Bug 80355

Summary: DP MST problems with xrandr while re-docking
Product: DRI Reporter: Sree Harsha Totakura <freedesktop>
Component: DRM/IntelAssignee: Intel GFX Bugs mailing list <intel-gfx-bugs>
Status: CLOSED FIXED QA Contact: Intel GFX Bugs mailing list <intel-gfx-bugs>
Severity: normal    
Priority: medium CC: dion, intel-gfx-bugs
Version: unspecified   
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:
Attachments:
Description Flags
X log from the session where I booted docked, un-docked and re-docked
none
Xorg log (5M large) until the crash described in comment #7
none
Xorg log until the crash described in comment #12
none
Xorg log until the crash observed with version 6c5658b14451239b8e4
none
DDX debug output util the problem of re-docking
none
Debug output while un-docking with intel driver@git ca296c18316a3ce1682
none
Debug output with intel driver@git 43ad5dbc60e1f50a
none
Debug output with intel driver@git 2ec2164ba4bd3a266949
none
Kernel oops upon re-docking none

Description Sree Harsha Totakura 2014-06-22 14:50:01 UTC 
Created attachment 101529 [details]
X log from the session where I booted docked, un-docked and re-docked

Hi!

I am trying out Dave Airlie's patches for DP MST on Intel Haswell
platform.  Particularly I am using the branch drm-i915-mst-v3.14 from
here http://cgit.freedesktop.org/~airlied/linux/?h=drm-next merged into
v3.14.4 from the linux-stable git repository.

Along with this, I am using the  HEAD version of userspace intel driver
from git://anongit.freedesktop.org/xorg/driver/xf86-video-intel.

The patches work -- I have a Lenovo T440s with two external monitors of
different resolutions connected through an ThinkPad ultradock and they
get detected as separate displays.  However, there is a problem when I
un-dock my notebook and re-dock it.

When I boot connected to the dock, xrandr shows the three monitors
(including my notebook's monitor) and all works fine:
> Screen 0: minimum 8 x 8, current 4864 x 1280, maximum 32767 x 32767
> eDP1 connected primary 1920x1080+2944+0 (normal left inverted right x axis y axis) 309mm x 175mm
>    1920x1080      60.0*+   59.9  
>    1680x1050      60.0     59.9  
>    1600x1024      60.2  
>    1400x1050      60.0  
>    1280x1024      60.0  
>    1440x900       59.9  
>    1280x960       60.0  
>    1360x768       59.8     60.0  
>    1152x864       60.0  
>    1024x768       60.0  
>    800x600        60.3     56.2  
>    640x480        59.9  
> DP1 disconnected (normal left inverted right x axis y axis)
> HDMI1 disconnected (normal left inverted right x axis y axis)
> DP2 disconnected (normal left inverted right x axis y axis)
> HDMI2 disconnected (normal left inverted right x axis y axis)
> DP3 connected 1920x1080+1024+0 (normal left inverted right x axis y axis) 598mm x 336mm
>    1920x1080      60.0*+   50.0     59.9  
>    1680x1050      59.9  
>    1280x1024      75.0     60.0  
>    1440x900       59.9  
>    1280x960       60.0  
>    1280x800       59.9  
>    1152x864       75.0  
>    1280x720       60.0     50.0     59.9  
>    1024x768       75.1     70.1     60.0  
>    832x624        74.6  
>    800x600        72.2     75.0     60.3     56.2  
>    720x576        50.0  
>    720x480        60.0     59.9  
>    640x480        75.0     72.8     66.7     60.0     59.9  
>    720x400        70.1  
> DP4 connected 1024x1280+0+0 left (normal left inverted right x axis y axis) 376mm x 301mm
>    1280x1024      60.0*+   75.0  
>    1152x864       75.0  
>    1024x768       75.1     70.1     60.0  
>    832x624        74.6  
>    800x600        72.2     75.0     60.3     56.2  
>    640x480        75.0     72.8     66.7     60.0  
>    720x400        70.1  
> DP5 disconnected (normal left inverted right x axis y axis)
> VIRTUAL1 disconnected (normal left inverted right x axis y axis)

When I un-dock, I see this in xrandr which is correct and all my
workspaces get transferred onto the notebook's monitor:
> Screen 0: minimum 8 x 8, current 1920 x 1080, maximum 32767 x 32767
> eDP1 connected primary 1920x1080+0+0 (normal left inverted right x axis y axis) 309mm x 175mm
>    1920x1080      60.0*+   59.9  
>    1680x1050      60.0     59.9  
>    1600x1024      60.2  
>    1400x1050      60.0  
>    1280x1024      60.0  
>    1440x900       59.9  
>    1280x960       60.0  
>    1360x768       59.8     60.0  
>    1152x864       60.0  
>    1024x768       60.0  
>    800x600        60.3     56.2  
>    640x480        59.9  
> DP1 disconnected (normal left inverted right x axis y axis)
> HDMI1 disconnected (normal left inverted right x axis y axis)
> DP2 disconnected (normal left inverted right x axis y axis)
> HDMI2 disconnected (normal left inverted right x axis y axis)
> DP3 disconnected (normal left inverted right x axis y axis)
> DP4 disconnected (normal left inverted right x axis y axis)
> DP5 disconnected (normal left inverted right x axis y axis)
> VIRTUAL1 disconnected (normal left inverted right x axis y axis)

And when I re-dock, I see the first xrandr output, but the monitors
don't light up.  I am not able to use xrandr to set a mode for them,
i.e. this fails:
> $ xrandr --output DP3 --mode 1920x1080
> xrandr: cannot find mode 1920x1080

As a result of this gnome-settings-daemon seems to crash.

I noticed that this does not happen if I dock the notebook after booting
it un-docked.  The xrandr output is different if I boot up un-docked; it
does not have DP3, DP4, DP5, but they show up when I dock it.  The
problem surfaces if I un-dock and then re-dock.

I guess the problem happens when the outputs DP3, DP4, DP5 are not
removed in xrandr when the notebook is un-docked.

This output from dmesg when I un-docked seem related:
> [ 1560.059912] ------------[ cut here ]------------
> [ 1560.059935] WARNING: CPU: 0 PID: 4990 at drivers/gpu/drm/i915/intel_display.c:9462 intel_modeset_check_state+0x576/0x7b0 [i915]()
> [ 1560.059938] encoder's enabled state mismatch (expected 1, found 0)
> [ 1560.059939] Modules linked in: ctr ccm rfcomm bnep vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O) binfmt_misc uinput snd_hda_codec_hdmi snd_hda_codec_realtek iTCO_wdt iTCO_vendor_support snd_hda_codec_generic nls_iso8859_1 nls_cp437 vfat fat ext2 x86_pkg_temp_thermal intel_powerclamp arc4 snd_usb_audio snd_usbmidi_lib snd_seq_midi snd_seq_midi_event snd_rawmidi intel_rapl coretemp uvcvideo videobuf2_vmalloc videobuf2_memops kvm_intel videobuf2_core videodev media kvm pcspkr joydev psmouse serio_raw evdev btusb bluetooth 6lowpan_iphc iwlmvm mac80211 iwlwifi cfg80211 i2c_i801 rtsx_pci_ms memstick lpc_ich mei_me mei snd_hda_intel snd_hda_codec wmi snd_hwdep snd_pcm snd_seq i915 snd_timer ac snd_seq_device thinkpad_acpi nvram tpm_tis i2c_algo_bit rfkill tpm drm_kms_helper snd drm battery i2c_core video soundcore processor button fuse autofs4 ext4 crc16 jbd2 mbcache hid_logitech_dj hid_generic dm_crypt dm_mod crc32_pclmul crc32c_intel rtsx_pci_sdmmc mmc_core ghash_clmulni_intel aes
ni_intel ahci libahci aes_x86_64 glue_helper lrw gf128mul ablk_helper cryptd libata e1000e ptp rtsx_pci pps_core mfd_core thermal thermal_sys
> [ 1560.060002] CPU: 0 PID: 4990 Comm: kworker/u16:0 Tainted: G           O 3.14.4-mst+ #14
> [ 1560.060004] Hardware name: LENOVO 20AQS00600/20AQS00600, BIOS GJET75WW (2.25 ) 03/28/2014
> [ 1560.060011] Workqueue: i915-dp i915_digport_work_func [i915]
> [ 1560.060013]  0000000000000000 0000000098c1ca1d ffffffff81501ab4 ffff8802c5855c50
> [ 1560.060016]  ffffffff8104ccf2 ffff8800db5a32e8 ffff8802c5855ca8 ffff8802c5855cc0
> [ 1560.060019]  0000000000000001 ffff8800db5a3318 ffffffff8104cd67 ffffffffa03820b0
> [ 1560.060023] Call Trace:
> [ 1560.060029]  [<ffffffff81501ab4>] ? dump_stack+0x41/0x51
> [ 1560.060033]  [<ffffffff8104ccf2>] ? warn_slowpath_common+0x72/0x90
> [ 1560.060036]  [<ffffffff8104cd67>] ? warn_slowpath_fmt+0x57/0x70
> [ 1560.060047]  [<ffffffffa0336242>] ? intel_ddi_get_hw_state+0x32/0x170 [i915]
> [ 1560.060058]  [<ffffffffa032b7d6>] ? intel_modeset_check_state+0x576/0x7b0 [i915]
> [ 1560.060069]  [<ffffffffa033eda1>] ? intel_dp_destroy_mst_connector+0x31/0xa0 [i915]
> [ 1560.060075]  [<ffffffffa02b7d12>] ? drm_dp_destroy_port+0x32/0x70 [drm_kms_helper]
> [ 1560.060081]  [<ffffffffa02b7e65>] ? drm_dp_destroy_mst_branch_device+0x115/0x140 [drm_kms_helper]
> [ 1560.060087]  [<ffffffffa02b9d65>] ? drm_dp_mst_topology_mgr_set_mst+0x2f5/0x400 [drm_kms_helper]
> [ 1560.060097]  [<ffffffffa033eab1>] ? intel_dp_handle_hpd_irq+0x141/0x170 [i915]
> [ 1560.060105]  [<ffffffffa02f84f5>] ? i915_digport_work_func+0x125/0x1a0 [i915]
> [ 1560.060109]  [<ffffffff8106891e>] ? process_one_work+0x16e/0x450
> [ 1560.060112]  [<ffffffff810695b1>] ? worker_thread+0x121/0x3d0
> [ 1560.060115]  [<ffffffff81069490>] ? flush_delayed_work+0x40/0x40
> [ 1560.060118]  [<ffffffff8106f79a>] ? kthread+0xda/0xf0
> [ 1560.060121]  [<ffffffff8106f6c0>] ? kthread_create_on_node+0x1a0/0x1a0
> [ 1560.060124]  [<ffffffff8150fc4c>] ? ret_from_fork+0x7c/0xb0
> [ 1560.060127]  [<ffffffff8106f6c0>] ? kthread_create_on_node+0x1a0/0x1a0
> [ 1560.060129] ---[ end trace fdc24314fed53257 ]---
> [ 1560.084214] usb 2-3.4.1.3: USB disconnect, device number 10
> [ 1560.272152] usb 3-3: USB disconnect, device number 2
> [ 1560.544416] thinkpad_acpi: EC reports that Thermal Table has changed
> [ 1560.648057] thinkpad_acpi: undocked from hotplug port replicator
Comment 1 Sree Harsha Totakura 2014-06-22 14:56:36 UTC 
-- Window manager: i3 + gnome-settings-daemon
-- chipset: 00:02.0 VGA compatible controller: Intel Corporation Haswell-ULT Integrated Graphics Controller (rev 09)
-- system architecture: x86-64
-- xf86-video-intel: GIT head/master b3d3c0e8e75a963262e4dc463fef60d7e9f1f01a
-- xserver: X.Org X Server 1.15.1-1 from latest Debian testing
-- kernel version: 3.14.4 merged with drm-i915-mst-v3.14 branch from http://cgit.freedesktop.org/~airlied/linux/log/?h=drm-i915-mst-support
-- Linux distribution: current Debian Testing
-- Machine or mobo model: Lenovo T440s
-- Display connector: DP MST (eDP + HDMI + DVI)
Comment 2 Chris Wilson 2014-06-22 15:03:12 UTC 
(In reply to comment #0)
> And when I re-dock, I see the first xrandr output, but the monitors
> don't light up.  I am not able to use xrandr to set a mode for them,
> i.e. this fails:
> > $ xrandr --output DP3 --mode 1920x1080
> > xrandr: cannot find mode 1920x1080
> 
> As a result of this gnome-settings-daemon seems to crash.
> 
> I noticed that this does not happen if I dock the notebook after booting
> it un-docked.  The xrandr output is different if I boot up un-docked; it
> does not have DP3, DP4, DP5, but they show up when I dock it.  The
> problem surfaces if I un-dock and then re-dock.
> 
> I guess the problem happens when the outputs DP3, DP4, DP5 are not
> removed in xrandr when the notebook is un-docked.

