Two AST driver fixes
Subsystems (3)
cover Two AST driver fixes
Hello,
Here are two (attempted) fixes for the AST DRM driver. The issues they fix are both seen when the ast driver is unloaded (tested on Power9, although it looks like the second one is architecture independent).
I'm fairly confident about the first fix, as it looks pretty straight forward.
I'm not sure if the second patch uses the right approach, so I'd appreciate some feedback. I've had a good look around, and it does seem to fix the problem but I don't know this area at all.
Note that while it does seem odd to take a reference just before calling drm_framebuffer_remove(), that seems to be be necessary because drm_framebuffer_remove() is expecting the framebuffer to be dynamically allocated (but the AST driver directly contains it) (I saw some references to this being legacy behaviour).
Cheers,
Sam.
Sam Bobroff (2):
drm/ast: Fix incorrect free on ioregs drm/ast: Fix connector leak during driver unload
drivers/gpu/drm/ast/ast_fb.c | 4 ++++ drivers/gpu/drm/ast/ast_main.c | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-)
Signature · 1 line
2.19.0.2.gcad72f5712
PATCH 1/2 drm/ast: Fix incorrect free on ioregs
If the platform has no IO space, ioregs is placed next to the already allocated regs. In this case, it should not be separately freed.
This prevents a kernel warning from __vunmap "Trying to vfree() nonexistent vm area" when unloading the driver.
--- drivers/gpu/drm/ast/ast_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/ast/ast_main.c +2 -1
@@ -583,7 +583,8 @@ void ast_driver_unload(struct drm_device *dev)drm_mode_config_cleanup (dev);ast_mm_fini (ast); -pci_iounmap (dev->pdev, ast->ioregs); +if (ast->ioregs != ast->regs +AST_IO_MM_OFFSET ) +pci_iounmap (dev->pdev, ast->ioregs);pci_iounmap (dev->pdev, ast->regs);kfree (ast); }
Signature · 1 line
2.19.0.2.gcad72f5712
PATCH 2/2 drm/ast: Fix connector leak during driver unload
In reply to Sam BobroffWhen unloading the ast driver, a warning message is printed by drm_mode_config_cleanup() because a reference is still held to one of the drm_connector structs.
Correct this by calling drm_framebuffer_remove() in ast_fbdev_destroy().
--- drivers/gpu/drm/ast/ast_fb.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/ast/ast_fb.c +4 -0
@@ -263,6 +263,10 @@ static void ast_fbdev_destroy(struct drm_device *dev, {struct ast_framebuffer *afb = &afbdev->afb; +/* drm_framebuffer_remove() expects us to hold a ref, which it +* will drop, so take one: */ +drm_framebuffer_get (&afb->base); +drm_framebuffer_remove (&afb->base);drm_fb_helper_unregister_fbi (&afbdev->helper);if (afb->obj) {
Signature · 1 line
2.19.0.2.gcad72f5712
Dave Airlie
maintainerRe: [PATCH 2/2] drm/ast: Fix connector leak during driver unload
Quoted 18 lines · Sam Bobroff
When unloading the ast driver, a warning message is printed by
drm_mode_config_cleanup()because a reference is still held to one of thedrm_connectorstructs.Correct this by calling
drm_framebuffer_remove()inast_fbdev_destroy().Signed-off-by Sam Bobroff <[email protected]>--- drivers/gpu/drm/ast/ast_fb.c | 4 ++++ 1 file changed, 4 insertions(+)drivers/gpu/drm/ast/ast_fb.c +0
-0
drivers/gpu/drm/ast/ast_fb.c static void ast_fbdev_destroy(struct drm_device *dev, · line 269
Quoted 7 lines
drivers/gpu/drm/ast/ast_fb.c +4
-0@@ -263,6 +263,10 @@ static void ast_fbdev_destroy(struct drm_device *dev, {struct ast_framebuffer *afb = &afbdev->afb; +/* drm_framebuffer_remove() expects us to hold a ref, which it +* will drop, so take one: */ +drm_framebuffer_get (&afb->base); +drm_framebuffer_remove (&afb->base);
This doesn't seem corret, no other driver does this pattern, and I can't believe ast is special here.
The get just doesn't make sense.
Dave.
