From nobody Thu Dec 18 18:50:10 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 247C4C41513 for ; Wed, 16 Aug 2023 14:10:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343510AbjHPOKa (ORCPT ); Wed, 16 Aug 2023 10:10:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54476 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343567AbjHPOKY (ORCPT ); Wed, 16 Aug 2023 10:10:24 -0400 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id A5711210D for ; Wed, 16 Aug 2023 07:10:22 -0700 (PDT) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 8E243D75; Wed, 16 Aug 2023 07:11:03 -0700 (PDT) Received: from ewhatever.cambridge.arm.com (ewhatever.cambridge.arm.com [10.1.197.1]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id A1E723F762; Wed, 16 Aug 2023 07:10:20 -0700 (PDT) From: Suzuki K Poulose To: hejunhao3@huawei.com Cc: coresight@lists.linaro.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, jonathan.cameron@huawei.com, leo.yan@linaro.org, mike.leach@linaro.org, james.clark@arm.com, linuxarm@huawei.com, yangyicong@huawei.com, prime.zeng@hisilicon.com, Suzuki K Poulose Subject: [PATCH v2 1/2] coresight: trbe: Fix TRBE potential sleep in atomic context Date: Wed, 16 Aug 2023 15:10:07 +0100 Message-Id: <20230816141008.535450-1-suzuki.poulose@arm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230814093813.19152-1-hejunhao3@huawei.com> References: <20230814093813.19152-1-hejunhao3@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Junhao He smp_call_function_single() will allocate an IPI interrupt vector to the target processor and send a function call request to the interrupt vector. After the target processor receives the IPI interrupt, it will execute arm_trbe_remove_coresight_cpu() call request in the interrupt handler. According to the device_unregister() stack information, if other process is useing the device, the down_write() may sleep, and trigger deadlocks or unexpected errors. arm_trbe_remove_coresight_cpu coresight_unregister device_unregister device_del kobject_del __kobject_del sysfs_remove_dir kernfs_remove down_write ---------> it may sleep Add a helper arm_trbe_disable_cpu() to disable TRBE precpu irq and reset per TRBE. Simply call arm_trbe_remove_coresight_cpu() directly without useing the smp_call_function_single(), which is the same as registering the TRBE coresight device. Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") Signed-off-by: Junhao He Link: https://lore.kernel.org/r/20230814093813.19152-2-hejunhao3@huawei.com [ Remove duplicate cpumask checks during removal ] Signed-off-by: Suzuki K Poulose --- drivers/hwtracing/coresight/coresight-trbe.c | 33 +++++++++++--------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtraci= ng/coresight/coresight-trbe.c index 7720619909d6..025f70adee47 100644 --- a/drivers/hwtracing/coresight/coresight-trbe.c +++ b/drivers/hwtracing/coresight/coresight-trbe.c @@ -1225,6 +1225,17 @@ static void arm_trbe_enable_cpu(void *info) enable_percpu_irq(drvdata->irq, IRQ_TYPE_NONE); } =20 +static void arm_trbe_disable_cpu(void *info) +{ + struct trbe_drvdata *drvdata =3D info; + struct trbe_cpudata *cpudata =3D this_cpu_ptr(drvdata->cpudata); + + disable_percpu_irq(drvdata->irq); + trbe_reset_local(cpudata); + cpudata->drvdata =3D NULL; +} + + static void arm_trbe_register_coresight_cpu(struct trbe_drvdata *drvdata, = int cpu) { struct trbe_cpudata *cpudata =3D per_cpu_ptr(drvdata->cpudata, cpu); @@ -1326,18 +1337,12 @@ static void arm_trbe_probe_cpu(void *info) cpumask_clear_cpu(cpu, &drvdata->supported_cpus); } =20 -static void arm_trbe_remove_coresight_cpu(void *info) +static void arm_trbe_remove_coresight_cpu(struct trbe_drvdata *drvdata, in= t cpu) { - int