RESEND:i2c-eg20t: fix race between i2c init and interrupt enable

RESEND:i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi Hu]

the eg20t driver call request_irq() function before the pch_base_address,
base address of i2c controller's register, isassigned an effective value.

it is one possible scenario that an interrupt which isn't inside eg20t
arrives immediately after request_irq() is executed when i2c controller
shares an interrupt number with others.  since the interrupt handler
pch_i2c_handler() has already active as shared action, it will be called
and read its own register to determine if this interrupt is from itself.

At that moment, since base address of i2c registers is not remapped
in kernel space yet,so the INT handler will access an illegal address
and then a error occurs.

Bad IO access at port 0x18 (return inl(port))
 Call Trace:
  [<c102c733>] warn_slowpath_common+0x73/0xa0
  [<c13109f5>] ? bad_io_access+0x45/0x50
  [<c13109f5>] ? bad_io_access+0x45/0x50
  [<c102c804>] warn_slowpath_fmt+0x34/0x40
  [<c13109f5>] bad_io_access+0x45/0x50
  [<c1310b62>] ioread32+0x22/0x40
  [<c14c60db>] pch_i2c_handler+0x3b/0x120
  [<c1092f34>] handle_irq_event_percpu+0x64/0x330
  [<c109323b>] handle_irq_event+0x3b/0x60
  [<c1095b50>] ? unmask_irq+0x30/0x30
  [<c1095ba0>] handle_fasteoi_irq+0x50/0xe0
  <IRQ>  [<c16e7e78>] ? do_IRQ+0x48/0xc0
  [<c16e7f6f>] ? smp_apic_timer_interrupt+0x7f/0x17a
  [<c16e7da9>] ? common_interrupt+0x29/0x30
  [<c1008ebb>] ? mwait_idle+0x8b/0x2c0
  [<c1009e8e>] ? cpu_idle+0x9e/0xc0
  [<c16be408>] ? rest_init+0x6c/0x74
  [<c19f770a>] ? start_kernel+0x311/0x318
  [<c19f7231>] ? repair_env_string+0x51/0x51
  [<c19f7078>] ? i386_start_kernel+0x78/0x7d
 ---[ end trace eb3a1028f468a140 ]---
 i2c_eg20t 0000:05:0c.2: pch_i2c_handler :I2C-3 mode(0) is not supported

after testing last patch, replacing request_irq() location is not a
good idea,it might produce a little time windows ,in which the interrupts
occurring inside  will be omitted.

the new patch adds a check point on interrupt handler in case field
'pch_base_address' has not been initialed.


Yadi Hu (1)
    i2c-eg20t: fix race between i2c init and interrupt enable

drivers/i2c/busses/i2c-eg20t.c |    5 +++++
 1 file changed, 5 insertions(+)

[PATCH] i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi Hu]

From: "Yadi.hu" <yadi.hu@windriver.com>

the eg20t driver call request_irq() function before the pch_base_address, 
base address of i2c controller's register, isassigned an effective value.

it is one possible scenario that an interrupt which isn't inside eg20t 
arrives immediately after request_irq() is executed when i2c controller 
shares an interrupt number with others.  since the interrupt handler 
pch_i2c_handler() has already active as shared action, it will be called 
and read its own register to determine if this interrupt is from itself.

At that moment, since base address of i2c registers is not remapped 
in kernel space yet,so the INT handler will access an illegal address
and then a error occurs.

the new patch adds a check point on interrupt handler in case field
'pch_base_address' has not been initialed.

Signed-off-by: Yadi.hu <yadi.hu@windriver.com>
---
 drivers/i2c/busses/i2c-eg20t.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index 137125b..4ac8a49 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -152,6 +152,7 @@ struct i2c_algo_pch_data {
 	int pch_buff_mode_en;
 	u32 pch_event_flag;
 	bool pch_i2c_xfer_in_progress;
+	bool initflag;
 };
 
 /**
@@ -635,6 +636,8 @@ static irqreturn_t pch_i2c_handler(int irq, void *pData)
 	u32 mode;
 
 	for (i = 0, flag = 0; i < adap_info->ch_num; i++) {
+		if (!adap_info->pch_data[i].initflag)
+			continue;
 		p = adap_info->pch_data[i].pch_base_address;
 		mode = ioread32(p + PCH_I2CMOD);
 		mode &= BUFFER_MODE | EEPROM_SR_MODE;
@@ -783,6 +786,7 @@ static int pch_i2c_probe(struct pci_dev *pdev,
 	for (i = 0; i < adap_info->ch_num; i++) {
 		pch_adap = &adap_info->pch_data[i].pch_adapter;
 		adap_info->pch_i2c_suspended = false;
+		adap_info->pch_data[i].initflag = false;
 
 		adap_info->pch_data[i].p_adapter_info = adap_info;
 
@@ -806,6 +810,7 @@ static int pch_i2c_probe(struct pci_dev *pdev,
 			pch_pci_err(pdev, "i2c_add_adapter[ch:%d] FAILED\n", i);
 			goto err_add_adapter;
 		}
+		adap_info->pch_data[i].initflag = true;
 	}
 
 	pci_set_drvdata(pdev, adap_info);
-- 
2.9.3

Re: RESEND:i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi]

ping....  any objection?

