[Letux-kernel] Bug in i2c_device_probe

[H. Nikolaus Schaller]

Hi Tony,
I've observed this message on the Pyra with letux-4.17.0-lpae kernel:

[    1.806477] platform 48070000.i2c: Retrying from deferred list
[    1.813802] ------------[ cut here ]------------
[    1.818666] WARNING: CPU: 1 PID: 778 at drivers/irqchip/irq-gic.c:1016 gic_irq_domain_translate+0x78/0x100
[    1.828839] Modules linked in:
[    1.832075] CPU: 1 PID: 778 Comm: kworker/1:1 Not tainted 4.17.0-letux-lpae+ #2407
[    1.840012] Hardware name: Generic OMAP5 (Flattened Device Tree)
[    1.846319] Workqueue: events deferred_probe_work_func
[    1.851724] [<c020fd94>] (unwind_backtrace) from [<c020b690>] (show_stack+0x10/0x14)
[    1.859856] [<c020b690>] (show_stack) from [<c083c848>] (dump_stack+0x7c/0x9c)
[    1.867443] [<c083c848>] (dump_stack) from [<c022b330>] (__warn+0xd8/0x108)
[    1.874765] [<c022b330>] (__warn) from [<c022b420>] (warn_slowpath_null+0x38/0x44)
[    1.882712] [<c022b420>] (warn_slowpath_null) from [<c051ee2c>] (gic_irq_domain_translate+0x78/0x100)
[    1.892393] [<c051ee2c>] (gic_irq_domain_translate) from [<c051f19c>] (gic_irq_domain_alloc+0x28/0x6c)
[    1.902163] [<c051f19c>] (gic_irq_domain_alloc) from [<c021f9d8>] (wakeupgen_domain_alloc+0xa4/0xc0)
[    1.911756] [<c021f9d8>] (wakeupgen_domain_alloc) from [<c0277810>] (__irq_domain_alloc_irqs+0x148/0x200)
[    1.921798] [<c0277810>] (__irq_domain_alloc_irqs) from [<c0277d00>] (irq_create_fwspec_mapping+0x278/0x32c)
[    1.932106] [<c0277d00>] (irq_create_fwspec_mapping) from [<c0277dfc>] (irq_create_of_mapping+0x48/0x50)
[    1.942064] [<c0277dfc>] (irq_create_of_mapping) from [<c072c1c4>] (of_irq_get+0x5c/0x64)
[    1.950646] [<c072c1c4>] (of_irq_get) from [<c06ccf40>] (i2c_device_probe+0xb8/0x260)
[    1.958869] [<c06ccf40>] (i2c_device_probe) from [<c05cbe5c>] (driver_probe_device+0x188/0x318)
[    1.968010] [<c05cbe5c>] (driver_probe_device) from [<c05ca60c>] (bus_for_each_drv+0x84/0x94)
[    1.976966] [<c05ca60c>] (bus_for_each_drv) from [<c05cbc3c>] (__device_attach+0x88/0xfc)
[    1.985546] [<c05cbc3c>] (__device_attach) from [<c05cb1e8>] (bus_probe_device+0x28/0x80)
[    1.994137] [<c05cb1e8>] (bus_probe_device) from [<c05c99c0>] (device_add+0x3f8/0x50c)
[    2.002453] [<c05c99c0>] (device_add) from [<c06ce484>] (i2c_new_device+0x1c0/0x29c)
[    2.010585] [<c06ce484>] (i2c_new_device) from [<c06d0950>] (of_i2c_register_device+0x130/0x174)
[    2.019813] [<c06d0950>] (of_i2c_register_device) from [<c06d0c5c>] (of_i2c_register_devices+0x70/0xbc)
[    2.029674] [<c06d0c5c>] (of_i2c_register_devices) from [<c06cea18>] (i2c_register_adapter+0x27c/0x390)
[    2.039539] [<c06cea18>] (i2c_register_adapter) from [<c06d3dbc>] (omap_i2c_probe+0x578/0x670)
[    2.048576] [<c06d3dbc>] (omap_i2c_probe) from [<c05cd974>] (platform_drv_probe+0x50/0xa0)
[    2.057257] [<c05cd974>] (platform_drv_probe) from [<c05cbe5c>] (driver_probe_device+0x188/0x318)
[    2.066576] [<c05cbe5c>] (driver_probe_device) from [<c05ca60c>] (bus_for_each_drv+0x84/0x94)
[    2.075525] [<c05ca60c>] (bus_for_each_drv) from [<c05cbc3c>] (__device_attach+0x88/0xfc)
[    2.084118] [<c05cbc3c>] (__device_attach) from [<c05cb1e8>] (bus_probe_device+0x28/0x80)
[    2.092695] [<c05cb1e8>] (bus_probe_device) from [<c05cb704>] (deferred_probe_work_func+0xf8/0x130)
[    2.102192] [<c05cb704>] (deferred_probe_work_func) from [<c0242648>] (process_one_work+0x244/0x464)
[    2.111776] [<c0242648>] (process_one_work) from [<c0242890>] (process_scheduled_works+0x28/0x30)
[    2.121082] [<c0242890>] (process_scheduled_works) from [<c0242e44>] (worker_thread+0x2e8/0x3ec)
[    2.130305] [<c0242e44>] (worker_thread) from [<c0246df0>] (kthread+0x134/0x150)
[    2.138069] [<c0246df0>] (kthread) from [<c02010d8>] (ret_from_fork+0x14/0x3c)
[    2.145640] Exception stack(0xee2dffb0 to 0xee2dfff8)
[    2.150936] ffa0:                                     00000000 00000000 00000000 00000000
[    2.159530] ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    2.168109] ffe0: 00000000 00000000 00000000 00000000 00000013 00000000
[    2.175078] ---[ end trace cc54ad81996a459a ]---
[    2.179930] WARNING on irq_domain: interrupt-controller at 48211000

