Nouveau - Mar 2008 - [Bug 14941] New: ioremap leak in DRM

http://bugs.freedesktop.org/show_bug.cgi?id=14941

           Summary: ioremap leak in DRM
           Product: xorg
           Version: unspecified
          Platform: x86-64 (AMD64)
        OS/Version: Linux (All)
            Status: NEW
          Severity: minor
          Priority: medium
         Component: Driver/nouveau
        AssignedTo: nouveau at lists.freedesktop.org
        ReportedBy: pq at iki.fi
         QAContact: xorg-team at lists.x.org


Nouveau is leaking one ioremap per X start. Apparently it is the kernel fifo,
since it always mapped from the beginning of VRAM, and has size 0x8000 or 32kB.

My hardware is NV20 (gf3). DRM and DDX from git around 9th March.

I found this while mmiotracing nouveau. I start the trace, load drm.ko and
nouveau.ko, start X three times in a row, unload nouveau.ko and drm.ko. Now
when I stop mmiotracing, it reports three non-unmapped io-mappings as described
above.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=14941





--- Comment #1 from Maarten Maathuis <madman2003 at gmail.com>  2008-03-10
11:26:07 PST ---
Created an attachment (id=15010)
 --> (http://bugs.freedesktop.org/attachment.cgi?id=15010)
Unmap the bushbuffer when it's no longer needed.

Please try this patch.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=14941


Pekka Paalanen <pq at iki.fi> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|ioremap leak in DRM         |ioremap leak/oddity in DRM




--- Comment #2 from Pekka Paalanen <pq at iki.fi>  2008-03-10 12:24:53 PST
---
Patch applied and it does now properly unmap the kernel fifo.

But, this is weird:

[ 3570.805372] kmmio: __ioremap(0xfb000000, 0x1000000, 0x0) = ffffc20002500000
[ 3570.838376] kmmio: __ioremap(0xfb700000, 0x100000, 0x0) = ffffc20003580000
[ 3571.491843] [drm:nouveau_mem_init] *ERROR* Error initialising AGP: 1
[ 3571.523846] [drm] Allocating FIFO number 0
[ 3571.589003] [drm] nouveau_fifo_alloc: initialised FIFO 0
[ 3571.589016] kmmio: __ioremap(0xf4000000, 0x8000, 0x0) = ffffc200024e0000
[ 3571.590088] [drm] Allocating FIFO number 1
[ 3571.660816] [drm] nouveau_fifo_alloc: initialised FIFO 1
[ 3571.660831] kmmio: __ioremap(0xfb810000, 0x10000, 0x0) = ffffc20003520000
[ 3575.667748] [drm] nouveau_fifo_free: freeing fifo 1
[ 3575.668822] kmmio: Unmapping ffffc200024e0000.
[ 3575.668900] [drm] nouveau_fifo_free: freeing fifo 0
[ 3575.670486] kmmio: Unmapping ffffc20003520000.
[ 3575.670814] kmmio: Unmapping ffffc20003580000.
[ 3575.671003] kmmio: Unmapping ffffc20002500000.
[ 3583.159104] ACPI: PCI interrupt for device 0000:01:00.0 disabled
[ 3583.160275] [drm] Module unloaded
[ 3594.912672] kmmio: unload...

And also the respective parts of mmiotrace log:

MAP 52.192110 34 0xfb000000 0xffffc20002500000 0x1000000 0x0 0
MAP 52.225075 35 0xfb700000 0xffffc20003580000 0x100000 0x0 0
MAP 52.975927 36 0xf4000000 0xffffc200024e0000 0x8000 0x0 0
MAP 53.047763 37 0xfb810000 0xffffc20003520000 0x10000 0x0 0
UNMAP 57.056969 36 0x0 0
UNMAP 57.058877 37 0x0 0
UNMAP 57.058991 35 0x0 0
UNMAP 57.059153 34 0x0 0

What we see here is that DRM says it is freeing first fifo 1, then fifo 0.
Mmiotrace is saying that the fifo 0's mapping is removed first, and fifo
1's
mapping second. This does not match, hence looks suspicous.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=14941





--- Comment #3 from Maarten Maathuis <madman2003 at gmail.com>  2008-03-10
13:05:51 PST ---
Created an attachment (id=15012)
 --> (http://bugs.freedesktop.org/attachment.cgi?id=15012)
Unmap bushbuffer when deallocating fifo.

No idea where the unmapping of fifo 1 happens, but i do have a patch to force
it to unmap early.

Please try this also.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=14941





--- Comment #4 from Pekka Paalanen <pq at iki.fi>  2008-03-10 13:51:10 PST
---
Ok, so I should not have applied the both patches together. ANyway, this is the
kernel log:

[10827.545301] kmmio: loaded.
[10837.455814] [drm] Initialized drm 1.1.0 20060810
[10842.824600] ACPI: PCI Interrupt 0000:01:00.0[A] -> GSI 16 (level, low)
->
IRQ 16
[10842.825872] kmmio: ioremap_nocache(0xfb000000, 0x8) = ffffc200004bc000
[10842.826156] kmmio: Unmapping ffffc200004bc000.
[10842.826493] [drm] Detected an NV20 generation card (0x020000a5)
[10842.826713] [drm] Initialized nouveau 0.0.10 20060213 on minor 0
[10858.554576] kmmio: __ioremap(0xfb000000, 0x1000000, 0x0) = ffffc20002500000
[10858.587579] kmmio: __ioremap(0xfb700000, 0x100000, 0x0) = ffffc20003580000
[10858.593323] kmmio: Unmapping ffffc20003580000.
[10858.593494] kmmio: Unmapping ffffc20002500000.
[10858.627117] kmmio: __ioremap(0xfb000000, 0x1000000, 0x0) = ffffc20002500000
[10858.660011] kmmio: __ioremap(0xfb700000, 0x100000, 0x0) = ffffc20003580000
[10858.665817] kmmio: Unmapping ffffc20003580000.
[10858.665988] kmmio: Unmapping ffffc20002500000.
[10859.671455] kmmio: __ioremap(0xfb000000, 0x1000000, 0x0) = ffffc20002500000
[10859.703436] kmmio: __ioremap(0xfb700000, 0x100000, 0x0) = ffffc20003580000
[10859.709132] kmmio: Unmapping ffffc20003580000.
[10859.709302] kmmio: Unmapping ffffc20002500000.
[10859.741084] kmmio: __ioremap(0xfb000000, 0x1000000, 0x0) = ffffc20002500000
[10859.773234] kmmio: __ioremap(0xfb700000, 0x100000, 0x0) = ffffc20003580000
[10859.778917] kmmio: Unmapping ffffc20003580000.
[10859.779086] kmmio: Unmapping ffffc20002500000.
[10859.811407] kmmio: __ioremap(0xfb000000, 0x1000000, 0x0) = ffffc20002500000
[10859.842806] kmmio: __ioremap(0xfb700000, 0x100000, 0x0) = ffffc20003580000
[10860.487452] [drm:nouveau_mem_init] *ERROR* Error initialising AGP: 1
[10860.519058] [drm] Allocating FIFO number 0
[10860.585753] [drm] nouveau_fifo_alloc: initialised FIFO 0
[10860.585764] kmmio: __ioremap(0xf4000000, 0x8000, 0x0) = ffffc200024e0000
[10860.586806] [drm] Allocating FIFO number 1
[10860.657699] [drm] nouveau_fifo_alloc: initialised FIFO 1
[10860.657714] kmmio: __ioremap(0xfb810000, 0x10000, 0x0) = ffffc20003520000
[10873.312851] [drm] Allocating FIFO number 2
[10873.385945] [drm] nouveau_fifo_alloc: initialised FIFO 2
[10873.385960] kmmio: __ioremap(0xfb820000, 0x10000, 0x0) = ffffc20003540000
[10877.386933] [drm] nouveau_fifo_free: freeing fifo 2
[10878.892568] [drm] Allocating FIFO number 2
[10878.965646] [drm] nouveau_fifo_alloc: initialised FIFO 2
[10882.966435] [drm] nouveau_fifo_free: freeing fifo 2
[10885.638113] [drm] nouveau_fifo_free: freeing fifo 1
[10885.639210] kmmio: Unmapping ffffc200024e0000.
[10885.639292] [drm] nouveau_fifo_free: freeing fifo 0
[10885.639857] kmmio: Unmapping ffffc200024e0000.
[10885.639933] iounmap: bad address ffffc200024e0000
[10885.640014] Pid: 15415, comm: X Not tainted 2.6.24-gentoo-r2-trace #1
[10885.640100] 
[10885.640101] Call Trace:
[10885.640240]  [<ffffffff8021ca0e>] iounmap+0x9a/0xe0
[10885.640251]  [<ffffffff881c4264>] :mmio:iounmap_trace+0x14f/0x15c
[10885.640279]  [<ffffffff881cf80f>] :drm:drm_core_ioremapfree+0x51/0x53
[10885.640292]  [<ffffffff881f1089>]
:nouveau:nouveau_fifo_free+0x1db/0x253
[10885.640308]  [<ffffffff881f5d6c>]
:nouveau:nouveau_dma_channel_takedown+0x60/0x6c
[10885.640320]  [<ffffffff881f0287>] :nouveau:nouveau_lastclose+0x63/0x109
[10885.640339]  [<ffffffff881ccb7a>] :drm:drm_lastclose+0x4a/0x3b5
[10885.640359]  [<ffffffff881cdabb>] :drm:drm_release+0x47f/0x4d2
[10885.640368]  [<ffffffff80274970>] __fput+0xc5/0x1a1
[10885.640375]  [<ffffffff80274c0c>] fput+0x13/0x15
[10885.640379]  [<ffffffff80271f1b>] filp_close+0x66/0x71
[10885.640386]  [<ffffffff8022b89d>] put_files_struct+0x6c/0xc0
[10885.640392]  [<ffffffff8022b946>] __exit_files+0x55/0x5a
[10885.640397]  [<ffffffff8022cd37>] do_exit+0x242/0x778
[10885.640401]  [<ffffffff80274c0c>] fput+0x13/0x15
[10885.640408]  [<ffffffff8022d300>] sys_exit_group+0x0/0x14
[10885.640413]  [<ffffffff8022d312>] sys_exit_group+0x12/0x14
[10885.640417]  [<ffffffff8020b74e>] system_call+0x7e/0x83
[10885.641638] 
[10885.642736] kmmio: Unmapping ffffc20003540000.
[10885.643070] kmmio: Unmapping ffffc20003520000.
[10885.643157] kmmio: Unmapping ffffc20003580000.
[10885.643316] kmmio: Unmapping ffffc20002500000.
[10892.039445] ACPI: PCI interrupt for device 0000:01:00.0 disabled
[10892.039524] [drm] Module unloaded
[10943.881377] kmmio: unload...


Looks like something is freeing a bunch of io-mappings at a time. Notice, how
creating fifo 2 for the second time does not ioremap anything, so there is
caching in action.

Maybe this is a non-issue.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=14941





--- Comment #5 from Maarten Maathuis <madman2003 at gmail.com>  2008-03-10
15:23:14 PST ---
Still, someone should find out what is doing this caching.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=14941





--- Comment #6 from Maarten Maathuis <madman2003 at gmail.com>  2008-03-12
15:40:25 PST ---
Should i just push the first patch?


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=14941


Stuart Bennett <sb476 at cam.ac.uk> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED




--- Comment #7 from Stuart Bennett <sb476 at cam.ac.uk>  2009-03-24
20:06:08 PST ---
http://cgit.freedesktop.org/mesa/drm/commit/?id=c9cfeaa5542e08381a8144d0a5bd96036a19082f
fixes the leak for me.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.