Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

glxgears hangs system in drm_modeset_lock with MacBookPro 2015 with drm-4.6-next #4

Closed
huanghwh opened this issue May 25, 2016 · 23 comments
Assignees
Labels

Comments

@huanghwh
Copy link

Hi,
I try to test drm-next-4.6 on my MacBookPro 15(2015),
kldload i915kms show:

[drm] Initialized drm 1.1.0 20060810
bus_register unimplemented!!!
drmn0: on vgapci0
vgapci0: child drmn0 requested pci_enable_io
vgapci0: child drmn0 requested pci_enable_io
[drm] Found 128MB of eLLC
WARN_ON(domain->wake_count == 0)
[drm] Memory usable by graphics device = 2048M
[drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[drm] Driver supports precise vblank timestamp query.
[drm] Connector eDP-1: get mode from tunables:
[drm] - kern.vt.fb.modes.eDP-1
[drm] - kern.vt.fb.default_mode
[drm] Connector DP-1: get mode from tunables:
[drm] - kern.vt.fb.modes.DP-1
[drm] - kern.vt.fb.default_mode
[drm] Connector HDMI-A-1: get mode from tunables:
[drm] - kern.vt.fb.modes.HDMI-A-1
[drm] - kern.vt.fb.default_mode
[drm] Connector DP-2: get mode from tunables:
[drm] - kern.vt.fb.modes.DP-2
[drm] - kern.vt.fb.default_mode
[drm] Connector HDMI-A-2: get mode from tunables:
[drm] - kern.vt.fb.modes.HDMI-A-2
[drm] - kern.vt.fb.default_mode
[drm] Connector HDMI-A-3: get mode from tunables:
[drm] - kern.vt.fb.modes.HDMI-A-3
[drm] - kern.vt.fb.default_mode
[drm] Initialized i915 1.6.0 20160229 for drmn on minor 0
VT: Replacing driver "efifb" with new "fb".
start FB_INFO:
type=11 height=1800 width=2880 depth=32
cmsize=16 size=21196800
pbase=0x90000000 vbase=0xffffffff82210000
name=drmn0 flags=0x0 stride=11776 bpp=32
cmap[0]=0 cmap[1]=7f0000 cmap[2]=7f00 cmap[3]=c4a000
end FB_INFO
drmn0: fb0: inteldrmfb frame buffer device

But VT console looks like move to bottom right, I could not see the whole screen.

The mate desktop can show, but quickly panic:

vm_radix_insert: key 33 is already present:

http://sw.gddsn.org.cn/freebsd/drm-4.6-next-panic.jpg

@mattmacy mattmacy self-assigned this May 25, 2016
@mattmacy
Copy link
Member

This commit will probably fix this panic:
e9f1c14

Please pull and retry

@huanghwh
Copy link
Author

huanghwh commented May 28, 2016

I try to test gears, panic is gone but the whole system hang very quickly:

WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !list_empty(&lock->head) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../dev/drm2/drm_modeset_lock.c:336
WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/i915/i915kms/../../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83753b55s] ERROR dp_aux_ch not done status 0xa015010e

@mattmacy
Copy link
Member

I'll try to reproduce. Thanks.

@mattmacy mattmacy changed the title [panic]vm_radix_insert: key 33 is already present on MacBookPro 2015 with drm-4.6-next glxgears hangs system in drm_modeset_lock with MacBookPro 2015 with drm-4.6-next May 28, 2016
@mattmacy
Copy link
Member

The comments actually make it pretty clear what the problem is. Rather than fix the crufty locking in DRM it now relies on runtime deadlock detection. I didn't realize that this functionality was actually mandatory. I should be able to fix this some time tomorrow.

 * As KMS moves toward more fine grained locking, and atomic ioctl where
 * userspace can indirectly control locking order, it becomes necessary
 * to use ww_mutex and acquire-contexts to avoid deadlocks.  But because
 * the locking is more distributed around the driver code, we want a bit
 * of extra utility/tracking out of our acquire-ctx.  This is provided
 * by drm_modeset_lock / drm_modeset_acquire_ctx.
 *
 * For basic principles of ww_mutex, see: Documentation/locking/ww-mutex-design.txt
 *
 * The basic usage pattern is to:
 *
 *     drm_modeset_acquire_init(&ctx)
 *     retry:
 *     foreach (lock in random_ordered_set_of_locks) {
 *         ret = drm_modeset_lock(lock, &ctx)
 *         if (ret == -EDEADLK) {
 *             drm_modeset_backoff(&ctx);
 *             goto retry;
 *         }
 *     }
 *     ... do stuff ...
 *     drm_modeset_drop_locks(&ctx);
 *     drm_modeset_acquire_fini(&ctx);

@mattmacy
Copy link
Member

My last commit adds the runtime deadlock detection that DRM relies on:
0bde0b6

Please pull and try the latest.
I haven't hit this issue myself yet, so I can't guarantee it will fix it. Thanks.

@huanghwh
Copy link
Author

I got this error:

/home/hwh/git/freebsd-base-graphics/sys/modules/tmpfs/../../fs/tmpfs/tmpfs_subr.c:1374:20: error: too few arguments to fun
ction call, expected 6, have 5
NULL, NULL);
^
/home/hwh/git/freebsd-base-graphics/sys/vm/vm_pager.h:109:1: note: 'vm_pager_get_pages' declared here
int vm_pager_get_pages(vm_object_t, vm_page_t , int, int *, int *, int);
^
1 error generated.
--- tmpfs_subr.o ---
*
* [tmpfs_subr.o] Error code 1

@mattmacy
Copy link
Member

Sorry, please pull again. I had missed an add.