The first line is from enabling some DEBUG in drivers/base/dd.c
The last line is from a conditional printk after drivers/irqchip/irq-gic.c:1016

The code has a comment:

1015		/* Make it clear that broken DTs are... broken */
1016		WARN_ON(*type == IRQ_TYPE_NONE);

This would mean that something in the core DT is broken as we import the omap5-common.dtsi.

I have researched a little:

omap5.dtsi says:

	gic: interrupt-controller at 48211000 {
		compatible = "arm,cortex-a15-gic";
		interrupt-controller;
		#interrupt-cells = <3>;
		reg = <0 0x48211000 0 0x1000>,
		      <0 0x48212000 0 0x2000>,
		      <0 0x48214000 0 0x2000>,
		      <0 0x48216000 0 0x2000>;
		interrupt-parent = <&gic>;
	};

but there is no description what #interrupt-cells = <3> means:

https://elixir.bootlin.com/linux/v4.17/source/Documentation/devicetree/bindings/interrupt-controller/interrupts.txt

Should this be #interrupt-cells = <2>?

On the other hand this comes when retrying to probe 48070000.i2c which is defined as

		i2c1: i2c at 48070000 {
			compatible = "ti,omap4-i2c";
			reg = <0x48070000 0x100>;
			interrupts = <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>;
			#address-cells = <1>;
			#size-cells = <0>;
			ti,hwmods = "i2c1";
		};

where the interrupts property has indeed 3 cells. So the bindings docmay just be incomplete.

But I have no idea why the condition

1016		WARN_ON(*type == IRQ_TYPE_NONE)

can trigger based on DT definitions?

BTW:  I have observed the strcmp(NULL) issue also on Pyra/omap5 (which also uses pwm_bl).

So this might just be another symptom of the same issue.

Another strange observation is that bus_probe_device() is twice in the call stack.

BR and thanks,
Nikolaus