Re: [PATCH v2] pinctrl: qcom: Assign irq_disable/eoi conditionally

[Marc Zyngier <maz@kernel.org>]

Hi Linus,

On 2020-03-09 12:52, Linus Walleij wrote:
> The hierarchical parts of MSM pinctrl/GPIO is only
> used when the device tree has a "wakeup-parent" as
> a phandle, but the .irq_disable and .irq_eoi are anyway
> assigned leading to semantic problems on elder
> Qualcomm chipsets.
> 
> When the drivers/mfd/qcom-pm8xxx.c driver calls
> chained_irq_exit() that call will in turn call chip->irq_eoi()
> which is set to irq_chip_eoi_parent() by default on a
> hierachical IRQ chip, and the parent is pinctrl-msm.c
> so that will in turn unconditionally call
> irq_chip_eoi_parent() again, but its parent is invalid
> so we get the following crash:
> 
>  Unnable to handle kernel NULL pointer dereference at
>  virtual address 00000010
>  pgd = (ptrval)
>  [00000010] *pgd=00000000
>  Internal error: Oops: 5 [#1] PREEMPT SMP ARM
>  (...)
>  PC is at irq_chip_eoi_parent+0x4/0x10
>  LR is at pm8xxx_irq_handler+0x1b4/0x2d8
> 
> If we solve this crash by avoiding to call up to
> irq_chip_eoi_parent(), the machine will hang and get
> reset by the watchdog, because of semantic issues,
> probably inside irq_chip.
> 
> As a solution, just assign the .irq_disable and .irq_eoi
> condtionally if we are actually using a wakeup parent.
> 
> Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
> Cc: Lina Iyer <ilina@codeaurora.org>
> Cc: Marc Zyngier <maz@kernel.org>
> Cc: Stephen Boyd <swboyd@chromium.org>
> Cc: stable@vger.kernel.org
> Fixes: e35a6ae0eb3a ("pinctrl/msm: Setup GPIO chip in hierarchy")
> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
> ---
> ChangeLog v1->v2:
> - Noticed that the previous solution doesn't actually work,
>   the machine hangs and reboots intead (even if it got rid of
>   the most obvious crash). Make a more thorough solution that
>   completely avoids using these callbacks if we don't have
>   a parent.

What is the problem with disable exactly?

> - v1 was called "Guard irq_eoi()"
> ---
>  drivers/pinctrl/qcom/pinctrl-msm.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c
> b/drivers/pinctrl/qcom/pinctrl-msm.c
> index 9a8daa256a32..fe3c53ae25f4 100644
> --- a/drivers/pinctrl/qcom/pinctrl-msm.c
> +++ b/drivers/pinctrl/qcom/pinctrl-msm.c
> @@ -1100,11 +1100,9 @@ static int msm_gpio_init(struct msm_pinctrl 
> *pctrl)
> 
>  	pctrl->irq_chip.name = "msmgpio";
>  	pctrl->irq_chip.irq_enable = msm_gpio_irq_enable;
> -	pctrl->irq_chip.irq_disable = msm_gpio_irq_disable;

I find it really odd to have the enable callback, but not the disable.
What is the rational for that? Can we drop the enable as well for old
platforms and only use mask/unmask instead?

>  	pctrl->irq_chip.irq_mask = msm_gpio_irq_mask;
>  	pctrl->irq_chip.irq_unmask = msm_gpio_irq_unmask;
>  	pctrl->irq_chip.irq_ack = msm_gpio_irq_ack;
> -	pctrl->irq_chip.irq_eoi = irq_chip_eoi_parent;
>  	pctrl->irq_chip.irq_set_type = msm_gpio_irq_set_type;
>  	pctrl->irq_chip.irq_set_wake = msm_gpio_irq_set_wake;
>  	pctrl->irq_chip.irq_request_resources = msm_gpio_irq_reqres;
> @@ -1118,7 +1116,8 @@ static int msm_gpio_init(struct msm_pinctrl 
> *pctrl)
>  		if (!chip->irq.parent_domain)
>  			return -EPROBE_DEFER;
>  		chip->irq.child_to_parent_hwirq = msm_gpio_wakeirq;
> -
> +		pctrl->irq_chip.irq_disable = msm_gpio_irq_disable;
> +		pctrl->irq_chip.irq_eoi = irq_chip_eoi_parent;
>  		/*
>  		 * Let's skip handling the GPIOs, if the parent irqchip
>  		 * is handling the direct connect IRQ of the GPIO.

Thanks,

         M.
-- 
Jazz is not dead. It just smells funny...