From: Francesco Lavra <flavra@baylibre.com>
To: "Mike Looijmans" <mike.looijmans@topic.nl>,
"Linus Walleij" <linusw@kernel.org>,
"Maksim Kiselev" <bigunclemax@gmail.com>,
"Sander Vanheule" <sander@svanheule.net>,
"Andy Shevchenko" <andriy.shevchenko@linux.intel.com>,
"Dmitry Mastykin" <mastichi@gmail.com>,
"Evgenii Shatokhin" <e.shatokhin@yadro.com>,
"Arturas Moskvinas" <arturas.moskvinas@gmail.com>,
"Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>,
"Andreas Kaessens" <akaessens@gmail.com>,
"Radim Pavlik" <radim.pavlik@tbs-biometrics.com>,
"Thomas Preston" <thomas.preston@codethink.co.uk>
Cc: linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] pinctrl: mcp23s08: Disable all pin interrupts during probe
Date: Tue, 07 Apr 2026 14:59:36 +0200 [thread overview]
Message-ID: <80c917d828932a225e0a1a9fffb77d55d27241cb.camel@baylibre.com> (raw)
In-Reply-To: <e6909c2b-d41a-47ce-8f82-2bee3801fa50@topic.nl>
On Tue, 2026-04-07 at 12:17 +0200, Mike Looijmans wrote:
> On 07-04-2026 08:58, Linus Walleij wrote:
> > On Mon, Mar 30, 2026 at 6:19 PM Francesco Lavra <flavra@baylibre.com>
> > wrote:
> >
> > > A chip being probed may have the interrupt-on-change feature enabled
> > > on
> > > some of its pins, for example after a reboot. This can cause the chip
> > > to
> > > generate interrupts for pins that don't have a registered nested
> > > handler,
> > > which leads to a kernel crash such as below:
> > >
> > > [ 7.928897] Unable to handle kernel read from unreadable memory at
> > > virtual address 00000000000000ac
> > > [ 7.932314] Mem abort info:
> > > [ 7.935081] ESR = 0x0000000096000004
> > > [ 7.938808] EC = 0x25: DABT (current EL), IL = 32 bits
> > > [ 7.944094] SET = 0, FnV = 0
> > > [ 7.947127] EA = 0, S1PTW = 0
> > > [ 7.950247] FSC = 0x04: level 0 translation fault
> > > [ 7.955101] Data abort info:
> > > [ 7.957961] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> > > [ 7.963421] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> > > [ 7.968447] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> > > [ 7.973734] user pgtable: 4k pages, 48-bit VAs,
> > > pgdp=00000000089b7000
> > > [ 7.980148] [00000000000000ac] pgd=0000000000000000,
> > > p4d=0000000000000000
> > > [ 7.986913] Internal error: Oops: 0000000096000004 [#1] SMP
> > > [ 7.992545] Modules linked in:
> > > [ 8.073678] CPU: 0 UID: 0 PID: 81 Comm: irq/18-4-0025 Not tainted
> > > 7.0.0-rc6-gd2b5a1f931c8-dirty #199
> > > [ 8.073689] Hardware name: Khadas VIM3 (DT)
> > > [ 8.073692] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS
> > > BTYPE=--)
> > > [ 8.094639] pc : _raw_spin_lock_irq+0x40/0x80
> > > [ 8.098970] lr : handle_nested_irq+0x2c/0x168
> > > [ 8.098979] sp : ffff800082b2bd20
> > > [ 8.106599] x29: ffff800082b2bd20 x28: ffff800080107920 x27:
> > > ffff800080104d88
> > > [ 8.106611] x26: ffff000003298080 x25: 0000000000000001 x24:
> > > 000000000000ff00
> > > [ 8.113707] x23: 0000000000000001 x22: 0000000000000000 x21:
> > > 000000000000000e
> > > [ 8.120850] x20: 0000000000000000 x19: 00000000000000ac x18:
> > > 0000000000000000
> > > [ 8.135046] x17: 0000000000000000 x16: 0000000000000000 x15:
> > > 0000000000000000
> > > [ 8.135062] x14: ffff800081567ea8 x13: ffffffffffffffff x12:
> > > 0000000000000000
> > > [ 8.135070] x11: 00000000000000c0 x10: 0000000000000b60 x9 :
> > > ffff800080109e0c
> > > [ 8.135078] x8 : 1fffe0000069dbc1 x7 : 0000000000000001 x6 :