Re: [PATCH 2/2] drm/ast: Fix connector leak during driver unload
Quoted 30 lines · Dave Airlie
Quoted 18 lines · Sam Bobroff
When unloading the ast driver, a warning message is printed by
drm_mode_config_cleanup()because a reference is still held to one of thedrm_connectorstructs.Correct this by calling
drm_framebuffer_remove()inast_fbdev_destroy().Signed-off-by Sam Bobroff <[email protected]>--- drivers/gpu/drm/ast/ast_fb.c | 4 ++++ 1 file changed, 4 insertions(+)drivers/gpu/drm/ast/ast_fb.c +0
-0drivers/gpu/drm/ast/ast_fb.c static void ast_fbdev_destroy(struct drm_device *dev, · line 269
Quoted 7 lines
drivers/gpu/drm/ast/ast_fb.c +4
-0@@ -263,6 +263,10 @@ static void ast_fbdev_destroy(struct drm_device *dev, {struct ast_framebuffer *afb = &afbdev->afb; +/* drm_framebuffer_remove() expects us to hold a ref, which it +* will drop, so take one: */ +drm_framebuffer_get (&afb->base); +drm_framebuffer_remove (&afb->base);This doesn't seem corret, no other driver does this pattern, and I can't believe ast is special here.
Quoted 1 line
The get just doesn't make sense.
Thanks for having a look at this, as I said in the cover letter I was concerned that it might not be a good fix.
But the AST driver does seem to be special (or just old?) because it embeds the drm_framebuffer directly into ast_fbdev and (almost all) other drivers dynamically allocate and reference count theirs.
The drm_framebuffer_get() certainly looks weird but it is there in order to cause drm_framebuffer_remove() to call legacy_remove_fb(), which it won't do unless the refcount is at least 2. (And because the drm_framebuffer isn't dynamically allocated in this case we don't really care about the reference count anyway.)
An alternative might be to call legacy_remove_fb() directly, but it's declared static. Do you think it would be better to expose it and call it directly from the AST driver code? Or is there some other better way to put the drm_connectors?
Quoted 1 line
Dave.
Cheers,
Sam.
Re: [PATCH 2/2] drm/ast: Fix connector leak during driver unload
Quoted 47 lines · Sam Bobroff
Quoted 30 lines · Dave Airlie
Quoted 18 lines · Sam Bobroff
When unloading the ast driver, a warning message is printed by
drm_mode_config_cleanup()because a reference is still held to one of thedrm_connectorstructs.Correct this by calling
drm_framebuffer_remove()inast_fbdev_destroy().Signed-off-by Sam Bobroff <[email protected]>--- drivers/gpu/drm/ast/ast_fb.c | 4 ++++ 1 file changed, 4 insertions(+)drivers/gpu/drm/ast/ast_fb.c +0
-0drivers/gpu/drm/ast/ast_fb.c static void ast_fbdev_destroy(struct drm_device *dev, · line 269
Quoted 7 lines
drivers/gpu/drm/ast/ast_fb.c +4
-0@@ -263,6 +263,10 @@ static void ast_fbdev_destroy(struct drm_device *dev, {struct ast_framebuffer *afb = &afbdev->afb; +/* drm_framebuffer_remove() expects us to hold a ref, which it +* will drop, so take one: */ +drm_framebuffer_get (&afb->base); +drm_framebuffer_remove (&afb->base);This doesn't seem corret, no other driver does this pattern, and I can't believe ast is special here.
Quoted 1 line
The get just doesn't make sense.
Thanks for having a look at this, as I said in the cover letter I was concerned that it might not be a good fix.
But the AST driver does seem to be special (or just old?) because it embeds the
drm_framebufferdirectly intoast_fbdevand (almost all) other drivers dynamically allocate and reference count theirs.The
drm_framebuffer_get()certainly looks weird but it is there in order to causedrm_framebuffer_remove()to calllegacy_remove_fb(), which it won't do unless the refcount is at least 2. (And because thedrm_framebufferisn't dynamically allocated in this case we don't really care about the reference count anyway.)
Quoted 4 lines
An alternative might be to call
legacy_remove_fb()directly, but it's declared static. Do you think it would be better to expose it and call it directly from the AST driver code? Or is there some other better way to put thedrm_connectors?
Your problem isn't the dynamic fb vs. embedded fb for fbdev (you're already using drm_framebuffer_unregister_private to handle that). Your problem is you're not shutting down stuff on driver unload, which means the fb is still in use. drm_atomic_helper_shutdown() takes care of that for atomic drivers.
No idea anymore what to do for legacy code, probably need to open code a shutdown sequence. Definitely not the above.