Yadi


On 2016年09月07日 17:25, Yadi Hu wrote:
> the eg20t driver call request_irq() function before the pch_base_address,
> base address of i2c controller's register, isassigned an effective value.
>
> it is one possible scenario that an interrupt which isn't inside eg20t
> arrives immediately after request_irq() is executed when i2c controller
> shares an interrupt number with others.  since the interrupt handler
> pch_i2c_handler() has already active as shared action, it will be called
> and read its own register to determine if this interrupt is from itself.
>
> At that moment, since base address of i2c registers is not remapped
> in kernel space yet,so the INT handler will access an illegal address
> and then a error occurs.
>
> Bad IO access at port 0x18 (return inl(port))
>   Call Trace:
>    [<c102c733>] warn_slowpath_common+0x73/0xa0
>    [<c13109f5>] ? bad_io_access+0x45/0x50
>    [<c13109f5>] ? bad_io_access+0x45/0x50
>    [<c102c804>] warn_slowpath_fmt+0x34/0x40
>    [<c13109f5>] bad_io_access+0x45/0x50
>    [<c1310b62>] ioread32+0x22/0x40
>    [<c14c60db>] pch_i2c_handler+0x3b/0x120
>    [<c1092f34>] handle_irq_event_percpu+0x64/0x330
>    [<c109323b>] handle_irq_event+0x3b/0x60
>    [<c1095b50>] ? unmask_irq+0x30/0x30
>    [<c1095ba0>] handle_fasteoi_irq+0x50/0xe0
>    <IRQ>  [<c16e7e78>] ? do_IRQ+0x48/0xc0
>    [<c16e7f6f>] ? smp_apic_timer_interrupt+0x7f/0x17a
>    [<c16e7da9>] ? common_interrupt+0x29/0x30
>    [<c1008ebb>] ? mwait_idle+0x8b/0x2c0
>    [<c1009e8e>] ? cpu_idle+0x9e/0xc0
>    [<c16be408>] ? rest_init+0x6c/0x74
>    [<c19f770a>] ? start_kernel+0x311/0x318
>    [<c19f7231>] ? repair_env_string+0x51/0x51
>    [<c19f7078>] ? i386_start_kernel+0x78/0x7d
>   ---[ end trace eb3a1028f468a140 ]---
>   i2c_eg20t 0000:05:0c.2: pch_i2c_handler :I2C-3 mode(0) is not supported
>
> after testing last patch, replacing request_irq() location is not a
> good idea,it might produce a little time windows ,in which the interrupts
> occurring inside  will be omitted.
>
> the new patch adds a check point on interrupt handler in case field
> 'pch_base_address' has not been initialed.
>
>
> Yadi Hu (1)
>      i2c-eg20t: fix race between i2c init and interrupt enable
>
> drivers/i2c/busses/i2c-eg20t.c |    5 +++++
>   1 file changed, 5 insertions(+)
>

Re: RESEND:i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi]

ping once again, any objection?

Yadi

On 2016年09月07日 17:25, Yadi Hu wrote:
> the eg20t driver call request_irq() function before the pch_base_address,
> base address of i2c controller's register, isassigned an effective value.
>
> it is one possible scenario that an interrupt which isn't inside eg20t
> arrives immediately after request_irq() is executed when i2c controller
> shares an interrupt number with others.  since the interrupt handler
> pch_i2c_handler() has already active as shared action, it will be called
> and read its own register to determine if this interrupt is from itself.
>
> At that moment, since base address of i2c registers is not remapped
> in kernel space yet,so the INT handler will access an illegal address
> and then a error occurs.
>
> Bad IO access at port 0x18 (return inl(port))
>   Call Trace:
>    [<c102c733>] warn_slowpath_common+0x73/0xa0
>    [<c13109f5>] ? bad_io_access+0x45/0x50
>    [<c13109f5>] ? bad_io_access+0x45/0x50
>    [<c102c804>] warn_slowpath_fmt+0x34/0x40
>    [<c13109f5>] bad_io_access+0x45/0x50
>    [<c1310b62>] ioread32+0x22/0x40
>    [<c14c60db>] pch_i2c_handler+0x3b/0x120
>    [<c1092f34>] handle_irq_event_percpu+0x64/0x330
>    [<c109323b>] handle_irq_event+0x3b/0x60
>    [<c1095b50>] ? unmask_irq+0x30/0x30
>    [<c1095ba0>] handle_fasteoi_irq+0x50/0xe0
>    <IRQ>  [<c16e7e78>] ? do_IRQ+0x48/0xc0
>    [<c16e7f6f>] ? smp_apic_timer_interrupt+0x7f/0x17a
>    [<c16e7da9>] ? common_interrupt+0x29/0x30
>    [<c1008ebb>] ? mwait_idle+0x8b/0x2c0
>    [<c1009e8e>] ? cpu_idle+0x9e/0xc0
>    [<c16be408>] ? rest_init+0x6c/0x74
>    [<c19f770a>] ? start_kernel+0x311/0x318
>    [<c19f7231>] ? repair_env_string+0x51/0x51
>    [<c19f7078>] ? i386_start_kernel+0x78/0x7d
>   ---[ end trace eb3a1028f468a140 ]---
>   i2c_eg20t 0000:05:0c.2: pch_i2c_handler :I2C-3 mode(0) is not supported
>
> after testing last patch, replacing request_irq() location is not a
> good idea,it might produce a little time windows ,in which the interrupts
> occurring inside  will be omitted.
>
> the new patch adds a check point on interrupt handler in case field
> 'pch_base_address' has not been initialed.
>
>
> Yadi Hu (1)
>      i2c-eg20t: fix race between i2c init and interrupt enable
>
> drivers/i2c/busses/i2c-eg20t.c |    5 +++++
>   1 file changed, 5 insertions(+)
>

