From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ville =?iso-8859-1?Q?Syrj=E4l=E4?= Subject: Re: Possible fb ref count issue with drm_plane_force_disable() Date: Fri, 11 Apr 2014 14:50:54 +0300 Message-ID: <20140411115054.GC18465@intel.com> References: <534684E8.9000203@ti.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Return-path: Received: from mga03.intel.com (mga03.intel.com [143.182.124.21]) by gabe.freedesktop.org (Postfix) with ESMTP id A1E806E388 for ; Fri, 11 Apr 2014 04:50:58 -0700 (PDT) Content-Disposition: inline In-Reply-To: <534684E8.9000203@ti.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Tomi Valkeinen Cc: dri-devel List-Id: dri-devel@lists.freedesktop.org On Thu, Apr 10, 2014 at 02:47:52PM +0300, Tomi Valkeinen wrote: > Hi, > = > I've been debugging omapdrm issues on top of the latest drm mainline > changes. Sometimes a drm_framebuffer ref count drops to -1 when aborting > a drm application, or unloading the modules. > = > The setup is very basic, just a single crtc with the crtc's primary plane. > = > What seems to happen is: > = > - App is started > = > - fb is created, and taken into use by omapdrm. omapdrm takes a ref to > the fb. > = > - the app is starts to shut down > = > - drm_framebuffer_remove is called > = > - fb->refcount.refcount > 1, so it goes to disable stuff > = > - drm_plane_force_disable is called for the primary plane > = > - drm_plane_force_disable does plane->disable_plane, which on omapdrm > puts stuff on a workqueue as plane cannot be disabled immediately > = > - drm_plane_force_disable calls __drm_framebuffer_unreference() > = > - at the end of drm_framebuffer_remove(), there's > drm_framebuffer_unreference, which causes ref count to go to zero, and > the fb to be destroyed > = > - a bit later, the queued work is ran, which does > drm_framebuffer_unreference(), and ref count goes to -1. Here omapdrm is > removing the ref that had been taken in the beginning. > = > = > So the explicit unref done by drm_plane_force_disable() seems a bit out > of place. I can't figure out which drm_framebuffer_reference() would be > the matching one for the unref done by drm_plane_force_disable(). > = > Any ideas what ref is that? Or is the __drm_framebuffer_unreference() > extra in drm_plane_force_disable()? That's the reference that was taken by the drm_mode_setplane() when it succesfully called the .update_plane() hook. __drm_framebuffer_unregister() drops the "idr reference" taken in drm_framebuffer_init(). And the last ref dropped by drm_framebuffer_remove() is the initial ref from kref_init() which I suppose is what the 'fpriv->fbs reference' comments are referring to. = -- = Ville Syrj=E4l=E4 Intel OTC