@huanghwh
Copy link
Author

WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/drm2/../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
WARNING !(((&(&mode_config->mutex)->sx)->sx_lock & ~((0x01 | 0x02 | 0x04 | 0x08) & ~0x01)) == (uintptr_t)(__curthread())) && !drm_modeset_is_locked(&mode_config->connection_mutex) failed at /home/hwh/git/freebsd-base-graphics/sys/modules/drm2/i915/i915kms/../../../../compat/linuxkpi/common/include/drm/drm_crtc.h:2633
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e
[drm:0xffffffff83758c65s] ERROR dp_aux_ch not done status 0xa015010e

@mattmacy
Copy link
Member

So unchanged. I'll have to figure out what it's unhappy about.

@mattmacy
Copy link
Member

I think the problem may be that it isn't waiting long enough. I've heavily revised the wait code and should have an update in the next hour.

static uint32_t
intel_dp_aux_wait_done(struct intel_dp *intel_dp, bool has_aux_irq)
{
    struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
    struct drm_device *dev = intel_dig_port->base.base.dev;
    struct drm_i915_private *dev_priv = dev->dev_private;
    i915_reg_t ch_ctl = intel_dp->aux_ch_ctl_reg;
    uint32_t status;
    bool done;

#define C (((status = I915_READ_NOTRACE(ch_ctl)) & DP_AUX_CH_CTL_SEND_BUSY) == 0)
    if (has_aux_irq)
        done = wait_event_timeout(dev_priv->gmbus_wait_queue, C,
                      msecs_to_jiffies_timeout(10));
    else
        done = wait_for_atomic(C, 10) == 0;
    if (!done)
        DRM_ERROR("dp aux hw did not signal timeout (has irq: %i)!\n",
              has_aux_irq);
#undef C

    return status;
}

@mattmacy
Copy link
Member

Also. woit_for_atomic should be waiting in terms of milliseconds. It was waiting in terms of microseconds.

@mattmacy
Copy link
Member

Does
5c16c50
do anything for your problem?

@huanghwh
Copy link
Author

/home/hwh/git/freebsd-base-graphics/sys/modules/linuxkpi/../../compat/linuxkpi/common/src/linux_compat.c:519:6: error: no
member named 'interruptible' in 'struct mm_struct'
mm->interruptible = 1;
~~ ^
1 error generated.
--- linux_compat.o ---
*** [linux_compat.o] Error code 1

@mattmacy
Copy link
Member

Sorry. Pull again.

@huanghwh
Copy link
Author

Still hang system...
I am on the trip now, could not get console msg without FireWire access.

@mattmacy
Copy link
Member

Thanks.

@mattmacy mattmacy added the bug label May 29, 2016
@huanghwh
Copy link
Author

I try "f1c5247", system still hang,
kldload i915kms show:

[drm] Initialized drm 1.1.0 20060810
drmn0: on vgapci0
can't re-use a leaf (debug)!
can't re-use a leaf (vblank_offdelay)!
can't re-use a leaf (timestamp_precision)!
can't re-use a leaf (name)!
vgapci0: child drmn0 requested pci_enable_io
vgapci0: child drmn0 requested pci_enable_io
[drm] Found 128MB of eLLC
WARN_ON(domain->wake_count == 0)
[drm] Memory usable by graphics device = 2048M
[drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[drm] Driver supports precise vblank timestamp query.
unrecognized class 196608 in linux_pci_get_class
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe045efa1f30
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0x29/frame 0xfffffe045efa1f60
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe045efa1f80
drm_mode_config_init() at drm_mode_config_init+0x1ad/frame 0xfffffe045efa1fb0
intel_modeset_init() at intel_modeset_init+0x27/frame 0xfffffe045efa20c0
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe045efa1dd0
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0xff/frame 0xfffffe045efa1e00
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe045efa1e20
drm_connector_init() at drm_connector_init+0x22/frame 0xfffffe045efa1ea0
intel_dp_init_connector() at intel_dp_init_connector+0x22d/frame 0xfffffe045efa1f60
[drm] Connector eDP-1: get mode from tunables:
[drm] - kern.vt.fb.modes.eDP-1
[drm] - kern.vt.fb.default_mode
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe045efa1dd0
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0x29/frame 0xfffffe045efa1e00
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe045efa1e20
drm_connector_init() at drm_connector_init+0x22/frame 0xfffffe045efa1ea0
intel_dp_init_connector() at intel_dp_init_connector+0x22d/frame 0xfffffe045efa1f60
[drm] Connector DP-1: get mode from tunables:
[drm] - kern.vt.fb.modes.DP-1
[drm] - kern.vt.fb.default_mode
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe045efa1d60
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0xff/frame 0xfffffe045efa1d90
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe045efa1db0
drm_encoder_init() at drm_encoder_init+0x2e/frame 0xfffffe045efa1e50
intel_dp_mst_encoder_init() at intel_dp_mst_encoder_init+0x7e/frame 0xfffffe045efa1ea0
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe045efa1d60
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0x8d/frame 0xfffffe045efa1d90
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe045efa1db0
drm_encoder_init() at drm_encoder_init+0x2e/frame 0xfffffe045efa1e50
intel_dp_mst_encoder_init() at intel_dp_mst_encoder_init+0x20f/frame 0xfffffe045efa1ea0
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe045efa1ea0
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0xff/frame 0xfffffe045efa1ed0
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe045efa1ef0
drm_connector_init() at drm_connector_init+0x22/frame 0xfffffe045efa1f70
intel_hdmi_init_connector() at intel_hdmi_init_connector+0x4c/frame 0xfffffe045efa1fb0
[drm] Connector HDMI-A-1: get mode from tunables:
[drm] - kern.vt.fb.modes.HDMI-A-1
[drm] - kern.vt.fb.default_mode
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe045efa1dd0
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0x8d/frame 0xfffffe045efa1e00
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe045efa1e20
drm_connector_init() at drm_connector_init+0x22/frame 0xfffffe045efa1ea0
intel_dp_init_connector() at intel_dp_init_connector+0x22d/frame 0xfffffe045efa1f60
[drm] Connector DP-2: get mode from tunables:
[drm] - kern.vt.fb.modes.DP-2
[drm] - kern.vt.fb.default_mode
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe045efa1d60
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0xff/frame 0xfffffe045efa1d90
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe045efa1db0
drm_encoder_init() at drm_encoder_init+0x2e/frame 0xfffffe045efa1e50
intel_dp_mst_encoder_init() at intel_dp_mst_encoder_init+0x7e/frame 0xfffffe045efa1ea0
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe045efa1d60
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0x8d/frame 0xfffffe045efa1d90
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe045efa1db0
drm_encoder_init() at drm_encoder_init+0x2e/frame 0xfffffe045efa1e50
intel_dp_mst_encoder_init() at intel_dp_mst_encoder_init+0x20f/frame 0xfffffe045efa1ea0
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe045efa1ea0
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0xff/frame 0xfffffe045efa1ed0
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe045efa1ef0
drm_connector_init() at drm_connector_init+0x22/frame 0xfffffe045efa1f70
intel_hdmi_init_connector() at intel_hdmi_init_connector+0x4c/frame 0xfffffe045efa1fb0
[drm] Connector HDMI-A-2: get mode from tunables:
[drm] - kern.vt.fb.modes.HDMI-A-2
[drm] - kern.vt.fb.default_mode
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe045efa1ea0
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0xff/frame 0xfffffe045efa1ed0
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe045efa1ef0
drm_connector_init() at drm_connector_init+0x22/frame 0xfffffe045efa1f70
intel_hdmi_init_connector() at intel_hdmi_init_connector+0x4c/frame 0xfffffe045efa1fb0
[drm] Connector HDMI-A-3: get mode from tunables:
[drm] - kern.vt.fb.modes.HDMI-A-3
[drm] - kern.vt.fb.default_mode
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe045efa1f60
