[Letux-kernel] two accelerometers + iio_bridge considered harmful

H. Nikolaus Schaller hns at goldelico.com
Tue Jul 31 21:12:29 CEST 2018


Hi,

> Am 31.07.2018 um 19:58 schrieb Andreas Kemnade <andreas at kemnade.info>:
> 
> On Tue, 31 Jul 2018 19:16:53 +0200
> Andreas Kemnade <andreas at kemnade.info> wrote:
> 
>> Hi,
>> 
>> On Sun, 29 Jul 2018 08:48:50 +0200
>> "H. Nikolaus Schaller" <hns at goldelico.com> wrote:
>> 
>>> Hi,
>>> 
>>>> Am 28.07.2018 um 22:59 schrieb Andreas Kemnade <andreas at kemnade.info>:
>>>> 
>>>> Hi,
>>>> 
>>>> I found out something strange.
>>>> At least in my gta04a5, there are two accelerometers:
>>>> the bmc150 and the bno055.
>>> 
>>> Yes.
>>> 
>>>> 
>>>> Disabling the bmc150-accel-i2c.ko module
>>>> makes the input bridge work reliably, enabling it again, lets it crash
>>>> again.
>>>> 
>>>> Are both populated on every gta04a5?
>>> 
>>> Yes. We got the BNO055 as a promotion by Bosch Sensortec - but did initially
>>> have no driver.
>>> 
>>> We got a driver as a quick hack without warranty from its author.
>>> 
>>>> 
>>>> And then there is another bug:
>>>> rmmod bno055
>>>> 
>>>> makes the bridge disappear
>>>> modprobe bno055
>>>> 
>>>> does not bring it back
>>> 
>>> That is probably easy to explain: iio_device_unregister_inputbridge()
>>> does not reduce the number of active channels and therefore a new
>>> modprobe thinks it already knows 3 channels.
>>> 
>>> The input-bridge driver collects the first three accelerometer
>>> values as X, Y, Z - with a slighty weak assumption that they
>>> belong to the same source. This might race if two accelerometer
>>> drivers probe concurrently. Then, channels are mixed up but
>>> it should not fail.
>>> 
>>> Maybe you can enable
>>> 
>>> 	printk("iio_device_register_inputbridge(): found an accelerometer\n");
>>> 
>>> 	printk("iio_device_register_inputbridge(): process channel %d\n", channel);
>>> 
>>> and add a printk to iio_device_unregister_inputbridge
>>> 
> 
> just for comparison, with bmc150_accel_i2c renamed so that it is
> disabled and xxd after bootup:
> 
> [    5.019744] omapdss: unknown parameter 'def_disp' ignored
> [    5.026519] omapdss_dss 48050000.dss: 48050000.dss supply vdda_video not found, using dummy regulator
> [    5.125061] DSS: OMAP DSS rev 2.0
> [    5.161468] omapdss_dss 48050000.dss: bound 48050400.dispc (ops dispc_component_ops [omapdss])
> [    5.227325] omapdss_dss 48050000.dss: bound 48050c00.encoder (ops venc_component_ops [omapdss])
> [    5.306488] gnss: GNSS driver registered with major 245
> [    5.427886] input: twl4030_pwrbutton as /devices/platform/68000000.ocp/48070000.i2c/i2c-0/0-0048/48070000.i2c:twl at 48:pwrbutton/input/input3
> [    5.449371] twl4030_madc 48070000.i2c:twl at 48:madc: 48070000.i2c:twl at 48:madc supply vusb3v1 not found, using dummy regulator
> [    5.513702] input: twl4030:vibrator as /devices/platform/68000000.ocp/48070000.i2c/i2c-0/0-0048/48070000.i2c:twl at 48:audio/twl4030-vibra/input/input4
> [    5.674407] twl4030_gpio twl4030-gpio: can't dispatch IRQs from modules
> [    5.855621] media: Linux media interface: v0.10
> [    5.862915] input: TSC2007 Touchscreen as /devices/platform/68000000.ocp/48072000.i2c/i2c-1/1-0048/input/input5
> [    5.882720] bno055 1-0029: software revision id 0311
> [    5.888580] twl4030_usb 48070000.i2c:twl at 48:twl4030-usb: Initialized TWL4030 USB module
> [    5.933166] iio_device_register_inputbridge(): found an accelerometer
> [    5.944061] bmp280 1-0076: 1-0076 supply vddd not found, using dummy regulator
> [    5.956634] musb-hdrc musb-hdrc.0.auto: MUSB HDRC host driver
> [    5.994232] iio_device_register_inputbridge(): => (ptrval)
> [    6.003173] videodev: Linux video capture interface: v2.00
> [    6.009216] omap_hdq 480b2000.1w: OMAP HDQ Hardware Rev 0.5. Driver in Interrupt mode
> [    6.022094] musb-hdrc musb-hdrc.0.auto: new USB bus registered, assigned bus number 1
