From patchwork Thu Jul 30 05:18:16 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Linus Torvalds X-Patchwork-Id: 6898231 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 411479F380 for ; Thu, 30 Jul 2015 05:18:22 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 7BFA8203A0 for ; Thu, 30 Jul 2015 05:18:20 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 16EBE2038A for ; Thu, 30 Jul 2015 05:18:19 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 3E5686E730; Wed, 29 Jul 2015 22:18:18 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-ig0-f170.google.com (mail-ig0-f170.google.com [209.85.213.170]) by gabe.freedesktop.org (Postfix) with ESMTPS id 9F4AC6E730; Wed, 29 Jul 2015 22:18:17 -0700 (PDT) Received: by igbij6 with SMTP id ij6so159553615igb.1; Wed, 29 Jul 2015 22:18:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:content-type; bh=2KTtSWzV5q9INxV1Nm8xZhfipOTUFlqZchfymeCSBz4=; b=ywd2MBE+EcNosg+kwjwqmQzaR708PLxnLVqKHWU4X1Usk8ifAwtNNQWclM34TCaI6n JXmy/aGZg+wf99gAWiioU2Q8eAiJF4vEhefvDiaF9XjZ2NTtawzHN7XaK0EinuNgWDDG moFcYxcb9j301UgNghV38LqAZS4S2hkSH9mgYgEW0MYGfDFUq0j5b7v7CTayuB5AoP/Z Mmt/NYGfBsgJsc/i7edZzrbqFl9xCYcfVryE9uVatkA6LKsJhyIwHdoCoYUhh3DEns+f BSe0kneVnZQj8iKGrLUCtIX3aAiwyPUTN06f0Uqla/5R1pOJlJaka3LLLJ9over6EGTz /i8w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=google; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:content-type; bh=2KTtSWzV5q9INxV1Nm8xZhfipOTUFlqZchfymeCSBz4=; b=PpSIOU/O3zbvo9u1xVVZoc0PaavUq9MNo9WiEzu2sxysEeBptnZeZx/NxP/RWwBD3Q fDQqlfe1sFXMa2CKvkXmLzR2nPyi3VDIb0JthbYQQsBJ6+JVLkxXQV7HoavajwfLxkat qPOglSpH8byGojsYTQTjdHQma+aCxQUQ7u9Yk= MIME-Version: 1.0 X-Received: by 10.50.102.68 with SMTP id fm4mr1937936igb.25.1438233497086; Wed, 29 Jul 2015 22:18:17 -0700 (PDT) Received: by 10.36.78.7 with HTTP; Wed, 29 Jul 2015 22:18:16 -0700 (PDT) In-Reply-To: <20150730013912.GA4068@thunk.org> References: <20150730004937.GA3133@thunk.org> <20150730013912.GA4068@thunk.org> Date: Wed, 29 Jul 2015 22:18:16 -0700 X-Google-Sender-Auth: jYa0ViRzkWN0GWjCh_FRbCjq4hY Message-ID: Subject: Re: [REGRESSION] Re: i915 driver crashes on T540p if docking station attached From: Linus Torvalds To: "Theodore Ts'o" , intel-gfx , DRI , Daniel Vetter , Mani Nikula , Ander Conselvan de Oliveira , Linux Kernel Mailing List , Linus Torvalds X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Spam-Status: No, score=-5.5 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,RP_MATCHES_RCVD,T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Wed, Jul 29, 2015 at 6:39 PM, Theodore Ts'o wrote: > > It's here: https://goo.gl/photos/xHjn2Z97JQEw6k2C9 You didn't catch enough of the code line to decode the code, but it's early enough in drm_crtc_index() (just five bytes in) that it's almost certainly the very first dereference, so it's almost guaranteed to be that crtc->dev access as part of list_for_each_entry(), with crtc being NULL. And yes, "->dev" is the very first field, so the offset is zero too (while the "->mode_config" list access would not be at offset zero). And it looks like it is called from drm_atomic_helper_check_modeset(): the reason it has a question mark in the backtrace is because the fault happens before the stack frame has even been set up. There are multiple calls to "drm_crtc_index()" from that function, I can't tell which one it is. Looking at the code generation I get, I think it's because update_connector_routing() gets inlined, and that one does several calls. Most of them look like this: if (connector->state->crtc) { idx = drm_crtc_index(connector->state->crtc); ie they check that the crtc is non-NULL, but that last one does not: connector_state->best_encoder = new_encoder; idx = drm_crtc_index(connector_state->crtc); crtc_state = state->crtc_states[idx]; crtc_state->mode_changed = true; and I suspect the fix might be something like the attached. Totally untested. Ted? This whole "atomic modeset" series has been one royal fuck-up, guys. We've had too many of these kinds of crap issues. Linus drivers/gpu/drm/drm_atomic_helper.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index 5b59d5ad7d1c..aac212297b49 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -230,10 +230,12 @@ update_connector_routing(struct drm_atomic_state *state, int conn_idx) } connector_state->best_encoder = new_encoder; - idx = drm_crtc_index(connector_state->crtc); + if (connector_state->crtc) { + idx = drm_crtc_index(connector_state->crtc); - crtc_state = state->crtc_states[idx]; - crtc_state->mode_changed = true; + crtc_state = state->crtc_states[idx]; + crtc_state->mode_changed = true; + } DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] using [ENCODER:%d:%s] on [CRTC:%d]\n", connector->base.id,