1 files changed, 78 insertions, 59 deletions

diff --git a/linux-core/drm_bo.c b/linux-core/drm_bo.c
index a1a27d1e..2ce3dbca 100644
--- a/linux-core/drm_bo.c
+++ b/linux-core/drm_bo.c
@@ -67,6 +67,9 @@ void drm_bo_add_to_pinned_lru(drm_buffer_object_t * bo)
 {
 	drm_mem_type_manager_t *man;
 
+	DRM_ASSERT_LOCKED(&bo->dev->struct_mutex);
+	DRM_ASSERT_LOCKED(&bo->mutex);
+
 	man = &bo->dev->bm.man[bo->pinned_mem_type];
 	list_add_tail(&bo->pinned_lru, &man->pinned);
 }
@@ -75,6 +78,8 @@ void drm_bo_add_to_lru(drm_buffer_object_t * bo)
 {
 	drm_mem_type_manager_t *man;
 
+	DRM_ASSERT_LOCKED(&bo->dev->struct_mutex);
+
 	if (!(bo->mem.mask & (DRM_BO_FLAG_NO_MOVE | DRM_BO_FLAG_NO_EVICT))
 	    || bo->mem.mem_type != bo->pinned_mem_type) {
 		man = &bo->dev->bm.man[bo->mem.mem_type];
@@ -134,6 +139,8 @@ static int drm_bo_add_ttm(drm_buffer_object_t * bo)
 	int ret = 0;
 	bo->ttm = NULL;
 
+	DRM_ASSERT_LOCKED(&bo->mutex);
+
 	switch (bo->type) {
 	case drm_bo_type_dc:
 		bo->ttm = drm_ttm_init(dev, bo->mem.num_pages << PAGE_SHIFT);
@@ -262,29 +269,25 @@ static int drm_bo_handle_move_mem(drm_buffer_object_t * bo,
 int drm_bo_wait(drm_buffer_object_t * bo, int lazy, int ignore_signals,
 		int no_wait)
 {
-
-	drm_fence_object_t *fence = bo->fence;
 	int ret;
 
-	if (fence) {
-		drm_device_t *dev = bo->dev;
-		if (drm_fence_object_signaled(fence, bo->fence_type)) {
-			drm_fence_usage_deref_unlocked(dev, fence);
-			bo->fence = NULL;
+	DRM_ASSERT_LOCKED(&bo->mutex);
+
+	if (bo->fence) {
+		if (drm_fence_object_signaled(bo->fence, bo->fence_type, 0)) {
+			drm_fence_usage_deref_unlocked(&bo->fence);
 			return 0;
 		}
 		if (no_wait) {
 			return -EBUSY;
 		}
 		ret =
-		    drm_fence_object_wait(dev, fence, lazy, ignore_signals,
+		    drm_fence_object_wait(bo->fence, lazy, ignore_signals,
 					  bo->fence_type);
 		if (ret)
 			return ret;
 
-		drm_fence_usage_deref_unlocked(dev, fence);
-		bo->fence = NULL;
-
+		drm_fence_usage_deref_unlocked(&bo->fence);
 	}
 	return 0;
 }
@@ -312,10 +315,8 @@ static int drm_bo_expire_fence(drm_buffer_object_t * bo, int allow_errors)
 					  "Evicting buffer.\n");
 			}
 		}
-		if (bo->fence) {
-			drm_fence_usage_deref_unlocked(dev, bo->fence);
-			bo->fence = NULL;
-		}
+		if (bo->fence)
+			drm_fence_usage_deref_unlocked(&bo->fence);
 	}
 	return 0;
 }
@@ -331,16 +332,17 @@ static void drm_bo_cleanup_refs(drm_buffer_object_t * bo, int remove_all)
 	drm_device_t *dev = bo->dev;
 	drm_buffer_manager_t *bm = &dev->bm;
 
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
+
 	atomic_inc(&bo->usage);
 	mutex_unlock(&dev->struct_mutex);
 	mutex_lock(&bo->mutex);
 
 	DRM_FLAG_MASKED(bo->priv_flags, 0, _DRM_BO_FLAG_UNFENCED);
 