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0xff/frame 0xfffffe045efa1f90
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe045efa1fb0
intel_modeset_init() at intel_modeset_init+0x117c/frame 0xfffffe045efa20c0
i915_driver_load() at i915_driver_load+0x1635/frame 0xfffffe045efa2280
drm_atomic_helper_duplicate_state() at drm_atomic_helper_duplicate_state+0x131/frame 0xfffffe045efa1fb0
intel_modeset_init() at intel_modeset_init+0x170f/frame 0xfffffe045efa20c0
i915_driver_load() at i915_driver_load+0x1635/frame 0xfffffe045efa2280
drm_dev_register() at drm_dev_register+0x65/frame 0xfffffe045efa22b0
drm_get_pci_dev() at drm_get_pci_dev+0x1e2/frame 0xfffffe045efa2330
drm_atomic_helper_check_modeset() at drm_atomic_helper_check_modeset+0x239/frame 0xfffffe045efa1ca0
intel_atomic_check() at intel_atomic_check+0x3a/frame 0xfffffe045efa1fb0
intel_modeset_init() at intel_modeset_init+0x172a/frame 0xfffffe045efa20c0
i915_driver_load() at i915_driver_load+0x1635/frame 0xfffffe045efa2280
drm_dev_register() at drm_dev_register+0x65/frame 0xfffffe045efa22b0
drm_fb_helper_single_add_all_connectors() at drm_fb_helper_single_add_all_connectors+0xd2/frame 0xfffffe045efa2060
intel_fbdev_init() at intel_fbdev_init+0x4cb/frame 0xfffffe045efa20c0
i915_driver_load() at i915_driver_load+0x1676/frame 0xfffffe045efa2280
drm_dev_register() at drm_dev_register+0x65/frame 0xfffffe045efa22b0
drm_get_pci_dev() at drm_get_pci_dev+0x1e2/frame 0xfffffe045efa2330
drm_kms_helper_poll_enable_locked() at drm_kms_helper_poll_enable_locked+0xea/frame 0xfffffe045efa2090
drm_kms_helper_poll_init() at drm_kms_helper_poll_init+0xa5/frame 0xfffffe045efa20c0
i915_driver_load() at i915_driver_load+0x18a3/frame 0xfffffe045efa2280
drm_dev_register() at drm_dev_register+0x65/frame 0xfffffe045efa22b0
drm_get_pci_dev() at drm_get_pci_dev+0x1e2/frame 0xfffffe045efa2330
[drm] Initialized i915 1.6.0 20160229 for drmn on minor 0
output_poll_execute() at output_poll_execute+0xe4/frame 0xfffffe044cdfd920
linux_work_fn() at VT: Replacing driver "efifb" with new "fb".
linux_work_fn+0xa4/frame 0xfffffe044cdfd9e0
taskqueue_run_locked() at taskqueue_run_locked+0x13b/frame 0xfffffe044cdfda40
taskqueue_thread_loop() at taskqueue_thread_loop+0xd8/frame 0xfffffe044cdfda70
fork_exit() at fork_exit+0x9c/frame 0xfffffe044cdfdab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe044cdfdab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
start FB_INFO:
type=11 height=1800 width=2880 depth=32
cmsize=16 size=21196800
pbase=0x90000000 vbase=0xffffffff82210000
name=drmn0 flags=0x0 stride=11776 bpp=32
cmap[0]=0 cmap[1]=7f0000 cmap[2]=7f00 cmap[3]=c4a000
end FB_INFO
drmn0: fb0: inteldrmfb frame buffer device
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe044cdfd820
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0xff/frame 0xfffffe044cdfd850
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe044cdfd870
drm_fb_helper_hotplug_event() at drm_fb_helper_hotplug_event+0x13a/frame 0xfffffe044cdfd8b0
output_poll_execute() at output_poll_execute+0x1f3/frame 0xfffffe044cdfd920
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe044cdfd7b0
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0xff/frame 0xfffffe044cdfd7e0
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe044cdfd800
drm_fb_helper_restore_fbdev_mode_unlocked() at drm_fb_helper_restore_fbdev_mode_unlocked+0x34/frame 0xfffffe044cdfd870
drm_fb_helper_hotplug_event() at drm_fb_helper_hotplug_event+0x185/frame 0xfffffe044cdfd8b0
drm_atomic_add_affected_connectors() at drm_atomic_add_affected_connectors+0xce/frame 0xfffffe044cdfd7c0
__drm_atomic_helper_set_config() at __drm_atomic_helper_set_config+0x210/frame 0xfffffe044cdfd800
drm_fb_helper_restore_fbdev_mode_unlocked() at drm_fb_helper_restore_fbdev_mode_unlocked+0x153/frame 0xfffffe044cdfd870
drm_fb_helper_hotplug_event() at drm_fb_helper_hotplug_event+0x185/frame 0xfffffe044cdfd8b0
output_poll_execute() at output_poll_execute+0x1f3/frame 0xfffffe044cdfd920
intel_atomic_check() at intel_atomic_check+0xeae/frame 0xfffffe044cdfd780
drm_atomic_check_only() at drm_atomic_check_only+0x252/frame 0xfffffe044cdfd7e0
drm_atomic_commit() at drm_atomic_commit+0x12/frame 0xfffffe044cdfd800
drm_fb_helper_restore_fbdev_mode_unlocked() at drm_fb_helper_restore_fbdev_mode_unlocked+0x16c/frame 0xfffffe044cdfd870
drm_fb_helper_hotplug_event() at drm_fb_helper_hotplug_event+0x185/frame 0xfffffe044cdfd8b0
modeset_lock() at modeset_lock+0x13d/frame 0xfffffe044cdfd7b0
drm_modeset_lock_all_ctx() at drm_modeset_lock_all_ctx+0xff/frame 0xfffffe044cdfd7e0
drm_modeset_lock_all() at drm_modeset_lock_all+0xb3/frame 0xfffffe044cdfd800
drm_fb_helper_restore_fbdev_mode_unlocked() at drm_fb_helper_restore_fbdev_mode_unlocked+0x34/frame 0xfffffe044cdfd870
drm_fb_helper_hotplug_event() at drm_fb_helper_hotplug_event+0x185/frame 0xfffffe044cdfd8b0
drm_atomic_add_affected_connectors() at drm_atomic_add_affected_connectors+0xce/frame 0xfffffe044cdfd880
__drm_atomic_helper_set_config() at __drm_atomic_helper_set_config+0x210/frame 0xfffffe044cdfd8c0
drm_fb_helper_restore_fbdev_mode_unlocked() at drm_fb_helper_restore_fbdev_mode_unlocked+0x153/frame 0xfffffe044cdfd930
vt_restore_fbdev_mode() at vt_restore_fbdev_mode+0x31/frame 0xfffffe044cdfd9e0
taskqueue_run_locked() at taskqueue_run_locked+0x13b/frame 0xfffffe044cdfda40

