Re: [PATCH 2/2] drm/panfrost: Fix race when restoring reset state in perfcnt

[Boris Brezillon]

On Thu, 15 Oct 2026 19:22:32 +0100
Adrián Larumbe <adrian.larumbe@xxxxxxxxxxxxx> wrote:

> struct panfrost_perfcnt::state should always be updated atomically, both
> in the dump ioctl and the reset sequence.
> 
> Fixes: 9944dd07f3cf ("drm/panfrost: Fix races between perfcnt and reset sequence")
> Signed-off-by: Adrián Larumbe <adrian.larumbe@xxxxxxxxxxxxx>

Reviewed-by: Boris Brezillon <boris.brezillon@xxxxxxxxxxxxx>

> ---
>  drivers/gpu/drm/panfrost/panfrost_perfcnt.c | 15 +++++++--------
>  1 file changed, 7 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> index b26da057a1a0..d50b6cc2ecfa 100644
> --- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> +++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> @@ -148,18 +148,17 @@ static int panfrost_perfcnt_dump_locked(struct panfrost_device *pfdev, u32 *stat
>  	 */
>  	ret = wait_for_completion_interruptible_timeout(&pfdev->perfcnt->dump_comp,
>  							msecs_to_jiffies(1000));
> -
>  	if (!ret)
>  		ret = -ETIMEDOUT;
>  
> -	/* We need to restore perfcnt state so the next successful dump can relay it to UM */
> -	if (ret < 0) {
> -		perfcnt->state |= *state;
> -		*state = 0;
> -		return ret;
> -	}
> -
>  	scoped_guard(rwsem_read, &pfdev->reset.lock) {
> +		/* Restore perfcnt state so the next successful dump can relay it to UM */
> +		if (ret < 0) {
> +			perfcnt->state |= *state;
> +			*state = 0;
> +			return ret;
> +		}
> +
>  		*state |= perfcnt->state;
>  
>  		/* UM must re-enable their session before requesting new dumps. */
>