From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78FDF1C2AA for ; Wed, 8 Apr 2026 13:27:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775654878; cv=none; b=u2MbF68KdFX66dPZPP25f51cLq9KVxjgys9K9LCWOxERHs2QPb8FNgpc1BG/JhwE3UGckBaHMAF4gZ1+8CLOil129b81cXkx6HLnjx6TGH0C78TgO/0ZA1qqsuHY1YCBxpUqwJOGWOWmcNdGEwE0pBJvpokeKHqhgLOnWBRvlug= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775654878; c=relaxed/simple; bh=P3DGNRJKCMq4MTyhW0M1kh845JUD53/YhbzBISX+U6k=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=C5hrIRCWWgXWORuSYvZ5XCBHFSmqaySgYC9YOODGtWsAWfmvl84PAJ6E/cvJ3jxhsjIt4dksBhoDejgUP+N+Jk0hw6mRCPp2iYy+j+OvdnA8mYQPSaKvCZed099F2p8kUDageth0201/PdFph3No9vVc7yh2JytGPYHGvmiLVT4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=IoJq6utT; arc=none smtp.client-ip=209.85.221.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="IoJq6utT" Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-43d0deb7ad5so5481578f8f.2 for ; Wed, 08 Apr 2026 06:27:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1775654876; x=1776259676; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=zNxMD4ebSTuVdeWGIOG/Mq97ZFOA7XKvnQijNMuyPBw=; b=IoJq6utT40LoqDLdfEKmOZj3p+qXdXnE8Gzwq0Cnz473d37ASoq+zFxZOJaVGBQcef T79+1yI8lzX4MOrhO8SslEEkg3j+1YDi28HmihnJOfNlHjqkapjErLuiH0JDP3HqBOSI miSM2IcB6WwEhGID8ieHsK4UeIpQgl2CwvLwL1SQArq0tI2mgv/QJT2iI7t29SVhfttH gFFiPn/wGod1r16JX0uKad8o9azX/DZOV3t9yiJANMfDOvA+bV/WOktUA178VkjhTT18 GjeuKIdj3l2BDauHL081JkhjYTaQppYUePrc3Q2K7ZShBqB4QAXAPXYjm3aGGMYCOCOO Qnpw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775654876; x=1776259676; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=zNxMD4ebSTuVdeWGIOG/Mq97ZFOA7XKvnQijNMuyPBw=; b=pyKUr1Od/6wt7SS4rsVj0aCfbYItEkGNU9hIKKL9jYvv6DqKi+h4hrbhqZkrRQ1xbC bfK3UtLsLxhIHdA5iZMmHfnTP0opVzJY/4BvBPWcOnjMFZGMrk2ah1qPRHdvZppBAq2I tHy80zChBzcFWhXJdFofHR3z8zAD09J1sFU3w0gszGVGdOm84bpTQJh68W5PI4639uMS 4lfy+uvXi85jEijiEDfjmwcc88AeCVVLoEOoehmewQX/td3ZrhMRNMkqDS06x1Vz0Zp2 wYO8TxXxX5RnYOLj7bXBlO7sSm1DKRJoLH+OItS+B7A/9P2uKSg/8uTQF+4Ykytfe9Fv AUYw== X-Forwarded-Encrypted: i=1; AJvYcCXs0nlnQ90/wmoXKiykyH9rthACWq4rsNhOuZHuKpIha21eeT5cvDjUrfTAujYGLZZB8UeosBeO0xPjIOM=@vger.kernel.org X-Gm-Message-State: AOJu0Yy4FQCst9LzP7BPY7FNdsRLpRXhntJBbEO0xzT5NE6TW7vqp9Hm TU6fi8dnn3CHTsQvIPgtxgY5nK5bNmG0Ros3hoBrXcGy8Q9i6MSiudADwfrhdoq/iJI= X-Gm-Gg: AeBDietWowUirgL0ynuUWrlHLDebjvXDVaESEXlpTRbNYaGNNJ+7zLSPVLfsC2XbP9c mg5cZ3IMONowl/NEQEGQqTaegqyEyYe8svySRfmJ2G9QpHNzV0PmFClwL8B6PmZGFQkc3A075BU ZqRv0Vw7NDdbdiROIMN2WTgWzozLdpJNhG1OXKNJM6B7cupHs0md2z/s6A54PK/S382j+a+hIo2 HWK14Ur+BPpkNsfvPTtpAIPEi6pJVh0hL/8pruvF7ggILhcCLSZDLtwvFrdsCNmwg+7xwpmTzlN iwwyJ+ekfBH2fVZPlkplJ+jpoZH+hvCICfPC6jOtyEBYhkv25PTytl89AxKRUDAK46KzRH+jExA E/83IlBMvxXXfSl2+aE1B0qtxeViTuKHGAXHiMYO8bdnB+yuO5naU4+hgoMbTYbUqUM9wvyvuZS rnvm85nC6gakuyLTsWEceTc09hLhiv X-Received: by 2002:a05:6000:400a:b0:43c:f764:6256 with SMTP id ffacd0b85a97d-43d292dbb67mr31327840f8f.37.1775654875832; Wed, 08 Apr 2026 06:27:55 -0700 (PDT) Received: from [192.168.1.3] ([185.48.77.170]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43d1e4f1a99sm62321846f8f.32.2026.04.08.06.27.54 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 08 Apr 2026 06:27:55 -0700 (PDT) Message-ID: <511c0ae1-6ad4-4607-92b5-4ea2be2ee04d@linaro.org> Date: Wed, 8 Apr 2026 14:27:54 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] coresight: tpda: fix race between refcnt check and register access To: Jie Gan Cc: coresight@lists.linaro.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Suzuki K Poulose , Mike Leach , Leo Yan , Alexander Shishkin , Tingwei Zhang , Tao Zhang References: <20260408-fix-race-condition-issue-v1-1-9a148d07e08f@oss.qualcomm.com> Content-Language: en-US From: James Clark In-Reply-To: <20260408-fix-race-condition-issue-v1-1-9a148d07e08f@oss.qualcomm.