> [    6.031036] bmp280 1-0076: 1-0076 supply vdda not found, using dummy regulator
> [    6.063781] input: accelerometer-iio-input-bridge as /devices/virtual/input/input6
> [    6.087310] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 4.18
> [    6.097167] w1_master_driver w1_bus_master1: Attaching one wire slave 01.000000000000 crc 3d
> [    6.140930] bq27xxx_battery_setup
> [    6.145904] bq27xxx_battery_setup: dm_regs=  (null)
> [    6.155975] iio delayed work at bf06b400
> [    6.160980] (NULL device *): hwmon: 'bq27000-battery' is not a valid name attribute, please fix
> [    6.180908] bq27xxx_battery_settings
> [    6.184661] bq27xxx_battery_settings: power_supply_get_battery_info failed ret=-1088647148
> [    6.231689] iio delayed_work:e0 ff ff ff 04 b4 06 bf 04 b4 06 bf 64 86 06 bf
> [    6.247009] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
> [    6.312225] iio delayed_work:00 00 00 00 00 00 00 00 00 00 00 00 38 8e 14 c0
> [    6.331665] usb usb1: Product: MUSB HDRC host driver
> [    6.349151] usb usb1: Manufacturer: Linux 4.18.0-rc6-letux+ musb-hcd
> [    6.370544] iio delayed_work:00 00 20 00 00 00 00 00 00 00 00 00
> [    6.397338] usb usb1: SerialNumber: musb-hdrc.0.auto
> [    6.404968] iio_device_register_inputbridge(): process channel 0
> [    6.420227] hub 1-0:1.0: USB hub found
> [    6.426483] iio_device_register_inputbridge(): found an accelerometer
> [    6.441528] hub 1-0:1.0: 1 port detected
> [    6.454010] iio_device_register_inputbridge(): process channel 1
> [    6.505737] iio_device_register_inputbridge(): found an accelerometer
> [    6.605590] iio_device_register_inputbridge(): process channel 2
> [    6.821197] pwm-backlight backlight: backlight supply power not found, using dummy regulator
> [    6.858978] (NULL device *): hwmon: 'gta04-battery' is not a valid name attribute, please fix
> [    6.955200] pwm-backlight backlight: backlight supply power not found, using dummy regulator
> [    6.981079] twl4030_bci 48070000.i2c:twl at 48:bci: battery temperature out of range
> [    7.004699] pwm-backlight backlight: backlight supply power not found, using dummy regulator
> [    7.014648] iio_charge:215
> [    7.019653] twl4030_bci 48070000.i2c:twl at 48:bci: battery temperature out of range
> [    7.082855] pwm-backlight backlight: backlight supply power not found, using dummy regulator
> [    7.131713] wwan_on_off_init: wwan_on_off_init
> [    7.187530] pps_core: LinuxPPS API ver. 1 registered
> [    7.192749] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti at linux.it>
> [    7.212646] wwan_on_off_probe: wwan_on_off_probe()
> [    7.271057] wwan_on_off_probe: onoff = (ptrval) indicator = (ptrval) -298512368 usb_phy = 1074724883
> [    7.304107] wwan_on_off_probe: wwan_on_off_probe() wwan=(ptrval)
> [    7.316436] pps pps0: new PPS source pps.-1
> [    7.324523] twl4030_voice_set_tristate codec=(ptrval) 1
> [    7.341979] TPS Voice IF is tristated
> [    7.347167] pps pps0: Registered IRQ 165 as PPS source
> [    7.353179] wwan_on_off_is_powered_on: gpio value = 1
> [    7.373168] omap-twl4030 sound: twl4030-hifi <-> 49022000.mcbsp mapping ok
> [    7.389862] wwan_on_off_is_powered_on: return 'true'
> [    7.452606] wwan_on_off_rfkill_set_block: blocked: 0
> [    7.497924] asoc-simple-card sound_telephony: gtm601 <-> 49026000.mcbsp mapping ok
> [    7.513214] wwan_on_off_set_power:on = 1
> [    7.527435] wwan_on_off_is_powered_on: gpio value = 1
> [    7.569000] wwan_on_off_is_powered_on: return 'true'
> [    7.598236] wwan_on_off_set_power: state 1
> [    7.623199] wwan_on_off_set_power: done
> [    7.654846] wwan_on_off_probe: successfully probed
> [    8.166595] omapdrm omapdrm.0: DMM not available, disable DMM support
> [    8.232666] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
> [    8.257171] [drm] No driver support for vblank timestamp query.
> [    8.265563] omapdrm omapdrm.0: Tiled buffers require DMM
> [    8.332916] Console: switching to colour frame buffer device 60x40
