Hi,
using a rcar-dmac.c on RCar3 being quite similar to the recent mainline
one [1] we got a BUG_ON() being hit [2].
This is
static inline void dma_cookie_complete(struct dma_async_tx_descriptor *tx)
{
BUG_ON(tx->cookie < DMA_MIN_COOKIE);
...
from dmaengine.h. I think DMA_MIN_COOKIE is 1, so it seems that cookie
becomes < 1.
Looking at rcar-dmac.c, there is one place where cookie is set to a
negative value [3]
desc->async_tx.cookie = -EBUSY;
And it looks like this is not protected by a spin_lock (?).
Could it be that we hit a race condition here?
What do you think?
Best regards
Dirk
[1]
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/dma/sh/rcar-dmac.c
[2]
kernel BUG at drivers/dma/dmaengine.h:54!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Hardware name: Custom board board based on r8a77990 (DT)
pc : rcar_dmac_isr_channel_thread+0xc0/0x190
lr : rcar_dmac_isr_channel_thread+0x84/0x190
sp : ffff000008b8bd30 pstate : a00001c5
x29: ffff000008b8bd30 x28: ffffe026daed4298
x27: dead000000000200 x26: dead000000000100
x25: ffff158988c28000 x24: ffffe026fb558cc8
x23: 0000000000000000 x22: ffffe026daed4254
x21: ffff1589821bd000 x20: ffffe026daed41a8
x19: ffffe026daed4288 x18: 0000fffff59a0c6a
x17: 0000ffff94c70f88 x16: ffff158981f3a17c
x15: 0000000000000000 x14: 0000000000000400
x13: 0000000000000400 x12: 0000000000000001
x11: ffffe026fab47000 x10: 0000000000000a10
x9 : ffff000008b8bd10 x8 : ffffe026fe0f1870
x7 : 0000000000010000 x6 : 00000000588b0000
x5 : ffffe026fe5d1410 x4 : 0000000000000000
x3 : 0000000000000002 x2 : 0000000000000000
x1 : 0000000000000000 x0 : 00000000e6f90060
Call trace:
rcar_dmac_isr_channel_thread+0xc0/0x190
irq_thread_fn+0x28/0x6c
irq_thread+0x134/0x198
kthread+0x120/0x130
ret_from_fork+0x10/0x18
Code: f9407293 b85a8260 7100001f 5400004c (d4210000)
---[ end trace 03ab56fc988cadbc ]---
Kernel panic - not syncing: Fatal exception
[3]
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/dma/sh/rcar-dmac.c#n951