Re: RESEND:i2c-eg20t: fix race between i2c init and interrupt enable

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 321 bytes --]


> after testing last patch, replacing request_irq() location is not a
> good idea,it might produce a little time windows ,in which the interrupts
> occurring inside  will be omitted.

To give you a little feedback: I think I liked the previous patch
better, but need the weekend to think about it.

Thanks,

   Wolfram


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: RESEND:i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi]

On 2016年09月14日 15:28, Wolfram Sang wrote:
>> after testing last patch, replacing request_irq() location is not a
>> good idea,it might produce a little time windows ,in which the interrupts
>> occurring inside  will be omitted.
> To give you a little feedback: I think I liked the previous patch
> better, but need the weekend to think about it.
>
> Thanks,
>
>     Wolfram
>
thanks your feedback.


Yadi

Re: RESEND:i2c-eg20t: fix race between i2c init and interrupt enable

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 545 bytes --]


> after testing last patch, replacing request_irq() location is not a
> good idea,it might produce a little time windows ,in which the interrupts
> occurring inside  will be omitted.
> 
> the new patch adds a check point on interrupt handler in case field
> 'pch_base_address' has not been initialed.

What about using two for-loops in probe like this pseudo code?

for (all_channels)
	do_initialization

request_irq()

for (all_channels)
	register_adapter


This seems to me the correct order and most readable solution.


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: RESEND:i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi]

在 2016/9/17 4:04, Wolfram Sang 写道:
>> after testing last patch, replacing request_irq() location is not a
>> good idea,it might produce a little time windows ,in which the interrupts
>> occurring inside  will be omitted.
>>
>> the new patch adds a check point on interrupt handler in case field
>> 'pch_base_address' has not been initialed.
> What about using two for-loops in probe like this pseudo code?
>
> for (all_channels)
> 	do_initialization
>
> request_irq()
>
> for (all_channels)
> 	register_adapter
>
>
> This seems to me the correct order and most readable solution.
if we use two for-loops, we would have to put  pch_i2c_init on the 
second loop in order to avoid littel interval, in which the interrupts 
occuring inside will be omitted.
it seems to me so uncomfortable. how do you like it?

for (all_channels)
	do_initialization

request_irq()

for (all_channels) {
	 pch_i2c_init  /* Enable interrupts at end of function*/
	 register_adapter
}

Yadi

Re: RESEND:i2c-eg20t: fix race between i2c init and interrupt enable

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 318 bytes --]


> it seems to me so uncomfortable. how do you like it?
> 
> for (all_channels)
> 	do_initialization
> 
> request_irq()
> 
> for (all_channels) {
> 	 pch_i2c_init  /* Enable interrupts at end of function*/
> 	 register_adapter
> }

Thanks for the correction. This would be still my preferred solution.


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: RESEND:i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi]

On 2016年09月18日 15:53, Wolfram Sang wrote:
>> it seems to me so uncomfortable. how do you like it?
>>
>> for (all_channels)
>> 	do_initialization
>>
>> request_irq()
>>
>> for (all_channels) {
>> 	 pch_i2c_init  /* Enable interrupts at end of function*/
>> 	 register_adapter
>> }
> Thanks for the correction. This would be still my preferred solution.
>
ok, I have no objection and will resend patch V3 per your solution.

Yadi

RESEND: V3 i2c-eg20t:fix race between i2c init and interrupt enable

[Yadi Hu]

the eg20t driver call request_irq() function before the pch_base_address,
base address of i2c controller's register, isassigned an effective value.

there is one possible scenario that an interrupt which isn't inside eg20t
arrives immediately after request_irq() is executed when i2c controller
shares an interrupt number with others.  since the interrupt handler
pch_i2c_handler() has already active as shared action, it will be called
and read its own register to determine if this interrupt is from itself.

At that moment, since base address of i2c registers is not remapped
in kernel space yet,so the INT handler will access an illegal address
and then a error occurs.