> [    8.435394] omapdrm omapdrm.0: fb0: omapdrm frame buffer device
> [    8.490417] [drm] Initialized omapdrm 1.0.0 20110917 for omapdrm.0 on minor 0
> [    8.608276] cfg80211: Loading compiled-in X.509 certificates for regulatory database
> [    8.704040] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
> [    8.774200] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
> [    8.793060] cfg80211: failed to load regulatory.db
> [    8.990112] voice ctl route: 0
> [    9.207000] wlcore: ERROR ti-connectivity/wl18xx-conf.bin configuration binary size is wrong, expected 1229 got 1221
> [    9.232360] wlcore: WARNING falling back to default config
> [    9.640014] wlcore: wl18xx HW: 183x or 180x, PG 2.2 (ROM 0x11)
> [    9.649719] wlcore: WARNING Detected unconfigured mac address in nvs, derive from fuse instead.
> 
> [    9.660644] wlcore: WARNING This default nvs file can be removed from the file system
> 
> [    9.713897] wlcore: loaded
> [   11.735229] EXT4-fs (mmcblk0p6): re-mounted. Opts: (null)
> [   11.964538] EXT4-fs (mmcblk0p6): re-mounted. Opts: errors=remount-ro
> [   13.136962] device-mapper: ioctl: 4.39.0-ioctl (2018-04-03) initialised: dm-devel at redhat.com
> [   13.945129] using random self ethernet address
> [   13.950164] using random host ethernet address
> [   13.959564] usb0: HOST MAC c6:c2:2e:22:00:89
> [   13.971130] usb0: MAC 02:e1:04:7f:25:4d
> [   13.975250] using random self ethernet address
> [   13.996948] using random host ethernet address
> [   14.001708] g_ether gadget: Ethernet Gadget, version: Memorial Day 2008
> [   14.021179] g_ether gadget: g_ether ready
> [   14.393737] EXT4-fs (mmcblk0p3): mounted filesystem with ordered data mode. Opts: (null)
> [   14.403228] UBIFS error (pid: 1860): cannot open "ubi0:gta04-rootfs", error -19
> [   14.451629] EXT4-fs (mmcblk0p7): mounted filesystem with ordered data mode. Opts: (null)
> [   14.507904] g_ether gadget: high-speed config #1: CDC Ethernet (ECM)
> [   15.652160] random: crng init done
> [   16.439453] NET: Registered protocol family 10
> [   16.468261] Segment Routing with IPv6
> [   17.048492] voice ctl route: 0
> [   19.834838] Bluetooth: Core ver 2.22
> [   19.845458] NET: Registered protocol family 31
> [   19.855895] Bluetooth: HCI device and connection manager initialized
> [   19.872528] Bluetooth: HCI socket layer initialized
> [   19.882598] Bluetooth: L2CAP socket layer initialized
> [   19.895080] Bluetooth: SCO socket layer initialized
> [   19.985229] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
> [   19.996398] Bluetooth: BNEP socket layer initialized
> [   24.701171] systemd-logind[2713]: New seat seat0.
> [   25.638031] systemd-logind[2713]: Failed to start user service: Unknown unit: user at 0.service
> [   25.688323] systemd-logind[2713]: New session 1 of user root.
> [   70.688751] iio delayed work at bf06b400
> [   70.693145] iio delayed_work open:e0 ff ff ff 04 b4 06 bf 04 b4 06 bf 64 86 06 bf
> [   70.702148] iio delayed_work open:00 00 00 00 00 00 00 00 00 00 00 00 38 8e 14 c0
> [   70.711944] iio delayed_work open:00 00 20 00 00 00 00 00 00 00 00 00
> [   70.719604] inputbridge_work
> [   70.837188] inputbridge_work
> [   70.946899] inputbridge_work
> [   71.057128] inputbridge_work
> [   71.167205] inputbridge_work
> [   71.287017] inputbridge_work
> [   71.407257] inputbridge_work
> [   71.527130] inputbridge_work
> and then rmmod bno055
> modprobe bno055
> rmmod bno055
> [  330.903503] unregister inputbridge
> [  330.909210] unregister input device ee7fa800
> [  336.414276] bno055 1-0029: software revision id 0311
> [  336.433197] iio_device_register_inputbridge(): found an accelerometer
> [  336.451446] iio_device_register_inputbridge(): found an accelerometer
> [  336.464447] iio_device_register_inputbridge(): found an accelerometer
> [  348.124969] unregister inputbridge
> [  348.130615] unregister input device ee7fa800