@mattmacy
Copy link
Member

are you able to break in to the debugger and get a core dump? There's no information in that output after it switches to vt_fb

@huanghwh
Copy link
Author

huanghwh commented May 31, 2016

I can't get core dump without firewire access, I pull latest git source, system not hang now, but desktop is very messy:
screenshot at 2016-05-31 08 29 35
screenshot at 2016-05-31 16 36 28
screenshot at 2016-05-31 16 38 53

@huanghwh
Copy link
Author

gears also eat a lot of cpu time:
1973 hwh 9 39 0 380M 69964K select 6 0:14 110.82% gears
906 root 1 90 0 255M 133M CPU3 3 4:31 86.41% Xorg

@mattmacy
Copy link
Member

Try SNA please.

@huanghwh
Copy link
Author

SNA mode is much better, thanks!
But the icons is so big;(

@mattmacy
Copy link
Member

I don't think icon size is a driver issue. Can I close this now?

mattmacy pushed a commit that referenced this issue Jun 24, 2016
Drop scan generation number and node table scan lock - the only place
where ni_scangen is checked is in ieee80211_timeout_stations() (and it
is used to prevent duplicate checking of the same node); node scan lock
protects only this variable + node table scan generation number.

This will fix (at least) next LOR (hostap mode):

lock order reversal:
1st 0xc175f84c urtwm0_scan_loc (urtwm0_scan_loc) @ /usr/src/sys/modules/wlan/../../net80211/ieee80211_node.c:2019
2nd 0xc175e018 urtwm0_com_lock (urtwm0_com_lock) @ /usr/src/sys/modules/wlan/../../net80211/ieee80211_node.c:2693
stack backtrace:
#0 0xa070d1c5 at witness_debugger+0x75
#1 0xa070d0f6 at witness_checkorder+0xd46
#2 0xa0694cce at __mtx_lock_flags+0x9e
#3 0xb03ad9ef at ieee80211_node_leave+0x12f
#4 0xb03afd13 at ieee80211_timeout_stations+0x483
#5 0xb03aa1c2 at ieee80211_node_timeout+0x42
#6 0xa06c6fa1 at softclock_call_cc+0x1e1
#7 0xa06c7518 at softclock+0xc8
#8 0xa06789ae at intr_event_execute_handlers+0x8e
#9 0xa0678fa0 at ithread_loop+0x90
#10 0xa0675fbe at fork_exit+0x7e
#11 0xa08af910 at fork_trampoline+0x8

In addition to the above:

* switch to ieee80211_iterate_nodes();
* do not assert that node table lock is held, while calling node_age();
  that's not really needed (there are no resources, which can be protected
  by this lock) + this fixes LOR/deadlock between ieee80211_timeout_stations()
  and ieee80211_set_tim() (easy to reproduce in HOSTAP mode while
  sending something to an STA with enabled power management).

Tested:

* (avos) urtwn0, hostap mode
* (adrian) AR9380, STA mode
* (adrian) AR9380, AR9331, AR9580, hostap mode

Notes:

* This changes the net80211 internals, so you have to recompile all of it
  and the wifi drivers.

Submitted by:	avos
Approved by:	re (delphij)
Differential Revision:	https://reviews.freebsd.org/D6833
mattmacy pushed a commit that referenced this issue Aug 9, 2016
commit e2c8b8701e2d moved modeset locking inside resume/suspend
functions, but missed a code path only executed on lid close/open
on older hardware. The result was a deadlock when closing and
opening the lid without suspending on such hardware:

 =============================================
 [ INFO: possible recursive locking detected ]
 4.6.0-rc1 #385 Not tainted
 ---------------------------------------------
 kworker/0:3/88 is trying to acquire lock:
  (&dev->mode_config.mutex){+.+.+.}, at: [<ffffffffa063e6a4>] intel_display_resume+0x4a/0x12f [i915]

 but task is already holding lock:
  (&dev->mode_config.mutex){+.+.+.}, at: [<ffffffffa02d0d4f>] drm_modeset_lock_all+0x3e/0xa6 [drm]

 other info that might help us debug this:
  Possible unsafe locking scenario:

        CPU0
        ----
   lock(&dev->mode_config.mutex);
   lock(&dev->mode_config.mutex);

  *** DEADLOCK ***

  May be due to missing lock nesting notation

 7 locks held by kworker/0:3/88:
  #0:  ("kacpi_notify"){++++.+}, at: [<ffffffff81068dfc>] process_one_work+0x14a/0x50b
  #1:  ((&dpc->work)#2){+.+.+.}, at: [<ffffffff81068dfc>] process_one_work+0x14a/0x50b
  #2:  ((acpi_lid_notifier).rwsem){++++.+}, at: [<ffffffff8106f874>] __blocking_notifier_call_chain+0x34/0x65
  #3:  (&dev_priv->modeset_restore_lock){+.+.+.}, at: [<ffffffffa0664cf6>] intel_lid_notify+0x3c/0xd9 [i915]
  #4:  (&dev->mode_config.mutex){+.+.+.}, at: [<ffffffffa02d0d4f>] drm_modeset_lock_all+0x3e/0xa6 [drm]
  #5:  (crtc_ww_class_acquire){+.+.+.}, at: [<ffffffffa02d0d59>] drm_modeset_lock_all+0x48/0xa6 [drm]
  #6:  (crtc_ww_class_mutex){+.+.+.}, at: [<ffffffffa02d0b2a>] modeset_lock+0x13c/0x1cd [drm]

