2013-06-17 17:50:27

by Tuomas Tynkkynen

[permalink] [raw]
Subject: [PATCH 0/2] Fix kernel panics with certain I2C tps6* chips

Hi,

Latest linux-next head (next-20130617) seems to have some backwards-incompatible
changes to the i2c core, which breaks the tps* drivers in our boards and cause
panics on boot.

ttynkkynen@ttynkkynen-lnx:~/upstream/kernel$ git bisect bad
c80f52847c50109ca248c22efbf71ff10553dca4 is the first bad commit
commit c80f52847c50109ca248c22efbf71ff10553dca4
Author: Linus Walleij <[email protected]>
Date: Mon May 13 22:18:21 2013 +0200

i2c: core: make it possible to match a pure device tree driver

This tries to address an issue found when writing an MFD driver
for the Nomadik STw481x PMICs: as the platform is using device
tree exclusively I want to specify the driver matching like
this:

static const struct of_device_id stw481x_match[] = {
{ .compatible = "st,stw4810", },
{ .compatible = "st,stw4811", },
{},
};

static struct i2c_driver stw481x_driver = {
.driver = {
.name = "stw481x",
.of_match_table = stw481x_match,
},
.probe = stw481x_probe,
.remove = stw481x_remove,
};

However that turns out not to be possible: the I2C probe code
is written so that the probe() call is always passed a match
from i2c_match_id() using non-devicetree matches.

This is probably why most devices using device tree for I2C
clients currently will pass no .of_match_table *at all* but
instead just use .id_table from struct i2c_driver to match
the device. As you realize that means that the whole idea with
compatible strings is discarded, and that is why we find strange
device tree I2C device compatible strings like "product" instead
of "vendor,product" as you could expect.

Let's figure out how to fix this before the mess spreads. This
patch will allow probeing devices with only an of_match_table
as per above, and will pass NULL as the second argument to the
probe() function. If the driver wants to deduce secondary info
from the struct of_device_id .data field, it has to call
of_match_device() on its own match table in the probe function
device tree probe path.

If drivers define both an .of_match_table *AND* a i2c_driver
.id_table, the .of_match_table will take precedence, just
as is done in the i2c_device_match() function in i2c-core.c.

I2C devices probed from device tree should subsequently be
fixed to handle the case where of_match_table() is
used (I think none of them do that today), and platforms should
fix their device trees to use compatible strings for I2C devices
instead of setting the name to Linux device driver names as is
done in multiple cases today.

Cc: Rob Herring <[email protected]>
Cc: Grant Likely <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
Signed-off-by: Wolfram Sang <[email protected]>

Tuomas Tynkkynen (2):
mfd: tps65910: Fix crash in i2c_driver .probe
regulator: tps62360: Fix crash in i2c_driver .probe

drivers/mfd/tps65910.c | 6 ++++--
drivers/regulator/tps62360-regulator.c | 8 ++++++--
2 files changed, 10 insertions(+), 4 deletions(-)

--
1.8.1.5


2013-06-17 17:50:32

by Tuomas Tynkkynen

[permalink] [raw]
Subject: [PATCH 1/2] mfd: tps65910: Fix crash in i2c_driver .probe

Commit "i2c: core: make it possible to match a pure device tree driver"
changed semantics of the i2c probing for device tree devices.
Device tree probed devices now get a NULL i2c_device_id pointer.
This caused kernel panics due to NULL dereference.

Signed-off-by: Tuomas Tynkkynen <[email protected]>
---
drivers/mfd/tps65910.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c
index d792772..a62c30d 100644
--- a/drivers/mfd/tps65910.c
+++ b/drivers/mfd/tps65910.c
@@ -461,16 +461,18 @@ static int tps65910_i2c_probe(struct i2c_client *i2c,
struct tps65910_board *of_pmic_plat_data = NULL;
struct tps65910_platform_data *init_data;
int ret = 0;
- int chip_id = id->driver_data;
+ int chip_id = -1;

pmic_plat_data = dev_get_platdata(&i2c->dev);

- if (!pmic_plat_data && i2c->dev.of_node) {
+ if (id) {
+ chip_id = id->driver_data;
+ } else if (i2c->dev.of_node) {
pmic_plat_data = tps65910_parse_dt(i2c, &chip_id);
of_pmic_plat_data = pmic_plat_data;
}

- if (!pmic_plat_data)
+ if (!pmic_plat_data || chip_id < 0)
return -EINVAL;

init_data = devm_kzalloc(&i2c->dev, sizeof(*init_data), GFP_KERNEL);
--
1.8.1.5

2013-06-17 17:50:29

by Tuomas Tynkkynen

[permalink] [raw]
Subject: [PATCH 2/2] regulator: tps62360: Fix crash in i2c_driver .probe

Commit "i2c: core: make it possible to match a pure device tree driver"
changed semantics of the i2c probing for device tree devices.
Device tree probed devices now get a NULL i2c_device_id pointer.
This caused kernel panics due to NULL dereference.

