From 713946d16f45ad0509434970ae6ff71529faab4b Mon Sep 17 00:00:00 2001

From: Manasi Navare <manasi.d.navare@intel.com>

Date: Thu, 26 Oct 2017 14:52:00 -0700

Subject: [PATCH] drm/i915: Cancel the modeset retry work during modeset cleanup

Git-commit: 713946d16f45ad0509434970ae6ff71529faab4b

Patch-mainline: v4.14-rc8

References: FATE#322643 bsc#1055900

No-fix: 886c6b8692ba5f71b578097524b3b082e2e02119

During modeset cleanup on driver unload we may have a pending

hotplug work. This needs to be canceled early during the teardown

so that it does not fire after we have freed the connector.

We do this after drm_kms_helper_poll_fini(dev) since this might

trigger modeset retry work due to link retrain and before

intel_fbdev_fini() since this work requires the lock from fbdev.

If this is not done we may see something like:

DEBUG_LOCKS_WARN_ON(mutex_is_locked(lock))

 ------------[ cut here ]------------

 WARNING: CPU: 4 PID: 5010 at kernel/locking/mutex-debug.c:103 mutex_destroy+0x4e/0x60

 Modules linked in: i915(-) snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec snd_hwdep snd_hda_core snd_pcm vgem ax88179_178

+a usbnet mii x86_pkg_temp_thermal intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel e1000e ptp pps_core prime_numbers i2c_hid

+[last unloaded: snd_hda_intel]

 CPU: 4 PID: 5010 Comm: drv_module_relo Tainted: G     U          4.14.0-rc3-CI-CI_DRM_3186+ #1

 Hardware name: Intel Corporation CoffeeLake Client Platform/CoffeeLake S UDIMM RVP, BIOS CNLSFWX1.R00.X104.A03.1709140524 09/14/2017

 task: ffff8803c827aa40 task.stack: ffffc90000520000

 RIP: 0010:mutex_destroy+0x4e/0x60

 RSP: 0018:ffffc90000523d58 EFLAGS: 00010292

 RAX: 000000000000002a RBX: ffff88044fbef648 RCX: 0000000000000000

 RDX: 0000000080000001 RSI: 0000000000000001 RDI: ffffffff810f0cf0

 RBP: ffffc90000523d60 R08: 0000000000000001 R09: 0000000000000001

 R10: 000000000f21cb81 R11: 0000000000000000 R12: ffff88044f71efc8

 R13: ffffffffa02b3d20 R14: ffffffffa02b3d90 R15: ffff880459b29308

 FS:  00007f5df4d6e8c0(0000) GS:ffff88045d300000(0000) knlGS:0000000000000000

 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033

 CR2: 000055ec51f00a18 CR3: 0000000451782006 CR4: 00000000003606e0

 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000

 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

 Call Trace:

  drm_fb_helper_fini+0xd9/0x130

  intel_fbdev_destroy+0x12/0x60 [i915]

  intel_fbdev_fini+0x28/0x30 [i915]

  intel_modeset_cleanup+0x45/0xa0 [i915]

  i915_driver_unload+0x92/0x180 [i915]

  i915_pci_remove+0x19/0x30 [i915]

  i915_driver_unload+0x92/0x180 [i915]

  i915_pci_remove+0x19/0x30 [i915]

  pci_device_remove+0x39/0xb0

  device_release_driver_internal+0x15d/0x220

  driver_detach+0x40/0x80

  bus_remove_driver+0x58/0xd0

  driver_unregister+0x2c/0x40

  pci_unregister_driver+0x36/0xb0

  i915_exit+0x1a/0x8b [i915]

  SyS_delete_module+0x18c/0x1e0

  entry_SYSCALL_64_fastpath+0x1c/0xb1

 RIP: 0033:0x7f5df3286287

 RSP: 002b:00007fff8e107cc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000b0

 RAX: ffffffffffffffda RBX: ffffffff81493a03 RCX: 00007f5df3286287

 RDX: 0000000000000001 RSI: 0000000000000800 RDI: 0000564c7be02e48

 RBP: ffffc90000523f88 R08: 0000000000000000 R09: 0000000000000080

 R10: 00007f5df4d6e8c0 R11: 0000000000000246 R12: 0000000000000000

 R13: 00007fff8e107eb0 R14: 0000000000000000 R15: 0000000000000000

Or a GPF like:

 general protection fault: 0000 [#1] PREEMPT SMP

 Modules linked in: i915(-) snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec snd_hwdep snd_hda_core snd_pcm vgem ax88179_178

+a usbnet mii x86_pkg_temp_thermal intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel e1000e ptp pps_core prime_numbers i2c_hid

+[last unloaded: snd_hda_intel]

 CPU: 0 PID: 82 Comm: kworker/0:1 Tainted: G     U  W       4.14.0-rc3-CI-CI_DRM_3186+ #1

 Hardware name: Intel Corporation CoffeeLake Client Platform/CoffeeLake S UDIMM RVP, BIOS CNLSFWX1.R00.X104.A03.1709140524 09/14/2017