Bad IO access at port 0x18 (return inl(port))
 Call Trace:
  [<c102c733>] warn_slowpath_common+0x73/0xa0
  [<c13109f5>] ? bad_io_access+0x45/0x50
  [<c13109f5>] ? bad_io_access+0x45/0x50
  [<c102c804>] warn_slowpath_fmt+0x34/0x40
  [<c13109f5>] bad_io_access+0x45/0x50
  [<c1310b62>] ioread32+0x22/0x40
  [<c14c60db>] pch_i2c_handler+0x3b/0x120
  [<c1092f34>] handle_irq_event_percpu+0x64/0x330
  [<c109323b>] handle_irq_event+0x3b/0x60
  [<c1095b50>] ? unmask_irq+0x30/0x30
  [<c1095ba0>] handle_fasteoi_irq+0x50/0xe0
  <IRQ>  [<c16e7e78>] ? do_IRQ+0x48/0xc0
  [<c16e7f6f>] ? smp_apic_timer_interrupt+0x7f/0x17a
  [<c16e7da9>] ? common_interrupt+0x29/0x30
  [<c1008ebb>] ? mwait_idle+0x8b/0x2c0
  [<c1009e8e>] ? cpu_idle+0x9e/0xc0
  [<c16be408>] ? rest_init+0x6c/0x74
  [<c19f770a>] ? start_kernel+0x311/0x318
  [<c19f7231>] ? repair_env_string+0x51/0x51
  [<c19f7078>] ? i386_start_kernel+0x78/0x7d
 ---[ end trace eb3a1028f468a140 ]---
 i2c_eg20t 0000:05:0c.2: pch_i2c_handler :I2C-3 mode(0) is not supported


Yadi Hu (1)
    i2c-eg20t: fix race between i2c init and interrupt enable

drivers/i2c/busses/i2c-eg20t.c |   18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

[PATCH] i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi Hu]

From: "Yadi.hu" <yadi.hu@windriver.com>

the eg20t driver call request_irq() function before the pch_base_address,
base address of i2c controller's register, is assigned an effective value.

there is one possible scenario that an interrupt which isn't inside eg20t
arrives immediately after request_irq() is executed when i2c controller
shares an interrupt number with others. since the interrupt handler
pch_i2c_handler() has already active as shared action, it will be called
and read its own register to determine if this interrupt is from itself.

At that moment, since base address of i2c registers is not remapped
in kernel space yet,so the INT handler will access an illegal address
and then a error occurs.

Signed-off-by: Yadi.hu <yadi.hu@windriver.com>
---
 drivers/i2c/busses/i2c-eg20t.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index 137125b..5ce71ce 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -773,13 +773,6 @@ static int pch_i2c_probe(struct pci_dev *pdev,
 	/* Set the number of I2C channel instance */
 	adap_info->ch_num = id->driver_data;
 
-	ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
-		  KBUILD_MODNAME, adap_info);
-	if (ret) {
-		pch_pci_err(pdev, "request_irq FAILED\n");
-		goto err_request_irq;
-	}
-
 	for (i = 0; i < adap_info->ch_num; i++) {
 		pch_adap = &adap_info->pch_data[i].pch_adapter;
 		adap_info->pch_i2c_suspended = false;
@@ -797,6 +790,17 @@ static int pch_i2c_probe(struct pci_dev *pdev,
 
 		pch_adap->dev.of_node = pdev->dev.of_node;
 		pch_adap->dev.parent = &pdev->dev;
+	}
+
+	ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
+		  KBUILD_MODNAME, adap_info);
+	if (ret) {
+		pch_pci_err(pdev, "request_irq FAILED\n");
+		goto err_request_irq;
+	}
+
+	for (i = 0; i < adap_info->ch_num; i++) {
+		pch_adap = &adap_info->pch_data[i].pch_adapter;
 
 		pch_i2c_init(&adap_info->pch_data[i]);
 
-- 
2.9.3

Re: [PATCH] i2c-eg20t: fix race between i2c init and interrupt enable

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 1063 bytes --]

On Sun, Sep 18, 2016 at 06:52:31PM +0800, Yadi Hu wrote:
> From: "Yadi.hu" <yadi.hu@windriver.com>
> 
> the eg20t driver call request_irq() function before the pch_base_address,
> base address of i2c controller's register, is assigned an effective value.
> 
> there is one possible scenario that an interrupt which isn't inside eg20t
> arrives immediately after request_irq() is executed when i2c controller
> shares an interrupt number with others. since the interrupt handler
> pch_i2c_handler() has already active as shared action, it will be called
> and read its own register to determine if this interrupt is from itself.
> 
> At that moment, since base address of i2c registers is not remapped
> in kernel space yet,so the INT handler will access an illegal address
> and then a error occurs.
> 
> Signed-off-by: Yadi.hu <yadi.hu@windriver.com>

Applied to for-next, thanks!

Please make sure "V3" also appears in the patch subject since patch
management tools pick this up. "-v <nr>" in recent git versions makes
this super easy.


