lkml.org 
[lkml]   [2016]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.2.y-ckt 002/206] drm/i915: Fix race condition in intel_dp_destroy_mst_connector()
    Date
    4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: Lyude <cpaul@redhat.com>

    commit 1f7717552ef1306be3b7ed28c66c6eff550e3a23 upstream.

    After unplugging a DP MST display from the system, we have to go through
    and destroy all of the DRM connectors associated with it since none of
    them are valid anymore. Unfortunately, intel_dp_destroy_mst_connector()
    doesn't do a good enough job of ensuring that throughout the destruction
    process that no modesettings can be done with the connectors. As it is
    right now, intel_dp_destroy_mst_connector() works like this:

    * Take all modeset locks
    * Clear the configuration of the crtc on the connector, if there is one
    * Drop all modeset locks, this is required because of circular
    dependency issues that arise with trying to remove the connector from
    sysfs with modeset locks held
    * Unregister the connector
    * Take all modeset locks, again
    * Do the rest of the required cleaning for destroying the connector
    * Finally drop all modeset locks for good

    This only works sometimes. During the destruction process, it's very
    possible that a userspace application will attempt to do a modesetting
    using the connector. When we drop the modeset locks, an ioctl handler
    such as drm_mode_setcrtc has the oppurtunity to take all of the modeset
    locks from us. When this happens, one thing leads to another and
    eventually we end up committing a mode with the non-existent connector:

    [drm:intel_dp_link_training_clock_recovery [i915]] *ERROR* failed to enable link training
    [drm:intel_dp_aux_ch] dp_aux_ch timeout status 0x7cf0001f
    [drm:intel_dp_start_link_train [i915]] *ERROR* failed to start channel equalization
    [drm:intel_dp_aux_ch] dp_aux_ch timeout status 0x7cf0001f
    [drm:intel_mst_pre_enable_dp [i915]] *ERROR* failed to allocate vcpi

    And in some cases, such as with the T460s using an MST dock, this
    results in breaking modesetting and/or panicking the system.

    To work around this, we now unregister the connector at the very
    beginning of intel_dp_destroy_mst_connector(), grab all the modesetting
    locks, and then hold them until we finish the rest of the function.

    Signed-off-by: Lyude <cpaul@redhat.com>
    Signed-off-by: Rob Clark <rclark@redhat.com>
    Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Link: http://patchwork.freedesktop.org/patch/msgid/1458155884-13877-1-git-send-email-cpaul@redhat.com
    [ kamal: backport to 4.2-stable: context ]
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    drivers/gpu/drm/i915/intel_dp_mst.c | 7 +++----
    1 file changed, 3 insertions(+), 4 deletions(-)

    diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
    index 8c127201..7feec0f 100644
    --- a/drivers/gpu/drm/i915/intel_dp_mst.c
    +++ b/drivers/gpu/drm/i915/intel_dp_mst.c
    @@ -470,14 +470,13 @@ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
    {
    struct intel_connector *intel_connector = to_intel_connector(connector);
    struct drm_device *dev = connector->dev;
    - /* need to nuke the connector */
    - mutex_lock(&dev->mode_config.mutex);
    - intel_connector_dpms(connector, DRM_MODE_DPMS_OFF);
    - mutex_unlock(&dev->mode_config.mutex);

    intel_connector->unregister(intel_connector);

    + /* need to nuke the connector */
    mutex_lock(&dev->mode_config.mutex);
    + intel_connector_dpms(connector, DRM_MODE_DPMS_OFF);
    +
    intel_connector_remove_from_fbdev(intel_connector);
    drm_connector_cleanup(connector);
    mutex_unlock(&dev->mode_config.mutex);
    --
    2.7.4
    \
     
     \ /
      Last update: 2016-06-10 01:01    [W:3.252 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site