They are not meant to be as Clients blow up if RandR outputs disappear. What is odd is the DP names, they should have the topology information in them for MST devices (so that the names are stable across dock events). What exactly does xrandr say after you plug the dock back in?

If you recompile the ddx with --enable-debug=full that will provide some more information about the output reattachment.
Comment 3 Sree Harsha Totakura 2014-06-22 15:10:44 UTC 
(In reply to comment #2)
> They are not meant to be as Clients blow up if RandR outputs disappear. What
> is odd is the DP names, they should have the topology information in them
> for MST devices (so that the names are stable across dock events). What
> exactly does xrandr say after you plug the dock back in?

I get this output from xrandr after re-docking:
Screen 0: minimum 8 x 8, current 1920 x 1080, maximum 32767 x 32767
eDP1 connected primary 1920x1080+0+0 (normal left inverted right x axis y axis) 309mm x 175mm
   1920x1080      60.0*+   59.9  
   1680x1050      60.0     59.9  
   1600x1024      60.2  
   1400x1050      60.0  
   1280x1024      60.0  
   1440x900       59.9  
   1280x960       60.0  
   1360x768       59.8     60.0  
   1152x864       60.0  
   1024x768       60.0  
   800x600        60.3     56.2  
   640x480        59.9  
DP1 disconnected (normal left inverted right x axis y axis)
HDMI1 disconnected (normal left inverted right x axis y axis)
DP2 disconnected (normal left inverted right x axis y axis)
HDMI2 disconnected (normal left inverted right x axis y axis)
DP3 connected (normal left inverted right x axis y axis)
   1920x1080      60.0 +   50.0     59.9  
   1680x1050      59.9  
   1280x1024      75.0     60.0  
   1440x900       59.9  
   1280x960       60.0  
   1280x800       59.9  
   1152x864       75.0  
   1280x720       60.0     50.0     59.9  
   1024x768       75.1     70.1     60.0  
   832x624        74.6  
   800x600        72.2     75.0     60.3     56.2  
   720x576        50.0  
   720x480        60.0     59.9  
   640x480        75.0     72.8     66.7     60.0     59.9  
   720x400        70.1  
DP4 connected (normal left inverted right x axis y axis)
   1280x1024      60.0 +   75.0  
   1152x864       75.0  
   1024x768       75.1     70.1     60.0  
   832x624        74.6  
   800x600        72.2     75.0     60.3     56.2  
   640x480        75.0     72.8     66.7     60.0  
   720x400        70.1  
DP5 disconnected (normal left inverted right x axis y axis)
VIRTUAL1 disconnected (normal left inverted right x axis y axis)

> If you recompile the ddx with --enable-debug=full that will provide some
> more information about the output reattachment.

What is ddx?
Comment 4 Chris Wilson 2014-06-22 15:27:16 UTC 
ddx (Device Dependent X) here is xf86-video-intel.
Comment 5 Sree Harsha Totakura 2014-06-22 15:52:19 UTC 
I get a crash in Xorg with --enable-debug=full when I undock:

gdb) core core-Xorg-6-0-0-3593-1403451910 
[New LWP 3593]
[New LWP 3598]
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
warning: no loadable sections found in added symbol-file system-supplied DSO at 0x7fff623fe000
Core was generated by `/usr/bin/X :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -nov'.
Program terminated with signal 6, Aborted.
#0  0x00007fe196b3f407 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007fe196b3f407 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007fe196b42508 in __GI_abort () at abort.c:89
#2  0x00007fe196b38516 in __assert_fail_base (
    fmt=0x7fe196c6ec60 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=assertion@entry=0x7fe19370ab85 "len >= 2", 
    file=file@entry=0x7fe19370999b "sna_display.c", line=line@entry=1937, 
    function=function@entry=0x7fe19370d020 <__PRETTY_FUNCTION__.25794> "outputs_for_crtc")
    at assert.c:92
#3  0x00007fe196b385c2 in __GI___assert_fail (assertion=0x7fe19370ab85 "len >= 2", 
    file=0x7fe19370999b "sna_display.c", line=1937, 
    function=0x7fe19370d020 <__PRETTY_FUNCTION__.25794> "outputs_for_crtc") at assert.c:101
#4  0x00007fe1935afdb7 in outputs_for_crtc (crtc=0x7fe1996e8a10, outputs=0x7fff6231bc60 "", 
    max=256) at sna_display.c:1937
#5  0x00007fe1935aff8f in sna_crtc_set_mode_major (crtc=0x7fe1996e8a10, mode=0x7fe1996e8a28, 
    rotation=1, x=1024, y=0) at sna_display.c:1984
#6  0x00007fe1935b5338 in sna_mode_resize (scrn=0x7fe1996e5f60, width=1920, height=1080)
    at sna_display.c:3763
#7  0x00007fe199305cf9 in xf86RandR12ScreenSetSize (pScreen=0x7fe1996edf00, width=1920, 
    height=1080, mmWidth=508, mmHeight=286) at ../../../../hw/xfree86/modes/xf86RandR12.c:700
#8  0x00007fe19934e3cb in ProcRRSetScreenSize (client=0x7fe199aacb10)
    at ../../randr/rrscreen.c:286
#9  0x00007fe19928886e in Dispatch () at ../../dix/dispatch.c:433
#10 0x00007fe19928c68a in dix_main (argc=10, argv=0x7fff6231c0c8, envp=<optimized out>)
    at ../../dix/main.c:294
#11 0x00007fe196b2bb45 in __libc_start_main (main=0x7fe199277c00 <main>, argc=10, 
    argv=0x7fff6231c0c8, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fff6231c0b8) at libc-start.c:287
#12 0x00007fe199277c2e in _start ()
(gdb) 

(gdb) bt full
#0  0x00007fe196b3f407 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
        resultvar = 0
        pid = 3593
        selftid = 3593
#1  0x00007fe196b42508 in __GI_abort () at abort.c:89
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x7fff6231df9c, 
            sa_sigaction = 0x7fff6231df9c}, sa_mask = {__val = {140606873973035, 
              140606817999259, 1937, 4, 140734840814240, 2574154832, 2577911008, 
              6120541427177881600, 0, 0, 0, 21474836480, 140606873972419, 140734840814392, 
              140606913421312, 140606873988192}}, sa_flags = -1821332603, 
          sa_restorer = 0x7fe19370d020 <__PRETTY_FUNCTION__.25794>}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007fe196b38516 in __assert_fail_base (
    fmt=0x7fe196c6ec60 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=assertion@entry=0x7fe19370ab85 "len >= 2", 
    file=file@entry=0x7fe19370999b "sna_display.c", line=line@entry=1937, 
    function=function@entry=0x7fe19370d020 <__PRETTY_FUNCTION__.25794> "outputs_for_crtc")
    at assert.c:92
        str = 0x7fe199a388b0 ""
        total = 4096
#3  0x00007fe196b385c2 in __GI___assert_fail (assertion=0x7fe19370ab85 "len >= 2", 
    file=0x7fe19370999b "sna_display.c", line=1937, 
    function=0x7fe19370d020 <__PRETTY_FUNCTION__.25794> "outputs_for_crtc") at assert.c:101
No locals.
#4  0x00007fe1935afdb7 in outputs_for_crtc (crtc=0x7fe1996e8a10, outputs=0x7fff6231bc60 "", 
    max=256) at sna_display.c:1937
        config = 0x7fe1996e7c50
        len = 0
        i = 9
        __PRETTY_FUNCTION__ = "outputs_for_crtc"
#5  0x00007fe1935aff8f in sna_crtc_set_mode_major (crtc=0x7fe1996e8a10, mode=0x7fe1996e8a28, 
    rotation=1, x=1024, y=0) at sna_display.c:1984
        scrn = 0x7fe1996e5f60
        sna = 0x7fe199122000
        sna_crtc = 0x7fe1996e8910
        saved_bo = 0x7fe1996ee440
        bo = 0x7fe199a9fa30
        saved_kmode = {clock = 2574180096, hdisplay = 32737, hsync_start = 0, 
          hsync_end = 18321, htotal = 39222, hskew = 32737, vdisplay = 0, 
          vsync_start = 1080, vsync_end = 0, vtotal = 0, vscan = 0, vrefresh = 2574180096, 
          flags = 32737, type = 2574253752, 
          name = "\341\177\000\000\260ޥ\231\341\177\000\000`\376o\231\341\177\000\000\071\071\062\231\341\177\000\000\000\000\000"}
        saved_offset = 2574180096
        saved_transform = false
        outputs = "\000\264\251\231\341\177\000\000\270֩\231\341\177\000\000\220\274\061b\377\177\000\000\217\360T\223\341\177\000\000p֩\231\341\177\000\000\000 \022\231\341\177\000\000\300\274\061b\377\177\000\000\343\031U\223\341\177\000\000\300\274\061b\377\177\000\000p֩\231\---Type <return> to continue, or q <return> to quit---
341\177\000\000\060\372\251\231\341\177\000\000\000 \022\231\341\177\000\000\000\275\061b\377\177\000\000\233\035U\223\341\177\000\000 \370\227\223\341\177\000\000\060\372\251\231\341\177\000\000 \370\227\223\341\177\000\000\060\230\241\231\341\177\000\000\000 \022\231\341\177\000\000p֩\231\341\177\000\000\000\337n\231\341\177\000\000\221G6\231\341\177\000\000\260ޥ\231\341\177\000\000\000\337n\231\341\177\000\000\270\376o\231\341\177\000\000\060\372\251\231\341"...
        __PRETTY_FUNCTION__ = "sna_crtc_set_mode_major"
#6  0x00007fe1935b5338 in sna_mode_resize (scrn=0x7fe1996e5f60, width=1920, height=1080)
    at sna_display.c:3763
        crtc = 0x7fe1996e8a10
        config = 0x7fe1996e7c50
        sna = 0x7fe199122000
        screen = 0x7fe1996edf00
        new_front = 0x7fe199a5deb0
        i = 1
        __FUNCTION__ = "sna_mode_resize"
        __PRETTY_FUNCTION__ = "sna_mode_resize"
#7  0x00007fe199305cf9 in xf86RandR12ScreenSetSize (pScreen=0x7fe1996edf00, width=1920, 
    height=1080, mmWidth=508, mmHeight=286) at ../../../../hw/xfree86/modes/xf86RandR12.c:700
        pScrn = 0x7fe1996e5f60
        config = 0x7fe1996e7c50
        pRoot = 0x7fe199722000
        pScrnPix = <optimized out>
        ret = 0
        panning = 0
        c = <optimized out>
#8  0x00007fe19934e3cb in ProcRRSetScreenSize (client=0x7fe199aacb10)
    at ../../randr/rrscreen.c:286
        stuff = 0x7fe199a3cb70
        pWin = 0x7fe199722000
        pScreen = <optimized out>
        i = <optimized out>
        rc = <optimized out>
#9  0x00007fe19928886e in Dispatch () at ../../dix/dispatch.c:433
        clientReady = 0x7fe199a2bb20
        result = <optimized out>
        client = 0x7fe199aacb10
        nready = 0
        icheck = 0x7fe1996738d0 <checkForInput>
        start_tick = 395
#10 0x00007fe19928c68a in dix_main (argc=10, argv=0x7fff6231c0c8, envp=<optimized out>)
    at ../../dix/main.c:294
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
#11 0x00007fe196b2bb45 in __libc_start_main (main=0x7fe199277c00 <main>, argc=10, 
    argv=0x7fff6231c0c8, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fff6231c0b8) at libc-start.c:287
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, -4258070593275829813, 
                140606913870853, 140734840815808, 0, 0, 4257747970363089355, 
---Type <return> to continue, or q <return> to quit---
                4263613890836554187}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 
              0x7fe1993eabf0 <__libc_csu_init>, 0x7fff6231c0c8}, data = {prev = 0x0, 
              cleanup = 0x0, canceltype = -1723946000}}}
        not_first_call = <optimized out>
#12 0x00007fe199277c2e in _start ()
No symbol table info available.
(gdb)
Comment 6 Chris Wilson 2014-06-22 15:58:01 UTC 
Attach the Xorg.0.log up until the point of the crash.
Comment 7 Sree Harsha Totakura 2014-06-22 16:25:22 UTC 
Here is another crash:

(gdb) core core-Xorg-6-0-0-3610-1403453656 
[New LWP 3610]
[New LWP 3615]
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
warning: no loadable sections found in added symbol-file system-supplied DSO at 0x7fffaeda7000
Core was generated by `/usr/bin/X :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -nov'.
Program terminated with signal 6, Aborted.
#0  0x00007f497896e407 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007f497896e407 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007f4978971508 in __GI_abort () at abort.c:89
#2  0x00007f4978967516 in __assert_fail_base (
    fmt=0x7f4978a9dc60 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=assertion@entry=0x7f4975538b48 "width == info.width && height == info.height", 
    file=file@entry=0x7f497553899b "sna_display.c", line=line@entry=320, 
    function=function@entry=0x7f497553ba93 <__PRETTY_FUNCTION__.25426> "assert_scanout")
    at assert.c:92
#3  0x00007f49789675c2 in __GI___assert_fail (
    assertion=0x7f4975538b48 "width == info.width && height == info.height", 
    file=0x7f497553899b "sna_display.c", line=320, 
    function=0x7f497553ba93 <__PRETTY_FUNCTION__.25426> "assert_scanout") at assert.c:101
#4  0x00007f49753da1bb in assert_scanout (kgem=0x7f497af51000, bo=0x7f497ca4ffd0, 
    width=1280, height=1024) at sna_display.c:320
#5  0x00007f49753da343 in get_fb (sna=0x7f497af51000, bo=0x7f497ca4ffd0, width=1280, 
    height=1024) at sna_display.c:340
#6  0x00007f49753eb2cb in sna_mode_redisplay (sna=0x7f497af51000) at sna_display.c:6249
#7  0x00007f49753bbae2 in sna_scanout_flush (sna=0x7f497af51000) at sna_accel.c:17189
#8  0x00007f49753bcfaa in sna_accel_block_handler (sna=0x7f497af51000, tv=0x7fffaecaa818)
    at sna_accel.c:17662
#9  0x00007f49753ef3e8 in sna_block_handler (arg=0x7f497c6c0e20, timeout=0x7fffaecaa818, 
    read_mask=0x7f497b4a98c0 <LastSelectMask>) at sna_driver.c:723
#10 0x00007f497b0bbfb4 in BlockHandler (pTimeout=pTimeout@entry=0x7fffaecaa818, 
    pReadmask=pReadmask@entry=0x7f497b4a98c0 <LastSelectMask>) at ../../dix/dixutils.c:387
#11 0x00007f497b207384 in WaitForSomething (pClientsReady=pClientsReady@entry=0x7f497c9feb80)
    at ../../os/WaitFor.c:215
#12 0x00007f497b0b75c1 in Dispatch () at ../../dix/dispatch.c:362
#13 0x00007f497b0bb68a in dix_main (argc=10, argv=0x7fffaecaac28, envp=<optimized out>)
    at ../../dix/main.c:294
#14 0x00007f497895ab45 in __libc_start_main (main=0x7f497b0a6c00 <main>, argc=10, 
    argv=0x7fffaecaac28, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fffaecaac18) at libc-start.c:287
#15 0x00007f497b0a6c2e in _start ()
(gdb) bt full
#0  0x00007f497896e407 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
        resultvar = 0
        pid = 3610
        selftid = 3610
#1  0x00007f4978971508 in __GI_abort () at abort.c:89
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x7fffaecabf9c, 
            sa_sigaction = 0x7fffaecabf9c}, sa_mask = {__val = {139953533722923, 
              139953477749147, 320, 4, 140736125903792, 47244640257, 16384, 0, 0, 0, 0, 
              21474836480, 139953533722307, 140736125903944, 139953573171200, 
              139953533738080}}, sa_flags = 1968409416, 
          sa_restorer = 0x7f497553ba93 <__PRETTY_FUNCTION__.25426>}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007f4978967516 in __assert_fail_base (
    fmt=0x7f4978a9dc60 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=assertion@entry=0x7f4975538b48 "width == info.width && height == info.height", 
    file=file@entry=0x7f497553899b "sna_display.c", line=line@entry=320, 
    function=function@entry=0x7f497553ba93 <__PRETTY_FUNCTION__.25426> "assert_scanout")
    at assert.c:92
        str = 0x7f497ca0bcf0 ""
        total = 4096
#3  0x00007f49789675c2 in __GI___assert_fail (
    assertion=0x7f4975538b48 "width == info.width && height == info.height", 
    file=0x7f497553899b "sna_display.c", line=320, 
    function=0x7f497553ba93 <__PRETTY_FUNCTION__.25426> "assert_scanout") at assert.c:101
No locals.
#4  0x00007f49753da1bb in assert_scanout (kgem=0x7f497af51000, bo=0x7f497ca4ffd0, 
    width=1280, height=1024) at sna_display.c:320
        info = {fb_id = 92, width = 4864, height = 1280, pitch = 19456, bpp = 32, 
          depth = 24, handle = 48}
        __PRETTY_FUNCTION__ = "assert_scanout"
#5  0x00007f49753da343 in get_fb (sna=0x7f497af51000, bo=0x7f497ca4ffd0, width=1280, 
    height=1024) at sna_display.c:340
        scrn = 0x7f497c6b8e40
        arg = {fb_id = 0, width = 0, height = 1280, pitch = 0, bpp = 1061, depth = 0, 
          handle = 4864}
        __PRETTY_FUNCTION__ = "get_fb"
        __FUNCTION__ = "get_fb"
#6  0x00007f49753eb2cb in sna_mode_redisplay (sna=0x7f497af51000) at sna_display.c:6249
        arg = {crtc_id = 8, fb_id = 32767, flags = 1968343902, reserved = 32585, 
          user_data = 47}
        bo = 0x7f497ca4ffd0
        crtc = 0x7f497c6bc500
        sna_crtc = 0x7f497c6bc400
        damage = {extents = {x1 = 0, y1 = 0, x2 = 1024, y2 = 1280}, data = 0x0}
        config = 0x7f497c6bab70
        region = 0x7f497c9fce20
        i = 2
        __FUNCTION__ = "sna_mode_redisplay"
---Type <return> to continue, or q <return> to quit---
        __PRETTY_FUNCTION__ = "sna_mode_redisplay"
#7  0x00007f49753bbae2 in sna_scanout_flush (sna=0x7f497af51000) at sna_accel.c:17189
        priv = 0x7f497ca24bd0
        busy = true
        __FUNCTION__ = "sna_scanout_flush"
#8  0x00007f49753bcfaa in sna_accel_block_handler (sna=0x7f497af51000, tv=0x7fffaecaa818)
    at sna_accel.c:17662
        __PRETTY_FUNCTION__ = "sna_accel_block_handler"
        __FUNCTION__ = "sna_accel_block_handler"
#9  0x00007f49753ef3e8 in sna_block_handler (arg=0x7f497c6c0e20, timeout=0x7fffaecaa818, 
    read_mask=0x7f497b4a98c0 <LastSelectMask>) at sna_driver.c:723
        sna = 0x7f497af51000
        tv = 0x7fffaecaa818
        __FUNCTION__ = "sna_block_handler"
#10 0x00007f497b0bbfb4 in BlockHandler (pTimeout=pTimeout@entry=0x7fffaecaa818, 
    pReadmask=pReadmask@entry=0x7f497b4a98c0 <LastSelectMask>) at ../../dix/dixutils.c:387
        i = 0
        j = <optimized out>
#11 0x00007f497b207384 in WaitForSomething (pClientsReady=pClientsReady@entry=0x7f497c9feb80)
    at ../../os/WaitFor.c:215
        i = <optimized out>
        waittime = {tv_sec = 118, tv_usec = 692000}
        wt = 0x7fffaecaa820
        timeout = <optimized out>
        clientsReadable = {fds_bits = {0 <repeats 16 times>}}
        clientsWritable = {fds_bits = {140736125905152, 0, 139953577797840, 139953600614944, 
            140736125905312, 1, 32, 139953577732120, 139953577797840, 139953573734114, 
            139953600614944, 140736125905312, 1, 139953600588976, 140736125905216, 
            139953475928436}}
        selecterr = <optimized out>
        nready = 0
        devicesReadable = {fds_bits = {140736125905232, 139953600588976, 140736125905248, 
            1133755368535988992, 139953600588976, 139953600614944, 139953598451748, 
            139953600614944, 44040206, 139953577732120, 139953577797840, 139953574954594, 
            139951509341240, 4294967296, 189151244491161614, 4063232}}
        now = <optimized out>
        someReady = 0
#12 0x00007f497b0b75c1 in Dispatch () at ../../dix/dispatch.c:362
        clientReady = 0x7f497c9feb80
        result = <optimized out>
        client = <optimized out>
        nready = <optimized out>
        icheck = 0x7f497b4a28d0 <checkForInput>
        start_tick = <optimized out>
#13 0x00007f497b0bb68a in dix_main (argc=10, argv=0x7fffaecaac28, envp=<optimized out>)
    at ../../dix/main.c:294
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
#14 0x00007f497895ab45 in __libc_start_main (main=0x7f497b0a6c00 <main>, argc=10, 
    argv=0x7fffaecaac28, init=<optimized out>, fini=<optimized out>, 
---Type <return> to continue, or q <return> to quit---
    rtld_fini=<optimized out>, stack_end=0x7fffaecaac18) at libc-start.c:287
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 6282698114761085954, 139953573620741, 
                140736125905952, 0, 0, -6282524569740127230, -6223322061983198206}, 
              mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 
              0x7f497b219bf0 <__libc_csu_init>, 0x7fffaecaac28}, data = {prev = 0x0, 
              cleanup = 0x0, canceltype = 2065800176}}}
        not_first_call = <optimized out>
#15 0x00007f497b0a6c2e in _start ()
No symbol table info available.
(gdb)
Comment 8 Sree Harsha Totakura 2014-06-22 16:28:10 UTC 
Created attachment 101530 [details]
Xorg log (5M large) until the crash described in comment #7
Comment 9 Sree Harsha Totakura 2014-06-22 16:30:38 UTC 
I had to upload the log file gziped -- the debug output seems to be huge 5MB output for about 30 seconds; is there a way in which we can limit it?
Comment 10 Chris Wilson 2014-06-22 16:59:44 UTC 
This should avoid the second crash:

commit dca0f1c2ccf14df38764ed12b971dc491cf22608
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Sun Jun 22 17:53:59 2014 +0100

    sna: Track CRTC mode changes and discard old flips
    
    If we have a pending flip across a modeset we must be careful to drop
    the stale flip_bo after the modeset.
    
    Reported-by: Sree Harsha Totakura <freedesktop@h.totakura.in>
    References: https://bugs.freedesktop.org/show_bug.cgi?id=80355#c8
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>


One issue is that no DP report a MST path, which explains the absence of any connector called something like: DP1-2.
Comment 11 Chris Wilson 2014-06-22 17:47:21 UTC 
And this should fix the first crash you reported:

commit f22ea4e821a33eccd3a9283d7ab048857008f7e8
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Sun Jun 22 17:53:59 2014 +0100

    sna: Disable unused CRTC after undock events
    
    If undocking removes output (as the MST topology changes and some
    outputs then become unreachable), we may leave dangling CRTC. This
    confuses us, so disable any enabled but unconnected CRTC after the
    undock event.
    
    Reported-by: Sree Harsha Totakura <freedesktop@h.totakura.in>
    References: https://bugs.freedesktop.org/show_bug.cgi?id=80355#c5
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>


All that remains is to try and shed some light on the original bug.
Comment 12 Sree Harsha Totakura 2014-06-22 21:56:54 UTC 
I get a new crash this time:

(gdb) core core-Xorg-11-0-0-3755-1403473466 
[New LWP 3755]
[New LWP 3760]
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
warning: no loadable sections found in added symbol-file system-supplied DSO at 0x7fff4feea000
Core was generated by `/usr/bin/X :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -nov'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007f4646f68b15 in strlen_sigsafe (s=0x4 <Address 0x4 out of bounds>) at ../../os/log.c:179
179	../../os/log.c: No such file or directory.
(gdb) bt
#0  0x00007f4646f68b15 in strlen_sigsafe (s=0x4 <Address 0x4 out of bounds>) at ../../os/log.c:179
#1  pnprintf (size=1024, args=<optimized out>, f=0x7f464128c510 "%s: discarding all damage %dx[(%d, %d], (%d, %d)]\n", 
    string=0x7fff4fedc580 "G") at ../../os/log.c:378
#2  LogVMessageVerbSigSafe (type=<optimized out>, verb=<optimized out>, 
    format=0x7f464128c510 "%s: discarding all damage %dx[(%d, %d], (%d, %d)]\n", args=<optimized out>) at ../../os/log.c:678
#3  0x00007f4641143c8c in LogF (f=0x7f464128c510 "%s: discarding all damage %dx[(%d, %d], (%d, %d)]\n") at sna_driver.c:1380
#4  0x00007f464112f98d in sna_pixmap_discard_shadow_damage (priv=0x7f4648aea380, region=0x0) at sna_display.c:1275
#5  0x00007f46410d0ace in sna_pixmap_free_gpu (sna=0x7f4646ca4000, priv=0x7f4648aea380) at sna_accel.c:485
#6  0x00007f46410d7015 in _sna_pixmap_move_to_cpu (pixmap=0x7f4648aea300, flags=7) at sna_accel.c:2305
#7  0x00007f46410d89b4 in sna_drawable_move_region_to_cpu (drawable=0x7f4648aea300, region=0x7fff4fedcff0, flags=5)
    at sna_accel.c:2692
#8  0x00007f46410e7454 in sna_copy_boxes (src=0x7f4648df3af0, dst=0x7f4648aeb000, gc=0x7f4648c1cbb0, region=0x7fff4fedcff0, dx=-941, 
    dy=-521, bitplane=0, closure=0x0) at sna_accel.c:6596
#9  0x00007f46410e817e in sna_do_copy (src=0x7f4648df3af0, dst=0x7f4648aeb000, gc=0x7f4648c1cbb0, sx=0, sy=0, width=40, height=40, 
    dx=941, dy=521, copy=0x7f46410e51c2 <sna_copy_boxes>, bitPlane=0, closure=0x0) at sna_accel.c:6793
#10 0x00007f46410e8679 in sna_copy_area (src=0x7f4648df3af0, dst=0x7f4648aeb000, gc=0x7f4648c1cbb0, src_x=0, src_y=0, width=40, 
    height=40, dst_x=941, dst_y=521) at sna_accel.c:6875
#11 0x00007f4646eea5a8 in damageCopyArea (pSrc=0x7f4648df3af0, pDst=0x7f4648aeb000, pGC=0x7f4648c1cbb0, srcx=0, 
    srcy=<optimized out>, width=40, height=40, dstx=941, dsty=521) at ../../../miext/damage/damage.c:765
#12 0x00007f4646f3e6ba in miDCRestoreUnderCursor (pDev=pDev@entry=0x7f4648bf19d0, pScreen=pScreen@entry=0x7f4648ab6f00, x=941, 
    y=521, w=40, h=40) at ../../mi/midispcur.c:447
#13 0x00007f4646f4d422 in miSpriteRemoveCursor (pDev=0x7f4648bf19d0, pScreen=0x7f4648ab6f00) at ../../mi/misprite.c:844
#14 0x00007f4646f4e4cb in miSpriteReportDamage (pDamage=<optimized out>, pRegion=0x7fff4fedd2a0, closure=0x7f4648ab6f00)
    at ../../mi/misprite.c:271
#15 0x00007f4646ee6b54 in DamageReportDamage (pDamage=pDamage@entry=0x7f4648ab8830, pDamageRegion=pDamageRegion@entry=0x7fff4fedd2a0)
    at ../../../miext/damage/damage.c:1913
#16 0x00007f4646ee6d61 in damageRegionAppend (pDrawable=0x7f4648e1b350, pRegion=pRegion@entry=0x7fff4fedd300, clip=clip@entry=1, 
    subWindowMode=<optimized out>) at ../../../miext/damage/damage.c:264
#17 0x00007f4646ee7018 in damageDamageBox (pDrawable=pDrawable@entry=0x7f4648e1b350, pBox=pBox@entry=0x7fff4fedd340, 
    subWindowMode=<optimized out>) at ../../../miext/damage/damage.c:320
#18 0x00007f4646ee8c60 in damagePolyFillRect (pDrawable=0x7f4648e1b350, pGC=0x7f4648aea830, nRects=1, pRects=<optimized out>)
    at ../../../miext/damage/damage.c:1192
#19 0x00007f4646f3faa1 in miPaintWindow (pWin=<optimized out>, pWin@entry=0x7f4648e1b350, prgn=prgn@entry=0x7f4648e6c3d0, 
    what=what@entry=0) at ../../mi/miexpose.c:641
#20 0x00007f4646f40375 in miWindowExposures (pWin=0x7f4648e1b350, prgn=0x7f4648e6c3d0, other_exposed=0x0) at ../../mi/miexpose.c:470
#21 0x00007f4646f55538 in miHandleValidateExposures (pWin=0x7f4648aeb000) at ../../mi/miwindow.c:223
#22 0x00007f4646e39c50 in SetRootClip (pScreen=0x7f4648ab6f00, enable=1) at ../../dix/window.c:3610
#23 0x00007f4646e8b4e1 in xf86CursorEnableDisableFBAccess (pScrn=0x7f4648aaef60, enable=1)
    at ../../../../hw/xfree86/ramdac/xf86Cursor.c:225
#24 0x00007f4646e4872a in xf86VTSwitch () at ../../../../hw/xfree86/common/xf86Events.c:555
#25 xf86Wakeup (blockData=<optimized out>, err=<optimized out>, pReadmask=<optimized out>)
    at ../../../../hw/xfree86/common/xf86Events.c:288
#26 0x00007f4646e0f17d in WakeupHandler (result=result@entry=-1, pReadmask=pReadmask@entry=0x7f46471fc8c0 <LastSelectMask>)
    at ../../dix/dixutils.c:423
#27 0x00007f4646f5a40f in WaitForSomething (pClientsReady=pClientsReady@entry=0x7f4648df3020) at ../../os/WaitFor.c:229
#28 0x00007f4646e0a5c1 in Dispatch () at ../../dix/dispatch.c:362
#29 0x00007f4646e0e68a in dix_main (argc=10, argv=0x7fff4fedda58, envp=<optimized out>) at ../../dix/main.c:294
#30 0x00007f46446adb45 in __libc_start_main (main=0x7f4646df9c00 <main>, argc=10, argv=0x7fff4fedda58, init=<optimized out>, 
    fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fff4fedda48) at libc-start.c:287
#31 0x00007f4646df9c2e in _start ()
(gdb) bt full
#0  0x00007f4646f68b15 in strlen_sigsafe (s=0x4 <Address 0x4 out of bounds>) at ../../os/log.c:179
        len = 0
#1  pnprintf (size=1024, args=<optimized out>, f=0x7f464128c510 "%s: discarding all damage %dx[(%d, %d], (%d, %d)]\n", 
    string=0x7fff4fedc580 "G") at ../../os/log.c:378
        length_modifier = <optimized out>
        f_idx = 1
        s_idx = 0
        f_len = 50
        string_arg = 0x4 <Address 0x4 out of bounds>
        si = <optimized out>
        p_len = <optimized out>
        number = "+\000\000\000\000\000\000\000\360\305\355O\377\177\000\000\001\000\000\000"
        i = <optimized out>
        ui = <optimized out>
#2  LogVMessageVerbSigSafe (type=<optimized out>, verb=<optimized out>, 
    format=0x7f464128c510 "%s: discarding all damage %dx[(%d, %d], (%d, %d)]\n", args=<optimized out>) at ../../os/log.c:678
        type_str = <optimized out>
        buf = "G\000\000\000\001\000\000\000\033\000\000\000\000\000\000\000+\000\000\000\000\000\000\000\033\000\000\000\000\000\000\000+\000\000\000\000\000\000\000,\210\366FF\177\000\000__sn\001\000\000\000X\312\355O\377\177\000\000(1920, 1080)\n\000: 1\000\000iring bo handle=32 (needed flsna_pixmap_free_gpu: handle=28 (pinned? 1)\n\000\060, busy? 0\n\000 syncing CPU bo\n\000\060, stride=7680 "...
        newline = <optimized out>
#3  0x00007f4641143c8c in LogF (f=0x7f464128c510 "%s: discarding all damage %dx[(%d, %d], (%d, %d)]\n") at sna_driver.c:1380
        ap = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fff4fedcac0, reg_save_area = 0x7fff4fedca00}}
#4  0x00007f464112f98d in sna_pixmap_discard_shadow_damage (priv=0x7f4648aea380, region=0x0) at sna_display.c:1275
        sna = 0x7f4646ca4000
        __FUNCTION__ = "sna_pixmap_discard_shadow_damage"
#5  0x00007f46410d0ace in sna_pixmap_free_gpu (sna=0x7f4646ca4000, priv=0x7f4648aea380) at sna_accel.c:485
        __FUNCTION__ = "sna_pixmap_free_gpu"
        __PRETTY_FUNCTION__ = "sna_pixmap_free_gpu"
#6  0x00007f46410d7015 in _sna_pixmap_move_to_cpu (pixmap=0x7f4648aea300, flags=7) at sna_accel.c:2305
        sna = 0x7f4646ca4000
        priv = 0x7f4648aea380
        __FUNCTION__ = "_sna_pixmap_move_to_cpu"
        __PRETTY_FUNCTION__ = "_sna_pixmap_move_to_cpu"
#7  0x00007f46410d89b4 in sna_drawable_move_region_to_cpu (drawable=0x7f4648aea300, region=0x7fff4fedcff0, flags=5)
    at sna_accel.c:2692
        pixmap = 0x7f4648aea300
        sna = 0x7f4646ca4000
        priv = 0x7f4648aea380
        dx = 0
        dy = 0
        __FUNCTION__ = "sna_drawable_move_region_to_cpu"
        __PRETTY_FUNCTION__ = "sna_drawable_move_region_to_cpu"
#8  0x00007f46410e7454 in sna_copy_boxes (src=0x7f4648df3af0, dst=0x7f4648aeb000, gc=0x7f4648c1cbb0, region=0x7fff4fedcff0, dx=-941, 
    dy=-521, bitplane=0, closure=0x0) at sna_accel.c:6596
        mode = 5
        dst_bits = 0x7f4648c56f20
        src_bits = 0x7f46412818f0
        dst_stride = 48
        src_stride = 48
        src_pixmap = 0x7f4648df3af0
        src_priv = 0x7f4648df3a50
        dst_pixmap = 0x7f4648aea300
        dst_priv = 0x7f4648aea380
        sna = 0x7f4646ca4000
        damage = 0x7f46471eb600 <damageGCFuncs>
        bo = 0x0
        src_dx = -941
        src_dy = -521
        dst_dx = 0
        dst_dy = 0
        box = 0x7fff4fedcff0
        n = 1
        alu = 3
        stride = 32767
        bpp = 32
        bits = 0x7fff4fedcfa8 ""
        replaces = false
        __PRETTY_FUNCTION__ = "sna_copy_boxes"
        __FUNCTION__ = "sna_copy_boxes"
#9  0x00007f46410e817e in sna_do_copy (src=0x7f4648df3af0, dst=0x7f4648aeb000, gc=0x7f4648c1cbb0, sx=0, sy=0, width=40, height=40, 
    dx=941, dy=521, copy=0x7f46410e51c2 <sna_copy_boxes>, bitPlane=0, closure=0x0) at sna_accel.c:6793
        clip = 0x0
        region = {extents = {x1 = 941, y1 = 521, x2 = 981, y2 = 561}, data = 0x0}
        src_extents = {x1 = 0, y1 = 0, x2 = 40, y2 = 40}
        expose = false
---Type <return> to continue, or q <return> to quit---
        __FUNCTION__ = "sna_do_copy"
        __PRETTY_FUNCTION__ = "sna_do_copy"
#10 0x00007f46410e8679 in sna_copy_area (src=0x7f4648df3af0, dst=0x7f4648aeb000, gc=0x7f4648c1cbb0, src_x=0, src_y=0, width=40, 
    height=40, dst_x=941, dst_y=521) at sna_accel.c:6875
        sna = 0x7f4646ca4000
        copy = 0x7f46410e51c2 <sna_copy_boxes>
        __FUNCTION__ = "sna_copy_area"
#11 0x00007f4646eea5a8 in damageCopyArea (pSrc=0x7f4648df3af0, pDst=0x7f4648aeb000, pGC=0x7f4648c1cbb0, srcx=0, 
    srcy=<optimized out>, width=40, height=40, dstx=941, dsty=521) at ../../../miext/damage/damage.c:765
        ret = <optimized out>
        oldFuncs = 0x7f46471eb600 <damageGCFuncs>
#12 0x00007f4646f3e6ba in miDCRestoreUnderCursor (pDev=pDev@entry=0x7f4648bf19d0, pScreen=pScreen@entry=0x7f4648ab6f00, x=941, 
    y=521, w=40, h=40) at ../../mi/midispcur.c:447
        pBuffer = <optimized out>
        pSave = <optimized out>
        pWin = 0x7f4648aeb000
        pGC = 0x7f4648c1cbb0
#13 0x00007f4646f4d422 in miSpriteRemoveCursor (pDev=0x7f4648bf19d0, pScreen=0x7f4648ab6f00) at ../../mi/misprite.c:844
        pCursorInfo = 0x7f4648c230c8
        pScreen = 0x7f4648ab6f00
        pDev = 0x7f4648bf19d0
#14 0x00007f4646f4e4cb in miSpriteReportDamage (pDamage=<optimized out>, pRegion=0x7fff4fedd2a0, closure=0x7f4648ab6f00)
    at ../../mi/misprite.c:271
        pScreen = 0x7f4648ab6f00
        pCursorInfo = <optimized out>
        pDev = 0x7f4648bf19d0
#15 0x00007f4646ee6b54 in DamageReportDamage (pDamage=pDamage@entry=0x7f4648ab8830, pDamageRegion=pDamageRegion@entry=0x7fff4fedd2a0)
    at ../../../miext/damage/damage.c:1913
        tmpBox = <optimized out>
        tmpRegion = {extents = {x1 = -11552, y1 = 20461, x2 = 32767, y2 = 0}, data = 0x7f4648e1b350}
        was_empty = <optimized out>
#16 0x00007f4646ee6d61 in damageRegionAppend (pDrawable=0x7f4648e1b350, pRegion=pRegion@entry=0x7fff4fedd300, clip=clip@entry=1, 
    subWindowMode=<optimized out>) at ../../../miext/damage/damage.c:264
        pScreen = <optimized out>
        pDamage = 0x7f4648ab8830
        pNext = 0x0
        clippedRec = {extents = {x1 = 787, y1 = 463, x2 = 1133, y2 = 617}, data = 0x0}
        pDamageRegion = 0x7fff4fedd2a0
        pixClip = {extents = {x1 = 0, y1 = 0, x2 = 1920, y2 = 1080}, data = 0x0}
        draw_x = 0
        draw_y = 0
        screen_x = <optimized out>
        screen_y = <optimized out>
#17 0x00007f4646ee7018 in damageDamageBox (pDrawable=pDrawable@entry=0x7f4648e1b350, pBox=pBox@entry=0x7fff4fedd340, 
    subWindowMode=<optimized out>) at ../../../miext/damage/damage.c:320
        region = {extents = {x1 = 787, y1 = 463, x2 = 1133, y2 = 617}, data = 0x0}
#18 0x00007f4646ee8c60 in damagePolyFillRect (pDrawable=0x7f4648e1b350, pGC=0x7f4648aea830, nRects=1, pRects=<optimized out>)
    at ../../../miext/damage/damage.c:1192
        box = {x1 = 787, y1 = 463, x2 = 1133, y2 = 617}
        pRectsTmp = <optimized out>
        nRectsTmp = <optimized out>
        oldFuncs = 0x7f46471eb600 <damageGCFuncs>
#19 0x00007f4646f3faa1 in miPaintWindow (pWin=<optimized out>, pWin@entry=0x7f4648e1b350, prgn=prgn@entry=0x7f4648e6c3d0, 
    what=what@entry=0) at ../../mi/miexpose.c:641
        pScreen = <optimized out>
        gcval = {{val = 3, ptr = 0x3}, {val = 15592941, ptr = 0xededed}, {val = 0, ptr = 0x7f4600000000}, {val = 1190010108, 
            ptr = 0x7f4646ee1cfc <present_clip_notify+92>}, {val = 1340986400, ptr = 0x7fff4fedd420}, {val = 1219407952, 
            ptr = 0x7f4648aeb050}}
        gcmask = 261
        pGC = 0x7f4648aea830
        i = <optimized out>
        pbox = <optimized out>
        prect = 0x7f4648abe610
        draw_x_off = 787
        draw_y_off = 463
        tile_x_off = <optimized out>
        tile_y_off = <optimized out>
        fill = <optimized out>
        solid = <optimized out>
        drawable = 0x7f4648e1b350
#20 0x00007f4646f40375 in miWindowExposures (pWin=0x7f4648e1b350, prgn=0x7f4648e6c3d0, other_exposed=0x0) at ../../mi/miexpose.c:470
        expRec = {extents = {x1 = 0, y1 = 22, x2 = 0, y2 = 22}, data = 0x7f46471ed660 <RegionEmptyData>}
        clientInterested = <optimized out>
        exposures = 0x7f4648e6c3d0
#21 0x00007f4646f55538 in miHandleValidateExposures (pWin=0x7f4648aeb000) at ../../mi/miwindow.c:223
        pChild = 0x7f4648e1b350
        val = 0x7f4648e6c3d0
---Type <return> to continue, or q <return> to quit---
        WindowExposures = 0x7f4646f401a0 <miWindowExposures>
#22 0x00007f4646e39c50 in SetRootClip (pScreen=0x7f4648ab6f00, enable=1) at ../../dix/window.c:3610
        pWin = 0x7f4648aeb000
        pChild = <optimized out>
        WasViewable = 1
        anyMarked = <optimized out>
        pLayerWin = 0x7f4648de29a0
        box = <optimized out>
#23 0x00007f4646e8b4e1 in xf86CursorEnableDisableFBAccess (pScrn=0x7f4648aaef60, enable=1)
    at ../../../../hw/xfree86/ramdac/xf86Cursor.c:225
        pDev = 0x7f4648bf19d0
        pScreen = 0x7f4648ab6f00
#24 0x00007f4646e4872a in xf86VTSwitch () at ../../../../hw/xfree86/common/xf86Events.c:555
        i = 0
        pInfo = <optimized out>
        ih = <optimized out>
#25 xf86Wakeup (blockData=<optimized out>, err=<optimized out>, pReadmask=<optimized out>)
    at ../../../../hw/xfree86/common/xf86Events.c:288
        LastSelectMask = <optimized out>
        devicesWithInput = {fds_bits = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 140734373058629, 139939812098048, 139939843480992, 
            139939843632896, 140734534374880, 139939716277427}}
        pInfo = <optimized out>
#26 0x00007f4646e0f17d in WakeupHandler (result=result@entry=-1, pReadmask=pReadmask@entry=0x7f46471fc8c0 <LastSelectMask>)
    at ../../dix/dixutils.c:423
        i = <optimized out>
        j = <optimized out>
#27 0x00007f4646f5a40f in WaitForSomething (pClientsReady=pClientsReady@entry=0x7f4648df3020) at ../../os/WaitFor.c:229
        i = -1
        waittime = {tv_sec = 585, tv_usec = 798477}
        wt = 0x7fff4fedd650
        timeout = <optimized out>
        clientsReadable = {fds_bits = {0 <repeats 16 times>}}
        clientsWritable = {fds_bits = {140734534375168, -3392621443132310784, 163, 32, 139939846957232, 0, 139939847085488, 
            139939814964541, 0, 32, 140734534375504, 139939847408384, 140734534375264, 0, 73014444064, 139939845336864}}
        selecterr = 4
        nready = 0
        devicesReadable = {fds_bits = {140734534375504, 32, 163, 1073741825, 139939843846144, 0, 139939843846560, 139939845336864, 
            139939847408384, 32, 0, 139939847085488, 140734534375504, 139939814966263, 163, 140734534375496}}
        now = <optimized out>
        someReady = 0
#28 0x00007f4646e0a5c1 in Dispatch () at ../../dix/dispatch.c:362
        clientReady = 0x7f4648df3020
        result = <optimized out>
        client = <optimized out>
        nready = <optimized out>
        icheck = 0x7f46471f58d0 <checkForInput>
        start_tick = <optimized out>
#29 0x00007f4646e0e68a in dix_main (argc=10, argv=0x7fff4fedda58, envp=<optimized out>) at ../../dix/main.c:294
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
#30 0x00007f46446adb45 in __libc_start_main (main=0x7f4646df9c00 <main>, argc=10, argv=0x7fff4fedda58, init=<optimized out>, 
    fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fff4fedda48) at libc-start.c:287
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, -2997484005447636350, 139939813497861, 140734534376016, 0, 0, 
                2997237868451129986, 2948244738523458178}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 
              0x7f4646f6cbf0 <__libc_csu_init>, 0x7fff4fedda58}, data = {prev = 0x0, cleanup = 0x0, canceltype = 1190579184}}}
        not_first_call = <optimized out>
#31 0x00007f4646df9c2e in _start ()
No symbol table info available.
(gdb)
Comment 13 Sree Harsha Totakura 2014-06-22 21:59:18 UTC 
Created attachment 101542 [details]
Xorg log until the crash described in comment #12
Comment 14 Chris Wilson 2014-06-23 07:13:15 UTC 
That was a silly typo in the debug message:

commit 83cbbcd816e449402f3d49aeba3c099a20b8bc1b
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Mon Jun 23 07:29:20 2014 +0100

    sna: Add missing string for DBG
    
    References: https://bugs.freedesktop.org/show_bug.cgi?id=80355#c12
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Comment 15 Chris Wilson 2014-06-23 07:52:42 UTC 
Thankyou for the logs.

If I understand the log files correctly, "sna: Disable unused CRTC after undock events" should be sufficient to make the ddx function correctly. Can you please describe what the behaviour is at the moment?
Comment 16 Sree Harsha Totakura 2014-06-23 20:38:23 UTC 
Created attachment 101611 [details]
Xorg log until the crash observed with version 6c5658b14451239b8e4

X crashed this time when I un-docked the notebook.  I used the HEAD (6c5658b14451239b8e4) version.  Attached in the Xorg log up until the crash.

Here is the stack trace:
(gdb) core core-Xorg-6-0-0-5285-1403555025 
[New LWP 5285]
[New LWP 5296]
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
warning: no loadable sections found in added symbol-file system-supplied DSO at 0x7fffb5670000
Core was generated by `/usr/bin/X :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -nov'.
Program terminated with signal 6, Aborted.
#0  0x00007f811fe48407 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007f811fe48407 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007f811fe4b508 in __GI_abort () at abort.c:89
#2  0x00007f811fe41516 in __assert_fail_base (
    fmt=0x7f811ff77c60 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=assertion@entry=0x7f811ca13aed "len >= 2", 
    file=file@entry=0x7f811ca128fb "sna_display.c", line=line@entry=1948, 
    function=function@entry=0x7f811ca15fe0 <__PRETTY_FUNCTION__.25799> "outputs_for_crtc")
    at assert.c:92
#3  0x00007f811fe415c2 in __GI___assert_fail (assertion=0x7f811ca13aed "len >= 2", 
    file=0x7f811ca128fb "sna_display.c", line=1948, 
    function=0x7f811ca15fe0 <__PRETTY_FUNCTION__.25799> "outputs_for_crtc") at assert.c:101
#4  0x00007f811c8b815c in outputs_for_crtc (crtc=0x7f8123de3a10, 
    outputs=0x7fffb563d990 "\240K\031$\201\177", max=256) at sna_display.c:1948
#5  0x00007f811c8b8334 in sna_crtc_set_mode_major (crtc=0x7f8123de3a10, mode=0x7f8123de3a28, 
    rotation=1, x=1024, y=0) at sna_display.c:1995
#6  0x00007f811c8bd7ee in sna_mode_resize (scrn=0x7f8123de0f60, width=1920, height=1080)
    at sna_display.c:3786
#7  0x00007f812260ecf9 in xf86RandR12ScreenSetSize (pScreen=0x7f8123de8f00, width=1920, 
    height=1080, mmWidth=508, mmHeight=286) at ../../../../hw/xfree86/modes/xf86RandR12.c:700
#8  0x00007f81226573cb in ProcRRSetScreenSize (client=0x7f8124148040)
    at ../../randr/rrscreen.c:286
#9  0x00007f812259186e in Dispatch () at ../../dix/dispatch.c:433
#10 0x00007f812259568a in dix_main (argc=10, argv=0x7fffb563ddf8, envp=<optimized out>)
    at ../../dix/main.c:294
#11 0x00007f811fe34b45 in __libc_start_main (main=0x7f8122580c00 <main>, argc=10, 
    argv=0x7fffb563ddf8, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fffb563dde8) at libc-start.c:287
#12 0x00007f8122580c2e in _start ()
(gdb) bt full
#0  0x00007f811fe48407 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
        resultvar = 0
        pid = 5285
        selftid = 5285
#1  0x00007f811fe4b508 in __GI_abort () at abort.c:89
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x7fffb563ef9c, 
            sa_sigaction = 0x7fffb563ef9c}, sa_mask = {__val = {140192563806507, 
              140192507832571, 1948, 4, 140736236607440, 3043219728, 140192629303072, 
              140192027508736, 0, 0, 0, 21474836480, 140192563805891, 140736236607592, 
              140192603258880, 140192563821664}}, sa_flags = 480328429, 
          sa_restorer = 0x7f811ca15fe0 <__PRETTY_FUNCTION__.25799>}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007f811fe41516 in __assert_fail_base (
    fmt=0x7f811ff77c60 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=assertion@entry=0x7f811ca13aed "len >= 2", 
    file=file@entry=0x7f811ca128fb "sna_display.c", line=line@entry=1948, 
    function=function@entry=0x7f811ca15fe0 <__PRETTY_FUNCTION__.25799> "outputs_for_crtc")
    at assert.c:92
        str = 0x7f81241338b0 "\340\001\030$\201\177"
        total = 4096
#3  0x00007f811fe415c2 in __GI___assert_fail (assertion=0x7f811ca13aed "len >= 2", 
    file=0x7f811ca128fb "sna_display.c", line=1948, 
    function=0x7f811ca15fe0 <__PRETTY_FUNCTION__.25799> "outputs_for_crtc") at assert.c:101
No locals.
#4  0x00007f811c8b815c in outputs_for_crtc (crtc=0x7f8123de3a10, 
    outputs=0x7fffb563d990 "\240K\031$\201\177", max=256) at sna_display.c:1948
        sna = 0x7f812242b000
        config = 0x7f8123de2c50
        len = 0
        i = 8
        __PRETTY_FUNCTION__ = "outputs_for_crtc"
#5  0x00007f811c8b8334 in sna_crtc_set_mode_major (crtc=0x7f8123de3a10, mode=0x7f8123de3a28, 
    rotation=1, x=1024, y=0) at sna_display.c:1995
        scrn = 0x7f8123de0f60
        sna = 0x7f812242b000
        sna_crtc = 0x7f8123de3910
        saved_bo = 0x7f8123de9440
        bo = 0x7f812417b620
        saved_kmode = {clock = 601788160, hdisplay = 32641, hsync_start = 0, 
          hsync_end = 55185, htotal = 8806, hskew = 32641, vdisplay = 0, vsync_start = 1080, 
          vsync_end = 0, vtotal = 0, vscan = 0, vrefresh = 601788160, flags = 32641, 
          type = 601861816, 
          name = "\201\177\000\000`\177/$\201\177\000\000`\256\337#\201\177\000\000\071\311b\"\201\177\000\000\000\000\000"}
        saved_offset = 601788160
        saved_transform = false
        outputs = "\240K\031$\201\177\000\000\000\260B\"\201\177\000\000\300\331c\265\377\177\000\000\256q\205\034\201\177\000\000\000\267\027$\201\177\000\000\000\260B\"\201\177\000\000\3---Type <return> to continue, or q <return> to quit---
60\331c\265\377\177\000\000$\233\205\034\201\177\000\000\360\331c\265\377\177\000\000\000\267\027$\201\177\000\000 \266\027$\201\177\000\000\000\260B\"\201\177\000\000\060\332c\265\377\177\000\000ܞ\205\034\201\177\000\000`\212\310\034\201\177\000\000 \266\027$\201\177\000\000`\212\310\034\201\177\000\000\060H\021$\201\177\000\000\000\260B\"\201\177\000\000\000\267\027$\201\177\000\000\000\217\336#\201\177\000\000\221\327f\"\201\177\000\000`\177/$\201\177\000\000\000\217\336#\201\177\000\000\270\256\337#\201\177\000\000 "...
        __PRETTY_FUNCTION__ = "sna_crtc_set_mode_major"
#6  0x00007f811c8bd7ee in sna_mode_resize (scrn=0x7f8123de0f60, width=1920, height=1080)
    at sna_display.c:3786
        crtc = 0x7f8123de3a10
        config = 0x7f8123de2c50
        sna = 0x7f812242b000
        screen = 0x7f8123de8f00
        new_front = 0x7f81242f7f60
        i = 1
        __FUNCTION__ = "sna_mode_resize"
        __PRETTY_FUNCTION__ = "sna_mode_resize"
#7  0x00007f812260ecf9 in xf86RandR12ScreenSetSize (pScreen=0x7f8123de8f00, width=1920, 
    height=1080, mmWidth=508, mmHeight=286) at ../../../../hw/xfree86/modes/xf86RandR12.c:700
        pScrn = 0x7f8123de0f60
        config = 0x7f8123de2c50
        pRoot = 0x7f8123e1d000
        pScrnPix = <optimized out>
        ret = 0
        panning = 0
        c = <optimized out>
#8  0x00007f81226573cb in ProcRRSetScreenSize (client=0x7f8124148040)
    at ../../randr/rrscreen.c:286
        stuff = 0x7f8124301a30
        pWin = 0x7f8123e1d000
        pScreen = <optimized out>
        i = <optimized out>
        rc = <optimized out>
#9  0x00007f812259186e in Dispatch () at ../../dix/dispatch.c:433
        clientReady = 0x7f8124126b20
        result = <optimized out>
        client = 0x7f8124148040
        nready = 0
        icheck = 0x7f812297c8d0 <checkForInput>
        start_tick = 530
#10 0x00007f812259568a in dix_main (argc=10, argv=0x7fffb563ddf8, envp=<optimized out>)
    at ../../dix/main.c:294
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
#11 0x00007f811fe34b45 in __libc_start_main (main=0x7f8122580c00 <main>, argc=10, 
    argv=0x7fffb563ddf8, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fffb563dde8) at libc-start.c:287
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 7648591260410097033, 140192603704325, 
                140736236609008, 0, 0, -7648752649115357815, -7699045414466703991}, 
---Type <return> to continue, or q <return> to quit---
              mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 
              0x7f81226f3bf0 <__libc_csu_init>, 0x7fffb563ddf8}, data = {prev = 0x0, 
              cleanup = 0x0, canceltype = 577715184}}}
        not_first_call = <optimized out>
#12 0x00007f8122580c2e in _start ()
No symbol table info available.
(gdb)
Comment 17 Chris Wilson 2014-06-23 21:54:14 UTC 
Hmm, it didn't actually disable the CRTC as I expected. Let's try that again:

commit 706480bde6120f84388a99085ed3d1cc3b759697
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Mon Jun 23 22:50:23 2014 +0100

    sna: Disable CRTC after MST topology change
    
    In order to disable CRTC after marking outputs as removed after probing
    MST topology updates, we must manually mark the CRTCs as no longer
    enabled.
    
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Comment 18 Sree Harsha Totakura 2014-06-23 22:16:12 UTC 
Created attachment 101617 [details]
DDX debug output util the problem of re-docking

There were no crashes this time.  However, the behaviour described in comment #1 persists.
Comment 19 Sree Harsha Totakura 2014-06-23 22:17:17 UTC 
(In reply to comment #18)
> There were no crashes this time.  However, the behaviour described in
> comment #1 persists.
I meant the behaviour in bug description.
Comment 20 Chris Wilson 2014-06-24 10:40:26 UTC 
Hmm, sna_mode_discover() claims to remove the devices it just added, but doesn't. That is very fishy! I've pushed a little more debug, and would appreciate another debug=full log file. Thanks.


commit 5c8829b30ad3acd2e59dac9ffa2aba8aadcada61
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Tue Jun 24 11:35:23 2014 +0100

    sna: Add some more DBG around connector discovery
    
    References: https://bugs.freedesktop.org/show_bug.cgi?id=80355
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

commit 271ed88e517745505c133bd68c40a8566ec8a625
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Tue Jun 24 11:24:26 2014 +0100

    sna: Ensure serial is not 0 for runtime MST discovery
    
    We reserve serial==0 for the initial setup that is run before RandR is
    configured. After the server is running, we have to take extra steps to
    make the outputs visible to userspace.
    
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Comment 21 Sree Harsha Totakura 2014-06-24 18:07:23 UTC 
Created attachment 101686 [details]
Debug output while un-docking with intel driver@git ca296c18316a3ce1682

Debug output with the intel driver updated to current git head (ca296c18316a3ce1682).
Comment 22 Chris Wilson 2014-06-24 20:23:56 UTC 
Hmm. After what I assume are the undock events, the kernel reports all the connectors as still present. Or at least the code thinks so.
Comment 23 Chris Wilson 2014-06-24 20:27:03 UTC 
For completeness, could you please generate new debug file with

commit 74c1cf60a7ce7e79bc727780151f4f233798e5f4
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Tue Jun 24 20:49:18 2014 +0100

    sna: Add yet more DBG messages to MST discovery
    
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>


I hope I am getting closer.
Comment 24 Sree Harsha Totakura 2014-06-24 21:21:26 UTC 
Created attachment 101698 [details]
Debug output with intel driver@git 43ad5dbc60e1f50a

I stopped X quickly after re-docking.  So the output relevant to the un-dock/re-dock event should be at the end of the log.
Comment 25 Chris Wilson 2014-06-25 06:34:18 UTC 
Spotted some bad behaviour where we did not recognise DP3/DP4/DP5 being reattached (with new connector ids, so new object with old names) as they didn't have an associated MST path.

commit 204ec74a61ba0b9628c686b98c48fa1220866c2d
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Wed Jun 25 07:31:33 2014 +0100

    sna: Check all connectors for reuse
    
    Do not rely on the MST path being present to indicate a connector that
    may be reused.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=80355
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

That should tidy up the detection. Can you please attach a new debug log and describe the behaviour?
Comment 26 Sree Harsha Totakura 2014-06-25 22:28:57 UTC 
Created attachment 101776 [details]
Debug output with intel driver@git 2ec2164ba4bd3a266949

(In reply to comment #25)
> Spotted some bad behaviour where we did not recognise DP3/DP4/DP5 being
> reattached (with new connector ids, so new object with old names) as they
> didn't have an associated MST path.
> 
> commit 204ec74a61ba0b9628c686b98c48fa1220866c2d
> Author: Chris Wilson <chris@chris-wilson.co.uk>
> Date:   Wed Jun 25 07:31:33 2014 +0100

This time there was a kernel OOPS, so I guess now the bug has to be investigated in kernel space.
Comment 27 Sree Harsha Totakura 2014-06-25 22:33:23 UTC 
Created attachment 101777 [details]
Kernel oops upon re-docking

For completeness, I am attaching the kernel oops message received during re-docking.  The log also contains a call trace of a slow path.
Comment 28 Sree Harsha Totakura 2014-06-25 22:40:18 UTC 
Ah, sorry, I got confused X crash for a kernel panic.  What I experienced was a crash in X.  This happened as soon as I re-docked.  Also, https://bugs.freedesktop.org/attachment.cgi?id=101776 is the relevant log showing the debug output leading to this crash.  ddx is at version 2ec2164ba4bd3a266949.

