From: Mike Looijmans <mike.looijmans@topic.nl>
To: "Francesco Lavra" <flavra@baylibre.com>,
"Linus Walleij" <linusw@kernel.org>,
"Maksim Kiselev" <bigunclemax@gmail.com>,
"Sander Vanheule" <sander@svanheule.net>,
"Andy Shevchenko" <andriy.shevchenko@linux.intel.com>,
"Dmitry Mastykin" <mastichi@gmail.com>,
"Evgenii Shatokhin" <e.shatokhin@yadro.com>,
"Arturas Moskvinas" <arturas.moskvinas@gmail.com>,
"Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>,
"Andreas Kaessens" <akaessens@gmail.com>,
"Radim Pavlik" <radim.pavlik@tbs-biometrics.com>,
"Thomas Preston" <thomas.preston@codethink.co.uk>
Cc: linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] pinctrl: mcp23s08: Disable all pin interrupts during probe
Date: Tue, 7 Apr 2026 15:44:56 +0200 [thread overview]
Message-ID: <0a7aef7d-a888-49a3-8d12-4438a4b52efc@topic.nl> (raw)
In-Reply-To: <80c917d828932a225e0a1a9fffb77d55d27241cb.camel@baylibre.com>
On 07-04-2026 14:59, Francesco Lavra wrote:
> On Tue, 2026-04-07 at 12:17 +0200, Mike Looijmans wrote:
>> On 07-04-2026 08:58, Linus Walleij wrote:
>>> On Mon, Mar 30, 2026 at 6:19 PM Francesco Lavra <flavra@baylibre.com>
>>> wrote:
>>>
>>>> A chip being probed may have the interrupt-on-change feature enabled
>>>> on
>>>> some of its pins, for example after a reboot. This can cause the chip
>>>> to
>>>> generate interrupts for pins that don't have a registered nested
>>>> handler,
>>>> which leads to a kernel crash such as below:
>>>>
>>>> [ 7.928897] Unable to handle kernel read from unreadable memory at
>>>> virtual address 00000000000000ac
>>>> [ 7.932314] Mem abort info:
>>>> [ 7.935081] ESR = 0x0000000096000004
>>>> [ 7.938808] EC = 0x25: DABT (current EL), IL = 32 bits
>>>> [ 7.944094] SET = 0, FnV = 0
>>>> [ 7.947127] EA = 0, S1PTW = 0
>>>> [ 7.950247] FSC = 0x04: level 0 translation fault
>>>> [ 7.955101] Data abort info:
>>>> [ 7.957961] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
>>>> [ 7.963421] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
>>>> [ 7.968447] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
>>>> [ 7.973734] user pgtable: 4k pages, 48-bit VAs,
>>>> pgdp=00000000089b7000
>>>> [ 7.980148] [00000000000000ac] pgd=0000000000000000,
>>>> p4d=0000000000000000
>>>> [ 7.986913] Internal error: Oops: 0000000096000004 [#1] SMP
>>>> [ 7.992545] Modules linked in:
>>>> [ 8.073678] CPU: 0 UID: 0 PID: 81 Comm: irq/18-4-0025 Not tainted
>>>> 7.0.0-rc6-gd2b5a1f931c8-dirty #199
>>>> [ 8.073689] Hardware name: Khadas VIM3 (DT)
>>>> [ 8.073692] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS
>>>> BTYPE=--)
>>>> [ 8.094639] pc : _raw_spin_lock_irq+0x40/0x80
>>>> [ 8.098970] lr : handle_nested_irq+0x2c/0x168
>>>> [ 8.098979] sp : ffff800082b2bd20
>>>> [ 8.106599] x29: ffff800082b2bd20 x28: ffff800080107920 x27:
>>>> ffff800080104d88
>>>> [ 8.106611] x26: ffff000003298080 x25: 0000000000000001 x24:
>>>> 000000000000ff00
>>>> [ 8.113707] x23: 0000000000000001 x22: 0000000000000000 x21:
>>>> 000000000000000e
>>>> [ 8.120850] x20: 0000000000000000 x19: 00000000000000ac x18:
>>>> 0000000000000000
>>>> [ 8.135046] x17: 0000000000000000 x16: 0000000000000000 x15:
>>>> 0000000000000000
>>>> [ 8.135062] x14: ffff800081567ea8 x13: ffffffffffffffff x12:
>>>> 0000000000000000
>>>> [ 8.135070] x11: 00000000000000c0 x10: 0000000000000b60 x9 :
>>>> ffff800080109e0c
>>>> [ 8.135078] x8 : 1fffe0000069dbc1 x7 : 0000000000000001 x6 :
>>>> ffff0000034ede00
>>>> [ 8.135086] x5 : 0000000000000000 x4 : ffff0000034ede08 x3 :
>>>> 0000000000000001
>>>> [ 8.163460] x2 : 0000000000000000 x1 : 0000000000000001 x0 :
>>>> 00000000000000ac
>>>> [ 8.170560] Call trace:
>>>> [ 8.180094] _raw_spin_lock_irq+0x40/0x80 (P)
>>>> [ 8.184443] mcp23s08_irq+0x248/0x358
>>>> [ 8.184462] irq_thread_fn+0x34/0xb8
>>>> [ 8.184470] irq_thread+0x1a4/0x310
>>>> [ 8.195093] kthread+0x13c/0x150
>>>> [ 8.198309] ret_from_fork+0x10/0x20
>>>> [ 8.201850] Code: d65f03c0 d2800002 52800023 f9800011 (885ffc01)
>>>> [ 8.207931] ---[ end trace 0000000000000000 ]---
>>>>
>>>> This issue has always been present, but has been latent until commit
>>>> "f9f4fda15e72" ("pinctrl: mcp23s08: init reg_defaults from HW at
>>>> probe and
>>>> switch cache type"), which correctly removed reg_defaults from the
>>>> regmap
>>>> and as a side effect changed the behavior of the interrupt handler so
>>>> that
>>>> the real value of the MCP_GPINTEN register is now being read from the
>>>> chip
>>>> instead of using a bogus 0 default value; a non-zero value for this
>>>> register can trigger the invocation of a nested handler which may not
>>>> exist
>>>> (yet).
>>>> Fix this issue by disabling all pin interrupts during initialization.
>>>>
>>>> Fixes: "f9f4fda15e72" ("pinctrl: mcp23s08: init reg_defaults from HW
>>>> at probe and switch cache type")
>>>> Signed-off-by: Francesco Lavra <flavra@baylibre.com>
>>> Patch applied for fixes since it's pretty urgent, and it also looks
>>> right to me.
>>>
>>> However added some people using this to the CC so they
>>> get a chance to react before it goes upstream.
>> Looks okay to me too.
>>
>> Maybe it'd be better to unconditionally write "0" to this register? No
>> need to exercise the interrupt logic and pins when no-one is listening...
> Not sure I understand, unconditionally writing "0" to this register is
> exactly what this patch does.
It appears to be inside a "if (mcp->irq && mcp->irq_controller)" block.
Which is fine, of course. If there's no handler, the register has no effect.
I just thought it'd be cleaner to set it to 0 as part of the global
initialization at the start of probe.
>> I was going to say "if the device doesn't have a reset GPIO", but
>> looking at the code, the reset GPIO is never asserted by this driver.
> Right. In any case, the reset GPIO is optional, so we would still need to
> initialize the register manually if there is no reset GPIO.
I suspect it's actually a bug in the driver that it doesn't assert the
reset (before de-asserting). But that's for another patch...
--
Mike Looijmans
System Expert
TOPIC Embedded Products B.V.
Materiaalweg 4, 5681 RJ Best
The Netherlands
T: +31 (0) 499 33 69 69
E: mike.looijmans@topic.nl
W: www.topic.nl
next prev parent reply other threads:[~2026-04-07 13:45 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-30 16:19 [PATCH] pinctrl: mcp23s08: Disable all pin interrupts during probe Francesco Lavra
2026-04-07 6:58 ` Linus Walleij
2026-04-07 7:50 ` Francesco Lavra
2026-04-07 9:30 ` Linus Walleij
2026-04-07 13:47 ` Andy Shevchenko
2026-04-07 10:17 ` Mike Looijmans
2026-04-07 12:59 ` Francesco Lavra
2026-04-07 13:44 ` Mike Looijmans [this message]
2026-04-07 22:21 ` Uwe Kleine-König
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0a7aef7d-a888-49a3-8d12-4438a4b52efc@topic.nl \
--to=mike.looijmans@topic.nl \
--cc=akaessens@gmail.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=arturas.moskvinas@gmail.com \
--cc=bigunclemax@gmail.com \
--cc=e.shatokhin@yadro.com \
--cc=flavra@baylibre.com \
--cc=linusw@kernel.org \
--cc=linux-gpio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mastichi@gmail.com \
--cc=radim.pavlik@tbs-biometrics.com \
--cc=sander@svanheule.net \
--cc=thomas.preston@codethink.co.uk \
--cc=u.kleine-koenig@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).