From patchwork Sun Sep 4 15:35:01 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Vetter X-Patchwork-Id: 1124132 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by demeter2.kernel.org (8.14.4/8.14.4) with ESMTP id p84GaS4H021154 for ; Sun, 4 Sep 2011 16:36:48 GMT Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 55D5EA1B14 for ; Sun, 4 Sep 2011 09:36:28 -0700 (PDT) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from mail-ew0-f49.google.com (mail-ew0-f49.google.com [209.85.215.49]) by gabe.freedesktop.org (Postfix) with ESMTP id 94EEDA0881 for ; Sun, 4 Sep 2011 09:34:51 -0700 (PDT) Received: by ewy3 with SMTP id 3so2309219ewy.36 for ; Sun, 04 Sep 2011 09:34:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; bh=+SjbCFJzVm3ULONvQ6Hs+8Z9uc5hsr0jwrrian9KSis=; b=Yi81h7NjQTgHUTZ/j25Zz1EU6+VUOKxqCZagBR/PxAbDX+++h4Sxge4HzrA62kOewS hLplyU5ibF+3e4BhStEhH/Bnu+8j3xSCqylkCDzGbzvfTCOA9Pwrmi/dqrABLe2O5QJS 433UY4ZgINpRZKJnizfQkmHSiPLQWOOlz80mk= Received: by 10.213.9.9 with SMTP id j9mr452476ebj.9.1315154089989; Sun, 04 Sep 2011 09:34:49 -0700 (PDT) Received: from localhost.localdomain (178-83-130-250.dynamic.hispeed.ch [178.83.130.250]) by mx.google.com with ESMTPS id q50sm6207272eef.9.2011.09.04.09.34.48 (version=TLSv1/SSLv3 cipher=OTHER); Sun, 04 Sep 2011 09:34:49 -0700 (PDT) From: Daniel Vetter To: intel-gfx@lists.freedesktop.org Date: Sun, 4 Sep 2011 17:35:01 +0200 Message-Id: <1315150502-12537-3-git-send-email-daniel.vetter@ffwll.ch> X-Mailer: git-send-email 1.7.6 In-Reply-To: <1315150502-12537-1-git-send-email-daniel.vetter@ffwll.ch> References: <20110904084953.16cd10a2@bwidawsk.net> <1315150502-12537-1-git-send-email-daniel.vetter@ffwll.ch> Cc: Daniel Vetter , Ben Widawsky Subject: [Intel-gfx] [PATCH 2/3] drm/i915: close PM interrupt masking races in the rps work func X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: intel-gfx-bounces+patchwork-intel-gfx=patchwork.kernel.org@lists.freedesktop.org Errors-To: intel-gfx-bounces+patchwork-intel-gfx=patchwork.kernel.org@lists.freedesktop.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter2.kernel.org [140.211.167.43]); Sun, 04 Sep 2011 16:36:48 +0000 (UTC) This patch closes the following race: We get a PM interrupt A, mask it, set dev_priv->iir = PM_A and kick of the work item. Scheduler isn't grumpy, so the work queue takes rps_lock, grabs pm_iir = dev_priv->pm_iir and pm_imr = READ(PMIMR). Note that pm_imr == pm_iir because we've just masked the interrupt we've got. Now hw sends out PM interrupt B (not masked), we process it and mask it. Later on the irq handler also clears PMIIR. Then the work item proceeds and at the end clears PMIMR. Because (local) pm_imr == pm_iir we have pm_imr & ~pm_iir == 0 so all interrupts are enabled. Hardware is still interrupt-happy, and sends out a new PM interrupt B. PMIMR doesn't mask B (it does not mask anything), PMIIR is cleared, so we get it and hit the WARN in the interrupt handler (because dev_priv->pm_iir == PM_B). That's why I've moved the WRITE(PMIMR, 0) up under the protection of the rps_lock. And write an uncoditional 0 to PMIMR, because that's what we'll do anyway. This races looks much more likely because we can arbitrarily extend the window by grabing dev->struct mutex right after the irq handler has processed the first PM_B interrupt. Signed-off-by: Daniel Vetter --- drivers/gpu/drm/i915/i915_irq.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c index 2fdd9f9..21ebcbd 100644 --- a/drivers/gpu/drm/i915/i915_irq.c +++ b/drivers/gpu/drm/i915/i915_irq.c @@ -383,6 +383,7 @@ static void gen6_pm_rps_work(struct work_struct *work) pm_iir = dev_priv->pm_iir; dev_priv->pm_iir = 0; pm_imr = I915_READ(GEN6_PMIMR); + I915_WRITE(GEN6_PMIMR, 0); spin_unlock_irq(&dev_priv->rps_lock); if (!pm_iir) @@ -420,7 +421,6 @@ static void gen6_pm_rps_work(struct work_struct *work) * an *extremely* unlikely race with gen6_rps_enable() that is prevented * by holding struct_mutex for the duration of the write. */ - I915_WRITE(GEN6_PMIMR, pm_imr & ~pm_iir); mutex_unlock(&dev_priv->dev->struct_mutex); }