 stack backtrace:
 CPU: 0 PID: 88 Comm: kworker/0:3 Not tainted 4.6.0-rc1 #385
 Hardware name: LENOVO 2776LEG/2776LEG, BIOS 6EET55WW (3.15 ) 12/19/2011
 Workqueue: kacpi_notify acpi_os_execute_deferred
  0000000000000000 ffff88022fd5f990 ffffffff8124af06 ffffffff825b39c0
  ffffffff825b39c0 ffff88022fd5fa60 ffffffff8108f547 ffff88022fd5fa70
  000000008108e817 ffff880230236cc0 0000000000000000 ffffffff825b39c0
 Call Trace:
  [<ffffffff8124af06>] dump_stack+0x67/0x90
  [<ffffffff8108f547>] __lock_acquire+0xdb5/0xf71
  [<ffffffff8108bd2c>] ? look_up_lock_class+0xbe/0x10a
  [<ffffffff8108fae2>] lock_acquire+0x137/0x1cb
  [<ffffffff8108fae2>] ? lock_acquire+0x137/0x1cb
  [<ffffffffa063e6a4>] ? intel_display_resume+0x4a/0x12f [i915]
  [<ffffffff8148202f>] mutex_lock_nested+0x7e/0x3a4
  [<ffffffffa063e6a4>] ? intel_display_resume+0x4a/0x12f [i915]
  [<ffffffffa063e6a4>] ? intel_display_resume+0x4a/0x12f [i915]
  [<ffffffffa02d0b2a>] ? modeset_lock+0x13c/0x1cd [drm]
  [<ffffffffa063e6a4>] intel_display_resume+0x4a/0x12f [i915]
  [<ffffffffa063e6a4>] ? intel_display_resume+0x4a/0x12f [i915]
  [<ffffffffa02d0b2a>] ? modeset_lock+0x13c/0x1cd [drm]
  [<ffffffffa02d0b2a>] ? modeset_lock+0x13c/0x1cd [drm]
  [<ffffffffa02d0bf7>] ? drm_modeset_lock+0x17/0x24 [drm]
  [<ffffffffa02d0c8b>] ? drm_modeset_lock_all_ctx+0x87/0xa1 [drm]
  [<ffffffffa0664d6a>] intel_lid_notify+0xb0/0xd9 [i915]
  [<ffffffff8106f4c6>] notifier_call_chain+0x4a/0x6c
  [<ffffffff8106f88d>] __blocking_notifier_call_chain+0x4d/0x65
  [<ffffffff8106f8b9>] blocking_notifier_call_chain+0x14/0x16
  [<ffffffffa0011215>] acpi_lid_send_state+0x83/0xad [button]
  [<ffffffffa00112a6>] acpi_button_notify+0x41/0x132 [button]
  [<ffffffff812b07df>] acpi_device_notify+0x19/0x1b
  [<ffffffff812c8570>] acpi_ev_notify_dispatch+0x49/0x64
  [<ffffffff812ab9fb>] acpi_os_execute_deferred+0x14/0x20
  [<ffffffff81068f17>] process_one_work+0x265/0x50b
  [<ffffffff810696f5>] worker_thread+0x1fc/0x2dd
  [<ffffffff810694f9>] ? rescuer_thread+0x309/0x309
  [<ffffffff810694f9>] ? rescuer_thread+0x309/0x309
  [<ffffffff8106e2d6>] kthread+0xe0/0xe8
  [<ffffffff8107bc47>] ? local_clock+0x19/0x22
  [<ffffffff81484f42>] ret_from_fork+0x22/0x40
  [<ffffffff8106e1f6>] ? kthread_create_on_node+0x1b5/0x1b5

Fixes: e2c8b8701e2d ("drm/i915: Use atomic helpers for suspend, v2.")
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1459328913-13719-1-git-send-email-bjorn@mork.no
mattmacy pushed a commit that referenced this issue Aug 16, 2016
drm_connector_register_all requires a few too many locks because our
connector_list locking is busted. Add another FIXME+hack to work
around this. This should address the below lockdep splat:

======================================================
[ INFO: possible circular locking dependency detected ]
4.7.0-rc5+ #524 Tainted: G           O
-------------------------------------------------------
kworker/u8:0/6 is trying to acquire lock:
 (&dev->mode_config.mutex){+.+.+.}, at: [<ffffffff815afde0>] drm_modeset_lock_all+0x40/0x120

but task is already holding lock:
 ((fb_notifier_list).rwsem){++++.+}, at: [<ffffffff810ac195>] __blocking_notifier_call_chain+0x35/0x70

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 ((fb_notifier_list).rwsem){++++.+}:
       [<ffffffff810df611>] lock_acquire+0xb1/0x200
       [<ffffffff819a55b4>] down_write+0x44/0x80
       [<ffffffff810abf91>] blocking_notifier_chain_register+0x21/0xb0
       [<ffffffff814c7448>] fb_register_client+0x18/0x20
       [<ffffffff814c6c86>] backlight_device_register+0x136/0x260
       [<ffffffffa0127eb2>] intel_backlight_device_register+0xa2/0x160 [i915]
       [<ffffffffa00f46be>] intel_connector_register+0xe/0x10 [i915]
       [<ffffffffa0112bfb>] intel_dp_connector_register+0x1b/0x80 [i915]
       [<ffffffff8159dfea>] drm_connector_register+0x4a/0x80
       [<ffffffff8159fe44>] drm_connector_register_all+0x64/0xf0
       [<ffffffff815a2a64>] drm_modeset_register_all+0x174/0x1c0
       [<ffffffff81599b72>] drm_dev_register+0xc2/0xd0
       [<ffffffffa00621d7>] i915_driver_load+0x1547/0x2200 [i915]
       [<ffffffffa006d80f>] i915_pci_probe+0x4f/0x70 [i915]
       [<ffffffff814a2135>] local_pci_probe+0x45/0xa0
       [<ffffffff814a349b>] pci_device_probe+0xdb/0x130
       [<ffffffff815c07e3>] driver_probe_device+0x223/0x440
       [<ffffffff815c0ad5>] __driver_attach+0xd5/0x100
       [<ffffffff815be386>] bus_for_each_dev+0x66/0xa0
       [<ffffffff815c002e>] driver_attach+0x1e/0x20
       [<ffffffff815bf9be>] bus_add_driver+0x1ee/0x280
       [<ffffffff815c1810>] driver_register+0x60/0xe0
       [<ffffffff814a1a10>] __pci_register_driver+0x60/0x70
       [<ffffffffa01a905b>] i915_init+0x5b/0x62 [i915]
       [<ffffffff8100042d>] do_one_initcall+0x3d/0x150
       [<ffffffff811a935b>] do_init_module+0x5f/0x1d9
       [<ffffffff81124416>] load_module+0x20e6/0x27e0
       [<ffffffff81124d63>] SYSC_finit_module+0xc3/0xf0
       [<ffffffff81124dae>] SyS_finit_module+0xe/0x10
       [<ffffffff819a83a9>] entry_SYSCALL_64_fastpath+0x1c/0xac