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [PATCH] i2c-eg20t: fix race between i2c init and interrupt enable

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 1040 bytes --]

On Wed, Sep 21, 2016 at 06:16:09PM +0200, Wolfram Sang wrote:
> On Sun, Sep 18, 2016 at 06:52:31PM +0800, Yadi Hu wrote:
> > From: "Yadi.hu" <yadi.hu@windriver.com>
> > 
> > the eg20t driver call request_irq() function before the pch_base_address,
> > base address of i2c controller's register, is assigned an effective value.
> > 
> > there is one possible scenario that an interrupt which isn't inside eg20t
> > arrives immediately after request_irq() is executed when i2c controller
> > shares an interrupt number with others. since the interrupt handler
> > pch_i2c_handler() has already active as shared action, it will be called
> > and read its own register to determine if this interrupt is from itself.
> > 
> > At that moment, since base address of i2c registers is not remapped
> > in kernel space yet,so the INT handler will access an illegal address
> > and then a error occurs.
> > 
> > Signed-off-by: Yadi.hu <yadi.hu@windriver.com>
> 
> Applied to for-next, thanks!

I meant: applied to for-current!


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [PATCH] i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi]

On 2016年09月22日 00:18, Wolfram Sang wrote:
> On Wed, Sep 21, 2016 at 06:16:09PM +0200, Wolfram Sang wrote:
>> On Sun, Sep 18, 2016 at 06:52:31PM +0800, Yadi Hu wrote:
>>> From: "Yadi.hu" <yadi.hu@windriver.com>
>>>
>>> the eg20t driver call request_irq() function before the pch_base_address,
>>> base address of i2c controller's register, is assigned an effective value.
>>>
>>> there is one possible scenario that an interrupt which isn't inside eg20t
>>> arrives immediately after request_irq() is executed when i2c controller
>>> shares an interrupt number with others. since the interrupt handler
>>> pch_i2c_handler() has already active as shared action, it will be called
>>> and read its own register to determine if this interrupt is from itself.
>>>
>>> At that moment, since base address of i2c registers is not remapped
>>> in kernel space yet,so the INT handler will access an illegal address
>>> and then a error occurs.
>>>
>>> Signed-off-by: Yadi.hu <yadi.hu@windriver.com>
>> Applied to for-next, thanks!
> I meant: applied to for-current!
one quick and stupid question, what's different between for-current and 
for-next branch?

Yadi
>

Re: [PATCH] i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi]

On 2016年09月22日 00:16, Wolfram Sang wrote:
> On Sun, Sep 18, 2016 at 06:52:31PM +0800, Yadi Hu wrote:
>> From: "Yadi.hu" <yadi.hu@windriver.com>
>>
>> the eg20t driver call request_irq() function before the pch_base_address,
>> base address of i2c controller's register, is assigned an effective value.
>>
>> there is one possible scenario that an interrupt which isn't inside eg20t
>> arrives immediately after request_irq() is executed when i2c controller
>> shares an interrupt number with others. since the interrupt handler
>> pch_i2c_handler() has already active as shared action, it will be called
>> and read its own register to determine if this interrupt is from itself.
>>
>> At that moment, since base address of i2c registers is not remapped
>> in kernel space yet,so the INT handler will access an illegal address
>> and then a error occurs.
>>
>> Signed-off-by: Yadi.hu <yadi.hu@windriver.com>
> Applied to for-next, thanks!
>
> Please make sure "V3" also appears in the patch subject since patch
> management tools pick this up. "-v <nr>" in recent git versions makes
> this super easy.

Got it, I will resend the patch with V3 tag.


Yadi

Re: [PATCH] i2c-eg20t: fix race between i2c init and interrupt enable

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 354 bytes --]


> >Applied to for-next, thanks!
> >
> >Please make sure "V3" also appears in the patch subject since patch
> >management tools pick this up. "-v <nr>" in recent git versions makes
> >this super easy.
> 
> Got it, I will resend the patch with V3 tag.

No need, it is already applied.

for-current carries patches for 4.8, for-next for 4.9.


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

[PATCH] i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi Hu]

From: "Yadi.hu" <yadi.hu@windriver.com>

the driver executes request_irq() function before the base address
of i2c registers is remapped in kernel space. If i2c controller
shares an interrupt line with other devices,it is possible that
an interrupt arrives immediately after request_irq() is called.
Since the interrupt handler pch_i2c_handler() is active, it will
read its own register to determine if this interrupt was from
its own device.
At this moment, base address of i2c registers is not remapped
in kernel space yet,so the INT handler access a unknown address
and a error occurs.

