From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965067AbcCPTSc (ORCPT ); Wed, 16 Mar 2016 15:18:32 -0400 Received: from mx1.redhat.com ([209.132.183.28]:55696 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935127AbcCPTS3 (ORCPT ); Wed, 16 Mar 2016 15:18:29 -0400 From: Lyude To: intel-gfx@lists.freedesktop.org Cc: Rob Clark , Lyude , stable@vger.kernel.org, Daniel Vetter , Jani Nikula , David Airlie , dri-devel@lists.freedesktop.org (open list:INTEL DRM DRIVERS (excluding Poulsbo, Moorestow...), linux-kernel@vger.kernel.org (open list)) Subject: [PATCH] drm/i915: Fix race condition in intel_dp_destroy_mst_connector() Date: Wed, 16 Mar 2016 15:18:04 -0400 Message-Id: <1458155884-13877-1-git-send-email-cpaul@redhat.com> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Wed, 16 Mar 2016 19:18:29 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org After unplugging a DP MST display from the system, we have to go through and destroy all of the DRM connectors associated with it since none of them are valid anymore. Unfortunately, intel_dp_destroy_mst_connector() doesn't do a good enough job of ensuring that throughout the destruction process that no modesettings can be done with the connectors. As it is right now, intel_dp_destroy_mst_connector() works like this: * Take all modeset locks * Clear the configuration of the crtc on the connector, if there is one * Drop all modeset locks, this is required because of circular dependency issues that arise with trying to remove the connector from sysfs with modeset locks held * Unregister the connector * Take all modeset locks, again * Do the rest of the required cleaning for destroying the connector * Finally drop all modeset locks for good This only works sometimes. During the destruction process, it's very possible that a userspace application will attempt to do a modesetting using the connector. When we drop the modeset locks, an ioctl handler such as drm_mode_setcrtc has the oppurtunity to take all of the modeset locks from us. When this happens, one thing leads to another and eventually we end up committing a mode with the non-existent connector: [drm:intel_dp_link_training_clock_recovery [i915]] *ERROR* failed to enable link training [drm:intel_dp_aux_ch] dp_aux_ch timeout status 0x7cf0001f [drm:intel_dp_start_link_train [i915]] *ERROR* failed to start channel equalization [drm:intel_dp_aux_ch] dp_aux_ch timeout status 0x7cf0001f [drm:intel_mst_pre_enable_dp [i915]] *ERROR* failed to allocate vcpi And in some cases, such as with the T460s using an MST dock, this results in breaking modesetting and/or panicking the system. To work around this, we now unregister the connector at the very beginning of intel_dp_destroy_mst_connector(), grab all the modesetting locks, and then hold them until we finish the rest of the function. CC: stable@vger.kernel.org Signed-off-by: Lyude Signed-off-by: Rob Clark --- drivers/gpu/drm/i915/intel_dp_mst.