-Daniel
Signature · 7 lines
Daniel Vetter Software Engineer, Intel Corporation +41 (0) 79 365 57 48 - http://blog.ffwll.ch _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
Re: [PATCH 2/2] drm/ast: Fix connector leak during driver unload
Quoted 59 lines · Daniel Vetter
Quoted 47 lines · Sam Bobroff
Quoted 30 lines · Dave Airlie
Quoted 18 lines · Sam Bobroff
When unloading the ast driver, a warning message is printed by
drm_mode_config_cleanup()because a reference is still held to one of thedrm_connectorstructs.Correct this by calling
drm_framebuffer_remove()inast_fbdev_destroy().Signed-off-by Sam Bobroff <[email protected]>--- drivers/gpu/drm/ast/ast_fb.c | 4 ++++ 1 file changed, 4 insertions(+)drivers/gpu/drm/ast/ast_fb.c +0
-0drivers/gpu/drm/ast/ast_fb.c static void ast_fbdev_destroy(struct drm_device *dev, · line 269
Quoted 7 lines
drivers/gpu/drm/ast/ast_fb.c +4
-0@@ -263,6 +263,10 @@ static void ast_fbdev_destroy(struct drm_device *dev, {struct ast_framebuffer *afb = &afbdev->afb; +/* drm_framebuffer_remove() expects us to hold a ref, which it +* will drop, so take one: */ +drm_framebuffer_get (&afb->base); +drm_framebuffer_remove (&afb->base);This doesn't seem corret, no other driver does this pattern, and I can't believe ast is special here.
Quoted 1 line
The get just doesn't make sense.
Thanks for having a look at this, as I said in the cover letter I was concerned that it might not be a good fix.
But the AST driver does seem to be special (or just old?) because it embeds the
drm_framebufferdirectly intoast_fbdevand (almost all) other drivers dynamically allocate and reference count theirs.The
drm_framebuffer_get()certainly looks weird but it is there in order to causedrm_framebuffer_remove()to calllegacy_remove_fb(), which it won't do unless the refcount is at least 2. (And because thedrm_framebufferisn't dynamically allocated in this case we don't really care about the reference count anyway.)Quoted 4 lines
An alternative might be to call
legacy_remove_fb()directly, but it's declared static. Do you think it would be better to expose it and call it directly from the AST driver code? Or is there some other better way to put thedrm_connectors?Your problem isn't the dynamic fb vs. embedded fb for fbdev (you're already using
drm_framebuffer_unregister_privateto handle that). Your problem is you're not shutting down stuff on driver unload, which means the fb is still in use.drm_atomic_helper_shutdown()takes care of that for atomic drivers.
Quoted 3 lines
No idea anymore what to do for legacy code, probably need to open code a shutdown sequence. Definitely not the above.
-Daniel
Well, it looks like drm_crtc_force_disable_all() would also do the job, and from looking at nouveau_display_fini() it's used there as an alternative to drm_atomic_helper_shutdown().
Would it be reasonable to call that at the start of ast_fbdev_destroy() instead? (Testing shows that it does allow the drm_connector to be released. Is it enough/correct though?)
Cheers,
Sam.
Quoted 5 lines
Signature · 3 lines
Daniel Vetter Software Engineer, Intel Corporation +41 (0) 79 365 57 48 - http://blog.ffwll.ch
Re: [PATCH 2/2] drm/ast: Fix connector leak during driver unload
Quoted 60 lines · Sam Bobroff
Quoted 59 lines · Daniel Vetter
Quoted 47 lines · Sam Bobroff
Quoted 30 lines · Dave Airlie
Quoted 18 lines · Sam Bobroff
When unloading the ast driver, a warning message is printed by
drm_mode_config_cleanup()because a reference is still held to one of thedrm_connectorstructs.Correct this by calling
drm_framebuffer_remove()inast_fbdev_destroy().Signed-off-by Sam Bobroff <[email protected]>--- drivers/gpu/drm/ast/ast_fb.c | 4 ++++ 1 file changed, 4 insertions(+)drivers/gpu/drm/ast/ast_fb.c +0
-0drivers/gpu/drm/ast/ast_fb.c static void ast_fbdev_destroy(struct drm_device *dev, · line 269
Quoted 7 lines
drivers/gpu/drm/ast/ast_fb.c +4
-0@@ -263,6 +263,10 @@ static void ast_fbdev_destroy(struct drm_device *dev, {struct ast_framebuffer *afb = &afbdev->afb; +/* drm_framebuffer_remove() expects us to hold a ref, which it +* will drop, so take one: */ +drm_framebuffer_get (&afb->base); +drm_framebuffer_remove (&afb->base);This doesn't seem corret, no other driver does this pattern, and I can't believe ast is special here.
Quoted 1 line
The get just doesn't make sense.
Thanks for having a look at this, as I said in the cover letter I was concerned that it might not be a good fix.
But the AST driver does seem to be special (or just old?) because it embeds the
drm_framebufferdirectly intoast_fbdevand (almost all) other drivers dynamically allocate and reference count theirs.The
drm_framebuffer_get()certainly looks weird but it is there in order to causedrm_framebuffer_remove()to calllegacy_remove_fb(), which it won't do unless the refcount is at least 2. (And because thedrm_framebufferisn't dynamically allocated in this case we don't really care about the reference count anyway.)Quoted 4 lines
An alternative might be to call
legacy_remove_fb()directly, but it's declared static. Do you think it would be better to expose it and call it directly from the AST driver code? Or is there some other better way to put thedrm_connectors?Your problem isn't the dynamic fb vs. embedded fb for fbdev (you're already using
drm_framebuffer_unregister_privateto handle that). Your problem is you're not shutting down stuff on driver unload, which means the fb is still in use.drm_atomic_helper_shutdown()takes care of that for atomic drivers.
Quoted 7 lines
Quoted 3 lines
No idea anymore what to do for legacy code, probably need to open code a shutdown sequence. Definitely not the above.
-DanielWell, it looks like
drm_crtc_force_disable_all()would also do the job, and from looking atnouveau_display_fini()it's used there as an alternative todrm_atomic_helper_shutdown().
Ah right, I tried looking for that one but didn't find it with a quick scan.
Quoted 3 lines
Would it be reasonable to call that at the start of
ast_fbdev_destroy()instead? (Testing shows that it does allow thedrm_connectorto be released. Is it enough/correct though?)
Yes.
-Daniel
Signature · 7 lines
Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
Re: [PATCH 2/2] drm/ast: Fix connector leak during driver unload
Quoted 72 lines · Daniel Vetter
Quoted 60 lines · Sam Bobroff
Quoted 59 lines · Daniel Vetter
Quoted 47 lines · Sam Bobroff
Quoted 30 lines · Dave Airlie
Quoted 18 lines · Sam Bobroff
When unloading the ast driver, a warning message is printed by
drm_mode_config_cleanup()because a reference is still held to one of thedrm_connectorstructs.Correct this by calling
drm_framebuffer_remove()inast_fbdev_destroy().Signed-off-by Sam Bobroff <[email protected]>--- drivers/gpu/drm/ast/ast_fb.c | 4 ++++ 1 file changed, 4 insertions(+)drivers/gpu/drm/ast/ast_fb.c +0
-0drivers/gpu/drm/ast/ast_fb.c static void ast_fbdev_destroy(struct drm_device *dev, · line 269
Quoted 7 lines
drivers/gpu/drm/ast/ast_fb.c +4
-0@@ -263,6 +263,10 @@ static void ast_fbdev_destroy(struct drm_device *dev, {struct ast_framebuffer *afb = &afbdev->afb; +/* drm_framebuffer_remove() expects us to hold a ref, which it +* will drop, so take one: */ +drm_framebuffer_get (&afb->base); +drm_framebuffer_remove (&afb->base);This doesn't seem corret, no other driver does this pattern, and I can't believe ast is special here.
Quoted 1 line
The get just doesn't make sense.
Thanks for having a look at this, as I said in the cover letter I was concerned that it might not be a good fix.
But the AST driver does seem to be special (or just old?) because it embeds the
drm_framebufferdirectly intoast_fbdevand (almost all) other drivers dynamically allocate and reference count theirs.The
drm_framebuffer_get()certainly looks weird but it is there in order to causedrm_framebuffer_remove()to calllegacy_remove_fb(), which it won't do unless the refcount is at least 2. (And because thedrm_framebufferisn't dynamically allocated in this case we don't really care about the reference count anyway.)Quoted 4 lines
An alternative might be to call
legacy_remove_fb()directly, but it's declared static. Do you think it would be better to expose it and call it directly from the AST driver code? Or is there some other better way to put thedrm_connectors?Your problem isn't the dynamic fb vs. embedded fb for fbdev (you're already using
drm_framebuffer_unregister_privateto handle that). Your problem is you're not shutting down stuff on driver unload, which means the fb is still in use.drm_atomic_helper_shutdown()takes care of that for atomic drivers.Quoted 7 lines
Quoted 3 lines
No idea anymore what to do for legacy code, probably need to open code a shutdown sequence. Definitely not the above.
-DanielWell, it looks like
drm_crtc_force_disable_all()would also do the job, and from looking atnouveau_display_fini()it's used there as an alternative todrm_atomic_helper_shutdown().Ah right, I tried looking for that one but didn't find it with a quick scan.
Quoted 6 lines
Quoted 3 lines
Would it be reasonable to call that at the start of
ast_fbdev_destroy()instead? (Testing shows that it does allow thedrm_connectorto be released. Is it enough/correct though?)Yes.
-Daniel
Great, I'll post a v2 with that change.
Cheers,
Sam.