 Bad IO access at port 0x18 (return inl(port))
 Call Trace:
  [<c102c733>] warn_slowpath_common+0x73/0xa0
  [<c13109f5>] ? bad_io_access+0x45/0x50
  [<c13109f5>] ? bad_io_access+0x45/0x50
  [<c102c804>] warn_slowpath_fmt+0x34/0x40
  [<c13109f5>] bad_io_access+0x45/0x50
  [<c1310b62>] ioread32+0x22/0x40
  [<c14c60db>] pch_i2c_handler+0x3b/0x120
  [<c1092f34>] handle_irq_event_percpu+0x64/0x330
  [<c109323b>] handle_irq_event+0x3b/0x60
  [<c1095b50>] ? unmask_irq+0x30/0x30
  [<c1095ba0>] handle_fasteoi_irq+0x50/0xe0
  <IRQ>  [<c16e7e78>] ? do_IRQ+0x48/0xc0
  [<c16e7f6f>] ? smp_apic_timer_interrupt+0x7f/0x17a
  [<c16e7da9>] ? common_interrupt+0x29/0x30
  [<c1008ebb>] ? mwait_idle+0x8b/0x2c0
  [<c1009e8e>] ? cpu_idle+0x9e/0xc0
  [<c16be408>] ? rest_init+0x6c/0x74
  [<c19f770a>] ? start_kernel+0x311/0x318
  [<c19f7231>] ? repair_env_string+0x51/0x51
  [<c19f7078>] ? i386_start_kernel+0x78/0x7d
 ---[ end trace eb3a1028f468a140 ]---
 i2c_eg20t 0000:05:0c.2: pch_i2c_handler :I2C-3 mode(0) is not supported

Signed-off-by: Yadi.hu <yadi.hu@windriver.com>
---
 drivers/i2c/busses/i2c-eg20t.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index 137125b..48483a5 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -773,13 +773,6 @@ static int pch_i2c_probe(struct pci_dev *pdev,
 	/* Set the number of I2C channel instance */
 	adap_info->ch_num = id->driver_data;
 
-	ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
-		  KBUILD_MODNAME, adap_info);
-	if (ret) {
-		pch_pci_err(pdev, "request_irq FAILED\n");
-		goto err_request_irq;
-	}
-
 	for (i = 0; i < adap_info->ch_num; i++) {
 		pch_adap = &adap_info->pch_data[i].pch_adapter;
 		adap_info->pch_i2c_suspended = false;
@@ -808,16 +801,23 @@ static int pch_i2c_probe(struct pci_dev *pdev,
 		}
 	}
 
+	ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
+		  KBUILD_MODNAME, adap_info);
+	if (ret) {
+		pch_pci_err(pdev, "request_irq FAILED\n");
+		goto err_request_irq;
+	}
+
 	pci_set_drvdata(pdev, adap_info);
 	pch_pci_dbg(pdev, "returns %d.\n", ret);
 	return 0;
 
+err_request_irq:
+	pci_iounmap(pdev, base_addr);
 err_add_adapter:
 	for (j = 0; j < i; j++)
 		i2c_del_adapter(&adap_info->pch_data[j].pch_adapter);
 	free_irq(pdev->irq, adap_info);
-err_request_irq:
-	pci_iounmap(pdev, base_addr);
 err_pci_iomap:
 	pci_release_regions(pdev);
 err_pci_req:
-- 
2.7.4

Re: [PATCH] i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi]

Hi,guys

it may more make sense to add a check point on interrupt handler in case 
field 'pch_base_address' has been assigned a effective value when an 
interrupt arrives.

So something like:

diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index 137125b..4ac8a49 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -152,6 +152,7 @@ struct i2c_algo_pch_data {
         int pch_buff_mode_en;
         u32 pch_event_flag;
         bool pch_i2c_xfer_in_progress;
+       bool initflag;
  };

  /**
@@ -635,6 +636,8 @@ static irqreturn_t pch_i2c_handler(int irq, void *pData)
         u32 mode;

         for (i = 0, flag = 0; i < adap_info->ch_num; i++) {
+               if (!adap_info->pch_data[i].initflag)
+                       continue;
                 p = adap_info->pch_data[i].pch_base_address;
                 mode = ioread32(p + PCH_I2CMOD);
                 mode &= BUFFER_MODE | EEPROM_SR_MODE;
@@ -783,6 +786,7 @@ static int pch_i2c_probe(struct pci_dev *pdev,
         for (i = 0; i < adap_info->ch_num; i++) {
                 pch_adap = &adap_info->pch_data[i].pch_adapter;
                 adap_info->pch_i2c_suspended = false;
+               adap_info->pch_data[i].initflag = false;

                 adap_info->pch_data[i].p_adapter_info = adap_info;

@@ -806,6 +810,7 @@ static int pch_i2c_probe(struct pci_dev *pdev,
                         pch_pci_err(pdev, "i2c_add_adapter[ch:%d] 
FAILED\n", i);
                         goto err_add_adapter;
                 }
+               adap_info->pch_data[i].initflag = ture;
         }



Compared with last one,  which one is better?

