[#4324] unload spi_mmc driver module may cause race condition when spi framework is enabled

Submitted By: Yi Li

Open Date

2008-08-07 23:44:13 Close Date

2008-08-11 04:50:50

Priority:

Medium Assignee:

Yi Li

Status:

Closed Fixed In Release:

N/A

Found In Release:

N/A Release:

2008r1 branch

Category:

N/A Board:

STAMP

Processor:

BF537 Silicon Revision:

Is this bug repeatable?:

Yes Resolution:

Rejected

Uboot version or rev.:

Toolchain version or rev.:

App binary format:

N/A

Summary: unload spi_mmc driver module may cause race condition when spi framework is enabled

Details:

As reported in forum thread:

blackfin.uclinux.org/gf/project/uclinux-dist/forum/?action=ForumBrowse&forum_id=39&_forum_action=ForumMessageBrowse&thread_id=28878

If kernel configure enables:

# SPI support

CONFIG_SPI=y

CONFIG_SPI_MASTER=y

and

"CONFIG_SPI_MMC=m

# CONFIG_SPI_MMC_FRAMEWORK_DRIVER is not set

CONFIG_SPI_MMC_BFIN_PIO_SPI=y"

at the same time, unloading "spi_mmc" driver module may cause warning (and exception).

root:/> modprobe spi_mmc

mmc_pio_spi:cs_#: 0x4, baud=0x0, flag=0xff00, ctrl=0x400

root:/> modprobe -r spi_mmc

WARNING: at lib/kref.c:33 kref_get()

Hardware Trace:

0 Target : <0x0000479c> { _dump_stack + 0x0 }

Source : <0x0007beec> { _kref_get + 0x54 }

1 Target : <0x0007beec> { _kref_get + 0x54 }

Source : <0x0000d702> { _printk + 0x16 }

2 Target : <0x0000d6fe> { _printk + 0x12 }

Source : <0x0000d5b4> { _vprintk + 0x1b8 }

3 Target : <0x0000d5a8> { _vprintk + 0x1ac }

Source : <0xffa00cf0> { __common_int_entry + 0xd8 }

4 Target : <0xffa00c8e> { __common_int_entry + 0x76 }

Source : <0xffa00ac0> { _return_from_int + 0x58 }

5 Target : <0xffa00ac0> { _return_from_int + 0x58 }

Source : <0xffa00a96> { _return_from_int + 0x2e }

6 Target : <0xffa00a68> { _return_from_int + 0x0 }

Source : <0xffa00c8a> { __common_int_entry + 0x72 }

7 Target : <0xffa00c88> { __common_int_entry + 0x70 }

Source : <0xffa003ec> { _asm_do_IRQ + 0x68 }

8 Target : <0xffa003e4> { _asm_do_IRQ + 0x60 }

Source : <0x000117ee> { __local_bh_enable + 0x3e }

9 Target : <0x000117b0> { __local_bh_enable + 0x0 }

Source : <0x000118f8> { ___do_softirq + 0x94 }

10 Target : <0x000118f0> { ___do_softirq + 0x8c }

Source : <0x000118d0> { ___do_softirq + 0x6c }

11 Target : <0x000118c4> { ___do_softirq + 0x60 }

Source : <0x000119d8> { _tasklet_action + 0x7c }

12 Target : <0x000119d2> { _tasklet_action + 0x76 }

Source : <0x000119ae> { _tasklet_action + 0x52 }

13 Target : <0x000119ac> { _tasklet_action + 0x50 }

Source : <0x0001b456> { ___rcu_process_callbacks + 0xb6 }

14 Target : <0x0001b450> { ___rcu_process_callbacks + 0xb0 }

Source : <0x0001b3e6> { ___rcu_process_callbacks + 0x46 }

15 Target : <0x0001b3e2> { ___rcu_process_callbacks + 0x42 }

Source : <0x0001b47e> { ___rcu_process_callbacks + 0xde }

Stack from 00421e08:

0002dbb2 0007bef0 0378ed44 0378ed2c 00000000 0012944c 00000021 000ffe88

0007b342 0378eec0 0000006a 00000044 00000003 000947ee 0378ed24 00000000

037cca60 00000001 00094806 00000017 00421e80 00009bfe 00093bd8 00094760

00000000 00421ea8 00014658 006bd3a0 0378d08e 0378eec0 00146578 00000081

033ecfe8 00000001 00000000 000268da 0043c028 00000000 0000000a 00421ea0

5f697073 00636d6d 00000000 00000000 00000000 00000000 00000000 00000000

Call Trace:

[<00026760>] _sys_delete_module+0x0/0x1e8

[<0000fffe>] _do_exit+0x57a/0x760

[<00008000>] _sram_free+0x14/0x44

[<0015cec5>] _bfin_init_mmr_debugfs+0x48c5/0x7074

[<0015e181>] _bfin_init_mmr_debugfs+0x5b81/0x7074

[<0015cec4>] _bfin_init_mmr_debugfs+0x48c4/0x7074

[<0015e174>] _bfin_init_mmr_debugfs+0x5b74/0x7074

WARNING: at lib/kref.c:33 kref_get()

Hardware Trace:

0 Target : <0x0000479c> { _dump_stack + 0x0 }

Source : <0x0007beec> { _kref_get + 0x54 }

1 Target : <0x0007beec> { _kref_get + 0x54 }

Source : <0x0000d702> { _printk + 0x16 }

2 Target : <0x0000d6fe> { _printk + 0x12 }

Source : <0x0000d5b4> { _vprintk + 0x1b8 }

3 Target : <0x0000d5a8> { _vprintk + 0x1ac }

Source : <0xffa00cf0> { __common_int_entry + 0xd8 }

4 Target : <0xffa00c8e> { __common_int_entry + 0x76 }

Source : <0xffa00ac0> { _return_from_int + 0x58 }

5 Target : <0xffa00ac0> { _return_from_int + 0x58 }

Source : <0xffa00a96> { _return_from_int + 0x2e }

6 Target : <0xffa00a68> { _return_from_int + 0x0 }

Source : <0xffa00c8a> { __common_int_entry + 0x72 }

7 Target : <0xffa00c88> { __common_int_entry + 0x70 }

Source : <0xffa003ec> { _asm_do_IRQ + 0x68 }

8 Target : <0xffa003e4> { _asm_do_IRQ + 0x60 }

Source : <0x000117ee> { __local_bh_enable + 0x3e }

9 Target : <0x000117b0> { __local_bh_enable + 0x0 }

Source : <0x000118f8> { ___do_softirq + 0x94 }

10 Target : <0x000118f0> { ___do_softirq + 0x8c }

Source : <0x000118d0> { ___do_softirq + 0x6c }

11 Target : <0x000118c4> { ___do_softirq + 0x60 }

Source : <0x000119d8> { _tasklet_action + 0x7c }

12 Target : <0x000119d2> { _tasklet_action + 0x76 }

Source : <0x000119ae> { _tasklet_action + 0x52 }

13 Target : <0x000119ac> { _tasklet_action + 0x50 }

Source : <0x0001b456> { ___rcu_process_callbacks + 0xb6 }

14 Target : <0x0001b450> { ___rcu_process_callbacks + 0xb0 }

Source : <0x0001b3e6> { ___rcu_process_callbacks + 0x46 }

15 Target : <0x0001b3e2> { ___rcu_process_callbacks + 0x42 }

Source : <0x0001b47e> { ___rcu_process_callbacks + 0xde }

Stack from 00421e08:

0002dbb2 0007bef0 0378ed44 0378ed2c 00000000 0012944c 00000021 000ffe88

0007b342 0378eec0 0000006a 00000044 00000003 000947ee 0378ed24 0378ed24

00000081 0007b304 00094806 00000017 00421e80 00009bfe 00093be6 00094760

00000000 00421ea8 00014658 006bd3a0 0378d08e 0378eec0 00146578 00000081

033ecfe8 00000001 00000000 000268da 0043c028 00000000 0000000a 00421ea0

5f697073 00636d6d 00000000 00000000 00000000 00000000 00000000 00000000

Call Trace:

[<00026760>] _sys_delete_module+0x0/0x1e8

[<0000fffe>] _do_exit+0x57a/0x760

[<00008000>] _sram_free+0x14/0x44

[<0015cec5>] _bfin_init_mmr_debugfs+0x48c5/0x7074

[<0015e181>] _bfin_init_mmr_debugfs+0x5b81/0x7074

[<0015cec4>] _bfin_init_mmr_debugfs+0x48c4/0x7074

[<0015e174>] _bfin_init_mmr_debugfs+0x5b74/0x7074

NULL pointer access (probably)

Kernel OOPS in progress

Defered Exception context

CURRENT PROCESS:

COMM=rmmod PID=102

TEXT = 0x00600000-0x00656e40 DATA = 0x00430e40-0x0043c134

BSS = 0x0043c134-0x00440000 USER-STACK = 0x0045feb0

return address: [0x000f6e8a]; contents of:

0x000f6e60: 3045 0064 6c66 0127 3006 05b3 0010 ac5a

0x000f6e70: 3042 0807 17eb 6006 2fef ac5a 9117 2fe3

0x000f6e80: 05fd 3228 0167 6fa6 916a [a0d7] e3ff ffc2

0x000f6e90: 0c00 1c09 0c07 1807 3217 6c66 0127 3045

SEQUENCER STATUS: Not tainted

SEQSTAT: 00000027 IPEND: 8030 SYSCFG: 0006

HWERRCAUSE: 0x0

EXCAUSE : 0x27

physical IVG15 asserted : <0xffa00e50> { _evt_system_call + 0x0 }

logical irq 6 mapped : <0xffa00250> { _timer_interrupt + 0x0 }

logical irq 18 mapped : <0x000912b8> { _bfin_serial_dma_rx_int + 0x0 }

logical irq 19 mapped : <0x00091224> { _bfin_serial_dma_tx_int + 0x0 }

logical irq 24 mapped : <0x0009abd4> { _bf537mac_interrupt + 0x0 }

RETE: <0x00000000> /* Maybe null pointer? */

RETN: <0x00421e40> /* unknown address */

RETX: <0x000f6e8a> { _klist_del + 0xa }

RETS: <0x000f6f18> { _klist_remove + 0xc }

PC : <0x000f6e8a> { _klist_del + 0xa }

DCPLB_FAULT_ADDR: <0x0000000c> /* Maybe null pointer? */

ICPLB_FAULT_ADDR: <0x000f6e8a> { _klist_del + 0xa }

PROCESSOR STATE:

R0 : 0378ed78 R1 : 0378ed24 R2 : 0000001f R3 : 0000001f

R4 : 00608850 R5 : 00432108 R6 : 00000000 R7 : 0378ed78

P0 : 0000000a P1 : 0014c954 P2 : 00000000 P3 : 0014d764

P4 : 0378ed24 P5 : 0378ed78 FP : 0045fd54 SP : 00421d64

LB0: 0015e181 LT0: 0015e174 LC0: 00000000

LB1: 0007eaec LT1: 0007eae2 LC1: 00000000

B0 : 00000000 L0 : 00000000 M0 : 00000000 I0 : 033ecfe8

B1 : 00000000 L1 : 00000000 M1 : 03362bac I1 : 0000180b

B2 : 00000000 L2 : 00000000 M2 : 033e4534 I2 : 00421cc4

B3 : 00000000 L3 : 00000000 M3 : 033e453c I3 : 00000000

A0.w: 0000007f A0.x: 00000000 A1.w: 0000007f A1.x: 00000000

USP : 0045fd48 ASTAT: 02002020

Hardware Trace:

0 Target : <0x000048c0> { _trap_c + 0x0 }

Source : <0xffa0075c> { _exception_to_level5 + 0xb4 }

1 Target : <0xffa006a8> { _exception_to_level5 + 0x0 }

Source : <0xffa00604> { _ex_trap_c + 0x5c }

2 Target : <0xffa005a8> { _ex_trap_c + 0x0 }

Source : <0xffa00442> { _ex_workaround_261 + 0x22 }

3 Target : <0xffa00420> { _ex_workaround_261 + 0x0 }

Source : <0xffa007fc> { _trap + 0x28 }

4 Target : <0xffa007d4> { _trap + 0x0 }

Source : <0xffa0054a> { _bfin_return_from_exception + 0xe }

5 Target : <0xffa0053c> { _bfin_return_from_exception + 0x0 }

Source : <0xffa00432> { _ex_workaround_261 + 0x12 }

6 Target : <0xffa00420> { _ex_workaround_261 + 0x0 }

Source : <0xffa007fc> { _trap + 0x28 }

7 Target : <0xffa007d4> { _trap + 0x0 }

Source : <0x000f6e88> { _klist_del + 0x8 }

8 Target : <0x000f6e80> { _klist_del + 0x0 }

Source : <0x000f6f14> { _klist_remove + 0x8 }

9 Target : <0x000f6f0c> { _klist_remove + 0x0 }

Source : <0x00093c1a> { _bus_remove_driver + 0x5e }

10 Target : <0x00093c12> { _bus_remove_driver + 0x56 }

Source : <0x00093bee> { _bus_remove_driver + 0x32 }

11 Target : <0x00093be6> { _bus_remove_driver + 0x2a }

Source : <0x0007be4a> { _kref_put + 0x52 }

12 Target : <0x0007be42> { _kref_put + 0x4a }

Source : <0x0007b2a6> { _kobject_put + 0x12 }

13 Target : <0x0007b2a6> { _kobject_put + 0x12 }

Source : <0x0007b296> { _kobject_put + 0x2 }

14 Target : <0x0007b294> { _kobject_put + 0x0 }

Source : <0x0007b2fc> { _kobject_cleanup + 0x54 }

15 Target : <0x0007b2f4> { _kobject_cleanup + 0x4c }

Source : <0x0007b2ea> { _kobject_cleanup + 0x42 }

Stack from 00421d44:

