• Lyude's avatar
    drm/i915: Fix race condition in intel_dp_destroy_mst_connector() · e4ad83b4
    Lyude authored
    [ Upstream commit 9e60290d ]
    
    After unplugging a DP MST display from the system, we have to go through
    and destroy all of the DRM connectors associated with it since none of
    them are valid anymore. Unfortunately, intel_dp_destroy_mst_connector()
    doesn't do a good enough job of ensuring that throughout the destruction
    process that no modesettings can be done with the connectors. As it is
    right now, intel_dp_destroy_mst_connector() works like this:
    
    * Take all modeset locks
    * Clear the configuration of the crtc on the connector, if there is one
    * Drop all modeset locks, this is required because of circular
      dependency issues that arise with trying to remove the connector from
      sysfs with modeset locks held
    * Unregister the connector
    * Take all modeset locks, again
    * Do the rest of the required cleaning for destroying the connector
    * Finally drop all modeset locks for good
    
    This only works sometimes. During the destruction process, it's very
    possible that a userspace application will attempt to do a modesetting
    using the connector. When we drop the modeset locks, an ioctl handler
    such as drm_mode_setcrtc has the oppurtunity to take all of the modeset
    locks from us. When this happens, one thing leads to another and
    eventually we end up committing a mode with the non-existent connector:
    
    	[drm:intel_dp_link_training_clock_recovery [i915]] *ERROR* failed to enable link training
    	[drm:intel_dp_aux_ch] dp_aux_ch timeout status 0x7cf0001f
    	[drm:intel_dp_start_link_train [i915]] *ERROR* failed to start channel equalization
    	[drm:intel_dp_aux_ch] dp_aux_ch timeout status 0x7cf0001f
    	[drm:intel_mst_pre_enable_dp [i915]] *ERROR* failed to allocate vcpi
    
    And in some cases, such as with the T460s using an MST dock, this
    results in breaking modesetting and/or panicking the system.
    
    To work around this, we now unregister the connector at the very
    beginning of intel_dp_destroy_mst_connector(), grab all the modesetting
    locks, and then hold them until we finish the rest of the function.
    
    CC: stable@vger.kernel.org
    Signed-off-by: default avatarLyude <cpaul@redhat.com>
    Signed-off-by: default avatarRob Clark <rclark@redhat.com>
    Reviewed-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
    Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
    Link: http://patchwork.freedesktop.org/patch/msgid/1458155884-13877-1-git-send-email-cpaul@redhat.com
    (cherry picked from commit 1f771755)
    Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
    Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
    e4ad83b4
intel_dp_mst.c 16.6 KB