3 files changed, 22 insertions, 8 deletions

diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index 1ebfd5a6dfec..4f0d181a690c 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -538,8 +538,8 @@ int r600_vb_ib_get(struct radeon_device *rdev)
 
 void r600_vb_ib_put(struct radeon_device *rdev)
 {
-	mutex_lock(&rdev->ib_pool.mutex);
 	radeon_fence_emit(rdev, rdev->r600_blit.vb_ib->fence);
+	mutex_lock(&rdev->ib_pool.mutex);
 	list_add_tail(&rdev->r600_blit.vb_ib->list, &rdev->ib_pool.scheduled_ibs);
 	mutex_unlock(&rdev->ib_pool.mutex);
 	radeon_ib_free(rdev, &rdev->r600_blit.vb_ib);
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 99292be8bc99..ff9e4171559a 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -402,6 +402,10 @@ struct radeon_ib {
 	uint32_t		length_dw;
 };
 
+/*
+ * locking -
+ * mutex protects scheduled_ibs, ready, alloc_bm
+ */
 struct radeon_ib_pool {
 	struct mutex		mutex;
 	struct radeon_object	*robj;
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 168a555d6fba..747b4bffb84b 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -56,10 +56,12 @@ int radeon_ib_get(struct radeon_device *rdev, struct radeon_ib **ib)
 		set_bit(i, rdev->ib_pool.alloc_bm);
 		rdev->ib_pool.ibs[i].length_dw = 0;
 		*ib = &rdev->ib_pool.ibs[i];
+		mutex_unlock(&rdev->ib_pool.mutex);
 		goto out;
 	}
 	if (list_empty(&rdev->ib_pool.scheduled_ibs)) {
 		/* we go do nothings here */
+		mutex_unlock(&rdev->ib_pool.mutex);
 		DRM_ERROR("all IB allocated none scheduled.\n");
 		r = -EINVAL;
 		goto out;
@@ -69,10 +71,13 @@ int radeon_ib_get(struct radeon_device *rdev, struct radeon_ib **ib)
 			 struct radeon_ib, list);
 	if (nib->fence == NULL) {
 		/* we go do nothings here */
+		mutex_unlock(&rdev->ib_pool.mutex);
 		DRM_ERROR("IB %lu scheduled without a fence.\n", nib->idx);
 		r = -EINVAL;
 		goto out;
 	}
+	mutex_unlock(&rdev->ib_pool.mutex);
+
 	r = radeon_fence_wait(nib->fence, false);
 	if (r) {
 		DRM_ERROR("radeon: IB(%lu:0x%016lX:%u)\n", nib->idx,
@@ -81,12 +86,17 @@ int radeon_ib_get(struct radeon_device *rdev, struct radeon_ib **ib)
 		goto out;
 	}
 	radeon_fence_unref(&nib->fence);
+
 	nib->length_dw = 0;
+
+	/* scheduled list is accessed here */
+	mutex_lock(&rdev->ib_pool.mutex);
 	list_del(&nib->list);
 	INIT_LIST_HEAD(&nib->list);
+	mutex_unlock(&rdev->ib_pool.mutex);
+
 	*ib = nib;
 out:
-	mutex_unlock(&rdev->ib_pool.mutex);
 	if (r) {
 		radeon_fence_unref(&fence);
 	} else {
@@ -110,9 +120,10 @@ void radeon_ib_free(struct radeon_device *rdev, struct radeon_ib **ib)
 		return;
 	}
 	list_del(&tmp->list);
-	if (tmp->fence) {
+	INIT_LIST_HEAD(&tmp->list);
+	if (tmp->fence)
 		radeon_fence_unref(&tmp->fence);
-	}
+
 	tmp->length_dw = 0;
 	clear_bit(tmp->idx, rdev->ib_pool.alloc_bm);
 	mutex_unlock(&rdev->ib_pool.mutex);
@@ -122,25 +133,24 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib)
 {
 	int r = 0;
 
-	mutex_lock(&rdev->ib_pool.mutex);
 	if (!ib->length_dw || !rdev->cp.ready) {
 		/* TODO: Nothings in the ib we should report. */
-		mutex_unlock(&rdev->ib_pool.mutex);
 		DRM_ERROR("radeon: couldn't schedule IB(%lu).\n", ib->idx);
 		return -EINVAL;
 	}
+
 	/* 64 dwords should be enough for fence too */
 	r = radeon_ring_lock(rdev, 64);
 	if (r) {
 		DRM_ERROR("radeon: scheduling IB failled (%d).\n", r);
-		mutex_unlock(&rdev->ib_pool.mutex);
 		return r;
 	}
 	radeon_ring_ib_execute(rdev, ib);
 	radeon_fence_emit(rdev, ib->fence);
-	radeon_ring_unlock_commit(rdev);
+	mutex_lock(&rdev->ib_pool.mutex);
 	list_add_tail(&ib->list, &rdev->ib_pool.scheduled_ibs);
 	mutex_unlock(&rdev->ib_pool.mutex);
+	radeon_ring_unlock_commit(rdev);
 	return 0;
 }