Ok, it is unregistered twice...
Well, the code is simply not good for unregistering.
Proposal is attached. It should unregister only if anything is registered.

I don't know if it is really better - we might have to track

iio_input_unregister_accel_channel() and wipe out channel slots by
that. And have input_register_accel_channel() find an empty one.

And unregister the input device only when all slots are empty.

Reminds me a little for the selectors of the pinmux framework...


> [  348.135223] Unable to handle kernel paging request at virtual address fffffff0
> [  348.142791] pgd = c4324c25
> [  348.145629] [fffffff0] *pgd=afffd861, *pte=00000000, *ppte=00000000
> [  348.152191] Internal error: Oops: 837 [#1] PREEMPT SMP ARM
> [  348.157928] Modules linked in: bno055(-) bnep bluetooth ecdh_generic ipv6 usb_f_ecm g_ether usb_f_rndis u_ether libcomposite configfs dm_crypt dm_mod dax arc4 wl18xx wlcore mac80211 cfg80211 omapdrm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm drm_panel_orientation_quirks pps_gpio panel_tpo_td028ttec1 snd_soc_simple_card snd_soc_simple_card_utils snd_soc_omap_twl4030 pps_core encoder_opa362 wwan_on_off snd_soc_gtm601 pwm_omap_dmtimer connector_analog_tv generic_adc_battery pwm_bl wlcore_sdio bmp280_spi ov9655 bq27xxx_battery_hdq bq27xxx_battery v4l2_fwnode v4l2_common omap_hdq videodev omap2430 bmp280_i2c bmp280 media at24 bmc150_magn_i2c bmc150_accel_core tsc2007 bmc150_magn industrialio_triggered_buffer leds_tca6507 kfifo_buf phy_twl4030_usb snd_soc_omap_mcbsp snd_soc_sdma musb_hdrc
> [  348.232696]  gpio_twl4030 twl4030_vibra snd_soc_twl4030 twl4030_charger twl4030_pwrbutton twl4030_madc gnss_w2sg0004 industrialio w2cbw003_bluetooth gnss omapdss omapdss_base cec [last unloaded: bno055]
> [  348.251586] CPU: 0 PID: 6845 Comm: rmmod Not tainted 4.18.0-rc6-letux+ #10
> [  348.258789] Hardware name: Generic OMAP36xx (Flattened Device Tree)
> [  348.265350] PC is at __input_unregister_device+0xf4/0x130
> [  348.270996] LR is at __input_unregister_device+0x38/0x130
> [  348.276672] pc : [<c05e7df8>]    lr : [<c05e7d3c>]    psr: 00070093
> [  348.283233] sp : ee721ec0  ip : 00000000  fp : c04f8958
> [  348.288726] r10: 00000000  r9 : ed0aff80  r8 : 00000004
> [  348.294189] r7 : ee330420  r6 : 00000000  r5 : ee7fa96c  r4 : ee7fa800
> [  348.301025] r3 : ffffffec  r2 : ee7fab30  r1 : 00000000  r0 : ee7fa800
> [  348.307861] Flags: nzcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
> [  348.315429] Control: 10c5387d  Table: ad470019  DAC: 00000051
> [  348.321441] Process rmmod (pid: 6845, stack limit = 0xa6d12228)
> [  348.327636] Stack: (0xee721ec0 to 0xee722000)
> [  348.332183] 1ec0: ee7fa800 ee7d622c c0b03d48 c05e7e88 ee7d6000 bf063394 ed0af440 ee721eec
