Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <CA+G9fYv94gx8+-JMzbmQaue3q3y6QdBmsGUCdD-26X5XavL3Ag@mail.gmail.com>
 <ZAocZRZh4FQRH3lc@smile.fi.intel.com> <CA+G9fYsOttth+k3Ki8LK_ZiayvXa0bAg-DmQAaFHZeEyR=6Lrw@mail.gmail.com>
In-Reply-To: <CA+G9fYsOttth+k3Ki8LK_ZiayvXa0bAg-DmQAaFHZeEyR=6Lrw@mail.gmail.com>
From:   Linus Walleij <linus.walleij@linaro.org>
Date:   Tue, 11 Apr 2023 10:57:28 +0200
Message-ID: <CACRpkdbUYWcFiRh+Y=MOekv2RjSP4sB2t5tVrSsz54Eez6wmVg@mail.gmail.com>
Subject: Re: selftests: gpio: crash on arm64
To:     Naresh Kamboju <naresh.kamboju@linaro.org>,
        Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Cc:     "open list:GPIO SUBSYSTEM" <linux-gpio@vger.kernel.org>,
        Andy Shevchenko <andriy.shevchenko@linux.intel.com>,
        Anders Roxell <anders.roxell@linaro.org>,
        Linux-Next Mailing List <linux-next@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        lkft-triage@lists.linaro.org,
        "open list:KERNEL SELFTEST FRAMEWORK" 
        <linux-kselftest@vger.kernel.org>, linux-mm <linux-mm@kvack.org>,
        Arnd Bergmann <arnd@arndb.de>, Shuah Khan <shuah@kernel.org>,
        Bartosz Golaszewski <brgl@bgdev.pl>,
        Andrew Morton <akpm@linux-foundation.org>,
        Pengfei Xu <pengfei.xu@intel.com>, yi1.lai@intel.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Mon, Apr 10, 2023 at 11:16=E2=80=AFAM Naresh Kamboju
<naresh.kamboju@linaro.org> wrote:
(...)
> Anders performed bisection on this problem.
> The bisection have been poing to this commit log,
>   first bad commit: [24c94060fc9b4e0f19e6e018869db46db21d6bc7]
>     gpiolib: ensure that fwnode is properly set

I don't think this is the real issue.

(...)
> # 2.  Module load error tests
> # 2.1 gpio overflow
(...)
> [   88.900984] Freed in software_node_release+0xdc/0x108 age=3D34 cpu=3D1=
 pid=3D683
> [   88.907899]  __kmem_cache_free+0x2a4/0x2e0
> [   88.912024]  kfree+0xc0/0x1a0
> [   88.915015]  software_node_release+0xdc/0x108
> [   88.919402]  kobject_put+0xb0/0x220
> [   88.922919]  software_node_notify_remove+0x98/0xe8
> [   88.927741]  device_del+0x184/0x380
> [   88.931259]  platform_device_del.part.0+0x24/0xa8
> [   88.935995]  platform_device_unregister+0x30/0x50

I think the refcount is wrong on the fwnode.

The chip is allocated with devm_gpiochip_add_data() which will not call
gpiochip_remove() until all references are removed by calling
devm_gpio_chip_release().

Add a pr_info() devm_gpio_chip_release() in drivers/gpio/gpiolib-devres.c
and see if the callback is even called. I think this could be the
problem: if that isn't cleaned up, there will be dangling references.

diff --git a/drivers/gpio/gpiolib-devres.c b/drivers/gpio/gpiolib-devres.c
index fe9ce6b19f15..30a0622210d7 100644
--- a/drivers/gpio/gpiolib-devres.c
+++ b/drivers/gpio/gpiolib-devres.c
@@ -394,6 +394,7 @@ static void devm_gpio_chip_release(void *data)
 {
        struct gpio_chip *gc =3D data;

+       pr_info("GPIOCHIP %s WAS REMOVED BY DEVRES\n", gc->label);
        gpiochip_remove(gc);
 }

If this isn't working we need to figure out what is holding a reference to
the gpiochip.

I don't know how the references to the gpiochip fwnode is supposed to
drop to zero though? I didn't work with mockup much ...

What I could think of is that maybe the mockup driver need a .shutdown()
callback to forcibly call gpiochip_remove(), and in that case it should
be wrapped in a non-existining devm_gpiochip_remove() since devres
is used to register it.

Bartosz will know better though! I am pretty sure he has this working
flawlessly so the tests must be doing something weird which is leaving
references around.

Yours,
Linus Walleij