Signed-off-by: Tuomas Tynkkynen <[email protected]>
---
drivers/regulator/tps62360-regulator.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/regulator/tps62360-regulator.c b/drivers/regulator/tps62360-regulator.c
index 612919c..a490d5b 100644
--- a/drivers/regulator/tps62360-regulator.c
+++ b/drivers/regulator/tps62360-regulator.c
@@ -351,7 +351,6 @@ static int tps62360_probe(struct i2c_client *client,
int chip_id;

pdata = client->dev.platform_data;
- chip_id = id->driver_data;

if (client->dev.of_node) {
const struct of_device_id *match;
@@ -364,6 +363,11 @@ static int tps62360_probe(struct i2c_client *client,
chip_id = (int)match->data;
if (!pdata)
pdata = of_get_tps62360_platform_data(&client->dev);
+ } else if (id) {
+ chip_id = id->driver_data;
+ } else {
+ dev_err(&client->dev, "No device tree match or id table match found\n");
+ return -ENODEV;
}

if (!pdata) {
@@ -402,7 +406,7 @@ static int tps62360_probe(struct i2c_client *client,
return -ENODEV;
}

- tps->desc.name = id->name;
+ tps->desc.name = client->name;
tps->desc.id = 0;
tps->desc.ops = &tps62360_dcdc_ops;
tps->desc.type = REGULATOR_VOLTAGE;
--
1.8.1.5

2013-06-17 18:07:44

by Stephen Warren

[permalink] [raw]
Subject: Re: [PATCH 1/2] mfd: tps65910: Fix crash in i2c_driver .probe

On 06/17/2013 11:47 AM, Tuomas Tynkkynen wrote:
> Commit "i2c: core: make it possible to match a pure device tree driver"
> changed semantics of the i2c probing for device tree devices.
> Device tree probed devices now get a NULL i2c_device_id pointer.
> This caused kernel panics due to NULL dereference.

> diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c

> pmic_plat_data = dev_get_platdata(&i2c->dev);
>
> - if (!pmic_plat_data && i2c->dev.of_node) {
> + if (id) {
> + chip_id = id->driver_data;
> + } else if (i2c->dev.of_node) {
> pmic_plat_data = tps65910_parse_dt(i2c, &chip_id);

That over-writes pmic_plat_data even if it was already set above. This
should really only happen if the earlier assignment didn't find any
pdata, i.e. if (!pmic_plat_data) here.

Looking at patch 2/2, the structure in that driver is correct, and
perhaps could be implemented the same or similarly here?

> of_pmic_plat_data = pmic_plat_data;

Or just swap those assignments:

of_pmic_plat_data = tps65910_parse_dt(...);
if (!pmic_plat_data)
pmic_plat_data = of_pmic_plat_data;

(although there's perhaps little point parsing the pdata from DT if it's
already provided through the device object)

> }
>
> - if (!pmic_plat_data)
> + if (!pmic_plat_data || chip_id < 0)
> return -EINVAL;

2013-06-17 18:16:13

by Stephen Warren

[permalink] [raw]
Subject: Re: [PATCH 2/2] regulator: tps62360: Fix crash in i2c_driver .probe

On 06/17/2013 11:47 AM, Tuomas Tynkkynen wrote:
> Commit "i2c: core: make it possible to match a pure device tree driver"
> changed semantics of the i2c probing for device tree devices.
> Device tree probed devices now get a NULL i2c_device_id pointer.
> This caused kernel panics due to NULL dereference.

Tested-by: Stephen Warren <[email protected]>
Reviewed-by: Stephen Warren <[email protected]>

2013-06-17 18:16:38

by Stephen Warren

[permalink] [raw]
Subject: Re: [PATCH 1/2] mfd: tps65910: Fix crash in i2c_driver .probe

On 06/17/2013 11:47 AM, Tuomas Tynkkynen wrote:
> Commit "i2c: core: make it possible to match a pure device tree driver"
> changed semantics of the i2c probing for device tree devices.
> Device tree probed devices now get a NULL i2c_device_id pointer.
> This caused kernel panics due to NULL dereference.