-> #0 (&dev->mode_config.mutex){+.+.+.}:
       [<ffffffff810df0ac>] __lock_acquire+0x10fc/0x1260
       [<ffffffff810df611>] lock_acquire+0xb1/0x200
       [<ffffffff819a3097>] mutex_lock_nested+0x67/0x3c0
       [<ffffffff815afde0>] drm_modeset_lock_all+0x40/0x120
       [<ffffffff8158f79b>] drm_fb_helper_restore_fbdev_mode_unlocked+0x2b/0x80
       [<ffffffff8158f81d>] drm_fb_helper_set_par+0x2d/0x50
       [<ffffffffa0105f7a>] intel_fbdev_set_par+0x1a/0x60 [i915]
       [<ffffffff814c13c6>] fbcon_init+0x586/0x610
       [<ffffffff8154d16a>] visual_init+0xca/0x130
       [<ffffffff8154e611>] do_bind_con_driver+0x1c1/0x3a0
       [<ffffffff8154eaf6>] do_take_over_console+0x116/0x180
       [<ffffffff814bd3a7>] do_fbcon_takeover+0x57/0xb0
       [<ffffffff814c1e48>] fbcon_event_notify+0x658/0x750
       [<ffffffff810abcae>] notifier_call_chain+0x3e/0xb0
       [<ffffffff810ac1ad>] __blocking_notifier_call_chain+0x4d/0x70
       [<ffffffff810ac1e6>] blocking_notifier_call_chain+0x16/0x20
       [<ffffffff814c748b>] fb_notifier_call_chain+0x1b/0x20
       [<ffffffff814c86b1>] register_framebuffer+0x251/0x330
       [<ffffffff8158fa9f>] drm_fb_helper_initial_config+0x25f/0x3f0
       [<ffffffffa0106b48>] intel_fbdev_initial_config+0x18/0x30 [i915]
       [<ffffffff810adfd8>] async_run_entry_fn+0x48/0x150
       [<ffffffff810a3947>] process_one_work+0x1e7/0x750
       [<ffffffff810a3efb>] worker_thread+0x4b/0x4f0
       [<ffffffff810aad4f>] kthread+0xef/0x110
       [<ffffffff819a85ef>] ret_from_fork+0x1f/0x40

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock((fb_notifier_list).rwsem);
                               lock(&dev->mode_config.mutex);
                               lock((fb_notifier_list).rwsem);
  lock(&dev->mode_config.mutex);

 *** DEADLOCK ***

6 locks held by kworker/u8:0/6:
 #0:  ("events_unbound"){.+.+.+}, at: [<ffffffff810a38c9>] process_one_work+0x169/0x750
 #1:  ((&entry->work)){+.+.+.}, at: [<ffffffff810a38c9>] process_one_work+0x169/0x750
 #2:  (registration_lock){+.+.+.}, at: [<ffffffff814c8487>] register_framebuffer+0x27/0x330
 #3:  (console_lock){+.+.+.}, at: [<ffffffff814c86ce>] register_framebuffer+0x26e/0x330
 #4:  (&fb_info->lock){+.+.+.}, at: [<ffffffff814c78dd>] lock_fb_info+0x1d/0x40
 #5:  ((fb_notifier_list).rwsem){++++.+}, at: [<ffffffff810ac195>] __blocking_notifier_call_chain+0x35/0x70

