From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tomi Valkeinen Subject: Possible fb ref count issue with drm_plane_force_disable() Date: Thu, 10 Apr 2014 14:47:52 +0300 Message-ID: <534684E8.9000203@ti.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1515938032==" Return-path: Received: from devils.ext.ti.com (devils.ext.ti.com [198.47.26.153]) by gabe.freedesktop.org (Postfix) with ESMTP id E9D486E206 for ; Thu, 10 Apr 2014 04:47:55 -0700 (PDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel , Rob Clark List-Id: dri-devel@lists.freedesktop.org --===============1515938032== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="VF7o09TMWtItJDFUeR80Djha6PCkeFpkn" --VF7o09TMWtItJDFUeR80Djha6PCkeFpkn Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hi, I've been debugging omapdrm issues on top of the latest drm mainline changes. Sometimes a drm_framebuffer ref count drops to -1 when aborting a drm application, or unloading the modules. The setup is very basic, just a single crtc with the crtc's primary plane= =2E What seems to happen is: - App is started - fb is created, and taken into use by omapdrm. omapdrm takes a ref to the fb. - the app is starts to shut down - drm_framebuffer_remove is called - fb->refcount.refcount > 1, so it goes to disable stuff - drm_plane_force_disable is called for the primary plane - drm_plane_force_disable does plane->disable_plane, which on omapdrm puts stuff on a workqueue as plane cannot be disabled immediately - drm_plane_force_disable calls __drm_framebuffer_unreference() - at the end of drm_framebuffer_remove(), there's drm_framebuffer_unreference, which causes ref count to go to zero, and the fb to be destroyed - a bit later, the queued work is ran, which does drm_framebuffer_unreference(), and ref count goes to -1. Here omapdrm is removing the ref that had been taken in the beginning. So the explicit unref done by drm_plane_force_disable() seems a bit out of place. I can't figure out which drm_framebuffer_reference() would be the matching one for the unref done by drm_plane_force_disable(). Any ideas what ref is that? Or is the __drm_framebuffer_unreference() extra in drm_plane_force_disable()? Tomi --VF7o09TMWtItJDFUeR80Djha6PCkeFpkn Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQIcBAEBAgAGBQJTRoToAAoJEPo9qoy8lh71pLUQAIfQKA19Fp2R6lyQzrEKV+XE 7d9TkD5OIWZuw07Tw9S+L94EV00bXePelLtSov4btAspKmHy8ckWKqxSnec2kANI 6kPaM5ULfWliotWZXmznAVymGFAPaquFC1nBBvTi1nPWAwaBx3V0MNxsne6c2FbG b5Bh6W++xpMJUMJkhKd4R5vIdWPxNiO3MYR6zQtLUpyjsMFw/sP78DfS/Uj9WGTo Ib5d20FSEWfmns/L2npXiQBTRgJAo3/acG9vTdJ4FCg2GCmbWImIUu3RmIjKEGHs 4rVuH5Mx4gchdYPAxgT92FdSnxtb2sHEF5h1juVgKeE+W5ndG7uRDsTqRZlnKF7Q 7ri9NtiUMr+97dhs++nsgjnXUvxmi02WPBvWorwIhxD2ne1SvtHQuOlWzYzy8lBA 7avcMwJSvBQ6LRsA2mnhyUBxeyCzHKYl2KeeKVKifLysjv//QMx3U48rK7guDru/ BTwMMu0nDEiHZhUKWJq56+ZLGcify7uQcLfEbCPTKcJM2Rl5dPC74xGpjyjZM70J LVlWdb7KKLoPR3Rrkto13XcdWY7iXQ++/aF26KjEtw/i4lTsLRzjbdLvrrBwXSTx QOqh346hrmGFbQTPccjsmAozhE3yCWOX+50vzydTv7/6vDc0PI2yCJSaWyr2ePM8 0gg3pRZ5u2nUOYdNHmEs =JReP -----END PGP SIGNATURE----- --VF7o09TMWtItJDFUeR80Djha6PCkeFpkn-- --===============1515938032== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel --===============1515938032==--