| Message ID | 1315483222-2195-2-git-send-email-daniel.vetter@ffwll.ch (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, Sep 08, 2011 at 02:00:21PM +0200, Daniel Vetter wrote: > This patch closes the following race: > > We get a PM interrupt A, mask it, set dev_priv->iir = PM_A and kick of the > work item. Scheduler isn't grumpy, so the work queue takes rps_lock, > grabs pm_iir = dev_priv->pm_iir and pm_imr = READ(PMIMR). Note that > pm_imr == pm_iir because we've just masked the interrupt we've got. > > Now hw sends out PM interrupt B (not masked), we process it and mask > it. Later on the irq handler also clears PMIIR. > > Then the work item proceeds and at the end clears PMIMR. Because > (local) pm_imr == pm_iir we have > pm_imr & ~pm_iir == 0 > so all interrupts are enabled. > > Hardware is still interrupt-happy, and sends out a new PM interrupt B. > PMIMR doesn't mask B (it does not mask anything), PMIIR is cleared, so > we get it and hit the WARN in the interrupt handler (because > dev_priv->pm_iir == PM_B). > > That's why I've moved the > WRITE(PMIMR, 0) > up under the protection of the rps_lock. And write an uncoditional 0 > to PMIMR, because that's what we'll do anyway. > > This races looks much more likely because we can arbitrarily extend > the window by grabing dev->struct mutex right after the irq handler > has processed the first PM_B interrupt. > > Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> > Cc: Ben Widawsky <ben@bwidawsk.net> Reviewed-by: Ben Widawsky <ben@bwidawsk.net>
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c index 2fdd9f9..21ebcbd 100644 --- a/drivers/gpu/drm/i915/i915_irq.c +++ b/drivers/gpu/drm/i915/i915_irq.c @@ -383,6 +383,7 @@ static void gen6_pm_rps_work(struct work_struct *work) pm_iir = dev_priv->pm_iir; dev_priv->pm_iir = 0; pm_imr = I915_READ(GEN6_PMIMR); + I915_WRITE(GEN6_PMIMR, 0); spin_unlock_irq(&dev_priv->rps_lock); if (!pm_iir) @@ -420,7 +421,6 @@ static void gen6_pm_rps_work(struct work_struct *work) * an *extremely* unlikely race with gen6_rps_enable() that is prevented * by holding struct_mutex for the duration of the write. */ - I915_WRITE(GEN6_PMIMR, pm_imr & ~pm_iir); mutex_unlock(&dev_priv->dev->struct_mutex); }
This patch closes the following race: We get a PM interrupt A, mask it, set dev_priv->iir = PM_A and kick of the work item. Scheduler isn't grumpy, so the work queue takes rps_lock, grabs pm_iir = dev_priv->pm_iir and pm_imr = READ(PMIMR). Note that pm_imr == pm_iir because we've just masked the interrupt we've got. Now hw sends out PM interrupt B (not masked), we process it and mask it. Later on the irq handler also clears PMIIR. Then the work item proceeds and at the end clears PMIMR. Because (local) pm_imr == pm_iir we have pm_imr & ~pm_iir == 0 so all interrupts are enabled. Hardware is still interrupt-happy, and sends out a new PM interrupt B. PMIMR doesn't mask B (it does not mask anything), PMIIR is cleared, so we get it and hit the WARN in the interrupt handler (because dev_priv->pm_iir == PM_B). That's why I've moved the WRITE(PMIMR, 0) up under the protection of the rps_lock. And write an uncoditional 0 to PMIMR, because that's what we'll do anyway. This races looks much more likely because we can arbitrarily extend the window by grabing dev->struct mutex right after the irq handler has processed the first PM_B interrupt. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Ben Widawsky <ben@bwidawsk.net> --- drivers/gpu/drm/i915/i915_irq.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)