec0] [c0005164] do_IRQ+0x10/0x20<br />
[c051bed0] [c0015bb4] ret_from_except+0x0/0x14<br />
--- Exception: 501 at cpu_idle+0x88/0xec<br />
LR = cpu_idle+0x88/0xec<br />
[c051bf90] [c0009b78] cpu_idle+0xe8/0xec (unreliable)<br />
[c051bfb0] [c0003e90] rest_init+0xb0/0xe0<br />
[c051bfc0] [c04b3890] start_kernel+0x304/0x318<br />
[c051bff0] [00003438] 0x3438<br />
Instruction dump:<br />
4812b041 939e000c 3ac00000 3b200000 3ae00001 81380034 2f890000 419e00c4<br />
801a0010 2f800003 419e00a0 81090008 <81680000> 3949003c 2f8b0000 419e0040<br />
Kernel panic - not syncing: Fatal exception in interrupt<br />
Call Trace:<br />
[c051bc00] [c00089b0] show_stack+0x50/0x160 (unreliable)<br />
[c051bc30] [c03cbc94] panic+0x128/0x1a8<br />
[c051bc80] [c0012eb8] die+0x168/0x224<br />
[c051bca0] [c0018fb0] bad_page_fault+0x90/0xc8<br />
[c051bcb0] [c00159b8] handle_page_fault+0x7c/0x80<br />
--- Exception: 300 at composite_setup+0xa68/0xb58<br />
LR = composite_setup+0xa3c/0xb58<br />
[c051bdb0] [c029d23c] qe_udc_irq+0xbbc/0xe10<br />
[c051be20] [c0092e48] handle_IRQ_event+0xb8/0x30c<br />
[c051be70] [c0095f7c] handle_level_irq+0xb8/0x184<br />
[c051be90] [c0030138] qe_ic_cascade_low_ipic+0x3c/0x50<br />
[c051bea0] [c00064e4] native_do_IRQ+0x98/0xb4<br />
[c051bec0] [c0005164] do_IRQ+0x10/0x20<br />
[c051bed0] [c0015bb4] ret_from_except+0x0/0x14<br />
--- Exception: 501 at cpu_idle+0x88/0xec<br />
LR = cpu_idle+0x88/0xec<br />
[c051bf90] [c0009b78] cpu_idle+0xe8/0xec (unreliable)<br />
[c051bfb0] [c0003e90] rest_init+0xb0/0xe0<br />
[c051bfc0] [c04b3890] start_kernel+0x304/0x318<br />
[c051bff0] [00003438] 0x3438<br />
Rebooting in 180 seconds..<br />
</pre><br />
<br />
<br><br> <br />
<br />
== Analysis ==<br />
<br />
显然这是一个访问空指针的错误。根据 NIP 的值，定位到出错指令地址为 0xc02a0d04<br />
<br />
反汇编内核，找到这个指令的所在：<br />
<br />
<pre><br />
c02a0cfc: 41 9e 00 a0 beq- cr7,c02a0d9c <composite_setup+0xb00><br />
c02a0d00: 81 09 00 08 lwz r8,8(r9)<br />
c02a0d04: 81 68 00 00 lwz r11,0(r8)<br />
c02a0d08: 39 49 00 3c addi r10,r9,60<br />
<br />
c02a0d0c: 2f 8b 00 00 cmpwi cr7,r11,0<br />
</pre><br />
<br />
<br />
位于 composite_setup()，查看 drivers/usb/gadget/composite.c，函数体比较大，很难定位到具体出错 C 语句。再一次 objdump -S -d 反汇编 g_ether.o 文件（-S 表示让 objdump 在输出中穿插原始的 C 源码，因为整个内核的源码很大，所以我们只针对一个小文件即可）得到：<br />
<br />
<pre><br />
if (gadget->speed == USB_SPEED_HIGH)<br />
3800: 80 1a 00 10 lwz r0,16(r26)<br />
3804: 2f 80 00 03 cmpwi cr7,r0,3<br />
3808: 41 9e 00 a0 beq- cr7,38a8 <composite_setup+0xb00><br />
descriptors = f->hs_descriptors;<br />
else<br />
descriptors = f->descriptors;<br />
380c: 81 09 00 08 lwz r8,8(r9)<br />
<br />
for (; *descriptors; ++descriptors) {<br />
3810: 81 68 00 00 lwz r11,0(r8)<br />
continue;<br />
<br />
ep = (struct usb_endpoint_descriptor *)*descriptors;<br />
addr = ((ep->bEndpointAddress & 0x80) >> 3)<br />
| (ep->bEndpointAddress & 0x0f);<br />
<br />
set_bit(addr, f->endpoints);<br />
</pre><br />
<br />
<br />
g_ether.o 无绝对地址，因此只能通过指令编码去对应，找到出错源码行是 'for (; *descriptors; ++descriptors) '，一看就知道是 *descriptors 出错，则往上找 descriptors 为何没有被赋值。<br />
<br />
<br />
加了几条 printk，很快发现是 gadget->speed 的模式设置有误，导致 descriptors 拿错了值，其值应该是 f->descriptors 而不是 f->hs_descriptors<br />
<br />
<br><br><br />
<br><br><br />
<br><br><br />
<br><br><br />
<br><br><br />
<br><br><br />
<br><br></div>
Comcat