Intel i915 and displayport mst freeze entire kernel

Question

Hi folks,
My lenovo laptop (t440s) came with the Ultra dock that has displayport on the back. I use a displayport cable to connect to a monitor. When I connect to the dock, the monitor works just fine, but if I ever try to "xrandr --output DP2-1 --off" it or disconnect from the dock, the entire kernel hard locks. No response, image on the screen is frozen, and from another computer on the same network I can't ssh or ping.
I put drm.debug=0xf on the boot line, and then repro'd the issue (which repro's every time) and I get the following output right before the crash (see the kernel BUG line)
Mar 18 12:13:54 nevada kernel: [drm:drm_ioctl] pid=587, dev=0xe200, auth=1, I915_GEM_BUSY
Mar 18 12:13:54 nevada kernel: [drm:drm_ioctl] pid=587, dev=0xe200, auth=1, I915_GEM_BUSY
Mar 18 12:13:54 nevada kernel: [drm:drm_ioctl] pid=587, dev=0xe200, auth=1, I915_GEM_MADVISE
Mar 18 12:13:54 nevada kernel: [drm:drm_ioctl] pid=587, dev=0xe200, auth=1, I915_GEM_BUSY
Mar 18 12:13:54 nevada kernel: [drm:drm_ioctl] pid=587, dev=0xe200, auth=1, I915_GEM_BUSY
Mar 18 12:13:54 nevada kernel: [drm:drm_ioctl] pid=587, dev=0xe200, auth=1, I915_GEM_MADVISE
Mar 18 12:13:54 nevada kernel: [drm:drm_ioctl] pid=587, dev=0xe200, auth=1, I915_GEM_THROTTLE
Mar 18 12:13:54 nevada kernel: [drm:intel_hpd_irq_handler] hotplug event received, stat 0x00400000, dig 0x00101210
Mar 18 12:13:54 nevada kernel: [drm:intel_hpd_irq_handler] digital hpd port C - long
Mar 18 12:13:54 nevada kernel: [drm:intel_hpd_irq_handler] Received HPD interrupt on PIN 5 - cnt: 1
Mar 18 12:13:54 nevada kernel: [drm:intel_dp_hpd_pulse] got hpd irq on port C - long
Mar 18 12:13:54 nevada kernel: [drm:intel_hpd_irq_handler] hotplug event received, stat 0x00400000, dig 0x00101210
Mar 18 12:13:54 nevada kernel: [drm:intel_hpd_irq_handler] digital hpd port C - long
Mar 18 12:13:54 nevada kernel: [drm:intel_hpd_irq_handler] Received HPD interrupt on PIN 5 - cnt: 2
Mar 18 12:13:54 nevada kernel: [drm:intel_dp_get_dpcd] DPCD: 12 14 c4 01 00 15 01 83 02 00 00 00 00 00 04
Mar 18 12:13:54 nevada kernel: [drm:intel_dp_get_dpcd] Displayport TPS3 supported
Mar 18 12:13:54 nevada kernel: [drm:intel_dp_probe_oui] Sink OUI: 000000
Mar 18 12:13:54 nevada kernel: [drm:intel_dp_probe_oui] Branch OUI: 90cc24
Mar 18 12:13:54 nevada kernel: [drm:intel_dp_probe_mst] Sink is MST capable
Mar 18 12:13:54 nevada kernel: [drm:intel_dp_hpd_pulse] got hpd irq on port C - long
Mar 18 12:13:54 nevada kernel: [drm:intel_dp_hpd_pulse] MST device may have disappeared 1 vs 1
Mar 18 12:13:54 nevada kernel: BUG: unable to handle kernel NULL pointer dereference at 000000000000004c
There are no other lines after that kernel NULL pointer dereference at 0x4c
I can attach or paste the full dmesg somewhere else if anyone is interested, but I'm confused by the second to last line there, MST device may have disappeared 1 vs 1. From the code (linux-stable at tag v3.18.6):
From drivers/gpu/drm/i915/intel_dp.c:
4559 mst_fail:
4560 /* if we were in MST mode, and device is not there get out of MST mode */
4561 if (intel_dp->is_mst) {
4562 DRM_DEBUG_KMS("MST device may have disappeared %d vs %d\n", intel_dp->is_mst, intel_dp->mst_mgr.mst_state);
4563 intel_dp->is_mst = false;
4564 drm_dp_mst_topology_mgr_set_mst(&intel_dp->mst_mgr, intel_dp->is_mst);
4565 }
4566 put_power:
4567 intel_display_power_put(dev_priv, power_domain);
4568
4569 return ret;
4570 }
So it's locking up either in drm_dp_mst_topology_mgr_set_mst (which doesn't have any debug messages in it in the main path, and does capture a lock) or it's locking up in intel_display_power_put, which ALSO doesn't have debug output. They both acquire mutex's.. looking into this some more. If anyone has seen this issue with displayport, mst, and linux 3.18.6 please let me know

Answer 1

Ok, writing a patch with debug messages to see where this is exactly locking up hopefully...
From 05a0a4758a98f47305165befa81eb61154e15676 Mon Sep 17 00:00:00 2001
From: Jeff Mickey <[email protected]>
Date: Wed, 18 Mar 2015 14:00:28 -0700
Subject: [PATCH] Debugging statements for figuring out this dp mst bug
Signed-off-by: Jeff Mickey <[email protected]>
drivers/gpu/drm/drm_dp_mst_topology.c | 27 ++++++++++++++++++++++-----
drivers/gpu/drm/i915/intel_dp.c | 8 ++++++++
drivers/gpu/drm/i915/intel_pm.c | 3 +++
3 files changed, 33 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index f50d884..b0ff4be 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1827,13 +1827,16 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms
int ret = 0;
struct drm_dp_mst_branch *mstb = NULL;
+ DRM_DEBUG_KMS("locking mgr->lock\n");
mutex_lock(&mgr->lock);
- if (mst_state == mgr->mst_state)
+ if (mst_state == mgr->mst_state) {
+ DRM_DEBUG_KMS("goto out_unlock 1\n");
goto out_unlock;
+ }
mgr->mst_state = mst_state;
/* set the device into MST mode */
if (mst_state) {
+ DRM_DEBUG_KMS("inside mst_state\n");
WARN_ON(mgr->mst_primary);
/* get dpcd info */
@@ -1849,9 +1852,11 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms
mgr->avail_slots = mgr->total_slots;
/* add initial branch device at LCT 1 */
+ DRM_DEBUG_KMS("calling drm_dp_add_mst_branch_device\n");
mstb = drm_dp_add_mst_branch_device(1, NULL);
if (mstb == NULL) {
ret = -ENOMEM;
+ DRM_DEBUG_KMS("goto out_unlock 2\n");
goto out_unlock;
mstb->mgr = mgr;
@@ -1864,29 +1869,35 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms
struct drm_dp_payload reset_pay;
reset_pay.start_slot = 0;
reset_pay.num_slots = 0x3f;
+ DRM_DEBUG_KMS("drm_dp_dpcd_write_payload\n");
drm_dp_dpcd_write_payload(mgr, 0, &reset_pay);
+ DRM_DEBUG_KMS("drm_dp_dpcd_writeb\n");
ret = drm_dp_dpcd_writeb(mgr->aux, DP_MSTM_CTRL,
DP_MST_EN | DP_UP_REQ_EN | DP_UPSTREAM_IS_SRC);
if (ret < 0) {
+ DRM_DEBUG_KMS("goto out_unlock 3\n");
goto out_unlock;
/* sort out guid */
+ DRM_DEBUG_KMS("drm_dp_dpcd_read\n");
ret = drm_dp_dpcd_read(mgr->aux, DP_GUID, mgr->guid, 16);
if (ret != 16) {
DRM_DEBUG_KMS("failed to read DP GUID %d\n", ret);
goto out_unlock;
+ DRM_DEBUG_KMS("drm_dp_validate_guid\n");
mgr->guid_valid = drm_dp_validate_guid(mgr, mgr->guid);
if (!mgr->guid_valid) {
+ DRM_DEBUG_KMS("drm_dp_dpcd_write 2\n");
ret = drm_dp_dpcd_write(mgr->aux, DP_GUID, mgr->guid, 16);
mgr->guid_valid = true;
+ DRM_DEBUG_KMS("queue_work\n");
queue_work(system_long_wq, &mgr->work);
ret = 0;
@@ -1895,6 +1906,7 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms
mstb = mgr->mst_primary;
mgr->mst_primary = NULL;