-	if (bo->fence && drm_fence_object_signaled(bo->fence, bo->fence_type)) {
-		drm_fence_usage_deref_locked(dev, bo->fence);
-		bo->fence = NULL;
-	}
+	if (bo->fence && drm_fence_object_signaled(bo->fence,
+						   bo->fence_type, 0))
+		drm_fence_usage_deref_unlocked(&bo->fence);
 
 	if (bo->fence && remove_all)
 		(void)drm_bo_expire_fence(bo, 0);
@@ -371,7 +373,7 @@ static void drm_bo_cleanup_refs(drm_buffer_object_t * bo, int remove_all)
 	}
 
 	if (list_empty(&bo->ddestroy)) {
-		drm_fence_object_flush(dev, bo->fence, bo->fence_type);
+		drm_fence_object_flush(bo->fence, bo->fence_type);
 		list_add_tail(&bo->ddestroy, &bm->ddestroy);
 		schedule_delayed_work(&bm->wq,
 				      ((DRM_HZ / 100) < 1) ? 1 : DRM_HZ / 100);
@@ -392,6 +394,8 @@ static void drm_bo_destroy_locked(drm_buffer_object_t * bo)
 	drm_device_t *dev = bo->dev;
 	drm_buffer_manager_t *bm = &dev->bm;
 
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
+
 	if (list_empty(&bo->lru) && bo->mem.mm_node == NULL &&
 	    list_empty(&bo->pinned_lru) && bo->pinned_node == NULL &&
 	    list_empty(&bo->ddestroy) && atomic_read(&bo->usage) == 0) {
@@ -414,6 +418,7 @@ static void drm_bo_destroy_locked(drm_buffer_object_t * bo)
 
 		atomic_dec(&bm->count);
 
+		BUG_ON(!list_empty(&bo->base.list));
 		drm_ctl_free(bo, sizeof(*bo), DRM_MEM_BUFOBJ);
 
 		return;
@@ -488,10 +493,15 @@ static void drm_bo_delayed_workqueue(struct work_struct *work)
 	mutex_unlock(&dev->struct_mutex);
 }
 
-void drm_bo_usage_deref_locked(drm_buffer_object_t * bo)
+void drm_bo_usage_deref_locked(drm_buffer_object_t ** bo)
 {
-	if (atomic_dec_and_test(&bo->usage)) {
-		drm_bo_destroy_locked(bo);
+        struct drm_buffer_object *tmp_bo = *bo;
+	bo = NULL;
+
+	DRM_ASSERT_LOCKED(&tmp_bo->dev->struct_mutex);
+
+	if (atomic_dec_and_test(&tmp_bo->usage)) {
+		drm_bo_destroy_locked(tmp_bo);
 	}
 }
 
@@ -500,18 +510,22 @@ static void drm_bo_base_deref_locked(drm_file_t * priv, drm_user_object_t * uo)
 	drm_buffer_object_t *bo =
 	    drm_user_object_entry(uo, drm_buffer_object_t, base);
 
+	DRM_ASSERT_LOCKED(&bo->dev->struct_mutex);
+
 	drm_bo_takedown_vm_locked(bo);
-	drm_bo_usage_deref_locked(bo);
+	drm_bo_usage_deref_locked(&bo);
 }
 
-static void drm_bo_usage_deref_unlocked(drm_buffer_object_t * bo)
+static void drm_bo_usage_deref_unlocked(drm_buffer_object_t ** bo)
 {
-	drm_device_t *dev = bo->dev;
+	struct drm_buffer_object *tmp_bo = *bo;
+	drm_device_t *dev = tmp_bo->dev;
 
-	if (atomic_dec_and_test(&bo->usage)) {
+	*bo = NULL;
+	if (atomic_dec_and_test(&tmp_bo->usage)) {
 		mutex_lock(&dev->struct_mutex);
-		if (atomic_read(&bo->usage) == 0)
-			drm_bo_destroy_locked(bo);
+		if (atomic_read(&tmp_bo->usage) == 0)
+			drm_bo_destroy_locked(tmp_bo);
 		mutex_unlock(&dev->struct_mutex);
 	}
 }
@@ -597,18 +611,17 @@ int drm_fence_buffer_objects(drm_file_t * priv,
 		if (entry->priv_flags & _DRM_BO_FLAG_UNFENCED) {
 			count++;
 			if (entry->fence)
-				drm_fence_usage_deref_locked(dev, entry->fence);
-			entry->fence = fence;
+				drm_fence_usage_deref_locked(&entry->fence);
+			entry->fence = drm_fence_reference_locked(fence);
 			DRM_FLAG_MASKED(entry->priv_flags, 0,
 					_DRM_BO_FLAG_UNFENCED);
 			DRM_WAKEUP(&entry->event_queue);
 			drm_bo_add_to_lru(entry);
 		}
 		mutex_unlock(&entry->mutex);
-		drm_bo_usage_deref_locked(entry);
+		drm_bo_usage_deref_locked(&entry);
 		l = f_list.next;
 	}
-	atomic_add(count, &fence->usage);
 	DRM_DEBUG("Fenced %d buffers\n", count);
       out:
 	mutex_unlock(&dev->struct_mutex);
@@ -723,7 +736,7 @@ static int drm_bo_mem_force_space(drm_device_t * dev,
 