cpu =3D smp_processor_id(); - struct trbe_drvdata *drvdata =3D info; - struct trbe_cpudata *cpudata =3D per_cpu_ptr(drvdata->cpudata, cpu); struct coresight_device *trbe_csdev =3D coresight_get_percpu_sink(cpu); =20 - disable_percpu_irq(drvdata->irq); - trbe_reset_local(cpudata); if (trbe_csdev) { coresight_unregister(trbe_csdev); - cpudata->drvdata =3D NULL; coresight_set_percpu_sink(cpu, NULL); } } @@ -1366,8 +1371,10 @@ static int arm_trbe_remove_coresight(struct trbe_drv= data *drvdata) { int cpu; =20 - for_each_cpu(cpu, &drvdata->supported_cpus) - smp_call_function_single(cpu, arm_trbe_remove_coresight_cpu, drvdata, 1); + for_each_cpu(cpu, &drvdata->supported_cpus) { + smp_call_function_single(cpu, arm_trbe_disable_cpu, drvdata, 1); + arm_trbe_remove_coresight_cpu(drvdata, cpu); + } free_percpu(drvdata->cpudata); return 0; } @@ -1406,12 +1413,8 @@ static int arm_trbe_cpu_teardown(unsigned int cpu, s= truct hlist_node *node) { struct trbe_drvdata *drvdata =3D hlist_entry_safe(node, struct trbe_drvda= ta, hotplug_node); =20 - if (cpumask_test_cpu(cpu, &drvdata->supported_cpus)) { - struct trbe_cpudata *cpudata =3D per_cpu_ptr(drvdata->cpudata, cpu); - - disable_percpu_irq(drvdata->irq); - trbe_reset_local(cpudata); - } + if (cpumask_test_cpu(cpu, &drvdata->supported_cpus)) + arm_trbe_disable_cpu(drvdata); return 0; } =20 --=20 2.34.1 From nobody Thu Dec 18 18:50:10 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD08CC04E69 for ; Mon, 14 Aug 2023 09:41:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233582AbjHNJlU (ORCPT ); Mon, 14 Aug 2023 05:41:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49814 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234036AbjHNJlH (ORCPT ); Mon, 14 Aug 2023 05:41:07 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E6D8D109 for ; Mon, 14 Aug 2023 02:41:05 -0700 (PDT) Received: from dggpeml500002.china.huawei.com (unknown [172.30.72.53]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4RPTp15yTcztS0h; Mon, 14 Aug 2023 17:37:29 +0800 (CST) Received: from localhost.localdomain (10.69.192.56) by dggpeml500002.china.huawei.com (7.185.36.158) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Mon, 14 Aug 2023 17:41:04 +0800 From: Junhao He To: , , , , CC: , , , , , , Subject: [PATCH 1/2] coresight: trbe: Fix TRBE potential sleep in atomic context Date: Mon, 14 Aug 2023 17:38:12 +0800 Message-ID: <20230814093813.19152-2-hejunhao3@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230814093813.19152-1-hejunhao3@huawei.com> References: <20230814093813.19152-1-hejunhao3@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.69.192.56] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To dggpeml500002.china.huawei.com (7.185.36.158) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" smp_call_function_single() will allocate an IPI interrupt vector to the target processor and send a function call request to the interrupt vector. After the target processor receives the IPI interrupt, it will execute arm_trbe_remove_coresight_cpu() call request in the interrupt handler. According to the device_unregister() stack information, if other process is useing the device, the down_write() may sleep, and trigger deadlocks or unexpected errors. arm_trbe_remove_coresight_cpu coresight_unregister device_unregister device_del kobject_del __kobject_del sysfs_remove_dir kernfs_remove down_write ---------> it may sleep Add a helper arm_trbe_disable_cpu() to disable TRBE precpu irq and reset per TRBE. Simply call arm_trbe_remove_coresight_cpu() directly without useing the smp_call_function_single(), which is the same as registering the TRBE coresight device. Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") Signed-off-by: Junhao He --- drivers/hwtracing/coresight/coresight-trbe.c | 35 +++++++++++--------- 1 file changed, 20 insertions(+), 15 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtraci= ng/coresight/coresight-trbe.c index 7720619909d6..ce1e6f537b8d 100644 --- a/drivers/hwtracing/coresight/coresight-trbe.c +++ b/drivers/hwtracing/coresight/coresight-trbe.c @@ -1225,6 +1225,17 @@ static void arm_trbe_enable_cpu(void *info) enable_percpu_irq(drvdata->irq, IRQ_TYPE_NONE); } =20 +static void arm_trbe_disable_cpu(void *info) +{ + struct trbe_drvdata *drvdata =3D info; + struct trbe_cpudata *cpudata =3D this_cpu_ptr(drvdata->cpudata); + + disable_percpu_irq(drvdata->irq); + trbe_reset_local(cpudata); + cpudata->drvdata =3D NULL; +} + + static void arm_trbe_register_coresight_cpu(struct trbe_drvdata *drvdata, = int cpu) { struct trbe_cpudata *cpudata =3D per_cpu_ptr(drvdata->cpudata, cpu); @@ -1326,18 +1337,12 @@ static void arm_trbe_probe_cpu(void *info) cpumask_clear_cpu(cpu, &drvdata->supported_cpus); } =20 -static void arm_trbe_remove_coresight_cpu(void *info) +static void arm_trbe_remove_coresight_cpu(struct trbe_drvdata *drvdata, in= t cpu) { - int cpu =3D smp_processor_id(); - struct trbe_drvdata *drvdata =3D info; - struct trbe_cpudata *cpudata =3D per_cpu_ptr(drvdata->cpudata, cpu); struct coresight_device *trbe_csdev =3D coresight_get_percpu_sink(cpu); =20 - disable_percpu_irq(drvdata->irq); - trbe_reset_local(cpudata); if (trbe_csdev) { coresight_unregister(trbe_csdev); - cpudata->drvdata =3D NULL; coresight_set_percpu_sink(cpu, NULL); } } @@ -1366,8 +1371,12 @@ static int arm_trbe_remove_coresight(struct trbe_drv= data *drvdata) { int cpu; =20 - for_each_cpu(cpu, &drvdata->supported_cpus) - smp_call_function_single(cpu, arm_trbe_remove_coresight_cpu, drvdata, 1); + for_each_cpu(cpu, &drvdata->supported_cpus) { + if (cpumask_test_cpu(cpu, &drvdata->supported_cpus)) + smp_call_function_single(cpu, arm_trbe_disable_cpu, drvdata, 1); + if (cpumask_test_cpu(cpu, &drvdata->supported_cpus)) + arm_trbe_remove_coresight_cpu(drvdata, cpu); + } free_percpu(drvdata->cpudata); return 0; } @@ -1406,12 +1415,8 @@ static int arm_trbe_cpu_teardown(unsigned int cpu, s= truct hlist_node *node) { struct trbe_drvdata *drvdata =3D hlist_entry_safe(node, struct trbe_drvda= ta, hotplug_node); =20 - if (cpumask_test_cpu(cpu, &drvdata->supported_cpus)) { - struct trbe_cpudata *cpudata =3D per_cpu_ptr(drvdata->cpudata, cpu); - - disable_percpu_irq(drvdata->irq); - trbe_reset_local(cpudata); - } + if (cpumask_test_cpu(cpu, &drvdata->supported_cpus)) + arm_trbe_disable_cpu(drvdata); return 0; } =20 --=20 2.33.0 From nobody Thu Dec 18 18:50:10 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1B2FFC04FE2 for ; Mon, 14 Aug 2023 09:41:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234127AbjHNJlY (ORCPT ); Mon, 14 Aug 2023 05:41:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49838 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234326AbjHNJlI (ORCPT ); Mon, 14 Aug 2023 05:41:08 -0400 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5ABA5E5F for ; Mon, 14 Aug 2023 02:41:07 -0700 (PDT) Received: from dggpeml500002.china.huawei.com (unknown [172.30.72.54]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4RPTpn1fN5z2BdKG; Mon, 14 Aug 2023 17:38:09 +0800 (CST) Received: from localhost.localdomain (10.69.192.56) by dggpeml500002.china.huawei.com (7.185.36.158) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Mon, 14 Aug 2023 17:41:04 +0800 From: Junhao He To: , , , , CC: , , , , , , Subject: [PATCH 2/2] coresight: core: Fix multiple free TRBE platform data resource Date: Mon, 14 Aug 2023 17:38:13 +0800 Message-ID: <20230814093813.19152-3-hejunhao3@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230814093813.19152-1-hejunhao3@huawei.com> References: <20230814093813.19152-1-hejunhao3@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.69.192.56] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To dggpeml500002.china.huawei.com (7.185.36.158) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Current the TRBE driver supports matching TRBE platform device through id_table. The ACPI created a dummy TRBE platform device inside drivers/perf/arm_pmu_acpi.c. So the TRBE platform driver will probe only once and allocate just one TRBE platform data resource. If the system supports the TRBE feature, Each CPU in the systems can have at least one TRBE present, and the coresight_unregister gets called multiple times, once for each of them. Therefore, when unregister TRBE coresight devices, the TRBE platform data resource will multiple free in function coresight_unregister. root@localhost:# insmod coresight-trbe.ko root@localhost:# rmmod coresight-trbe.ko [ 423.455932] ------------[ cut here ]------------ [ 423.461987] WARNING: CPU: 1 PID: 0 at drivers/base/devres.c:1064 devm_kf= ree+0x88/0x98 [ 423.483821] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G O 6= .5.0-rc4+ #1 [ 423.505842] pstate: 614000c9 (nZCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE= =3D--) ... [ 423.601301] Call trace: [ 423.604202] devm_kfree+0x88/0x98 [ 423.608369] coresight_release_platform_data+0xb8/0xe0 [coresight] [ 423.616589] coresight_unregister+0x120/0x170 [coresight] [ 423.623533] arm_trbe_remove_coresight_cpu+0x70/0xa0 [coresight_trbe] [ 423.631082] __flush_smp_call_function_queue+0x1e4/0x4e0 [ 423.637471] generic_smp_call_function_single_interrupt+0x1c/0x30 [ 423.644796] ipi_handler+0x90/0x278 [ 423.648992] handle_percpu_devid_irq+0x90/0x250 [ 423.654636] generic_handle_domain_irq+0x34/0x58 [ 423.659786] gic_handle_irq+0x12c/0x270 [ 423.664039] call_on_irq_stack+0x24/0x30 [ 423.668452] do_interrupt_handler+0x88/0x98 [ 423.673027] el1_interrupt+0x48/0xe8 [ 423.677413] el1h_64_irq_handler+0x18/0x28 [ 423.681781] el1h_64_irq+0x78/0x80 [ 423.685550] default_idle_call+0x5c/0x180 [ 423.689855] do_idle+0x25c/0x2c0 [ 423.694196] cpu_startup_entry+0x2c/0x40 [ 423.698373] secondary_start_kernel+0x144/0x188 [ 423.703920] __secondary_switched+0xb8/0xc0 [ 423.708972] ---[ end trace 0000000000000000 ]--- [ 423.729209] ------------[ cut here ]------------ ... [ 423.735217] WARNING: CPU: 2 PID: 40 at drivers/base/devres.c:1064 devm_k= free+0x88/0x98 ... [ 424.012385] WARNING: CPU: 3 PID: 0 at drivers/base/devres.c:1064 devm_kf= ree+0x88/0x98 ... This patch does the following: 1.TRBE coresight devices do not need regular connections information, We can free connections resource when the nr_conns is valid. 2.And we can ignore the free platform data resource, it will be automatically free in platform_driver_unregister(). Signed-off-by: Junhao He Reported-by: Junhao He --- drivers/hwtracing/coresight/coresight-core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtraci= ng/coresight/coresight-core.c index 118fcf27854d..c6f7889d1b4d 100644 --- a/drivers/hwtracing/coresight/coresight-core.c +++ b/drivers/hwtracing/coresight/coresight-core.c @@ -1555,9 +1555,10 @@ void coresight_release_platform_data(struct coresigh= t_device *csdev, conns[i]->dest_fwnode =3D NULL; devm_kfree(dev, conns[i]); } - devm_kfree(dev, pdata->out_conns); - devm_kfree(dev, pdata->in_conns); - devm_kfree(dev, pdata); + if (pdata->nr_outconns) + devm_kfree(dev, pdata->out_conns); + if (pdata->nr_inconns) + devm_kfree(dev, pdata->in_conns); if (csdev) coresight_remove_conns_sysfs_group(csdev); } --=20 2.33.0