From patchwork Wed Mar 28 16:03:51 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Keeping X-Patchwork-Id: 10313541 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 4679B60467 for ; Wed, 28 Mar 2018 16:05:41 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3689E28FD1 for ; Wed, 28 Mar 2018 16:05:41 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2ABE828FD8; Wed, 28 Mar 2018 16:05:41 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 4379029A3E for ; Wed, 28 Mar 2018 16:04:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=wUpXBy5zLS+V0D1EccXGy35+NEjP97vRY2FPuQNVL/k=; b=MDt 53LAWNncn4t3OF6LqKYuIyDW26QgZ3rOwCf/YeDVGutQQ9bK8p9uDDjF/1Cqny+VpTeeQokvYANCr L8ZNBP9dMvf6lZMWIvKpabKrial7gySdAE/Ku9o0OPD0tNtCFeGpU3IjQJR3BICVpzSDhGwHEFNeR QJYXO6dGsd5x4DD+uE5PABv1QO9xPbJyQqV/acP+QD9hzt5nLRzq6BUppAOjEmoAP5j5z/zCVnWrn I2m/y1+xBzcae9WdM5AAmzbBSlFA2V659xcbPpGwvMFb90/bprwUv7lOlliDYr2Ov0PbdkC1jRXAv 6Gd7Ds4Le7VAPxaByPuN70gDNds9FFQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1f1DZ1-0003lk-I6; Wed, 28 Mar 2018 16:04:39 +0000 Received: from dougal.metanate.com ([90.155.101.14] helo=metanate.com) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1f1DYs-0003hG-Cc; Wed, 28 Mar 2018 16:04:36 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=simple/simple; d=metanate.com; s=stronger; h=Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To: MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Lh1REr0jukmQeK0Am4uPougUZDSNUy31OxEFdOosIvA=; b=UoW0iYkmM1LdgSkICtf4mIghFl oWdrecmn5AVmjBo1MjYRLkrx2B9ES22F9vh7BTELg+EmYKozpOAExh2+l0MHqovhj6+9PzCnRGxJf yWBRz+Ud+DnhP26Z3vgiXsiBedaXpFUcYF6osvhJ6gKqj+IXGCuOQda4aGOI19hpkIuemNZX0bYck XzbTdvWX3A1+alvQ61pbXrHetl91zBHt8F51NJ+Ba+NT5fnucYdPnqU5nYuQLZKVoz4h1I+JR6Ic1 tB3o6l+sK/CBMt/rm/tLaOqrsnaJW20pqFp4Ngq66QgN/fn0CoXtJhs1UFqVXdZGkAQfXZpJ8i4l8 zsj3OrXQ==; Received: from [192.168.88.1] (helo=leela.metanate.com) by shrek.metanate.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.90_1) (envelope-from ) id 1f1DYM-00001f-Dj; Wed, 28 Mar 2018 17:03:58 +0100 From: John Keeping To: dri-devel@lists.freedesktop.org Subject: [PATCH] drm/rockchip: fix VOP vblank race Date: Wed, 28 Mar 2018 17:03:51 +0100 Message-Id: <20180328160351.23763-1-john@metanate.com> X-Mailer: git-send-email 2.16.3 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180328_090430_565188_A0C2FAE8 X-CRM114-Status: GOOD ( 11.35 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-rockchip@lists.infradead.org, John Keeping , Sandy Huang , linux-arm-kernel@lists.infradead.org, =?UTF-8?q?Heiko=20St=C3=BCbner?= MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP We have seen a case of a bad reference count for vblanks with the Rockchip VOP: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 383 at drivers/gpu/drm/drm_irq.c:1198 drm_vblank_put+0x40/0xcc Modules linked in: brcmfmac brcmutil CPU: 1 PID: 383 Comm: kworker/u8:2 Not tainted 4.9.75-rt60 #1 Hardware name: Rockchip (Device Tree) Workqueue: events_unbound flip_worker Backtrace: [] (dump_backtrace) from [] (show_stack+0x18/0x1c) r7:c0b1b13c r6:600b0013 r5:00000000 r4:c0b1b13c [] (show_stack) from [] (dump_stack+0x78/0x94) [] (dump_stack) from [] (__warn+0xe4/0x104) r7:00000009 r6:c03cf26c r5:00000000 r4:00000000 [] (__warn) from [] (warn_slowpath_null+0x28/0x30) r9:eeb443a0 r8:eeb443c8 r7:ee8a5ec0 r6:ee8a5ec0 r5:edb47f00 r4:ee096200 [] (warn_slowpath_null) from [] (drm_vblank_put+0x40/0xcc) [] (drm_vblank_put) from [] (drm_crtc_vblank_put+0x18/0x1c) r5:edb47f00 r4:ee3c8a80 [] (drm_crtc_vblank_put) from [] (vop_fb_unref_worker+0x18/0x24) [] (vop_fb_unref_worker) from [] (flip_worker+0x98/0xb4) r5:edb47f00 r4:eeb443a8 [] (flip_worker) from [] (process_one_work+0x1a8/0x2fc) r9:00000000 r8:ee807d00 r7:00000000 r6:ee809c00 r5:eeb443a8 r4:edfe5f80 [] (process_one_work) from [] (worker_thread+0x2ac/0x458) r10:00000088 r9:edfe5f98 r8:ee809c2c r7:c0b04100 r6:ee809c00 r5:ee809c00 r4:edfe5f80 [] (worker_thread) from [] (kthread+0xfc/0x10c) r10:00000000 r9:00000000 r8:c0135640 r7:edfe5f80 r6:00000000 r5:edf0e240 r4:ee8a4000 r3:ed194e00 [] (kthread) from [] (ret_from_fork+0x14/0x3c) r8:00000000 r7:00000000 r6:00000000 r5:c0139fc0 r4:edf0e240 ---[ end trace 0000000000000002 ]--- It seems that this is caused by unfortunate timing between vop_crtc_atomic_flush() and vop_handle_vblank() given the following ordering: atomic_flush handle_vblank ------------ ------------- drm_flip_work_queue set_bit if (test_and_clear_bit(...)) drm_flip_work_commit drm_vblank_get This results in vop_fb_unref_worker (called as flip work) decrementing the vblank refcount before it has been incremented. Signed-off-by: John Keeping Reviewed-by: Sandy huang --- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c index 6755a9eea4b2..d4e1400aedf3 100644 --- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c @@ -1017,9 +1017,9 @@ static void vop_crtc_atomic_flush(struct drm_crtc *crtc, continue; drm_framebuffer_get(old_plane_state->fb); + WARN_ON(drm_crtc_vblank_get(crtc) != 0); drm_flip_work_queue(&vop->fb_unref_work, old_plane_state->fb); set_bit(VOP_PENDING_FB_UNREF, &vop->pending); - WARN_ON(drm_crtc_vblank_get(crtc) != 0); } }