Here is the stacktrace:
(gdb) core core-Xorg-11-0-0-3572-1403733978 
[New LWP 3572]
[New LWP 3584]
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
warning: no loadable sections found in added symbol-file system-supplied DSO at 0x7fffcadfe000
Core was generated by `/usr/bin/X :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -nov'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007f12ab6dfde0 in sna_output_destroy (output=0x7f12b2d38aa0) at sna_display.c:2662
2662				RRDeleteOutputProperty(output->randr_output, sna_output->props[i].atoms[0]);
(gdb) bt
#0  0x00007f12ab6dfde0 in sna_output_destroy (output=0x7f12b2d38aa0) at sna_display.c:2662
#1  0x00007f12ab6e1f18 in sna_output_add (sna=0x7f12b1253000, id=43, serial=2)
    at sna_display.c:3412
#2  0x00007f12ab6e2ceb in sna_mode_discover (sna=0x7f12b1253000) at sna_display.c:3638
#3  0x00007f12ab6eeb90 in sna_handle_uevents (fd=14, closure=0x7f12b2d32f60)
    at sna_driver.c:779
#4  0x00007f12b13f737a in xf86Wakeup (blockData=<optimized out>, err=<optimized out>, 
    pReadmask=0x7f12b17ab8c0 <LastSelectMask>)
    at ../../../../hw/xfree86/common/xf86Events.c:282
#5  0x00007f12b13be17d in WakeupHandler (result=result@entry=2, 
    pReadmask=pReadmask@entry=0x7f12b17ab8c0 <LastSelectMask>) at ../../dix/dixutils.c:423
#6  0x00007f12b150940f in WaitForSomething (pClientsReady=pClientsReady@entry=0x7f12b3077020)
    at ../../os/WaitFor.c:229
#7  0x00007f12b13b95c1 in Dispatch () at ../../dix/dispatch.c:362
#8  0x00007f12b13bd68a in dix_main (argc=10, argv=0x7fffcad87828, envp=<optimized out>)
    at ../../dix/main.c:294
#9  0x00007f12aec5cb45 in __libc_start_main (main=0x7f12b13a8c00 <main>, argc=10, 
    argv=0x7fffcad87828, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fffcad87818) at libc-start.c:287
#10 0x00007f12b13a8c2e in _start ()
(gdb) bt full
#0  0x00007f12ab6dfde0 in sna_output_destroy (output=0x7f12b2d38aa0) at sna_display.c:2662
        sna_output = 0x7f12b2d389d0
        i = 0
#1  0x00007f12ab6e1f18 in sna_output_add (sna=0x7f12b1253000, id=43, serial=2)
    at sna_display.c:3412
        scrn = 0x7f12b2d32f60
        config = 0x7f12b2d34c50
        compat_conn = {conn = {encoders_ptr = 140736596570144, modes_ptr = 140736596570064, 
            props_ptr = 139718289677984, prop_values_ptr = 139718290226848, count_modes = 0, 
            count_props = 5, count_encoders = 3, encoder_id = 0, connector_id = 43, 
            connector_type = 10, connector_type_id = 3, connection = 3, mm_width = 0, 
            mm_height = 0, subpixel = 0}, pad = {3403182112, 32767, 3403182032, 32767, 
            3003539104, 32530, 3004087968, 32530, 0, 5, 3, 0, 43, 10, 3, 3, 0, 0, 0, 0}}
        enc = {encoder_id = 0, encoder_type = 0, crtc_id = 0, possible_crtcs = 0, 
          possible_clones = 0}
        dummy = {clock = 0, hdisplay = 0, hsync_start = 0, hsync_end = 19440, 
          htotal = 45779, hskew = 32530, vdisplay = 0, vsync_start = 28912, 
          vsync_end = 51928, vtotal = 32767, vscan = 0, vrefresh = 3000292192, 
          flags = 32530, type = 2, 
          name = "\000\000\000\000\060t\330\312\377\177\000\000 p\a\263\022\177\000\000@\001o\253\022\177\000\000\r\000\000"}
        sna_output = 0x7f12b30a7d40
        outputs = 0x7f12b17ab8c0 <LastSelectMask>
        output = 0x7f12b2d38aa0
        possible_encoders = 448
        attached_encoders = 448
        possible_crtcs = 7
        output_name = 0x7f12ab83b24f "DP"
        name = "DP3\000pixmap=5155, attache\000\215g\275\022\231", <incomplete sequence \321>
        path = 0
        len = 3
        i = 5
        __FUNCTION__ = "sna_output_add"
        __PRETTY_FUNCTION__ = "sna_output_add"
#2  0x00007f12ab6e2ceb in sna_mode_discover (sna=0x7f12b1253000) at sna_display.c:3638
        screen = 0x7f12b2d3af00
        config = 0x7f12b2d34c50
        res = {fb_id_ptr = 0, crtc_id_ptr = 0, connector_id_ptr = 140736596570384, 
          encoder_id_ptr = 0, count_fbs = 7, count_crtcs = 3, count_connectors = 6, 
          count_encoders = 9, min_width = 0, max_width = 8192, min_height = 0, 
          max_height = 8192}
        connectors = {11, 19, 23, 25, 29, 43, 0 <repeats 26 times>}
        changed = 0
        serial = 2
        i = 5
        j = 8
        __FUNCTION__ = "sna_mode_discover"
        __PRETTY_FUNCTION__ = "sna_mode_discover"
#3  0x00007f12ab6eeb90 in sna_handle_uevents (fd=14, closure=0x7f12b2d32f60)
    at sna_driver.c:779
---Type <return> to continue, or q <return> to quit---
        scrn = 0x7f12b2d32f60
        sna = 0x7f12b1253000
        dev = 0x7f12b30a7900
        str = 0x7f12b30eb1b0 "1"
        s = {st_dev = 4, st_ino = 6501, st_nlink = 1, st_mode = 8624, st_uid = 0, 
          st_gid = 44, __pad0 = 0, st_rdev = 57856, st_size = 0, st_blksize = 4096, 
          st_blocks = 0, st_atim = {tv_sec = 1403733977, tv_nsec = 991248113}, st_mtim = {
            tv_sec = 1403733977, tv_nsec = 991248113}, st_ctim = {tv_sec = 1403733977, 
            tv_nsec = 991248113}, __glibc_reserved = {0, 0, 0}}
        udev_devnum = 57856
        __FUNCTION__ = "sna_handle_uevents"
#4  0x00007f12b13f737a in xf86Wakeup (blockData=<optimized out>, err=<optimized out>, 
    pReadmask=0x7f12b17ab8c0 <LastSelectMask>)
    at ../../../../hw/xfree86/common/xf86Events.c:282
        ih = 0x7f12b2d4d360
        ih_tmp = 0x7f12b2d34bf0
        LastSelectMask = <optimized out>
        devicesWithInput = {fds_bits = {0 <repeats 16 times>}}
        pInfo = <optimized out>
#5  0x00007f12b13be17d in WakeupHandler (result=result@entry=2, 
    pReadmask=pReadmask@entry=0x7f12b17ab8c0 <LastSelectMask>) at ../../dix/dixutils.c:423
        i = <optimized out>
        j = <optimized out>
#6  0x00007f12b150940f in WaitForSomething (pClientsReady=pClientsReady@entry=0x7f12b3077020)
    at ../../os/WaitFor.c:229
        i = 2
        waittime = {tv_sec = 580, tv_usec = 306653}
        wt = 0x7fffcad87420
        timeout = <optimized out>
        clientsReadable = {fds_bits = {0 <repeats 16 times>}}
        clientsWritable = {fds_bits = {139718263703568, -3367679790576857856, 
            139718291099424, 32, 139718291707088, 0, 139718287826048, 139718261009725, 0, 
            32, 140736596571680, 139718292070640, 140736596571440, 163, 227633266720, 
            139718292079376}}
        selecterr = 11
        nready = 0
        devicesReadable = {fds_bits = {0 <repeats 16 times>}}
        now = <optimized out>
        someReady = 0
#7  0x00007f12b13b95c1 in Dispatch () at ../../dix/dispatch.c:362
        clientReady = 0x7f12b3077020
        result = <optimized out>
        client = <optimized out>
        nready = <optimized out>
        icheck = 0x7f12b17a48d0 <checkForInput>
        start_tick = <optimized out>
#8  0x00007f12b13bd68a in dix_main (argc=10, argv=0x7fffcad87828, envp=<optimized out>)
    at ../../dix/main.c:294
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
---Type <return> to continue, or q <return> to quit---
#9  0x00007f12aec5cb45 in __libc_start_main (main=0x7f12b13a8c00 <main>, argc=10, 
    argv=0x7fffcad87828, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fffcad87818) at libc-start.c:287
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, -7684529572261339676, 
                139718259543045, 140736596572192, 0, 0, 7684412693066866148, 
                7745712633811754468}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 
              0x7f12b151bbf0 <__libc_csu_init>, 0x7fffcad87828}, data = {prev = 0x0, 
              cleanup = 0x0, canceltype = -1320043536}}}
        not_first_call = <optimized out>
#10 0x00007f12b13a8c2e in _start ()
No symbol table info available.
(gdb)
Comment 29 Chris Wilson 2014-06-26 06:01:07 UTC 
Well, I wasn't expecting that. On to the next bug!

commit 12a349974b63a47ad55384abe0d7a839af48f31a
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Thu Jun 26 06:59:07 2014 +0100

    sna: Make output destroy more defensive
    
    We may never create the properties as it may be ignored or the
    allocation may fail, so we need to be careful when freeing we do not
    stumble over invalid pointers.
    
    References: https://bugs.freedesktop.org/show_bug.cgi?id=80355#c28
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Comment 30 Sree Harsha Totakura 2014-06-26 09:45:54 UTC 
Comment on attachment 101777 [details]
Kernel oops upon re-docking

I got confused again; this OOPS seems relevant here.  If I understood correctly, this is what had happened: there were two crashes, one in X and another one in the intel-dri kernel module.  Should I file this OOPS as a bug in intel-dri or send it to Airlie by some means?
Comment 31 Chris Wilson 2014-06-26 09:50:50 UTC 
(In reply to comment #30)
> Comment on attachment 101777 [details]
> Kernel oops upon re-docking
> 
> I got confused again; this OOPS seems relevant here.  If I understood
> correctly, this is what had happened: there were two crashes, one in X and
> another one in the intel-dri kernel module.  Should I file this OOPS as a
> bug in intel-dri or send it to Airlie by some means?

Doesn't look like his bug... Should be fixed by

commit 5ea1f752ae04be403a3dc8ec876a60d7f5f6990a
Author: Rob Clark <robdclark@gmail.com>
Date:   Fri May 30 12:29:48 2014 -0400

    drm: add drm_fb_helper_restore_fbdev_mode_unlocked()
    
    All drm_fb_helper_restore_fbdev_mode() call sites, save one, do the same
    locking.  Simplify this into drm_fb_helper_restore_fbdev_mode_unlocked().
    
    Signed-off-by: Rob Clark <robdclark@gmail.com>
    Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
Comment 32 Sree Harsha Totakura 2014-06-26 21:33:19 UTC 
(In reply to comment #31)
> Doesn't look like his bug... Should be fixed by
> 
> commit 5ea1f752ae04be403a3dc8ec876a60d7f5f6990a
> Author: Rob Clark <robdclark@gmail.com>
> Date:   Fri May 30 12:29:48 2014 -0400

I tried to merge/cherry-pick that commit but it resulted in merge conflicts which I could not resolve.  Could you please help with the merge?  My repository is here: https://github.com/totakura/linux/ .  The branch v3.14.4-mst contains Airlie's drm-i915-mst-v3.14 branch merged with v3.14.4.  The branch to-merge-into-v3.14.4-mst contains the above commit (5ea1f752ae04be403a3dc8ec876a60d7f5f6990a).
Comment 33 Chris Wilson 2014-06-27 06:39:05 UTC 
Ah, you already have that commit. In which case it looks like the set->fb and set->mode BUG_ONs instead. (I first thought it might have been the locking asserts.)

Try:

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index efd3cf50cb0f..3ed6169bc203 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -10753,6 +10753,15 @@ static int intel_crtc_set_config(struct drm_mode_set *set)
        BUG_ON(!set->crtc);
        BUG_ON(!set->crtc->helper_private);
 
+       if (set->mode == NULL)
+               set->fb = NULL;
+
+       if (set->num_connectors == 0)
+               set->fb = NULL;
+
+       if (set->fb == NULL)
+               set->mode = NULL;
+
        /* Enforce sane interface api - has been abused by the fb helper. */
        BUG_ON(!set->mode && set->fb);
        BUG_ON(set->fb && set->num_connectors == 0);
Comment 34 Sree Harsha Totakura 2014-06-27 11:18:31 UTC 
(In reply to comment #33)
> Ah, you already have that commit. In which case it looks like the set->fb
> and set->mode BUG_ONs instead. (I first thought it might have been the
> locking asserts.)

I think you've misunderstood; I do not have that commit.  I am using the branch v3.14.4-mst.  The branch to-merge-into-v3.14.4-mst contains that commit but it should be merged into v3.14.4-mst to include Airlie's changes.
Comment 35 Sree Harsha Totakura 2014-06-27 11:22:11 UTC 
(In reply to comment #34)
> I am using the branch v3.14.4-mst.
located at: https://github.com/totakura/linux/tree/v3.14.4-mst
Comment 36 Chris Wilson 2014-06-27 11:25:40 UTC 
Oops, I switched to the wrong branch in your tree.

Looking at the right tree, that commit isn't the fix I thought it was. I thought we didn't have any locking there, hence the BUG_ON. But your intel_fbdev_restore_mode() does do the right thing.

So it looks like the hack in comment 33 should help. I hope.
Comment 37 Sree Harsha Totakura 2014-06-28 07:59:11 UTC 
(In reply to comment #36)
> So it looks like the hack in comment 33 should help. I hope.

That patch does not apply and is being rejected in branch v3.14.4-mst.
Comment 38 Chris Wilson 2014-07-08 09:25:23 UTC 
Changing products for greater visibility now that it looks like we are passed the bugs in the ddx and into the kernel.
Comment 39 Jani Nikula 2014-09-08 14:06:46 UTC 
DP MST support has now been merged in upstream Linux. Please re-test with v3.17-rc4 or newer and report back. We simply don't have the bandwidth to support out-of-tree patches and branches. Thanks.
Comment 40 Sree Harsha Totakura 2014-11-07 10:02:26 UTC 
Marking this bug as fixed as I do not experience it anymore in linux-3.17.2.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.