Tested-by: Stephen Warren <[email protected]>

(although I imagine I'd need to retest if there was a v2 to address my
previous comments)

2013-06-18 07:52:13

by Linus Walleij

[permalink] [raw]
Subject: Re: [PATCH 0/2] Fix kernel panics with certain I2C tps6* chips

On Mon, Jun 17, 2013 at 7:47 PM, Tuomas Tynkkynen <[email protected]> wrote:

> Hi,
>
> Latest linux-next head (next-20130617) seems to have some backwards-incompatible
> changes to the i2c core, which breaks the tps* drivers in our boards and cause
> panics on boot.

You should probably put Wolfram (the i2c maintainer) on the To: line.

> Tuomas Tynkkynen (2):
> mfd: tps65910: Fix crash in i2c_driver .probe
> regulator: tps62360: Fix crash in i2c_driver .probe

Nice :-)

Yours,
Linus Walleij

2013-06-18 09:22:33

by Samuel Ortiz

[permalink] [raw]
Subject: Re: [PATCH 1/2] mfd: tps65910: Fix crash in i2c_driver .probe

On Mon, Jun 17, 2013 at 12:16:33PM -0600, Stephen Warren wrote:
> On 06/17/2013 11:47 AM, Tuomas Tynkkynen wrote:
> > Commit "i2c: core: make it possible to match a pure device tree driver"
> > changed semantics of the i2c probing for device tree devices.
> > Device tree probed devices now get a NULL i2c_device_id pointer.
> > This caused kernel panics due to NULL dereference.
>
> Tested-by: Stephen Warren <[email protected]>
>
> (although I imagine I'd need to retest if there was a v2 to address my
> previous comments)
I would prefer seeing a v2, especially to address the pmic_plat_data
overwriting issue.

Cheers,
Samuel.

--
Intel Open Source Technology Centre
http://oss.intel.com/

2013-06-18 09:36:00

by Tuomas Tynkkynen

[permalink] [raw]
Subject: Re: [PATCH 1/2] mfd: tps65910: Fix crash in i2c_driver .probe

On 06/17/2013 09:07 PM, Stephen Warren wrote:
> On 06/17/2013 11:47 AM, Tuomas Tynkkynen wrote:
>> Commit "i2c: core: make it possible to match a pure device tree driver"
>> changed semantics of the i2c probing for device tree devices.
>> Device tree probed devices now get a NULL i2c_device_id pointer.
>> This caused kernel panics due to NULL dereference.
>
>> diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c
>
>> pmic_plat_data = dev_get_platdata(&i2c->dev);
>>
>> - if (!pmic_plat_data && i2c->dev.of_node) {
>> + if (id) {
>> + chip_id = id->driver_data;
>> + } else if (i2c->dev.of_node) {
>> pmic_plat_data = tps65910_parse_dt(i2c, &chip_id);
>
> That over-writes pmic_plat_data even if it was already set above. This
> should really only happen if the earlier assignment didn't find any
> pdata, i.e. if (!pmic_plat_data) here.

That would cause the probe() to fail since it doesn't have a chip_id.

>
> Looking at patch 2/2, the structure in that driver is correct, and
> perhaps could be implemented the same or similarly here?
>

This seems to be the best way, I'll change it that way.

>> of_pmic_plat_data = pmic_plat_data;
>
> Or just swap those assignments:
>
> of_pmic_plat_data = tps65910_parse_dt(...);
> if (!pmic_plat_data)
> pmic_plat_data = of_pmic_plat_data;
>
> (although there's perhaps little point parsing the pdata from DT if it's
> already provided through the device object)

Yeah, especially since tps65910_parse_dt can dev_warn().

>
>> }
>>
>> - if (!pmic_plat_data)
>> + if (!pmic_plat_data || chip_id < 0)
>> return -EINVAL;
>

2013-06-18 15:56:13

by Wolfram Sang

[permalink] [raw]
Subject: Re: [PATCH 0/2] Fix kernel panics with certain I2C tps6* chips

On Mon, Jun 17, 2013 at 08:47:35PM +0300, Tuomas Tynkkynen wrote:
> Hi,
>
> Latest linux-next head (next-20130617) seems to have some backwards-incompatible
> changes to the i2c core, which breaks the tps* drivers in our boards and cause
> panics on boot.

Thanks for pointing out. I am going to revert the commit in hope for a
better solution.

So, this series is not needed.

Regards,

Wolfram


Attachments:
(No filename) (400.00 B)
signature.asc (836.00 B)
Digital signature
Download all attachments