/* this can fail if the device is gone */
+ DRM_DEBUG_KMS("drm_dp_dpcd_writeb 2\n");
drm_dp_dpcd_writeb(mgr->aux, DP_MSTM_CTRL, 0);
ret = 0;
memset(mgr->payloads, 0, mgr->max_payloads * sizeof(struct drm_dp_payload));
@@ -1904,11 +1916,16 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms
out_unlock:
+ DRM_DEBUG_KMS("unlocking mgr->lock\n");
mutex_unlock(&mgr->lock);
- if (mstb)
+ if (mstb) {
+ DRM_DEBUG_KMS("drm_dp_put_mst_branch_device 2\n");
drm_dp_put_mst_branch_device(mstb);
- return ret;
+ }
+
+ DRM_DEBUG_KMS("returning %d\n", ret);
+ return ret;
EXPORT_SYMBOL(drm_dp_mst_topology_mgr_set_mst);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 4bcd917..5a3c562 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -4523,24 +4523,29 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
if (HAS_PCH_SPLIT(dev)) {
if (!ibx_digital_port_connected(dev_priv, intel_dig_port))
+ DRM_DEBUG_KMS("goto mst_fail 1\n");
goto mst_fail;
} else {
if (g4x_digital_port_connected(dev, intel_dig_port) != 1)
+ DRM_DEBUG_KMS("goto mst_fail 2\n");
goto mst_fail;
if (!intel_dp_get_dpcd(intel_dp)) {
+ DRM_DEBUG_KMS("goto mst_fail 3\n");
goto mst_fail;
intel_dp_probe_oui(intel_dp);
if (!intel_dp_probe_mst(intel_dp))
+ DRM_DEBUG_KMS("goto mst_fail 4\n");
goto mst_fail;
} else {
if (intel_dp->is_mst) {
if (intel_dp_check_mst_status(intel_dp) == -EINVAL)
+ DRM_DEBUG_KMS("goto mst_fail 5\n");
goto mst_fail;
@@ -4549,6 +4554,7 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
* we'll check the link status via the normal hot plug path later -
* but for short hpds we should check it now
+ DRM_DEBUG_KMS("drm_modeset_lock\n");
drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
intel_dp_check_link_status(intel_dp);
drm_modeset_unlock(&dev->mode_config.connection_mutex);
@@ -4566,6 +4572,8 @@ mst_fail:
put_power:
intel_display_power_put(dev_priv, power_domain);
+ DRM_DEBUG_KMS("Returning %d as ret\n", ret);
+
return ret;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 83c7ecf..c5e6f33 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -6555,6 +6555,7 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
power_domains = &dev_priv->power_domains;
+ DRM_DEBUG_KMS("locking power_domains->lock\n");
mutex_lock(&power_domains->lock);
WARN_ON(!power_domains->domain_use_count[domain]);
@@ -6570,8 +6571,10 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
+ DRM_DEBUG_KMS("unlocking power_domains->lock\n");
mutex_unlock(&power_domains->lock);
+ DRM_DEBUG_KMS("intel_runtime_pm_put is being called\n");
intel_runtime_pm_put(dev_priv);
2.3.3