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit On 08/04/2026 2:23 pm, Jie Gan wrote: > Several sysfs show/store handlers check csdev->refcnt before acquiring > the spinlock, then access hardware registers inside the lock. This is > a race: between the check and the lock acquisition, the following can > occur on another CPU: > > CPU 0 (sysfs reader) CPU 1 (disable path) > ───────────────────────────── ────────────────────────────────── > refcnt == 1, check passes > [waiting for spinlock] tpda_disable(): refcnt → 0 > debug clock disabled > spinlock acquired > readl_relaxed() ← FAULT/hang > > tpda_disable() decrements csdev->refcnt under the same spinlock, so > moving the refcnt check inside the lock closes the race. > > Fix all six affected sysfs handlers: global_flush_req_show/store, > syncr_mode_show, syncr_count_show, and port_flush_req_show/store. > > Fixes: 8e1c358a3b0e ("coresight: tpda: add global_flush_req sysfs node") > Fixes: 33f04ead7c49 ("coresight: tpda: add logic to configure TPDA_SYNCR register") > Fixes: a089d585a7f4 ("coresight: tpda: add sysfs node to flush specific port") > Signed-off-by: Jie Gan Reviewed-by: James Clark > --- > drivers/hwtracing/coresight/coresight-tpda.c | 18 ++++++++++++------ > 1 file changed, 12 insertions(+), 6 deletions(-) > > diff --git a/drivers/hwtracing/coresight/coresight-tpda.c b/drivers/hwtracing/coresight/coresight-tpda.c > index 89c8f71f0aff..63a979312463 100644 > --- a/drivers/hwtracing/coresight/coresight-tpda.c > +++ b/drivers/hwtracing/coresight/coresight-tpda.c > @@ -360,10 +360,10 @@ static ssize_t global_flush_req_show(struct device *dev, > struct tpda_drvdata *drvdata = dev_get_drvdata(dev->parent); > unsigned long val; > > + guard(spinlock)(&drvdata->spinlock); > if (!drvdata->csdev->refcnt) > return -EINVAL; > > - guard(spinlock)(&drvdata->spinlock); > val = readl_relaxed(drvdata->base + TPDA_CR); > /* read global_flush_req bit */ > val &= TPDA_CR_FLREQ; > @@ -382,10 +382,13 @@ static ssize_t global_flush_req_store(struct device *dev, > if (kstrtoul(buf, 0, &val)) > return -EINVAL; > > - if (!drvdata->csdev->refcnt || !val) > + if (!val) > return -EINVAL; > > guard(spinlock)(&drvdata->spinlock); > + if (!drvdata->csdev->refcnt) > + return -EINVAL; > + > val = readl_relaxed(drvdata->base + TPDA_CR); > /* set global_flush_req bit */ > val |= TPDA_CR_FLREQ; > @@ -404,10 +407,10 @@ static ssize_t syncr_mode_show(struct device *dev, > struct tpda_drvdata *drvdata = dev_get_drvdata(dev->parent); > unsigned long val, syncr_val; > > + guard(spinlock)(&drvdata->spinlock); > if (!drvdata->csdev->refcnt) > return -EINVAL; > > - guard(spinlock)(&drvdata->spinlock); > syncr_val = readl_relaxed(drvdata->base + TPDA_SYNCR); > val = FIELD_GET(TPDA_SYNCR_MODE_CTRL_MASK, syncr_val); > > @@ -440,10 +443,10 @@ static ssize_t syncr_count_show(struct device *dev, > struct tpda_drvdata *drvdata = dev_get_drvdata(dev->parent); > unsigned long val; > > + guard(spinlock)(&drvdata->spinlock); > if (!drvdata->csdev->refcnt) > return -EINVAL; > > - guard(spinlock)(&drvdata->spinlock); > val = readl_relaxed(drvdata->base + TPDA_SYNCR); > val &= TPDA_SYNCR_COUNT_MASK; > > @@ -478,10 +481,10 @@ static ssize_t port_flush_req_show(struct device *dev, > struct tpda_drvdata *drvdata = dev_get_drvdata(dev->parent); > unsigned long val; > > + guard(spinlock)(&drvdata->spinlock); > if (!drvdata->csdev->refcnt) > return -EINVAL; > > - guard(spinlock)(&drvdata->spinlock); > val = readl_relaxed(drvdata->base + TPDA_FLUSH_CR); > > return sysfs_emit(buf, "0x%lx\n", val); > @@ -498,10 +501,13 @@ static ssize_t port_flush_req_store(struct device *dev, > if (kstrtou32(buf, 0, &val)) > return -EINVAL; > > - if (!drvdata->csdev->refcnt || !val) > + if (!val) > return -EINVAL; > > guard(spinlock)(&drvdata->spinlock); > + if (!drvdata->csdev->refcnt) > + return -EINVAL; > + > CS_UNLOCK(drvdata->base); > writel_relaxed(val, drvdata->base + TPDA_FLUSH_CR); > CS_LOCK(drvdata->base); > > --- > base-commit: f3e6330d7fe42b204af05a2dbc68b379e0ad179e > change-id: 20260408-fix-race-condition-issue-d44203254b87 > > Best regards,