> > > ffff0000034ede00
> > > [ 8.135086] x5 : 0000000000000000 x4 : ffff0000034ede08 x3 :
> > > 0000000000000001
> > > [ 8.163460] x2 : 0000000000000000 x1 : 0000000000000001 x0 :
> > > 00000000000000ac
> > > [ 8.170560] Call trace:
> > > [ 8.180094] _raw_spin_lock_irq+0x40/0x80 (P)
> > > [ 8.184443] mcp23s08_irq+0x248/0x358
> > > [ 8.184462] irq_thread_fn+0x34/0xb8
> > > [ 8.184470] irq_thread+0x1a4/0x310
> > > [ 8.195093] kthread+0x13c/0x150
> > > [ 8.198309] ret_from_fork+0x10/0x20
> > > [ 8.201850] Code: d65f03c0 d2800002 52800023 f9800011 (885ffc01)
> > > [ 8.207931] ---[ end trace 0000000000000000 ]---
> > >
> > > This issue has always been present, but has been latent until commit
> > > "f9f4fda15e72" ("pinctrl: mcp23s08: init reg_defaults from HW at
> > > probe and
> > > switch cache type"), which correctly removed reg_defaults from the
> > > regmap
> > > and as a side effect changed the behavior of the interrupt handler so
> > > that
> > > the real value of the MCP_GPINTEN register is now being read from the
> > > chip
> > > instead of using a bogus 0 default value; a non-zero value for this
> > > register can trigger the invocation of a nested handler which may not
> > > exist
> > > (yet).
> > > Fix this issue by disabling all pin interrupts during initialization.
> > >
> > > Fixes: "f9f4fda15e72" ("pinctrl: mcp23s08: init reg_defaults from HW
> > > at probe and switch cache type")
> > > Signed-off-by: Francesco Lavra <flavra@baylibre.com>
> > Patch applied for fixes since it's pretty urgent, and it also looks
> > right to me.
> >
> > However added some people using this to the CC so they
> > get a chance to react before it goes upstream.
> Looks okay to me too.
>
> Maybe it'd be better to unconditionally write "0" to this register? No
> need to exercise the interrupt logic and pins when no-one is listening...
Not sure I understand, unconditionally writing "0" to this register is
exactly what this patch does.
> I was going to say "if the device doesn't have a reset GPIO", but
> looking at the code, the reset GPIO is never asserted by this driver.
Right. In any case, the reset GPIO is optional, so we would still need to
initialize the register manually if there is no reset GPIO.
next prev parent reply other threads:[~2026-04-07 12:59 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-30 16:19 [PATCH] pinctrl: mcp23s08: Disable all pin interrupts during probe Francesco Lavra
2026-04-07 6:58 ` Linus Walleij
2026-04-07 7:50 ` Francesco Lavra
2026-04-07 9:30 ` Linus Walleij
2026-04-07 13:47 ` Andy Shevchenko
2026-04-07 10:17 ` Mike Looijmans
2026-04-07 12:59 ` Francesco Lavra [this message]
2026-04-07 13:44 ` Mike Looijmans
2026-04-07 22:21 ` Uwe Kleine-König
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=80c917d828932a225e0a1a9fffb77d55d27241cb.camel@baylibre.com \
--to=flavra@baylibre.com \
--cc=akaessens@gmail.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=arturas.moskvinas@gmail.com \
--cc=bigunclemax@gmail.com \
--cc=e.shatokhin@yadro.com \
--cc=linusw@kernel.org \
--cc=linux-gpio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mastichi@gmail.com \
--cc=mike.looijmans@topic.nl \
--cc=radim.pavlik@tbs-biometrics.com \
--cc=sander@svanheule.net \
--cc=thomas.preston@codethink.co.uk \
--cc=u.kleine-koenig@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).