00421d48 ffa00760 0014656c 0014656c 00146568 63725f5f 72705f75 7365636f

000f6e8a 00008030 00000027 00000000 00421e40 000f6e8a 000f6e8a 000f6f18

0378ed78 02002020 0007eaec 0015e181 0007eae2 0015e174 00000000 00000000

0000007f 00000000 0000007f 00000000 00000000 00000000 00000000 00000000

00000000 00000000 00000000 00000000 033e453c 033e4534 03362bac 00000000

00000000 00421cc4 0000180b 033ecfe8 0045fd48 0045fd54 0378ed78 0378ed24

Call Trace:

[<000f6f18>] _klist_remove+0xc/0x1c

[<00009bfe>] _task_running_tick+0x202/0x278

[<00093be6>] _bus_remove_driver+0x2a/0x8c

[<00093c1e>] _bus_remove_driver+0x62/0x8c

[<00094760>] _driver_unregister+0x0/0x4

[<00014658>] _run_timer_softirq+0x14/0x16c

[<0378d08e>] _cleanup_module+0x1a/0x2c [spi_mmc]

[<000268da>] _sys_delete_module+0x17a/0x1e8

[<00026760>] _sys_delete_module+0x0/0x1e8

[<0000fffe>] _do_exit+0x57a/0x760

[<00008000>] _sram_free+0x14/0x44

[<0015cec5>] _bfin_init_mmr_debugfs+0x48c5/0x7074

[<0015e181>] _bfin_init_mmr_debugfs+0x5b81/0x7074

[<0015cec4>] _bfin_init_mmr_debugfs+0x48c4/0x7074

[<0015e174>] _bfin_init_mmr_debugfs+0x5b74/0x7074

Modules linked in: spi_mmc

Kernel panic - not syncing: Kernel exception

Follow-ups

--- Yi Li 2008-08-08 00:46:38

A fix the Kconfig has been checked into svn branch 2008R1:

(Sorry for the reverse order)

Revision

5122

Author

adamliyi

Date

2008-08-07 22:28:34 -0500 (Thu, 07 Aug 2008)

Log Message

When selecting to use SPI PIO mode, make sure SPI_MASTER will not be enabled.

Otherwise, there would be exception when unloading the driver.

See forum thread:

blackfin.uclinux.org/gf/project/uclinux-dist/forum/?action=ForumBrowse&forum_id=39&_forum_action=ForumMessageBrowse&thread_id=28878

Modified Paths

branches/2008R1/drivers/mmc/spi_mmc/Kconfig

* Diff

Modified: branches/2008R1/drivers/mmc/spi_mmc/Kconfig (5121 => 5122)

--- branches/2008R1/drivers/mmc/spi_mmc/Kconfig 2008-08-07 14:59:20 UTC (rev

5121)

+++ branches/2008R1/drivers/mmc/spi_mmc/Kconfig 2008-08-08 03:28:34 UTC (rev

5122)

@@ -23,13 +23,13 @@

config SPI_MMC_FRAMEWORK_DRIVER

bool "SPI framework master"

- depends on SPI

+ depends on SPI_MASTER

help

Will use the SPI master of the system. This option is platform indepenent.

config SPI_MMC_BFIN_PIO_SPI

bool "Blackfin SPI bus directly"

- depends on BLACKFIN

+ depends on BLACKFIN && !SPI_MASTER

help

Will use Blackfin SPI bus directly. No other SPI device should be used with

this option.

The MMC/SD card will be driven in SPI PIO mode. This is a failsafe option

for testing.

--- Yi Li 2008-08-08 04:39:41

Sonic mentions this fix is not good in case of BF548 (and other system with more

than on SPI bus). It is possible to set SPI framework managing one bus, while

allow other device using another bus exclusively (without using the framework).

--- Yi Li 2008-08-11 00:33:43

I will revert the fix - Even if using "SPI_MMC_BFIN_PIO_SPI" driver

when "CONFIG_SPI" is enabled will cause problems, we don't limit the

user to Build the driver - it is their responsibility to use it correctly.

--- Yi Li 2008-08-11 05:50:52

Since this is not a bug - close it.

Files

Changes

Commits

Dependencies

Duplicates

Associations