stack backtrace:
CPU: 2 PID: 6 Comm: kworker/u8:0 Tainted: G           O    4.7.0-rc5+ #524
Hardware name: Intel Corp. Broxton P/NOTEBOOK, BIOS APLKRVPA.X64.0138.B33.1606250842 06/25/2016
Workqueue: events_unbound async_run_entry_fn
 0000000000000000 ffff8800758577f0 ffffffff814507a5 ffffffff828b9900
 ffffffff828b9900 ffff880075857830 ffffffff810dc6fa ffff880075857880
 ffff88007584d688 0000000000000005 0000000000000006 ffff88007584d6b0
Call Trace:
 [<ffffffff814507a5>] dump_stack+0x67/0x92
 [<ffffffff810dc6fa>] print_circular_bug+0x1aa/0x200
 [<ffffffff810df0ac>] __lock_acquire+0x10fc/0x1260
 [<ffffffff810df611>] lock_acquire+0xb1/0x200
 [<ffffffff815afde0>] ? drm_modeset_lock_all+0x40/0x120
 [<ffffffff815afde0>] ? drm_modeset_lock_all+0x40/0x120
 [<ffffffff819a3097>] mutex_lock_nested+0x67/0x3c0
 [<ffffffff815afde0>] ? drm_modeset_lock_all+0x40/0x120
 [<ffffffff810fa85f>] ? rcu_read_lock_sched_held+0x7f/0x90
 [<ffffffff81208218>] ? kmem_cache_alloc_trace+0x248/0x2b0
 [<ffffffff815afdc5>] ? drm_modeset_lock_all+0x25/0x120
 [<ffffffff815afde0>] drm_modeset_lock_all+0x40/0x120
 [<ffffffff8158f79b>] drm_fb_helper_restore_fbdev_mode_unlocked+0x2b/0x80
 [<ffffffff8158f81d>] drm_fb_helper_set_par+0x2d/0x50
 [<ffffffffa0105f7a>] intel_fbdev_set_par+0x1a/0x60 [i915]
 [<ffffffff814c13c6>] fbcon_init+0x586/0x610
 [<ffffffff8154d16a>] visual_init+0xca/0x130
 [<ffffffff8154e611>] do_bind_con_driver+0x1c1/0x3a0
 [<ffffffff8154eaf6>] do_take_over_console+0x116/0x180
 [<ffffffff814bd3a7>] do_fbcon_takeover+0x57/0xb0
 [<ffffffff814c1e48>] fbcon_event_notify+0x658/0x750
 [<ffffffff810abcae>] notifier_call_chain+0x3e/0xb0
 [<ffffffff810ac1ad>] __blocking_notifier_call_chain+0x4d/0x70
 [<ffffffff810ac1e6>] blocking_notifier_call_chain+0x16/0x20
 [<ffffffff814c748b>] fb_notifier_call_chain+0x1b/0x20
 [<ffffffff814c86b1>] register_framebuffer+0x251/0x330
 [<ffffffff815b7e8d>] ? vga_switcheroo_client_fb_set+0x5d/0x70
 [<ffffffff8158fa9f>] drm_fb_helper_initial_config+0x25f/0x3f0
 [<ffffffffa0106b48>] intel_fbdev_initial_config+0x18/0x30 [i915]
 [<ffffffff810adfd8>] async_run_entry_fn+0x48/0x150
 [<ffffffff810a3947>] process_one_work+0x1e7/0x750
 [<ffffffff810a38c9>] ? process_one_work+0x169/0x750
 [<ffffffff810a3efb>] worker_thread+0x4b/0x4f0
 [<ffffffff810a3eb0>] ? process_one_work+0x750/0x750
 [<ffffffff810aad4f>] kthread+0xef/0x110
 [<ffffffff819a85ef>] ret_from_fork+0x1f/0x40
 [<ffffffff810aac60>] ? kthread_stop+0x2e0/0x2e0

v2: Rebase onto the right branch (hand-editing patches ftw) and add more
reporters.

Reported-by: Imre Deak <imre.deak@intel.com>
Cc: Imre Deak <imre.deak@intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Acked-by: Chris Wilson <chris@chris-wilson.co.uk>
Reported-by: Jiri Kosina <jikos@kernel.org>
Cc: Jiri Kosina <jikos@kernel.org>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
mattmacy pushed a commit that referenced this issue Aug 25, 2016
  Fix for pr24346: arm asm label calculation error in sub

  Some ARM instructions encode 32-bit immediates as a 8-bit integer
  (0-255) and a 4-bit rotation (0-30, even) in its least significant 12
  bits. The original fixup, FK_Data_4, patches the instruction by the
  value bit-to-bit, regardless of the encoding. For example, assuming
  the label L1 and L2 are 0x0 and 0x104 respectively, the following
  instruction:

    add r0, r0, #(L2 - L1) ; expects 0x104, i.e., 260

  would be assembled to the following, which adds 1 to r0, instead of
  260:

    e2800104 add r0, r0, #4, 2 ; equivalently 1

  The new fixup kind fixup_arm_mod_imm takes care of the encoding:

    e2800f41 add r0, r0, #260

  Patch by Ting-Yuan Huang!

This fixes label calculation for ARM assembly, and is needed to enable
ARM assembly sources for OpenSSL.

Requested by:	jkim
MFC after:	3 days
mattmacy pushed a commit that referenced this issue Nov 3, 2016
Vendor issues fixed (FreeBSD):
PR #778: ACL error handling
Issue #745: Symlink check prefix optimization is too aggressive
Issue #746: Hard links with data can evade sandboxing restrictions

This update fixes the vulnerability #3 and vulnerability #4 as reported in
the "non-cryptanalytic attacks against FreeBSD update components".
https://gist.github.com/anonymous/e48209b03f1dd9625a992717e7b89c4f

Vulnerability #2 has already been fixed in r304866
johalun pushed a commit that referenced this issue Sep 19, 2017
…_EXT

If there is no OPREGION_ASLE_EXT then a VBT stored in mailbox #4 may
use the ASLE_EXT parts of the opregion. Adjust the vbt_size calculation
for a vbt in mailbox #4 for this.

This fixes the driver not finding the VBT on a jumper ezpad mini3
cherrytrail tablet and on a ACER SW5_017 machine.

Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1487088758-30050-1-git-send-email-jani.nikula@intel.com
(cherry picked from commit dfb65e71ea2c1d97ac373cc0587dc60b3307581a)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Johannes Lundberg <johalun0@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants