Possible fb ref count issue with drm_plane_force_disable()

[Archit Taneja]

Hi,

On Thursday 10 April 2014 05:17 PM, Tomi Valkeinen wrote:
> Hi,
>
> I've been debugging omapdrm issues on top of the latest drm mainline
> changes. Sometimes a drm_framebuffer ref count drops to -1 when aborting
> a drm application, or unloading the modules.
>
> The setup is very basic, just a single crtc with the crtc's primary plane.
>
> What seems to happen is:
>
> - App is started
>
> - fb is created, and taken into use by omapdrm. omapdrm takes a ref to
> the fb.
>
> - the app is starts to shut down
>
> - drm_framebuffer_remove is called

Does drm_framebuffer_remove get called when we abort the application, or 
unload omapdrm, or both?

>
> - fb->refcount.refcount > 1, so it goes to disable stuff
>
> - drm_plane_force_disable is called for the primary plane

Maybe we need to make sure that this func is called only when our driver 
has unreferenced it. In that case, we would probably need to flush our 
queue and disable interrupts(so that we don't queue more work).

>
> - drm_plane_force_disable does plane->disable_plane, which on omapdrm
> puts stuff on a workqueue as plane cannot be disabled immediately
>
> - drm_plane_force_disable calls __drm_framebuffer_unreference()
>
> - at the end of drm_framebuffer_remove(), there's
> drm_framebuffer_unreference, which causes ref count to go to zero, and
> the fb to be destroyed
>
> - a bit later, the queued work is ran, which does
> drm_framebuffer_unreference(), and ref count goes to -1. Here omapdrm is
> removing the ref that had been taken in the beginning.
>
>
> So the explicit unref done by drm_plane_force_disable() seems a bit out
> of place. I can't figure out which drm_framebuffer_reference() would be
> the matching one for the unref done by drm_plane_force_disable().
>
> Any ideas what ref is that? Or is the __drm_framebuffer_unreference()
> extra in drm_plane_force_disable()?


I can't get the corresponding reference for it either. But I can count 3 
of them when you run fbcon with drm's fb helper.

- One ref is taken in the drm_framebuffer_init called from 
omap_fbdev_create.

- fbcon will call fb_set_par, which calls drm_fb_helper_set_par, that 
seems to take a refernce to the fb in the end.

- drm_crtc_helper_set_config() calls the omadrm specific mode_set 
drm_crtc_funcs, which eventually calls a drm_framebuffer_reference in 
update_pin().

Archit