Re: [RFC PATCH v3 4/4] tests/drv_module_reload: add ipvr support

[Thierry Reding <thierry.reding@gmail.com>]

[-- Attachment #1.1: Type: text/plain, Size: 4060 bytes --]

On Mon, Dec 01, 2014 at 03:06:08AM +0000, Cheng, Yao wrote:
> > -----Original Message-----
> > From: Daniel Vetter [mailto:daniel.vetter@ffwll.ch] On Behalf Of Daniel
> > Vetter
> > Sent: Monday, November 24, 2014 21:15
> > To: Thierry Reding
> > Cc: Daniel Vetter; Cheng, Yao; intel-gfx@lists.freedesktop.org; dri-
> > devel@lists.freedesktop.org; daniel.vetter@ffwll.ch; Kelley, Sean V; Chehab,
> > John; emil.l.velikov@gmail.com; Jiang, Fei
> > Subject: Re: [RFC PATCH v3 4/4] tests/drv_module_reload: add ipvr support
> > 
> > On Mon, Nov 24, 2014 at 10:55:46AM +0100, Thierry Reding wrote:
> > > On Fri, Nov 21, 2014 at 09:36:33PM +0100, Daniel Vetter wrote:
> > > > On Fri, Nov 21, 2014 at 09:27:04PM +0100, Thierry Reding wrote:
> > > > > On Sat, Nov 22, 2014 at 03:10:01AM +0800, Yao Cheng wrote:
> > > > > > on vlv, if ipvr is installed, it need be manually unloaded
> > > > > > before i915, otherwise user might run into use-after-free issue.
> > > > >
> > > > > Huh? That doesn't sound right. What exactly is it that's going wrong?
> > > > > You should never have to do this. If you do you're almost
> > > > > certainly doing something wrong in the kernel module.
> > > >
> > > > It's the hilarity called platform devices. Removing them is somewhat
> > > > racy, so doing that upfront makes the entire thing a bit safer. The
> > > > use after free is on the text, since grabbing a module refcount for
> > > > the platform device doesn't work (it would pin the module forever).
> > >
> > > I don't understand what the issue is here. I've used platform devices
> > > quite extensively on ARM and I've never encountered a situation where
> > > they were insufficient (or racy for that matter).
> > >
> > > If I understand correctly what this commit tries to achieve, then it
> > > unloads one module before another module that it depends on so that
> > > the dependency can be removed subsequently without causing a crash.
> > > That sounds really brittle to me. How are you going to document this
> > > for users so that they don't accidentally go and unload the i915
> > > module and crash their system?
> > 
> > Module unloading taints your kernel and isn't an end-user supported feature.
> > That simple ;-)
> > 
> > Also afaik the problem is that you actually can't unload i915 until you've
> > unloaded the subordinate driver, since i915 registering the platform driver
> > prevents unload. Or at least that was my understanding, I didn't test this
> > myself. I just asked whether the unload script still works and apparently it
> > breaks.
> > 
> > I guess what's different with ARM is that DT creates all the platform devices,
> > and not modules themselves?
> > -Daniel
> 
> Thierry/Daniel, the actual symptom is, after "rmmod i915", though
> drm_drv_release() is also called on the child device "ipvr", I still
> see the module exist in the system (check it by "lsmod").

Which module? ipvr or i915?

> This causes issue when I modprobe i915 and ipvr again later.

What issue are you seeing? If your driver can't deal with a situation
where it's probed again after being removed then you have a bug.

> I don't understand why this happens but I believe what Daniel said:
> "grabbing a module refcount for the platform device doesn't work (it
> would pin the module forever)"

What I'd expect to happen is this:

	# modprobe i915
	i915 registers a platform devices
	# modprobe ipvr
	driver core probes ipvr device
	# modprobe -r i915
	i915 removes the platform device (ipvr's ->remove() is called)

I guess if you don't do anything else, then indeed the ipvr module will
stay around, but the above should work idempotently, that is you should
be able to repeat it an unlimited number of times and nothing should
break.

In fact you should be able to run the following in any permutation
without causing a crash:

	# modprobe i915
	# modprobe ipvr
	# modprobe -r ipvr
	# modprobe -r i915

If any permutation results in a crash you have a bug.

Thierry

[-- Attachment #1.2: Type: application/pgp-signature, Size: 819 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel