From: Jie Gan <jie.gan@oss.qualcomm.com>
To: Suzuki K Poulose <suzuki.poulose@arm.com>,
Mike Leach <mike.leach@arm.com>,
James Clark <james.clark@linaro.org>, Leo Yan <leo.yan@arm.com>,
Alexander Shishkin <alexander.shishkin@linux.intel.com>,
Maxime Coquelin <mcoquelin.stm32@gmail.com>,
Alexandre Torgue <alexandre.torgue@foss.st.com>,
Yeoreum Yun <yeoreum.yun@arm.com>,
Tingwei Zhang <tingwei.zhang@oss.qualcomm.com>
Cc: coresight@lists.linaro.org, linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org,
linux-stm32@st-md-mailman.stormreply.com
Subject: Re: [PATCH v2] coresight: Fix clock refcount imbalance on platform probe failure
Date: Mon, 9 Nov 2026 09:32:33 +0800 [thread overview]
Message-ID: <42ac8b93-d8d4-464f-a834-89303db792ed@oss.qualcomm.com> (raw)
In-Reply-To: <20260910-fix-clk-issue-v2-1-fda3dd324c0b@oss.qualcomm.com>
On 9/10/2026 9:17 AM, Jie Gan wrote:
> Each CoreSight platform_driver's probe() enables its clocks via
> coresight_get_enable_clocks() -> devm_clk_get_optional_enabled(), which
> registers a devm cleanup to run clk_disable_unprepare() on driver
> detach. The probe wrapper then unconditionally calls pm_runtime_put()
> regardless of whether the inner probe succeeded, so on failure this
> also fires runtime_suspend() and disables the same clocks a first
> time. The driver core then unwinds the failed probe and runs the devm
> cleanup, disabling them a second time and underflowing the refcount:
>
> coresight-etm4x etm0: probe with driver coresight-etm4x failed with error -22
> ------------[ cut here ]------------
> qdss_clk already disabled
> WARNING: CPU: 1 PID: 432 at drivers/clk/clk.c:1188 clk_core_disable+0x1d0/0x218
> ...
> ------------[ cut here ]------------
> Unpreparing enabled qdss_clk
> WARNING: CPU: 0 PID: 432 at drivers/clk/clk.c:1061 clk_core_unprepare+0x248/0x268
> ...
>
> qdss_clk is shared by every CoreSight node, so the extra disable drives
> its refcount to 0 while sibling devices still expect it enabled. The
> next funnel to probe then touches unclocked hardware and panics:
>
> SError Interrupt on CPU1, code 0x00000000be000000 -- SError
> Kernel panic - not syncing: Asynchronous SError Interrupt
> ...
> coresight_clear_self_claim_tag+0x7c/0x1e0 [coresight] (P)
> funnel_probe+0x114/0x2e0 [coresight_funnel]
> dynamic_funnel_probe+0x24/0x70 [coresight_funnel]
>
> On the failure path, disable runtime PM before releasing the usage
> reference: call pm_runtime_disable() first so no further
> runtime_suspend() can be scheduled, then pm_runtime_set_suspended() to
> explicitly record the suspended state, and finally
> pm_runtime_put_noidle() to drop the reference without invoking
> runtime_suspend(), leaving the devm cleanup as the sole disabler of
> the clocks.
>
> Affects catu, ctcu, etm4x, funnel, replicator, stm, tmc, tpiu and tnoc,
> all of which share this probe skeleton.
>
Gentle ping
> Reviewed-by: Leo Yan <leo.yan@arm.com>
> Fixes: 1abc1b212eff ("coresight: Appropriately disable programming clocks")
> Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
> ---
> Changes in v2:
> - update the workflow regarding to Leo's suggestion.
> - Link to v1: https://lore.kernel.org/r/20260907-fix-clk-issue-v1-1-efe81fa2b697@oss.qualcomm.com
> ---
> drivers/hwtracing/coresight/coresight-catu.c | 10 +++++++---
> drivers/hwtracing/coresight/coresight-ctcu-core.c | 10 +++++++---
> drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 +++++++----
> drivers/hwtracing/coresight/coresight-funnel.c | 10 +++++++---
> drivers/hwtracing/coresight/coresight-replicator.c | 10 +++++++---
> drivers/hwtracing/coresight/coresight-stm.c | 10 +++++++---
> drivers/hwtracing/coresight/coresight-tmc-core.c | 10 +++++++---
> drivers/hwtracing/coresight/coresight-tnoc.c | 10 +++++++---
> drivers/hwtracing/coresight/coresight-tpiu.c | 10 +++++++---
> 9 files changed, 63 insertions(+), 28 deletions(-)
>
> diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
> index ad8dafea7d2f..4e2687e61c9a 100644
> --- a/drivers/hwtracing/coresight/coresight-catu.c
> +++ b/drivers/hwtracing/coresight/coresight-catu.c
> @@ -632,11 +632,15 @@ static int catu_platform_probe(struct platform_device *pdev)
> pm_runtime_enable(&pdev->dev);
>
> ret = __catu_probe(&pdev->dev, res);
> - pm_runtime_put(&pdev->dev);
> - if (ret)
> + if (ret) {
> pm_runtime_disable(&pdev->dev);
> + pm_runtime_set_suspended(&pdev->dev);
> + pm_runtime_put_noidle(&pdev->dev);
> + return ret;
> + }
>
> - return ret;
> + pm_runtime_put(&pdev->dev);
> + return 0;
> }
>
> static void catu_platform_remove(struct platform_device *pdev)
> diff --git a/drivers/hwtracing/coresight/coresight-ctcu-core.c b/drivers/hwtracing/coresight/coresight-ctcu-core.c
> index 9043cad42f01..5827b6d5844f 100644
> --- a/drivers/hwtracing/coresight/coresight-ctcu-core.c
> +++ b/drivers/hwtracing/coresight/coresight-ctcu-core.c
> @@ -251,11 +251,15 @@ static int ctcu_platform_probe(struct platform_device *pdev)
> pm_runtime_enable(&pdev->dev);
>
> ret = ctcu_probe(pdev);
> - pm_runtime_put(&pdev->dev);
> - if (ret)
> + if (ret) {
> pm_runtime_disable(&pdev->dev);
> + pm_runtime_set_suspended(&pdev->dev);
> + pm_runtime_put_noidle(&pdev->dev);
> + return ret;
> + }
>
> - return ret;
> + pm_runtime_put(&pdev->dev);
> + return 0;
> }
>
> static void ctcu_platform_remove(struct platform_device *pdev)
> diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
> index 2247ad55d444..48050f86ead5 100644
> --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
> +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
> @@ -2330,12 +2330,15 @@ static int etm4_probe_platform_dev(struct platform_device *pdev)
> pm_runtime_enable(&pdev->dev);
>
> ret = etm4_probe(&pdev->dev);
> + if (ret) {
> + pm_runtime_disable(&pdev->dev);
> + pm_runtime_set_suspended(&pdev->dev);
> + pm_runtime_put_noidle(&pdev->dev);
> + return ret;
> + }
>
> pm_runtime_put(&pdev->dev);
> - if (ret)
> - pm_runtime_disable(&pdev->dev);
> -
> - return ret;
> + return 0;
> }
>
> static int etm4_probe_cpu(unsigned int cpu)
> diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
> index 0abc11f0690c..264964a340ec 100644
> --- a/drivers/hwtracing/coresight/coresight-funnel.c
> +++ b/drivers/hwtracing/coresight/coresight-funnel.c
> @@ -319,11 +319,15 @@ static int funnel_platform_probe(struct platform_device *pdev)
> pm_runtime_enable(&pdev->dev);
>
> ret = funnel_probe(&pdev->dev, res);
> - pm_runtime_put(&pdev->dev);
> - if (ret)
> + if (ret) {
> pm_runtime_disable(&pdev->dev);
> + pm_runtime_set_suspended(&pdev->dev);
> + pm_runtime_put_noidle(&pdev->dev);
> + return ret;
> + }
>
> - return ret;
> + pm_runtime_put(&pdev->dev);
> + return 0;
> }
>
> static void funnel_platform_remove(struct platform_device *pdev)
> diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
> index 2f382de357ee..93274ab0cfaa 100644
> --- a/drivers/hwtracing/coresight/coresight-replicator.c
> +++ b/drivers/hwtracing/coresight/coresight-replicator.c
> @@ -298,11 +298,15 @@ static int replicator_platform_probe(struct platform_device *pdev)
> pm_runtime_enable(&pdev->dev);
>
> ret = replicator_probe(&pdev->dev, res);
> - pm_runtime_put(&pdev->dev);
> - if (ret)
> + if (ret) {
> pm_runtime_disable(&pdev->dev);
> + pm_runtime_set_suspended(&pdev->dev);
> + pm_runtime_put_noidle(&pdev->dev);
> + return ret;
> + }
>
> - return ret;
> + pm_runtime_put(&pdev->dev);
> + return 0;
> }
>
> static void replicator_platform_remove(struct platform_device *pdev)
> diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
> index 4e860519a73f..88726274ebeb 100644
> --- a/drivers/hwtracing/coresight/coresight-stm.c
> +++ b/drivers/hwtracing/coresight/coresight-stm.c
> @@ -1011,11 +1011,15 @@ static int stm_platform_probe(struct platform_device *pdev)
> pm_runtime_enable(&pdev->dev);
>
> ret = __stm_probe(&pdev->dev, res);
> - pm_runtime_put(&pdev->dev);
> - if (ret)
> + if (ret) {
> pm_runtime_disable(&pdev->dev);
> + pm_runtime_set_suspended(&pdev->dev);
> + pm_runtime_put_noidle(&pdev->dev);
> + return ret;
> + }
>
> - return ret;
> + pm_runtime_put(&pdev->dev);
> + return 0;
> }
>
> static void stm_platform_remove(struct platform_device *pdev)
> diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c
> index bc5a133ada3e..c4fe2dde5bf8 100644
> --- a/drivers/hwtracing/coresight/coresight-tmc-core.c
> +++ b/drivers/hwtracing/coresight/coresight-tmc-core.c
> @@ -974,11 +974,15 @@ static int tmc_platform_probe(struct platform_device *pdev)
> pm_runtime_enable(&pdev->dev);
>
> ret = __tmc_probe(&pdev->dev, res);
> - pm_runtime_put(&pdev->dev);
> - if (ret)
> + if (ret) {
> pm_runtime_disable(&pdev->dev);
> + pm_runtime_set_suspended(&pdev->dev);
> + pm_runtime_put_noidle(&pdev->dev);
> + return ret;
> + }
>
> - return ret;
> + pm_runtime_put(&pdev->dev);
> + return 0;
> }
>
> static void tmc_platform_remove(struct platform_device *pdev)
> diff --git a/drivers/hwtracing/coresight/coresight-tnoc.c b/drivers/hwtracing/coresight/coresight-tnoc.c
> index 9e8de4323d28..4479d93f352b 100644
> --- a/drivers/hwtracing/coresight/coresight-tnoc.c
> +++ b/drivers/hwtracing/coresight/coresight-tnoc.c
> @@ -288,11 +288,15 @@ static int itnoc_probe(struct platform_device *pdev)
> pm_runtime_enable(&pdev->dev);
>
> ret = _tnoc_probe(&pdev->dev, res);
> - pm_runtime_put(&pdev->dev);
> - if (ret)
> + if (ret) {
> pm_runtime_disable(&pdev->dev);
> + pm_runtime_set_suspended(&pdev->dev);
> + pm_runtime_put_noidle(&pdev->dev);
> + return ret;
> + }
>
> - return ret;
> + pm_runtime_put(&pdev->dev);
> + return 0;
> }
>
> static void itnoc_remove(struct platform_device *pdev)
> diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
> index 7b029d2eb389..3166ed6bc224 100644
> --- a/drivers/hwtracing/coresight/coresight-tpiu.c
> +++ b/drivers/hwtracing/coresight/coresight-tpiu.c
> @@ -271,11 +271,15 @@ static int tpiu_platform_probe(struct platform_device *pdev)
> pm_runtime_enable(&pdev->dev);
>
> ret = __tpiu_probe(&pdev->dev, res);
> - pm_runtime_put(&pdev->dev);
> - if (ret)
> + if (ret) {
> pm_runtime_disable(&pdev->dev);
> + pm_runtime_set_suspended(&pdev->dev);
> + pm_runtime_put_noidle(&pdev->dev);
> + return ret;
> + }
>
> - return ret;
> + pm_runtime_put(&pdev->dev);
> + return 0;
> }
>
> static void tpiu_platform_remove(struct platform_device *pdev)
>
> ---
> base-commit: af5f12805e5cefa4fe68d6127c7e1fb78cd5535c
> change-id: 20260907-fix-clk-issue-51e43c533250
>
> Best regards,
prev parent reply other threads:[~2026-11-09 1:32 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-10 1:17 Jie Gan
2026-11-09 1:32 ` Jie Gan [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=42ac8b93-d8d4-464f-a834-89303db792ed@oss.qualcomm.com \
--to=jie.gan@oss.qualcomm.com \
--cc=alexander.shishkin@linux.intel.com \
--cc=alexandre.torgue@foss.st.com \
--cc=coresight@lists.linaro.org \
--cc=james.clark@linaro.org \
--cc=leo.yan@arm.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-stm32@st-md-mailman.stormreply.com \
--cc=mcoquelin.stm32@gmail.com \
--cc=mike.leach@arm.com \
--cc=suzuki.poulose@arm.com \
--cc=tingwei.zhang@oss.qualcomm.com \
--cc=yeoreum.yun@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®