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c index fa0dabf..b21ac88 100644 --- a/drivers/gpu/drm/i915/intel_dp_mst.c +++ b/drivers/gpu/drm/i915/intel_dp_mst.c @@ -499,6 +499,8 @@ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, struct intel_connector *intel_connector = to_intel_connector(connector); struct drm_device *dev = connector->dev; + intel_connector->unregister(intel_connector); + /* need to nuke the connector */ drm_modeset_lock_all(dev); if (connector->state->crtc) { @@ -512,11 +514,7 @@ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, WARN(ret, "Disabling mst crtc failed with %i\n", ret); } - drm_modeset_unlock_all(dev); - intel_connector->unregister(intel_connector); - - drm_modeset_lock_all(dev); intel_connector_remove_from_fbdev(intel_connector); drm_connector_cleanup(connector); drm_modeset_unlock_all(dev); -- 2.5.0 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lyude Subject: [PATCH] drm/i915: Fix race condition in intel_dp_destroy_mst_connector() Date: Wed, 16 Mar 2016 15:18:04 -0400 Message-ID: <1458155884-13877-1-git-send-email-cpaul@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: intel-gfx@lists.freedesktop.org Cc: Rob Clark , "open list:INTEL DRM DRIVERS excluding Poulsbo, Moorestow..., linux-kernel@vger.kernel.org open list" , stable@vger.kernel.org, Daniel Vetter , Lyude List-Id: dri-devel@lists.freedesktop.org QWZ0ZXIgdW5wbHVnZ2luZyBhIERQIE1TVCBkaXNwbGF5IGZyb20gdGhlIHN5c3RlbSwgd2UgaGF2 ZSB0byBnbyB0aHJvdWdoCmFuZCBkZXN0cm95IGFsbCBvZiB0aGUgRFJNIGNvbm5lY3RvcnMgYXNz b2NpYXRlZCB3aXRoIGl0IHNpbmNlIG5vbmUgb2YKdGhlbSBhcmUgdmFsaWQgYW55bW9yZS4gVW5m b3J0dW5hdGVseSwgaW50ZWxfZHBfZGVzdHJveV9tc3RfY29ubmVjdG9yKCkKZG9lc24ndCBkbyBh IGdvb2QgZW5vdWdoIGpvYiBvZiBlbnN1cmluZyB0aGF0IHRocm91Z2hvdXQgdGhlIGRlc3RydWN0 aW9uCnByb2Nlc3MgdGhhdCBubyBtb2Rlc2V0dGluZ3MgY2FuIGJlIGRvbmUgd2l0aCB0aGUgY29u bmVjdG9ycy4gQXMgaXQgaXMKcmlnaHQgbm93LCBpbnRlbF9kcF9kZXN0cm95X21zdF9jb25uZWN0 b3IoKSB3b3JrcyBsaWtlIHRoaXM6CgoqIFRha2UgYWxsIG1vZGVzZXQgbG9ja3MKKiBDbGVhciB0 aGUgY29uZmlndXJhdGlvbiBvZiB0aGUgY3J0YyBvbiB0aGUgY29ubmVjdG9yLCBpZiB0aGVyZSBp cyBvbmUKKiBEcm9wIGFsbCBtb2Rlc2V0IGxvY2tzLCB0aGlzIGlzIHJlcXVpcmVkIGJlY2F1c2Ug b2YgY2lyY3VsYXIKICBkZXBlbmRlbmN5IGlzc3VlcyB0aGF0IGFyaXNlIHdpdGggdHJ5aW5nIHRv IHJlbW92ZSB0aGUgY29ubmVjdG9yIGZyb20KICBzeXNmcyB3aXRoIG1vZGVzZXQgbG9ja3MgaGVs ZAoqIFVucmVnaXN0ZXIgdGhlIGNvbm5lY3RvcgoqIFRha2UgYWxsIG1vZGVzZXQgbG9ja3MsIGFn YWluCiogRG8gdGhlIHJlc3Qgb2YgdGhlIHJlcXVpcmVkIGNsZWFuaW5nIGZvciBkZXN0cm95aW5n IHRoZSBjb25uZWN0b3IKKiBGaW5hbGx5IGRyb3AgYWxsIG1vZGVzZXQgbG9ja3MgZm9yIGdvb2QK ClRoaXMgb25seSB3b3JrcyBzb21ldGltZXMuIER1cmluZyB0aGUgZGVzdHJ1Y3Rpb24gcHJvY2Vz cywgaXQncyB2ZXJ5CnBvc3NpYmxlIHRoYXQgYSB1c2Vyc3BhY2UgYXBwbGljYXRpb24gd2lsbCBh dHRlbXB0IHRvIGRvIGEgbW9kZXNldHRpbmcKdXNpbmcgdGhlIGNvbm5lY3Rvci4gV2hlbiB3ZSBk cm9wIHRoZSBtb2Rlc2V0IGxvY2tzLCBhbiBpb2N0bCBoYW5kbGVyCnN1Y2ggYXMgZHJtX21vZGVf c2V0Y3J0YyBoYXMgdGhlIG9wcHVydHVuaXR5IHRvIHRha2UgYWxsIG9mIHRoZSBtb2Rlc2V0Cmxv