From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 72593233923 for ; Sun, 12 Jul 2026 21:05:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783890311; cv=none; b=BYG1RuepDos2Cd2TudQW8dfA/KspR1GCuYk5oaRDHJq3vBL7A613sPEafC77lw1vXEKmigfCe7taBIWfXJPff7djiPU7b33dfO/a2GJOWs3uG3Ny5TZWxyr7JLH9wzgq60vQkweo8zBlnEpIp38SKru9u0yOcK1PVLV+NhD9Dtw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783890311; c=relaxed/simple; bh=odSjBM17z5rvWok6ezx5hXagOfcO2GuPyauGIRLxaSM=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version:Content-Type; b=uQCuEBLR/5aARrtR2PaZJPaUaxJorQCFNJaGwSC2soY7FikBwiYrQpEaQEZSp1NfbiFiy0vQ7gSkhATXnaIkFY8u29QL8WiLWhR++5u9ZyRU0mUbPevkMmkMecyluI8VRz4ZDhUql66cSA8nmeVPdwSXd6rWcNRgtlHeTBdcsrc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Kl/0Jr0T; arc=none smtp.client-ip=209.85.221.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Kl/0Jr0T" Received: by mail-wr1-f49.google.com with SMTP id ffacd0b85a97d-47362928f65so2450342f8f.2 for ; Sun, 12 Jul 2026 14:05:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783890308; x=1784495108; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=76fARbTyu0qdrrH8D7924DNiR5qZurH1xIxVFjOxQhY=; b=Kl/0Jr0TUekG0DSImQduVsv16tNzW6QD79KyN7L0I0OmkyIo0CCJrrqn6NZwY5j7Ag ikUQebKhkvHSTxXV3cAgJX+kW2dw9PeiXlIoXG8r6PicBbKgP4QhQSgtt5/FS4I2Pu9e 19n1gc22Fhi/u52rCXm0RxxYHvrQ8O6QUHwQ9+cSaAUaIswfaMDGm/dn2AumVF6mpIXP lxWxq8Fn/bwRNq7ncwYfzUaatGe78X+DefBvNnD+Jx8Am9fzvJTGKAxC78ZP27+I7Xn5 /aeZ61vhawxcoAKUunbayZAVgUw282Z/P1UZULIh/VNvwE2ckqYsV5SEMrCZclI/mTSp KNdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783890308; x=1784495108; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=76fARbTyu0qdrrH8D7924DNiR5qZurH1xIxVFjOxQhY=; b=BrilrXtHgLpMOLybmw7Uws8A5CyOn/l62S0ly/yLjv9JLS4iJjarDLFrSuUn7Wrdih aLAQeX4A3HFFSWsJu3ZEGF2qiUHj4OKddyC3xjfMOfueE5opuxvgNFAFmXAgArgsMGqt yVsDR5KAyr1X41EDaRkWbAXWw4WGTIUDQAz5uKg0QrTV9V/8mv4pyzr6wvNvZwBWgYTA oWcKiN/oOEcA1ZPkmQc1Z5D8rvQ4uBberOAhfICMIthPDwQmykQ+VzyVbIgzwcujghUF TdQoKnY/DL01EJPHlfl5mhVICsin/e/TdbMkXbdxsxk87Q+UNqZQgDsN7yEE9iA3i7dM 44ig== X-Forwarded-Encrypted: i=1; AHgh+RqqQACPpYYQ+q3KvZV9VTDBfH0nT/lG9sYYyHeMkMDBEEU/5arKELvgOxhEeAUOIxQcIuDpSLuj4yGeP6k=@vger.kernel.org X-Gm-Message-State: AOJu0YyrzgmqOHcmGDxVlnvRMjKjyr7TaM+fGjMLJRS7qjgfW/YuGRsk FL8K4wpUtRvEeeERTy2QGGBE5uceiQLsnPloncSO6A32VFkTaQhCUJe/ X-Gm-Gg: AfdE7cn3jx4jqmOASfjn0k8IvIxaToXZv7vNzWIMMw+TTGQS+COV4joQR2JjNlHslLf /zAV5HU3I9JsInQozMZEG978yyYdJk7iOEu3JQOIWKkH+MQZRk4bEGFguH4VcD1YFaiT/+Nnffc 9duhUduOhgs1j8jhLmmQMH+rXRUg5D17y99cpoNecVYkoiQvfE5sBrgQmx/hm33NlEDfJ8Xs0U3 4MI7EDmw9pQUpFLIPHOYvxq83qZN23Tuq96y2Vpt573WOx3VCmXEj32qQI/LrcJXzZvmsPFoMre EItpDNyWc0ezx1JxNHaJ746QhwMU4thd3WaIR/DtZDlQ8Qhun8TOAGAMzMYLXXmKO7wo3O5d1fX 9uEUhpJAMesvqLqYzuRxPillwrgdfmxU+iAnHt1vDIHdAgyOikB22gB7ODF77ICUmDh2FycOf1c N8dE8XBUvIukfNyR5hyIWR85yp06TDikWYH5zGlFlxm7+Whq8Ruw== X-Received: by 2002:a05:6000:220f:b0:474:7bf8:15d4 with SMTP id ffacd0b85a97d-47f2dcd720bmr7244179f8f.36.1783890307565; Sun, 12 Jul 2026 14:05:07 -0700 (PDT) Received: from ST.. ([102.185.196.44]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47aa039b126sm76460144f8f.24.2026.07.12.14.05.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jul 2026 14:05:07 -0700 (PDT) From: Mohamed Ayman To: Suzuki K Poulose , Mike Leach , James Clark , Leo Yan , Alexander Shishkin , Sebastian Andrzej Siewior , Clark Williams , Steven Rostedt , coresight@lists.linaro.org (moderated list:ARM/CORESIGHT FRAMEWORK AND DRIVERS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/CORESIGHT FRAMEWORK AND DRIVERS), linux-kernel@vger.kernel.org (open list), linux-rt-devel@lists.linux.dev (open list:Real-time Linux (PREEMPT_RT):Keyword:PREEMPT_RT) Cc: Mohamed Ayman , coresight@lists.linaro.org (moderated list:ARM/CORESIGHT FRAMEWORK AND DRIVERS), linux-arm-kernel@lists.infradead.org (moderated list:ARM/CORESIGHT FRAMEWORK AND DRIVERS), linux-kernel@vger.kernel.org (open list), linux-rt-devel@lists.linux.dev (open list:Real-time Linux (PREEMPT_RT):Keyword:PREEMPT_RT) Subject: [PATCH] coresight: Fix scheduling while atomic in coresight_device_release() Date: Mon, 13 Jul 2026 00:04:45 +0300 Message-Id: <20260712210446.14290-1-mohamedaymanworkspace@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dropping the last reference to a coresight_device can trigger a kernel panic on PREEMPT_RT builds due to a "scheduling while atomic" violation. When the CPU enters an idle state, coresight_cpu_pm_notify() is invoked with local interrupts disabled (atomic context). This function eventually calls coresight_put_percpu_source_ref(), which drops the device reference via put_device(). If this is the last reference, it triggers the release chain: coresight_cpu_pm_notify() (IRQs off) -> coresight_put_percpu_source_ref() -> put_device() -> coresight_device_release() -> free_percpu() On a PREEMPT_RT kernel, free_percpu() acquires pcpu_lock, which is implemented as a sleeping rt-mutex. Sleeping while in an atomic context causes a system crash. Fix this by deferring the teardown of the coresight_device to process context. Add a work_struct to `struct coresight_device` and use schedule_work() inside coresight_device_release() to safely execute free_percpu() and kfree() in a worker thread, away from the atomic PM notifier path. Additionally, remove the redundant raw_spinlock_irqsave guard in coresight_put_percpu_source_ref(). The lock was originally intended to protect the per-CPU pointer table, but dropping a reference does not touch this table. Signed-off-by: Mohamed Ayman --- drivers/hwtracing/coresight/coresight-core.c | 28 +++++++++++++------- include/linux/coresight.h | 2 ++ 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c index 6d65c43d5..9dbdb2977 100644 --- a/drivers/hwtracing/coresight/coresight-core.c +++ b/drivers/hwtracing/coresight/coresight-core.c @@ -165,13 +165,6 @@ void coresight_put_percpu_source_ref(struct coresight_device *csdev) guard(raw_spinlock_irqsave)(&coresight_dev_lock); - /* - * TODO: coresight_device_release() is invoked to release resources when - * the device's refcount reaches zero. It then calls free_percpu(), - * which acquires pcpu_lock — a sleepable lock when PREEMPT_RT is - * enabled. Since the raw spinlock coresight_dev_lock is held, this can - * lead to a potential "scheduling while atomic" issue. - */ put_device(&csdev->dev); } @@ -1257,13 +1250,30 @@ static void coresight_clear_default_sink(struct coresight_device *csdev) } } +static void coresight_device_release_work(struct work_struct *work) +{ + struct coresight_device *csdev = + container_of(work, struct coresight_device, free_work); + + free_percpu(csdev->perf_sink_id_map.cpu_map); + kfree(csdev); +} + static void coresight_device_release(struct device *dev) { struct coresight_device *csdev = to_coresight_device(dev); fwnode_handle_put(csdev->dev.fwnode); - free_percpu(csdev->perf_sink_id_map.cpu_map); - kfree(csdev); + + /* + * This release callback can run with the last reference dropped + * from atomic/IRQs-off context (e.g. coresight_put_percpu_source_ref() + * called from the CPU_PM notifier). free_percpu() takes pcpu_lock, + * which is a sleeping lock under PREEMPT_RT, so defer the actual + * teardown to process context. + */ + INIT_WORK(&csdev->free_work, coresight_device_release_work); + schedule_work(&csdev->free_work); } static int coresight_orphan_match(struct device *dev, void *data) diff --git a/include/linux/coresight.h b/include/linux/coresight.h index ddf18c970..63253f6c4 100644 --- a/include/linux/coresight.h +++ b/include/linux/coresight.h @@ -13,6 +13,7 @@ #include #include #include +#include /* Peripheral id registers (0xFD0-0xFEC) */ #define CORESIGHT_PERIPHIDR4 0xfd0 @@ -293,6 +294,7 @@ struct coresight_device { struct csdev_access access; struct device dev; struct coresight_path *path; + struct work_struct free_work; atomic_t mode; int refcnt; int cpu; -- 2.34.1