Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Sender: Guenter Roeck <groeck7@gmail.com>
Message-ID: <143c0449-8ce6-2179-1391-b3e3160b9846@roeck-us.net>
Date:   Mon, 21 Feb 2022 07:25:26 -0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.5.0
Subject: Re: [PATCH v3 2/4] hwmon: (lm90) Use hwmon_notify_event()
Content-Language: en-US
To:     Dmitry Osipenko <digetx@gmail.com>,
        Jon Hunter <jonathanh@nvidia.com>,
        Jean Delvare <jdelvare@suse.com>,
        Matt Merhar <mattmerhar@protonmail.com>
Cc:     linux-kernel@vger.kernel.org, linux-hwmon@vger.kernel.org,
        linux-tegra@vger.kernel.org
References: <20210618215455.19986-1-digetx@gmail.com>
 <20210618215455.19986-3-digetx@gmail.com>
 <9580f660-2a11-40e4-2986-f05703822d72@nvidia.com>
 <8d0c818a-d714-d8ab-f825-073cf549b959@gmail.com>
 <13b07bb3-90e4-a501-469c-ce64bc90bfd5@nvidia.com>
 <4c12cab4-6265-78c0-46ce-d4014c9919fe@gmail.com>
From:   Guenter Roeck <linux@roeck-us.net>
In-Reply-To: <4c12cab4-6265-78c0-46ce-d4014c9919fe@gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk

On 2/21/22 04:59, Dmitry Osipenko wrote:
> 21.02.2022 15:56, Jon Hunter пишет:
>>
>> On 21/02/2022 12:36, Dmitry Osipenko wrote:
>>> 21.02.2022 15:01, Jon Hunter пишет:
>>>> Hi Dmitry,
>>>>
>>>> On 18/06/2021 22:54, Dmitry Osipenko wrote:
>>>>> Use hwmon_notify_event() to notify userspace and thermal core about
>>>>> temperature changes.
>>>>>
>>>>> Suggested-by: Guenter Roeck <linux@roeck-us.net>
>>>>> Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
>>>>> ---
>>>>>     drivers/hwmon/lm90.c | 44
>>>>> +++++++++++++++++++++++++++++++++-----------
>>>>>     1 file changed, 33 insertions(+), 11 deletions(-)
>>>>>
>>>>> diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
>>>>> index 2e057fad05b4..e7b678a40b39 100644
>>>>> --- a/drivers/hwmon/lm90.c
>>>>> +++ b/drivers/hwmon/lm90.c
>>>>> @@ -465,6 +465,7 @@ enum lm90_temp11_reg_index {
>>>>>       struct lm90_data {
>>>>>         struct i2c_client *client;
>>>>> +    struct device *hwmon_dev;
>>>>>         u32 channel_config[4];
>>>>>         struct hwmon_channel_info temp_info;
>>>>>         const struct hwmon_channel_info *info[3];
>>>>> @@ -1731,22 +1732,41 @@ static bool lm90_is_tripped(struct i2c_client
>>>>> *client, u16 *status)
>>>>>           if ((st & (LM90_STATUS_LLOW | LM90_STATUS_LHIGH |
>>>>> LM90_STATUS_LTHRM)) ||
>>>>>             (st2 & MAX6696_STATUS2_LOT2))
>>>>> -        dev_warn(&client->dev,
>>>>> -             "temp%d out of range, please check!\n", 1);
>>>>> +        dev_dbg(&client->dev,
>>>>> +            "temp%d out of range, please check!\n", 1);
>>>>>         if ((st & (LM90_STATUS_RLOW | LM90_STATUS_RHIGH |
>>>>> LM90_STATUS_RTHRM)) ||
>>>>>             (st2 & MAX6696_STATUS2_ROT2))
>>>>> -        dev_warn(&client->dev,
>>>>> -             "temp%d out of range, please check!\n", 2);
>>>>> +        dev_dbg(&client->dev,
>>>>> +            "temp%d out of range, please check!\n", 2);
>>>>>         if (st & LM90_STATUS_ROPEN)
>>>>> -        dev_warn(&client->dev,
>>>>> -             "temp%d diode open, please check!\n", 2);
>>>>> +        dev_dbg(&client->dev,
>>>>> +            "temp%d diode open, please check!\n", 2);
>>>>>         if (st2 & (MAX6696_STATUS2_R2LOW | MAX6696_STATUS2_R2HIGH |
>>>>>                MAX6696_STATUS2_R2THRM | MAX6696_STATUS2_R2OT2))
>>>>> -        dev_warn(&client->dev,
>>>>> -             "temp%d out of range, please check!\n", 3);
>>>>> +        dev_dbg(&client->dev,
>>>>> +            "temp%d out of range, please check!\n", 3);
>>>>>         if (st2 & MAX6696_STATUS2_R2OPEN)
>>>>> -        dev_warn(&client->dev,
>>>>> -             "temp%d diode open, please check!\n", 3);
>>>>> +        dev_dbg(&client->dev,
>>>>> +            "temp%d diode open, please check!\n", 3);
>>>>> +
>>>>> +    if (st & LM90_STATUS_LLOW)
>>>>> +        hwmon_notify_event(data->hwmon_dev, hwmon_temp,
>>>>> +                   hwmon_temp_min, 0);
>>>>> +    if (st & LM90_STATUS_RLOW)
>>>>> +        hwmon_notify_event(data->hwmon_dev, hwmon_temp,
>>>>> +                   hwmon_temp_min, 1);
>>>>> +    if (st2 & MAX6696_STATUS2_R2LOW)
>>>>> +        hwmon_notify_event(data->hwmon_dev, hwmon_temp,
>>>>> +                   hwmon_temp_min, 2);
>>>>> +    if (st & LM90_STATUS_LHIGH)
>>>>> +        hwmon_notify_event(data->hwmon_dev, hwmon_temp,
>>>>> +                   hwmon_temp_max, 0);
>>>>> +    if (st & LM90_STATUS_RHIGH)
>>>>> +        hwmon_notify_event(data->hwmon_dev, hwmon_temp,
>>>>> +                   hwmon_temp_max, 1);
>>>>> +    if (st2 & MAX6696_STATUS2_R2HIGH)
>>>>> +        hwmon_notify_event(data->hwmon_dev, hwmon_temp,
>>>>> +                   hwmon_temp_max, 2);
>>>>
>>>>
>>>> We observed a random null pointer deference crash somewhere in the
>>>> thermal core (crash log below is not very helpful) when calling
>>>> mutex_lock(). It looks like we get an interrupt when this crash
>>>> happens.
>>>>
>>>> Looking at the lm90 driver, per the above, I now see we are calling
>>>> hwmon_notify_event() from the lm90 interrupt handler. Looking at
>>>> hwmon_notify_event() I see that ...
>>>>
>>>> hwmon_notify_event()
>>>>     --> hwmon_thermal_notify()
>>>>       --> thermal_zone_device_update()
>>>>         --> update_temperature()
>>>>           --> mutex_lock()
>>>>
>>>> So although I don't completely understand the crash, it does seem
>>>> that we should not be calling hwmon_notify_event() from the
>>>> interrupt handler.
>>>>
>>>> BTW I have not reproduced this myself yet, so I have just been
>>>> reviewing the code to try and understand this.
>>>
>>> Matt Merhar was experiencing a similar issue on T30 Ouya, but I never
>>> managed to reproduce it on Nexus 7 and Acer A500 tablets, and couldn't
>>> spot any problem in the code. IIRC, it was a NULL dereference of another
>>> pointer within that code.
>>
>>
>> OK. From looking at the above I don't think we can call
>> hwmon_notify_event() from an interrupt handler because this is going to
>> try and request a mutex. So we need to fix that.
> 
> The interrupt is threaded, so it can take a mutex.

Exactly. The problem is elsewhere.

Guenter