Y2tzIGZyb20gdXMuIFdoZW4gdGhpcyBoYXBwZW5zLCBvbmUgdGhpbmcgbGVhZHMgdG8gYW5vdGhl ciBhbmQKZXZlbnR1YWxseSB3ZSBlbmQgdXAgY29tbWl0dGluZyBhIG1vZGUgd2l0aCB0aGUgbm9u LWV4aXN0ZW50IGNvbm5lY3RvcjoKCglbZHJtOmludGVsX2RwX2xpbmtfdHJhaW5pbmdfY2xvY2tf cmVjb3ZlcnkgW2k5MTVdXSAqRVJST1IqIGZhaWxlZCB0byBlbmFibGUgbGluayB0cmFpbmluZwoJ W2RybTppbnRlbF9kcF9hdXhfY2hdIGRwX2F1eF9jaCB0aW1lb3V0IHN0YXR1cyAweDdjZjAwMDFm CglbZHJtOmludGVsX2RwX3N0YXJ0X2xpbmtfdHJhaW4gW2k5MTVdXSAqRVJST1IqIGZhaWxlZCB0 byBzdGFydCBjaGFubmVsIGVxdWFsaXphdGlvbgoJW2RybTppbnRlbF9kcF9hdXhfY2hdIGRwX2F1 eF9jaCB0aW1lb3V0IHN0YXR1cyAweDdjZjAwMDFmCglbZHJtOmludGVsX21zdF9wcmVfZW5hYmxl X2RwIFtpOTE1XV0gKkVSUk9SKiBmYWlsZWQgdG8gYWxsb2NhdGUgdmNwaQoKQW5kIGluIHNvbWUg Y2FzZXMsIHN1Y2ggYXMgd2l0aCB0aGUgVDQ2MHMgdXNpbmcgYW4gTVNUIGRvY2ssIHRoaXMKcmVz dWx0cyBpbiBicmVha2luZyBtb2Rlc2V0dGluZyBhbmQvb3IgcGFuaWNraW5nIHRoZSBzeXN0ZW0u CgpUbyB3b3JrIGFyb3VuZCB0aGlzLCB3ZSBub3cgdW5yZWdpc3RlciB0aGUgY29ubmVjdG9yIGF0 IHRoZSB2ZXJ5CmJlZ2lubmluZyBvZiBpbnRlbF9kcF9kZXN0cm95X21zdF9jb25uZWN0b3IoKSwg Z3JhYiBhbGwgdGhlIG1vZGVzZXR0aW5nCmxvY2tzLCBhbmQgdGhlbiBob2xkIHRoZW0gdW50aWwg d2UgZmluaXNoIHRoZSByZXN0IG9mIHRoZSBmdW5jdGlvbi4KCkNDOiBzdGFibGVAdmdlci5rZXJu ZWwub3JnClNpZ25lZC1vZmYtYnk6IEx5dWRlIDxjcGF1bEByZWRoYXQuY29tPgpTaWduZWQtb2Zm LWJ5OiBSb2IgQ2xhcmsgPHJjbGFya0ByZWRoYXQuY29tPgotLS0KIGRyaXZlcnMvZ3B1L2RybS9p OTE1L2ludGVsX2RwX21zdC5jIHwgNiArKy0tLS0KIDEgZmlsZSBjaGFuZ2VkLCAyIGluc2VydGlv bnMoKyksIDQgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJtL2k5MTUv aW50ZWxfZHBfbXN0LmMgYi9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pbnRlbF9kcF9tc3QuYwppbmRl eCBmYTBkYWJmLi5iMjFhYzg4IDEwMDY0NAotLS0gYS9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pbnRl bF9kcF9tc3QuYworKysgYi9kcml2ZXJzL2dwdS9kcm0vaTkxNS9pbnRlbF9kcF9tc3QuYwpAQCAt NDk5LDYgKzQ5OSw4IEBAIHN0YXRpYyB2b2lkIGludGVsX2RwX2Rlc3Ryb3lfbXN0X2Nvbm5lY3Rv cihzdHJ1Y3QgZHJtX2RwX21zdF90b3BvbG9neV9tZ3IgKm1nciwKIAlzdHJ1Y3QgaW50ZWxfY29u bmVjdG9yICppbnRlbF9jb25uZWN0b3IgPSB0b19pbnRlbF9jb25uZWN0b3IoY29ubmVjdG9yKTsK IAlzdHJ1Y3QgZHJtX2RldmljZSAqZGV2ID0gY29ubmVjdG9yLT5kZXY7CiAKKwlpbnRlbF9jb25u ZWN0b3ItPnVucmVnaXN0ZXIoaW50ZWxfY29ubmVjdG9yKTsKKwogCS8qIG5lZWQgdG8gbnVrZSB0 aGUgY29ubmVjdG9yICovCiAJZHJtX21vZGVzZXRfbG9ja19hbGwoZGV2KTsKIAlpZiAoY29ubmVj dG9yLT5zdGF0ZS0+Y3J0YykgewpAQCAtNTEyLDExICs1MTQsNyBAQCBzdGF0aWMgdm9pZCBpbnRl bF9kcF9kZXN0cm95X21zdF9jb25uZWN0b3Ioc3RydWN0IGRybV9kcF9tc3RfdG9wb2xvZ3lfbWdy ICptZ3IsCiAKIAkJV0FSTihyZXQsICJEaXNhYmxpbmcgbXN0IGNydGMgZmFpbGVkIHdpdGggJWlc biIsIHJldCk7CiAJfQotCWRybV9tb2Rlc2V0X3VubG9ja19hbGwoZGV2KTsKIAotCWludGVsX2Nv bm5lY3Rvci0+dW5yZWdpc3RlcihpbnRlbF9jb25uZWN0b3IpOwotCi0JZHJtX21vZGVzZXRfbG9j a19hbGwoZGV2KTsKIAlpbnRlbF9jb25uZWN0b3JfcmVtb3ZlX2Zyb21fZmJkZXYoaW50ZWxfY29u bmVjdG9yKTsKIAlkcm1fY29ubmVjdG9yX2NsZWFudXAoY29ubmVjdG9yKTsKIAlkcm1fbW9kZXNl dF91bmxvY2tfYWxsKGRldik7Ci0tIAoyLjUuMAoKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlz dHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4v bGlzdGluZm8vZHJpLWRldmVsCg==