Yadi



On 2016年08月29日 10:56, Yadi Hu wrote:
> From: "Yadi.hu" <yadi.hu@windriver.com>
>
> the driver executes request_irq() function before the base address
> of i2c registers is remapped in kernel space. If i2c controller
> shares an interrupt line with other devices,it is possible that
> an interrupt arrives immediately after request_irq() is called.
> Since the interrupt handler pch_i2c_handler() is active, it will
> read its own register to determine if this interrupt was from
> its own device.
> At this moment, base address of i2c registers is not remapped
> in kernel space yet,so the INT handler access a unknown address
> and a error occurs.
>
>   Bad IO access at port 0x18 (return inl(port))
>   Call Trace:
>    [<c102c733>] warn_slowpath_common+0x73/0xa0
>    [<c13109f5>] ? bad_io_access+0x45/0x50
>    [<c13109f5>] ? bad_io_access+0x45/0x50
>    [<c102c804>] warn_slowpath_fmt+0x34/0x40
>    [<c13109f5>] bad_io_access+0x45/0x50
>    [<c1310b62>] ioread32+0x22/0x40
>    [<c14c60db>] pch_i2c_handler+0x3b/0x120
>    [<c1092f34>] handle_irq_event_percpu+0x64/0x330
>    [<c109323b>] handle_irq_event+0x3b/0x60
>    [<c1095b50>] ? unmask_irq+0x30/0x30
>    [<c1095ba0>] handle_fasteoi_irq+0x50/0xe0
>    <IRQ>  [<c16e7e78>] ? do_IRQ+0x48/0xc0
>    [<c16e7f6f>] ? smp_apic_timer_interrupt+0x7f/0x17a
>    [<c16e7da9>] ? common_interrupt+0x29/0x30
>    [<c1008ebb>] ? mwait_idle+0x8b/0x2c0
>    [<c1009e8e>] ? cpu_idle+0x9e/0xc0
>    [<c16be408>] ? rest_init+0x6c/0x74
>    [<c19f770a>] ? start_kernel+0x311/0x318
>    [<c19f7231>] ? repair_env_string+0x51/0x51
>    [<c19f7078>] ? i386_start_kernel+0x78/0x7d
>   ---[ end trace eb3a1028f468a140 ]---
>   i2c_eg20t 0000:05:0c.2: pch_i2c_handler :I2C-3 mode(0) is not supported
>
> Signed-off-by: Yadi.hu <yadi.hu@windriver.com>
> ---
>   drivers/i2c/busses/i2c-eg20t.c | 18 +++++++++---------
>   1 file changed, 9 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
> index 137125b..48483a5 100644
> --- a/drivers/i2c/busses/i2c-eg20t.c
> +++ b/drivers/i2c/busses/i2c-eg20t.c
> @@ -773,13 +773,6 @@ static int pch_i2c_probe(struct pci_dev *pdev,
>   	/* Set the number of I2C channel instance */
>   	adap_info->ch_num = id->driver_data;
>   
> -	ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
> -		  KBUILD_MODNAME, adap_info);
> -	if (ret) {
> -		pch_pci_err(pdev, "request_irq FAILED\n");
> -		goto err_request_irq;
> -	}
> -
>   	for (i = 0; i < adap_info->ch_num; i++) {
>   		pch_adap = &adap_info->pch_data[i].pch_adapter;
>   		adap_info->pch_i2c_suspended = false;
> @@ -808,16 +801,23 @@ static int pch_i2c_probe(struct pci_dev *pdev,
>   		}
>   	}
>   
> +	ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
> +		  KBUILD_MODNAME, adap_info);
> +	if (ret) {
> +		pch_pci_err(pdev, "request_irq FAILED\n");
> +		goto err_request_irq;
> +	}
> +
>   	pci_set_drvdata(pdev, adap_info);
>   	pch_pci_dbg(pdev, "returns %d.\n", ret);
>   	return 0;
>   
> +err_request_irq:
> +	pci_iounmap(pdev, base_addr);
>   err_add_adapter:
>   	for (j = 0; j < i; j++)
>   		i2c_del_adapter(&adap_info->pch_data[j].pch_adapter);
>   	free_irq(pdev->irq, adap_info);
> -err_request_irq:
> -	pci_iounmap(pdev, base_addr);
>   err_pci_iomap:
>   	pci_release_regions(pdev);
>   err_pci_req:

[PATCH] i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi Hu]

From: Hu Yadi <Yadi.hu@windriver.com>

The driver executes request_irq() function before the base address
of i2c registers is remapped in kernel space. If i2c controller
shares an interrupt line with other devices,it is possible that
an interrupt arrives immediately after request_irq() is called.
Since the interrupt handler pch_i2c_handler() is active, it will
read its own register to determine if this interrupt was from
its device.
At this moment, base address of i2c registers is not remapped
in kernel space yet,so the INT handler access a unknown address
and a error occurs.

Signed-off-by: Hu Yadi <Yadi.hu@windriver.com>
---
 drivers/i2c/busses/i2c-eg20t.c |   25 ++++++++++++++-----------
 1 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index c811289..7a51ddc 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -893,15 +893,8 @@ static int __devinit pch_i2c_probe(struct pci_dev *pdev,
 
 	/* Set the number of I2C channel instance */
 	adap_info->ch_num = id->driver_data;
-
-	ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
-		  KBUILD_MODNAME, adap_info);
-	if (ret) {
-		pch_pci_err(pdev, "request_irq FAILED\n");
-		goto err_request_irq;
-	}
-
-	for (i = 0; i < adap_info->ch_num; i++) {
+	
+        for (i = 0; i < adap_info->ch_num; i++) {
 		pch_adap = &adap_info->pch_data[i].pch_adapter;
 		adap_info->pch_i2c_suspended = false;
 
@@ -928,15 +921,25 @@ static int __devinit pch_i2c_probe(struct pci_dev *pdev,
 		}
 	}
 
+
+
+	ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
+		  KBUILD_MODNAME, adap_info);
+	if (ret) {
+		pch_pci_err(pdev, "request_irq FAILED\n");
+		goto err_request_irq;
+	}
+
 	pci_set_drvdata(pdev, adap_info);
 	pch_pci_dbg(pdev, "returns %d.\n", ret);
 	return 0;
 
+
+err_request_irq:
+	free_irq(pdev->irq, adap_info);
 err_add_adapter:
 	for (j = 0; j < i; j++)
 		i2c_del_adapter(&adap_info->pch_data[j].pch_adapter);
-	free_irq(pdev->irq, adap_info);
-err_request_irq:
 	pci_iounmap(pdev, base_addr);
 err_pci_iomap:
 	pci_release_regions(pdev);
-- 
1.7.5.4

Re: [PATCH] i2c-eg20t: fix race between i2c init and interrupt enable

[Jean Delvare]

Hi Yadi,

On Tue, 23 Aug 2016 17:07:19 +0800, Yadi Hu wrote:
> From: Hu Yadi <Yadi.hu@windriver.com>
> 
> The driver executes request_irq() function before the base address
> of i2c registers is remapped in kernel space. If i2c controller
> shares an interrupt line with other devices,it is possible that
> an interrupt arrives immediately after request_irq() is called.
> Since the interrupt handler pch_i2c_handler() is active, it will
> read its own register to determine if this interrupt was from
> its device.
> At this moment, base address of i2c registers is not remapped
> in kernel space yet,so the INT handler access a unknown address
> and a error occurs.
> 
> Signed-off-by: Hu Yadi <Yadi.hu@windriver.com>
> ---
>  drivers/i2c/busses/i2c-eg20t.c |   25 ++++++++++++++-----------
>  1 files changed, 14 insertions(+), 11 deletions(-)
> (...)

ERROR: trailing whitespace
#66: FILE: drivers/i2c/busses/i2c-eg20t.c:896:
+^I$

ERROR: code indent should use tabs where possible
#67: FILE: drivers/i2c/busses/i2c-eg20t.c:897:
+        for (i = 0; i < adap_info->ch_num; i++) {$

WARNING: please, no spaces at the start of a line
#67: FILE: drivers/i2c/busses/i2c-eg20t.c:897:
+        for (i = 0; i < adap_info->ch_num; i++) {$

total: 2 errors, 1 warnings, 44 lines checked

I'll review your patch when it passes ./scripts/checkpatch.pl.

Also note (not reported by the script): please do not add random blank
lines in the source code, it lowers readability.

-- 
Jean Delvare
SUSE L3 Support

Re: [PATCH] i2c-eg20t: fix race between i2c init and interrupt enable

[Yadi]

On 2016年08月26日 23:32, Jean Delvare wrote:
> Hi Yadi,
>
> On Tue, 23 Aug 2016 17:07:19 +0800, Yadi Hu wrote:
>> From: Hu Yadi <Yadi.hu@windriver.com>
>>
>> The driver executes request_irq() function before the base address
>> of i2c registers is remapped in kernel space. If i2c controller
>> shares an interrupt line with other devices,it is possible that
>> an interrupt arrives immediately after request_irq() is called.
>> Since the interrupt handler pch_i2c_handler() is active, it will
>> read its own register to determine if this interrupt was from
>> its device.
>> At this moment, base address of i2c registers is not remapped
>> in kernel space yet,so the INT handler access a unknown address
>> and a error occurs.
>>
>> Signed-off-by: Hu Yadi <Yadi.hu@windriver.com>
>> ---
>>   drivers/i2c/busses/i2c-eg20t.c |   25 ++++++++++++++-----------
>>   1 files changed, 14 insertions(+), 11 deletions(-)
>> (...)
> ERROR: trailing whitespace
> #66: FILE: drivers/i2c/busses/i2c-eg20t.c:896:
> +^I$
>
> ERROR: code indent should use tabs where possible
> #67: FILE: drivers/i2c/busses/i2c-eg20t.c:897:
> +        for (i = 0; i < adap_info->ch_num; i++) {$
>
> WARNING: please, no spaces at the start of a line
> #67: FILE: drivers/i2c/busses/i2c-eg20t.c:897:
> +        for (i = 0; i < adap_info->ch_num; i++) {$
>
> total: 2 errors, 1 warnings, 44 lines checked
>
> I'll review your patch when it passes ./scripts/checkpatch.pl.
>
> Also note (not reported by the script): please do not add random blank
> lines in the source code, it lowers readability.
Hi Jean

Sorry for  mess up , I made a  patch V2 and send it off for review.

Yadi