> [  348.340759] 1ee0: c0b03d48 c04f8b18 00000000 ee213240 ed0af440 4a31c572 ee330420 ee330420
> [  348.349304] 1f00: ee2fa498 bf654020 ee330454 ee2fa4cc ee720000 00000081 00000000 c04f565c
> [  348.357879] 1f20: ee330420 bf654020 00000800 00000000 004da1f4 c04f5748 bf654020 c0b03d48
> [  348.366424] 1f40: 00000800 c04f486c bf654080 c01aad3c 306f6e62 00003535 00000000 ed4396c0
> [  348.374969] 1f60: 00000000 ed3db300 ed4396c0 00000000 ed3db300 ed3db778 ed4396c0 c014dee8
> [  348.383514] 1f80: c0101204 ee720000 00721fb0 4a31c572 004da1c0 004da1c0 bef14e99 00000081
> [  348.392028] 1fa0: c0101204 c0101000 004da1c0 004da1c0 004da1f4 00000800 a0c43500 a0c43500
> [  348.400573] 1fc0: 004da1c0 004da1c0 bef14e99 00000081 bef14d9c 00000000 bef14ba8 00000000
> [  348.409118] 1fe0: b6e91521 bef14b3c 004bd613 b6e91526 80010030 004da1f4 00000000 00000000
> [  348.417663] [<c05e7df8>] (__input_unregister_device) from [<c05e7e88>] (input_unregister_device+0x4c/0x6c)
> [  348.427825] [<c05e7e88>] (input_unregister_device) from [<bf063394>] (iio_device_unregister+0x1c/0x64 [industrialio])
> [  348.438964] [<bf063394>] (iio_device_unregister [industrialio]) from [<c04f8b18>] (release_nodes+0x1bc/0x1e4)
> [  348.449340] [<c04f8b18>] (release_nodes) from [<c04f565c>] (device_release_driver_internal+0x17c/0x1fc)
> [  348.459167] [<c04f565c>] (device_release_driver_internal) from [<c04f5748>] (driver_detach+0x60/0x6c)
> [  348.468780] [<c04f5748>] (driver_detach) from [<c04f486c>] (bus_remove_driver+0x64/0x8c)
> [  348.477264] [<c04f486c>] (bus_remove_driver) from [<c01aad3c>] (sys_delete_module+0x1a8/0x230)
> [  348.486267] [<c01aad3c>] (sys_delete_module) from [<c0101000>] (ret_fast_syscall+0x0/0x54)
> [  348.494903] Exception stack(0xee721fa8 to 0xee721ff0)
> [  348.500183] 1fa0:                   004da1c0 004da1c0 004da1f4 00000800 a0c43500 a0c43500
> [  348.508728] 1fc0: 004da1c0 004da1c0 bef14e99 00000081 bef14d9c 00000000 bef14ba8 00000000
> [  348.517242] 1fe0: b6e91521 bef14b3c 004bd613 b6e91526
> [  348.522521] Code: eb06ae96 e2840e19 e8bd4070 eafc2660 (e5831004)
> [  348.528900] ---[ end trace 969fe6166c2fa0ba ]---
> [  348.533905] note: rmmod[6845] exited with preempt_count 1
> 

BR,
Nikolaus

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-iio-input-bridge-improve-iio_device_unregister_input.patch
Type: application/octet-stream
Size: 1245 bytes
Desc: not available
URL: <http://lists.goldelico.com/pipermail/letux-kernel/attachments/20180731/d16a441a/attachment-0001.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.goldelico.com/pipermail/letux-kernel/attachments/20180731/d16a441a/attachment-0001.asc>


More information about the Letux-kernel mailing list