From patchwork Sun Sep 4 17:08:17 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ben Widawsky X-Patchwork-Id: 1124152 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by demeter2.kernel.org (8.14.4/8.14.4) with ESMTP id p84H8TuU007115 for ; Sun, 4 Sep 2011 17:08:50 GMT Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 344B8A09E0 for ; Sun, 4 Sep 2011 10:08:29 -0700 (PDT) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from cloud01.chad-versace.us (184-106-247-128.static.cloud-ips.com [184.106.247.128]) by gabe.freedesktop.org (Postfix) with ESMTP id 2C6A69E7A8 for ; Sun, 4 Sep 2011 10:08:11 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by cloud01.chad-versace.us (Postfix) with ESMTP id 481F71D41C2; Sun, 4 Sep 2011 17:11:29 +0000 (UTC) X-Virus-Scanned: amavisd-new at static.cloud-ips.com X-Spam-Flag: NO X-Spam-Score: -1 X-Spam-Level: X-Spam-Status: No, score=-1 tagged_above=-100 required=3 tests=[ALL_TRUSTED=-1] autolearn=ham Received: from cloud01.chad-versace.us ([127.0.0.1]) by localhost (cloud01.static.cloud-ips.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mhsqolbcGY9i; Sun, 4 Sep 2011 17:11:13 +0000 (UTC) Received: from bwidawsk.net (static-50-53-41-91.bvtn.or.frontiernet.net [50.53.41.91]) by cloud01.chad-versace.us (Postfix) with ESMTPSA id 057FC1D4094; Sun, 4 Sep 2011 17:11:10 +0000 (UTC) Date: Sun, 4 Sep 2011 10:08:17 -0700 From: Ben Widawsky To: Daniel Vetter Message-ID: <20110904100817.16c6c4cc@bwidawsk.net> In-Reply-To: <1315150502-12537-3-git-send-email-daniel.vetter@ffwll.ch> References: <20110904084953.16cd10a2@bwidawsk.net> <1315150502-12537-1-git-send-email-daniel.vetter@ffwll.ch> <1315150502-12537-3-git-send-email-daniel.vetter@ffwll.ch> X-Mailer: Claws Mail 3.7.10 (GTK+ 2.24.6; x86_64-unknown-linux-gnu) Mime-Version: 1.0 Cc: intel-gfx@lists.freedesktop.org Subject: Re: [Intel-gfx] [PATCH 2/3] drm/i915: close PM interrupt masking races in the rps work func X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: intel-gfx-bounces+patchwork-intel-gfx=patchwork.kernel.org@lists.freedesktop.org Errors-To: intel-gfx-bounces+patchwork-intel-gfx=patchwork.kernel.org@lists.freedesktop.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter2.kernel.org [140.211.167.43]); Sun, 04 Sep 2011 17:08:50 +0000 (UTC) On Sun, 4 Sep 2011 17:35:01 +0200 Daniel Vetter wrote: > This patch closes the following race: > > We get a PM interrupt A, mask it, set dev_priv->iir = PM_A and kick > of the work item. Scheduler isn't grumpy, so the work queue takes > rps_lock, grabs pm_iir = dev_priv->pm_iir and pm_imr = READ(PMIMR). > Note that pm_imr == pm_iir because we've just masked the interrupt > we've got. > > Now hw sends out PM interrupt B (not masked), we process it and mask > it. Later on the irq handler also clears PMIIR. > > Then the work item proceeds and at the end clears PMIMR. Because > (local) pm_imr == pm_iir we have > pm_imr & ~pm_iir == 0 > so all interrupts are enabled. > > Hardware is still interrupt-happy, and sends out a new PM interrupt B. > PMIMR doesn't mask B (it does not mask anything), PMIIR is cleared, so > we get it and hit the WARN in the interrupt handler (because > dev_priv->pm_iir == PM_B). > > That's why I've moved the > WRITE(PMIMR, 0) > up under the protection of the rps_lock. And write an uncoditional 0 > to PMIMR, because that's what we'll do anyway. > > This races looks much more likely because we can arbitrarily extend > the window by grabing dev->struct mutex right after the irq handler > has processed the first PM_B interrupt. > > Signed-off-by: Daniel Vetter > --- > drivers/gpu/drm/i915/i915_irq.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/drivers/gpu/drm/i915/i915_irq.c > b/drivers/gpu/drm/i915/i915_irq.c index 2fdd9f9..21ebcbd 100644 > --- a/drivers/gpu/drm/i915/i915_irq.c > +++ b/drivers/gpu/drm/i915/i915_irq.c > @@ -383,6 +383,7 @@ static void gen6_pm_rps_work(struct work_struct > *work) pm_iir = dev_priv->pm_iir; > dev_priv->pm_iir = 0; > pm_imr = I915_READ(GEN6_PMIMR); > + I915_WRITE(GEN6_PMIMR, 0); > spin_unlock_irq(&dev_priv->rps_lock); > > if (!pm_iir) > @@ -420,7 +421,6 @@ static void gen6_pm_rps_work(struct work_struct > *work) > * an *extremely* unlikely race with gen6_rps_enable() that > is prevented > * by holding struct_mutex for the duration of the write. > */ > - I915_WRITE(GEN6_PMIMR, pm_imr & ~pm_iir); > mutex_unlock(&dev_priv->dev->struct_mutex); > } > How about this: Ben diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c index 55518e3..3bc1479 100644 --- a/drivers/gpu/drm/i915/i915_irq.c +++ b/drivers/gpu/drm/i915/i915_irq.c @@ -415,12 +415,7 @@ static void gen6_pm_rps_work(struct work_struct *work) gen6_set_rps(dev_priv->dev, new_delay); dev_priv->cur_delay = new_delay; - /* - * rps_lock not held here because clearing is non-destructive. There is - * an *extremely* unlikely race with gen6_rps_enable() that is prevented - * by holding struct_mutex for the duration of the write. - */ - I915_WRITE(GEN6_PMIMR, pm_imr & ~pm_iir); + I915_WRITE(GEN6_PMIMR, pm_imr & dev_priv->pm_iir); mutex_unlock(&dev_priv->dev->struct_mutex); }