From patchwork Wed Mar 28 16:03:51 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Keeping X-Patchwork-Id: 10313547 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3327060353 for ; Wed, 28 Mar 2018 16:21:28 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 25C2D2921E for ; Wed, 28 Mar 2018 16:21:28 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2438D29F8B; Wed, 28 Mar 2018 16:21:28 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id A4C0C29AA7 for ; Wed, 28 Mar 2018 16:21:27 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 7C7C46E4C2; Wed, 28 Mar 2018 16:21:26 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org X-Greylist: delayed 1030 seconds by postgrey-1.36 at gabe; Wed, 28 Mar 2018 16:21:24 UTC Received: from metanate.com (dougal.metanate.com [90.155.101.14]) by gabe.freedesktop.org (Postfix) with ESMTPS id 21EF86E38A for ; Wed, 28 Mar 2018 16:21:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=simple/simple; d=metanate.com; s=stronger; h=Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To: MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Lh1REr0jukmQeK0Am4uPougUZDSNUy31OxEFdOosIvA=; b=UoW0iYkmM1LdgSkICtf4mIghFl oWdrecmn5AVmjBo1MjYRLkrx2B9ES22F9vh7BTELg+EmYKozpOAExh2+l0MHqovhj6+9PzCnRGxJf yWBRz+Ud+DnhP26Z3vgiXsiBedaXpFUcYF6osvhJ6gKqj+IXGCuOQda4aGOI19hpkIuemNZX0bYck XzbTdvWX3A1+alvQ61pbXrHetl91zBHt8F51NJ+Ba+NT5fnucYdPnqU5nYuQLZKVoz4h1I+JR6Ic1 tB3o6l+sK/CBMt/rm/tLaOqrsnaJW20pqFp4Ngq66QgN/fn0CoXtJhs1UFqVXdZGkAQfXZpJ8i4l8 zsj3OrXQ==; Received: from [192.168.88.1] (helo=leela.metanate.com) by shrek.metanate.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.90_1) (envelope-from ) id 1f1DYM-00001f-Dj; Wed, 28 Mar 2018 17:03:58 +0100 From: John Keeping To: dri-devel@lists.freedesktop.org Subject: [PATCH] drm/rockchip: fix VOP vblank race Date: Wed, 28 Mar 2018 17:03:51 +0100 Message-Id: <20180328160351.23763-1-john@metanate.com> X-Mailer: git-send-email 2.16.3 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-rockchip@lists.infradead.org, linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP We have seen a case of a bad reference count for vblanks with the Rockchip VOP: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 383 at drivers/gpu/drm/drm_irq.c:1198 drm_vblank_put+0x40/0xcc Modules linked in: brcmfmac brcmutil CPU: 1 PID: 383 Comm: kworker/u8:2 Not tainted 4.9.75-rt60 #1 Hardware name: Rockchip (Device Tree) Workqueue: events_unbound flip_worker Backtrace: [] (dump_backtrace) from [] (show_stack+0x18/0x1c) r7:c0b1b13c r6:600b0013 r5:00000000 r4:c0b1b13c [] (show_stack) from [] (dump_stack+0x78/0x94) [] (dump_stack) from [] (__warn+0xe4/0x104) r7:00000009 r6:c03cf26c r5:00000000 r4:00000000 [] (__warn) from [] (warn_slowpath_null+0x28/0x30) r9:eeb443a0 r8:eeb443c8 r7:ee8a5ec0 r6:ee8a5ec0 r5:edb47f00 r4:ee096200 [] (warn_slowpath_null) from [] (drm_vblank_put+0x40/0xcc) [] (drm_vblank_put) from [] (drm_crtc_vblank_put+0x18/0x1c) r5:edb47f00 r4:ee3c8a80 [] (drm_crtc_vblank_put) from [] (vop_fb_unref_worker+0x18/0x24) [] (vop_fb_unref_worker) from [] (flip_worker+0x98/0xb4) r5:edb47f00 r4:eeb443a8 [] (flip_worker) from [] (process_one_work+0x1a8/0x2fc) r9:00000000 r8:ee807d00 r7:00000000 r6:ee809c00 r5:eeb443a8 r4:edfe5f80 [] (process_one_work) from [] (worker_thread+0x2ac/0x458) r10:00000088 r9:edfe5f98 r8:ee809c2c r7:c0b04100 r6:ee809c00 r5:ee809c00 r4:edfe5f80 [] (worker_thread) from [] (kthread+0xfc/0x10c) r10:00000000 r9:00000000 r8:c0135640 r7:edfe5f80 r6:00000000 r5:edf0e240 r4:ee8a4000 r3:ed194e00 [] (kthread) from [] (ret_from_fork+0x14/0x3c) r8:00000000 r7:00000000 r6:00000000 r5:c0139fc0 r4:edf0e240 ---[ end trace 0000000000000002 ]--- It seems that this is caused by unfortunate timing between vop_crtc_atomic_flush() and vop_handle_vblank() given the following ordering: atomic_flush handle_vblank ------------ ------------- drm_flip_work_queue set_bit if (test_and_clear_bit(...)) drm_flip_work_commit drm_vblank_get This results in vop_fb_unref_worker (called as flip work) decrementing the vblank refcount before it has been incremented. Signed-off-by: John Keeping Reviewed-by: Sandy huang --- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c index 6755a9eea4b2..d4e1400aedf3 100644 --- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c @@ -1017,9 +1017,9 @@ static void vop_crtc_atomic_flush(struct drm_crtc *crtc, continue; drm_framebuffer_get(old_plane_state->fb); + WARN_ON(drm_crtc_vblank_get(crtc) != 0); drm_flip_work_queue(&vop->fb_unref_work, old_plane_state->fb); set_bit(VOP_PENDING_FB_UNREF, &vop->pending); - WARN_ON(drm_crtc_vblank_get(crtc) != 0); } }