 		ret = drm_bo_evict(entry, mem_type, no_wait);
 		mutex_unlock(&entry->mutex);
-		drm_bo_usage_deref_unlocked(entry);
+		drm_bo_usage_deref_unlocked(&entry);
 		if (ret)
 			return ret;
 		mutex_lock(&dev->struct_mutex);
@@ -943,10 +956,8 @@ static int drm_bo_quick_busy(drm_buffer_object_t * bo)
 
 	BUG_ON(bo->priv_flags & _DRM_BO_FLAG_UNFENCED);
 	if (fence) {
-		drm_device_t *dev = bo->dev;
-		if (drm_fence_object_signaled(fence, bo->fence_type)) {
-			drm_fence_usage_deref_unlocked(dev, fence);
-			bo->fence = NULL;
+		if (drm_fence_object_signaled(fence, bo->fence_type, 0)) {
+			drm_fence_usage_deref_unlocked(&bo->fence);
 			return 0;
 		}
 		return 1;
@@ -965,16 +976,13 @@ static int drm_bo_busy(drm_buffer_object_t * bo)
 
 	BUG_ON(bo->priv_flags & _DRM_BO_FLAG_UNFENCED);
 	if (fence) {
-		drm_device_t *dev = bo->dev;
-		if (drm_fence_object_signaled(fence, bo->fence_type)) {
-			drm_fence_usage_deref_unlocked(dev, fence);
-			bo->fence = NULL;
+		if (drm_fence_object_signaled(fence, bo->fence_type, 0)) {
+			drm_fence_usage_deref_unlocked(&bo->fence);
 			return 0;
 		}
-		drm_fence_object_flush(dev, fence, DRM_FENCE_TYPE_EXE);
-		if (drm_fence_object_signaled(fence, bo->fence_type)) {
-			drm_fence_usage_deref_unlocked(dev, fence);
-			bo->fence = NULL;
+		drm_fence_object_flush(fence, DRM_FENCE_TYPE_EXE);
+		if (drm_fence_object_signaled(fence, bo->fence_type, 0)) {
+			drm_fence_usage_deref_unlocked(&bo->fence);
 			return 0;
 		}
 		return 1;
@@ -1171,7 +1179,7 @@ static int drm_buffer_object_map(drm_file_t * priv, uint32_t handle,
 		drm_bo_fill_rep_arg(bo, rep);
       out:
 	mutex_unlock(&bo->mutex);
-	drm_bo_usage_deref_unlocked(bo);
+	drm_bo_usage_deref_unlocked(&bo);
 	return ret;
 }
 
@@ -1197,7 +1205,7 @@ static int drm_buffer_object_unmap(drm_file_t * priv, uint32_t handle)
 	}
 
 	drm_remove_ref_object(priv, ro);
-	drm_bo_usage_deref_locked(bo);
+	drm_bo_usage_deref_locked(&bo);
       out:
 	mutex_unlock(&dev->struct_mutex);
 	return ret;
@@ -1487,11 +1495,14 @@ static int drm_bo_handle_validate(drm_file_t * priv,
 				  uint64_t flags, uint64_t mask, uint32_t hint,
 				  struct drm_bo_info_rep *rep)
 {
+	struct drm_device *dev = priv->head->dev;
 	drm_buffer_object_t *bo;
 	int ret;
 	int no_wait = hint & DRM_BO_HINT_DONT_BLOCK;
 
+	mutex_lock(&dev->struct_mutex);
 	bo = drm_lookup_buffer_object(priv, handle, 1);
+	mutex_unlock(&dev->struct_mutex);
 	if (!bo) {
 		return -EINVAL;
 	}
@@ -1517,16 +1528,20 @@ static int drm_bo_handle_validate(drm_file_t * priv,
 
 	mutex_unlock(&bo->mutex);
 
-	drm_bo_usage_deref_unlocked(bo);
+	drm_bo_usage_deref_unlocked(&bo);
 	return ret;
 }
 
 static int drm_bo_handle_info(drm_file_t *priv, uint32_t handle,
 			      struct drm_bo_info_rep *rep)
 {
+	struct drm_device *dev = priv->head->dev;
 	drm_buffer_object_t *bo;
 
+	mutex_lock(&dev->struct_mutex);
 	bo = drm_lookup_buffer_object(priv, handle, 1);
+	mutex_unlock(&dev->struct_mutex);
+
 	if (!bo) {
 		return -EINVAL;
 	}
@@ -1535,7 +1550,7 @@ static int drm_bo_handle_info(drm_file_t *priv, uint32_t handle,
 		(void)drm_bo_busy(bo);
 	drm_bo_fill_rep_arg(bo, rep);
 	mutex_unlock(&bo->mutex);
-	drm_bo_usage_deref_unlocked(bo);
+	drm_bo_usage_deref_unlocked(&bo);
 	return 0;
 }
 
@@ -1543,11 +1558,15 @@ static int drm_bo_handle_wait(drm_file_t *priv, uint32_t handle,
 			      uint32_t hint,
 			      struct drm_bo_info_rep *rep)
 {
+	struct drm_device *dev = priv->head->dev;
 	drm_buffer_object_t *bo;
 	int no_wait = hint & DRM_BO_HINT_DONT_BLOCK;
 	int ret;
 
+	mutex_lock(&dev->struct_mutex);
 	bo = drm_lookup_buffer_object(priv, handle, 1);
+	mutex_unlock(&dev->struct_mutex);
+
 	if (!bo) {
 		return -EINVAL;
 	}
@@ -1564,7 +1583,7 @@ static int drm_bo_handle_wait(drm_file_t *priv, uint32_t handle,
 
       out:
 	mutex_unlock(&bo->mutex);
-	drm_bo_usage_deref_unlocked(bo);
+	drm_bo_usage_deref_unlocked(&bo);
 	return ret;
 }
 
@@ -1649,7 +1668,7 @@ int drm_buffer_object_create(drm_device_t *dev,
       out_err:
 	mutex_unlock(&bo->mutex);
 
-	drm_bo_usage_deref_unlocked(bo);
+	drm_bo_usage_deref_unlocked(&bo);
 	return ret;
 }
 
@@ -1774,7 +1793,7 @@ int drm_bo_create_ioctl(DRM_IOCTL_ARGS)
 	ret = drm_bo_add_user_object(priv, entry,
 				     req->mask & DRM_BO_FLAG_SHAREABLE);
 	if (ret) {
-		drm_bo_usage_deref_unlocked(entry);
+		drm_bo_usage_deref_unlocked(&entry);
 		goto out;
 	}
 	
@@ -2090,7 +2109,7 @@ restart:
 					allow_errors);
 		mutex_lock(&dev->struct_mutex);
 
-		drm_bo_usage_deref_locked(entry);
+		drm_bo_usage_deref_locked(&entry);
 		if (ret)
 			return ret;
 
@@ -2100,10 +2119,8 @@ restart:
 
 		do_restart = ((next->prev != list) && (next->prev != prev));
 
-		if (nentry != NULL && do_restart) {
-			drm_bo_usage_deref_locked(nentry);
-			nentry = NULL;
-		}
+		if (nentry != NULL && do_restart)
+			drm_bo_usage_deref_locked(&nentry);
 
 		if (do_restart)
 			goto restart;
@@ -2556,6 +2573,7 @@ static void drm_bo_takedown_vm_locked(drm_buffer_object_t * bo)
 	drm_local_map_t *map;
 	drm_device_t *dev = bo->dev;
 
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
 	if (list->user_token) {
 		drm_ht_remove_item(&dev->map_hash, &list->hash);
 		list->user_token = 0;
@@ -2572,7 +2590,7 @@ static void drm_bo_takedown_vm_locked(drm_buffer_object_t * bo)
 	drm_ctl_free(map, sizeof(*map), DRM_MEM_BUFOBJ);
 	list->map = NULL;
 	list->user_token = 0ULL;
-	drm_bo_usage_deref_locked(bo);
+	drm_bo_usage_deref_locked(&bo);
 }
 
 static int drm_bo_setup_vm_locked(drm_buffer_object_t * bo)
@@ -2581,6 +2599,7 @@ static int drm_bo_setup_vm_locked(drm_buffer_object_t * bo)
 	drm_local_map_t *map;
 	drm_device_t *dev = bo->dev;
 
+	DRM_ASSERT_LOCKED(&dev->struct_mutex);
 	list->map = drm_ctl_calloc(1, sizeof(*map), DRM_MEM_BUFOBJ);
 	if (!list->map)
 		return -ENOMEM;