[PATCH] dmaengine: pl330: drop only the runtime PM reference a channel holds

[PATCH] dmaengine: pl330: drop only the runtime PM reference a channel holds

[Krzysztof Sokołowski via B4 Relay]

From: Krzysztof Sokołowski <krzysiek.sokolowski@gmail.com>

pl330_tasklet() drops a runtime PM reference when the channel's work
list is empty, without checking that the channel still holds one.
pl330_terminate_all() drops that reference too (power_down =
pch->active) and clears pch->active. If a completion schedules the
tasklet and a client terminates the channel before the tasklet runs, the
tasklet finds an empty work list and drops the reference a second time:

  Runtime PM usage count underflow!

after which the controller can be runtime suspended while still in use.

Seen on an RK3128 board (dw_mmc using the PL330 for SD transfers) under
combined SD and USB load, where the dw_mmc error path terminates the
channel; the underflow was followed by "pl330_update:1678 Unexpected!"
and a failure to request the DMA channel again.

Take power_down from pch->active in the tasklet, as pl330_terminate_all()
does, so the reference taken in pl330_issue_pending() is dropped once.

Fixes: 5c9e6c2b2ba3 ("dmaengine: pl330: Fix runtime PM support for terminated transfers")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Sokołowski <krzysiek.sokolowski@gmail.com>
---
 drivers/dma/pl330.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index c2d0b47..b0eced8 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2090,7 +2090,12 @@ static void pl330_tasklet(struct tasklet_struct *t)
 		spin_lock(&pch->thread->dmac->lock);
 		_stop(pch->thread);
 		spin_unlock(&pch->thread->dmac->lock);
-		power_down = true;
+		/*
+		 * Drop the runtime PM reference only if this channel still
+		 * holds it: pl330_terminate_all() may already have dropped it
+		 * while this tasklet was scheduled.
+		 */
+		power_down = pch->active;
 		pch->active = false;
 	} else {
 		/* Make sure the PL330 Channel thread is active */

---
base-commit: aff5e6a77fc69a7c490246465940d18422d7c631
change-id: 20261028-pl330-runtime-pm-b5a30050b2f5

Best regards,
--  
Krzysztof Sokołowski <krzysiek.sokolowski@gmail.com>

Re: [PATCH] dmaengine: pl330: drop only the runtime PM reference a channel holds

[Frank Li]

On Wed, Oct 28, 2026 at 12:28:11PM +0100, Krzysztof Sokołowski via B4 Relay wrote:
> [You don't often get email from devnull+krzysiek.sokolowski.gmail.com@kernel.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> From: Krzysztof Sokołowski <krzysiek.sokolowski@gmail.com>
>
> pl330_tasklet() drops a runtime PM reference when the channel's work
> list is empty, without checking that the channel still holds one.
> pl330_terminate_all() drops that reference too (power_down =
> pch->active) and clears pch->active. If a completion schedules the
> tasklet and a client terminates the channel before the tasklet runs, the
> tasklet finds an empty work list and drops the reference a second time:
>
>   Runtime PM usage count underflow!
>
> after which the controller can be runtime suspended while still in use.
>
> Seen on an RK3128 board (dw_mmc using the PL330 for SD transfers) under
> combined SD and USB load, where the dw_mmc error path terminates the
> channel; the underflow was followed by "pl330_update:1678 Unexpected!"
> and a failure to request the DMA channel again.
>
> Take power_down from pch->active in the tasklet, as pl330_terminate_all()
> does, so the reference taken in pl330_issue_pending() is dropped once.
>
> Fixes: 5c9e6c2b2ba3 ("dmaengine: pl330: Fix runtime PM support for terminated transfers")
> Cc: stable@vger.kernel.org
> Signed-off-by: Krzysztof Sokołowski <krzysiek.sokolowski@gmail.com>
> ---

The same patch at
https://patchwork.kernel.org/project/linux-dmaengine/patch/20261015-review-pl330-pm-original-v3-v3-1-5be09f37df77@crepuse.com/