 Workqueue: events intel_dp_modeset_retry_work_fn [i915]

 task: ffff88045a5caa40 task.stack: ffffc90000378000

 RIP: 0010:drm_setup_crtcs+0x143/0xbf0

 RSP: 0018:ffffc9000037bd20 EFLAGS: 00010202

 RAX: 6b6b6b6b6b6b6b6b RBX: 0000000000000002 RCX: 0000000000000001

 RDX: 0000000000000001 RSI: 0000000000000780 RDI: 00000000ffffffff

 RBP: ffffc9000037bdb8 R08: 0000000000000001 R09: 0000000000000001

 R10: 0000000000000780 R11: 0000000000000000 R12: 0000000000000002

 R13: ffff88044fbef4e8 R14: 0000000000000780 R15: 0000000000000438

 FS:  0000000000000000(0000) GS:ffff88045d200000(0000) knlGS:0000000000000000

 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033

 CR2: 000055ec51ee5168 CR3: 000000044c89d003 CR4: 00000000003606f0

 Call Trace:

  drm_fb_helper_hotplug_event.part.18+0x7e/0xc0

  drm_fb_helper_hotplug_event+0x1a/0x20

  intel_fbdev_output_poll_changed+0x1a/0x20 [i915]

  drm_kms_helper_hotplug_event+0x27/0x30

  intel_dp_modeset_retry_work_fn+0x77/0x80 [i915]

  process_one_work+0x233/0x660

  worker_thread+0x206/0x3b0

  kthread+0x152/0x190

  ? process_one_work+0x660/0x660

  ? kthread_create_on_node+0x40/0x40

  ret_from_fork+0x27/0x40

 Code: 06 00 00 45 8b 45 20 31 db 45 31 e4 45 85 c0 0f 8e 91 06 00 00 44 8b 75 94 44 8b 7d 90 49 8b 45 28 49 63 d4 44 89 f6 41 83 c4 01 <48> 8b 04 d0 44

+89 fa 48 8b 38 48 8b 87 a8 01 00 00 ff 50 20 01

 RIP: drm_setup_crtcs+0x143/0xbf0 RSP: ffffc9000037bd20

 ---[ end trace 08901ff1a77d30c7 ]---

V2: 

* Rename it to intel_hpd_poll_fini() and call drm_kms_helper_fini() inside it

as the first step before cancel work (Chris Wilson)

* Add GPF trace in commit message and make the function static (Maarten Lankhorst)

Suggested-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>

Suggested-by: Chris Wilson <chris@chris-wilson.co.uk>

Fixes: 9301397a63b3 ("drm/i915: Implement Link Rate fallback on Link training failure")

Cc: Chris Wilson <chris@chris-wilson.co.uk>

Cc: Tony Cheng <tony.cheng@amd.com>

Cc: Harry Wentland <Harry.wentland@amd.com>

Cc: Jani Nikula <jani.nikula@linux.intel.com>

Cc: Daniel Vetter <daniel.vetter@intel.com>

Cc: Ville Syrjala <ville.syrjala@linux.intel.com>

Cc: Manasi Navare <manasi.d.navare@intel.com>

Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>

Signed-off-by: Manasi Navare <manasi.d.navare@intel.com>

Link: https://patchwork.freedesktop.org/patch/msgid/1509054720-25325-1-git-send-email-manasi.d.navare@intel.com

Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

(cherry picked from commit 886c6b8692ba5f71b578097524b3b082e2e02119)

Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

Acked-by: Takashi Iwai <tiwai@suse.de>

---

 drivers/gpu/drm/i915/intel_display.c |   19 ++++++++++++++++++-

 1 file changed, 18 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/i915/intel_display.c

+++ b/drivers/gpu/drm/i915/intel_display.c

@@ -15230,6 +15230,23 @@ void intel_connector_unregister(struct d

 	intel_panel_destroy_backlight(connector);

 }

+static void intel_hpd_poll_fini(struct drm_device *dev)

+{

+	struct intel_connector *connector;

+	struct drm_connector_list_iter conn_iter;

+

+	/* First disable polling... */

+	drm_kms_helper_poll_fini(dev);

+

+	/* Then kill the work that may have been queued by hpd. */

+	drm_connector_list_iter_begin(dev, &conn_iter);

+	for_each_intel_connector_iter(connector, &conn_iter) {

+		if (connector->modeset_retry_work.func)

+			cancel_work_sync(&connector->modeset_retry_work);

+	}

+	drm_connector_list_iter_end(&conn_iter);

+}

+

 void intel_modeset_cleanup(struct drm_device *dev)

 {

 	struct drm_i915_private *dev_priv = to_i915(dev);

@@ -15250,7 +15267,7 @@ void intel_modeset_cleanup(struct drm_de

 	 * Due to the hpd irq storm handling the hotplug work can re-arm the

 	 * poll handlers. Hence disable polling after hpd handling is shut down.

 	 */

-	drm_kms_helper_poll_fini(dev);

+	intel_hpd_poll_fini(dev);

 	/* poll work can call into fbdev, hence clean that up afterwards */

 	intel_fbdev_fini(dev_priv);