From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
To: huangbibo <huangbibo@uniontech.com>, linux-i2c@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, mika.westerberg@linux.intel.com,
andriy.shevchenko@linux.intel.com, p.zabel@pengutronix.de
Subject: Re: [PATCH] i2c: designware: I2C unexpected interrupt handling will cause kernel panic
Date: Thu, 11 Nov 2021 16:05:54 +0200 [thread overview]
Message-ID: <0f203acf-7f63-e2d0-b590-120d3a7ba9c5@linux.intel.com> (raw)
In-Reply-To: <20211111065759.7423-1-huangbibo@uniontech.com>
Hi
On 11/11/21 8:57 AM, huangbibo wrote:
> I2C interrupts may be triggered unexpectedly,
> such as programs that directly access I2C registers,
> bus conflicts caused by hardware design defects, etc.
> These can cause null pointer reference errors and kernel panic.
>
> kernel log:
> [ 52.676442] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
> ...
> [ 52.816536] Workqueue: efi_rts_wq efi_call_rts
> [ 52.820968] pstate: 60000085 (nZCv daIf -PAN -UAO)
> [ 52.825753] pc : i2c_dw_isr+0x36c/0x5e0 [i2c_designware_core]
> [ 52.831487] lr : i2c_dw_isr+0x88/0x5e0 [i2c_designware_core]
> [ 52.837134] sp : ffff8020fff17650
> [ 52.924451] Call trace:
> [ 52.926888] i2c_dw_isr+0x36c/0x5e0 [i2c_designware_core]
> ...
> [ 52.957394] gic_handle_irq+0x7c/0x178
> [ 52.961130] el1_irq+0xb0/0x140
> [ 52.964259] 0x21291d30
> [ 52.983729] 0x21160938
> [ 52.986164] __efi_rt_asm_wrapper+0x28/0x44
> [ 52.990335] efi_call_rts+0x78/0x448
> [ 53.019021] Kernel panic - not syncing: Fatal exception in interrupt
>
> Signed-off-by: huangbibo <huangbibo@uniontech.com>
> ---
> drivers/i2c/busses/i2c-designware-master.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
> index 2871cf2ee8b4..6af1ede38253 100644
> --- a/drivers/i2c/busses/i2c-designware-master.c
> +++ b/drivers/i2c/busses/i2c-designware-master.c
> @@ -631,8 +631,14 @@ static int i2c_dw_irq_handler_master(struct dw_i2c_dev *dev)
> if (stat & DW_IC_INTR_RX_FULL)
> i2c_dw_read(dev);
>
> - if (stat & DW_IC_INTR_TX_EMPTY)
> - i2c_dw_xfer_msg(dev);
> + if (stat & DW_IC_INTR_TX_EMPTY) {
> + if (dev->msgs) {
> + i2c_dw_xfer_msg(dev);
> + } else { //null pointer
> + i2c_dw_disable_int(dev);
> + return 0;
> + }
> + }
This feels to me we are masking the problem. It's common to have
i2c-designware device suspended (and registers might read all bits zero)
and receive interrupts from another device if interrupt line is shared.
Also while dev->msgs is NULL.
I'd like to understand the issue more. Could you add
"i2c_designware_core.dyndbg=+p" into command line in order to see
dev_dbg() prints in dmesg and with following patch?
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -720,6 +720,7 @@ static int i2c_dw_irq_handler_master(struct
dw_i2c_dev *dev)
u32 stat;
stat = i2c_dw_read_clear_intrbits(dev);
+ dev_dbg(dev->dev, "stat %#x\n", stat);
if (stat & DW_IC_INTR_TX_ABRT) {
dev->cmd_err |= DW_IC_ERR_TX_ABRT;
dev->status = STATUS_IDLE;
Jarkko
next prev parent reply other threads:[~2021-11-11 14:06 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-11 6:57 [PATCH] i2c: designware: I2C unexpected interrupt handling will cause kernel panic huangbibo
2021-11-11 14:05 ` Jarkko Nikula [this message]
[not found] ` <tencent_48E4F3B231317FCA25752384@qq.com>
2021-11-12 10:26 ` andriy.shevchenko
2021-11-11 16:13 ` Andy Shevchenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0f203acf-7f63-e2d0-b590-120d3a7ba9c5@linux.intel.com \
--to=jarkko.nikula@linux.intel.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=huangbibo@uniontech.com \
--cc=linux-i2c@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mika.westerberg@linux.intel.com \
--cc=p.zabel@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).