Frank
>  drivers/dma/pl330.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
> index c2d0b47..b0eced8 100644
> --- a/drivers/dma/pl330.c
> +++ b/drivers/dma/pl330.c
> @@ -2090,7 +2090,12 @@ static void pl330_tasklet(struct tasklet_struct *t)
>                 spin_lock(&pch->thread->dmac->lock);
>                 _stop(pch->thread);
>                 spin_unlock(&pch->thread->dmac->lock);
> -               power_down = true;
> +               /*
> +                * Drop the runtime PM reference only if this channel still
> +                * holds it: pl330_terminate_all() may already have dropped it
> +                * while this tasklet was scheduled.
> +                */
> +               power_down = pch->active;
>                 pch->active = false;
>         } else {
>                 /* Make sure the PL330 Channel thread is active */
>
> ---
> base-commit: aff5e6a77fc69a7c490246465940d18422d7c631
> change-id: 20261028-pl330-runtime-pm-b5a30050b2f5
>
> Best regards,
> --
> Krzysztof Sokołowski <krzysiek.sokolowski@gmail.com>
>
>

Re: [PATCH] dmaengine: pl330: drop only the runtime PM reference a channel holds

[Krzysztof Sokołowski]

W dniu 28.10.2026 o 15:35, Frank Li pisze:
> On Wed, Oct 28, 2026 at 12:28:11PM +0100, Krzysztof Sokołowski via B4 Relay wrote:
>> [You don't often get email from devnull+krzysiek.sokolowski.gmail.com@kernel.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>>
>> From: Krzysztof Sokołowski <krzysiek.sokolowski@gmail.com>
>>
>> pl330_tasklet() drops a runtime PM reference when the channel's work
>> list is empty, without checking that the channel still holds one.
>> pl330_terminate_all() drops that reference too (power_down =
>> pch->active) and clears pch->active. If a completion schedules the
>> tasklet and a client terminates the channel before the tasklet runs, the
>> tasklet finds an empty work list and drops the reference a second time:
>>
>>    Runtime PM usage count underflow!
>>
>> after which the controller can be runtime suspended while still in use.
>>
>> Seen on an RK3128 board (dw_mmc using the PL330 for SD transfers) under
>> combined SD and USB load, where the dw_mmc error path terminates the
>> channel; the underflow was followed by "pl330_update:1678 Unexpected!"
>> and a failure to request the DMA channel again.
>>
>> Take power_down from pch->active in the tasklet, as pl330_terminate_all()
>> does, so the reference taken in pl330_issue_pending() is dropped once.
>>
>> Fixes: 5c9e6c2b2ba3 ("dmaengine: pl330: Fix runtime PM support for terminated transfers")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Krzysztof Sokołowski <krzysiek.sokolowski@gmail.com>
>> ---
> The same patch at
> https://patchwork.kernel.org/project/linux-dmaengine/patch/20261015-review-pl330-pm-original-v3-v3-1-5be09f37df77@crepuse.com/
>
> Frank
>>   drivers/dma/pl330.c | 7 ++++++-
>>   1 file changed, 6 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
>> index c2d0b47..b0eced8 100644
>> --- a/drivers/dma/pl330.c
>> +++ b/drivers/dma/pl330.c
>> @@ -2090,7 +2090,12 @@ static void pl330_tasklet(struct tasklet_struct *t)
>>                  spin_lock(&pch->thread->dmac->lock);
>>                  _stop(pch->thread);
>>                  spin_unlock(&pch->thread->dmac->lock);
>> -               power_down = true;
>> +               /*
>> +                * Drop the runtime PM reference only if this channel still
>> +                * holds it: pl330_terminate_all() may already have dropped it
>> +                * while this tasklet was scheduled.
>> +                */
>> +               power_down = pch->active;
>>                  pch->active = false;
>>          } else {
>>                  /* Make sure the PL330 Channel thread is active */
>>
>> ---
>> base-commit: aff5e6a77fc69a7c490246465940d18422d7c631
>> change-id: 20261028-pl330-runtime-pm-b5a30050b2f5
>>
>> Best regards,
>> --
>> Krzysztof Sokołowski <krzysiek.sokolowski@gmail.com>
>>
>>
Hello.

It is very interesting, but I have it for last month only in my private 
repo, that has now public facing side to upstream fixes I have made .

My public repo: https://github.com/ksokolowski/rocknix-distribution/

Set of patches including this one are here:

https://github.com/ksokolowski/rocknix-distribution/commit/dd3923788d94588b8d5fdb602808b13370ab4208#diff-27b400675ba20f118e98f9a25b963ece2a2336d9ef1fc9416c273f507e24c271

Anyway, I can confirm it works fine on real hardware for last month. So 
you can drop my patch and merge previous one as tested and confirmed to 
work.

Krzysztof