From: Linus Walleij <linusw@kernel.org>
To: "Francesco Lavra" <flavra@baylibre.com>,
"Maksim Kiselev" <bigunclemax@gmail.com>,
"Sander Vanheule" <sander@svanheule.net>,
"Andy Shevchenko" <andriy.shevchenko@linux.intel.com>,
"Mike Looijmans" <mike.looijmans@topic.nl>,
"Dmitry Mastykin" <mastichi@gmail.com>,
"Evgenii Shatokhin" <e.shatokhin@yadro.com>,
"Arturas Moskvinas" <arturas.moskvinas@gmail.com>,
"Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>,
"Andreas Kaessens" <akaessens@gmail.com>,
"Radim Pavlik" <radim.pavlik@tbs-biometrics.com>,
"Thomas Preston" <thomas.preston@codethink.co.uk>
Cc: linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] pinctrl: mcp23s08: Disable all pin interrupts during probe
Date: Tue, 7 Apr 2026 08:58:09 +0200 [thread overview]
Message-ID: <CAD++jLkdoD=0RjpAMLWTMRtUX1+3tB6exOu5=nC3ERBYdrUiUw@mail.gmail.com> (raw)
In-Reply-To: <20260330161914.1071118-1-flavra@baylibre.com>
On Mon, Mar 30, 2026 at 6:19 PM Francesco Lavra <flavra@baylibre.com> wrote:
> A chip being probed may have the interrupt-on-change feature enabled on
> some of its pins, for example after a reboot. This can cause the chip to
> generate interrupts for pins that don't have a registered nested handler,
> which leads to a kernel crash such as below:
>
> [ 7.928897] Unable to handle kernel read from unreadable memory at virtual address 00000000000000ac
> [ 7.932314] Mem abort info:
> [ 7.935081] ESR = 0x0000000096000004
> [ 7.938808] EC = 0x25: DABT (current EL), IL = 32 bits
> [ 7.944094] SET = 0, FnV = 0
> [ 7.947127] EA = 0, S1PTW = 0
> [ 7.950247] FSC = 0x04: level 0 translation fault
> [ 7.955101] Data abort info:
> [ 7.957961] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> [ 7.963421] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> [ 7.968447] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> [ 7.973734] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000089b7000
> [ 7.980148] [00000000000000ac] pgd=0000000000000000, p4d=0000000000000000
> [ 7.986913] Internal error: Oops: 0000000096000004 [#1] SMP
> [ 7.992545] Modules linked in:
> [ 8.073678] CPU: 0 UID: 0 PID: 81 Comm: irq/18-4-0025 Not tainted 7.0.0-rc6-gd2b5a1f931c8-dirty #199
> [ 8.073689] Hardware name: Khadas VIM3 (DT)
> [ 8.073692] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [ 8.094639] pc : _raw_spin_lock_irq+0x40/0x80
> [ 8.098970] lr : handle_nested_irq+0x2c/0x168
> [ 8.098979] sp : ffff800082b2bd20
> [ 8.106599] x29: ffff800082b2bd20 x28: ffff800080107920 x27: ffff800080104d88
> [ 8.106611] x26: ffff000003298080 x25: 0000000000000001 x24: 000000000000ff00
> [ 8.113707] x23: 0000000000000001 x22: 0000000000000000 x21: 000000000000000e
> [ 8.120850] x20: 0000000000000000 x19: 00000000000000ac x18: 0000000000000000
> [ 8.135046] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
> [ 8.135062] x14: ffff800081567ea8 x13: ffffffffffffffff x12: 0000000000000000
> [ 8.135070] x11: 00000000000000c0 x10: 0000000000000b60 x9 : ffff800080109e0c
> [ 8.135078] x8 : 1fffe0000069dbc1 x7 : 0000000000000001 x6 : ffff0000034ede00
> [ 8.135086] x5 : 0000000000000000 x4 : ffff0000034ede08 x3 : 0000000000000001
> [ 8.163460] x2 : 0000000000000000 x1 : 0000000000000001 x0 : 00000000000000ac
> [ 8.170560] Call trace:
> [ 8.180094] _raw_spin_lock_irq+0x40/0x80 (P)
> [ 8.184443] mcp23s08_irq+0x248/0x358
> [ 8.184462] irq_thread_fn+0x34/0xb8
> [ 8.184470] irq_thread+0x1a4/0x310
> [ 8.195093] kthread+0x13c/0x150
> [ 8.198309] ret_from_fork+0x10/0x20
> [ 8.201850] Code: d65f03c0 d2800002 52800023 f9800011 (885ffc01)
> [ 8.207931] ---[ end trace 0000000000000000 ]---
>
> This issue has always been present, but has been latent until commit
> "f9f4fda15e72" ("pinctrl: mcp23s08: init reg_defaults from HW at probe and
> switch cache type"), which correctly removed reg_defaults from the regmap
> and as a side effect changed the behavior of the interrupt handler so that
> the real value of the MCP_GPINTEN register is now being read from the chip
> instead of using a bogus 0 default value; a non-zero value for this
> register can trigger the invocation of a nested handler which may not exist
> (yet).
> Fix this issue by disabling all pin interrupts during initialization.
>
> Fixes: "f9f4fda15e72" ("pinctrl: mcp23s08: init reg_defaults from HW at probe and switch cache type")
> Signed-off-by: Francesco Lavra <flavra@baylibre.com>
Patch applied for fixes since it's pretty urgent, and it also looks
right to me.
However added some people using this to the CC so they
get a chance to react before it goes upstream.
Yours,
Linus Walleij
next prev parent reply other threads:[~2026-04-07 6:58 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-30 16:19 [PATCH] pinctrl: mcp23s08: Disable all pin interrupts during probe Francesco Lavra
2026-04-07 6:58 ` Linus Walleij [this message]
2026-04-07 7:50 ` Francesco Lavra
2026-04-07 9:30 ` Linus Walleij
2026-04-07 13:47 ` Andy Shevchenko
2026-04-07 10:17 ` Mike Looijmans
2026-04-07 12:59 ` Francesco Lavra
2026-04-07 13:44 ` Mike Looijmans
2026-04-07 22:21 ` Uwe Kleine-König
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAD++jLkdoD=0RjpAMLWTMRtUX1+3tB6exOu5=nC3ERBYdrUiUw@mail.gmail.com' \
--to=linusw@kernel.org \
--cc=akaessens@gmail.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=arturas.moskvinas@gmail.com \
--cc=bigunclemax@gmail.com \
--cc=e.shatokhin@yadro.com \
--cc=flavra@baylibre.com \
--cc=linux-gpio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mastichi@gmail.com \
--cc=mike.looijmans@topic.nl \
--cc=radim.pavlik@tbs-biometrics.com \
--cc=sander@svanheule.net \
--cc=thomas.preston@codethink.co.uk \
--cc=u.kleine-koenig@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).