From: Ilia Mirkin <imirkin@alum.mit.edu>
Date: Mon Jun 6 20:30:48 2016 -0400
Subject: [PATCH 2/5]nouveau: more locking - make sure that fence work is always done with the push mutex acquired
Patch-mainline: N/A
References: boo#997171
Signed-off-by: Max Staudt <mstaudt@suse.de>

Cherry-picked from 2733e5483e1c2b80e4b0ae21187ec5e3e1579397
                at https://github.com/imirkin/mesa.git

Signed-off-by: Max Staudt <mstaudt@suse.de>
---
 src/gallium/drivers/nouveau/nouveau_buffer.c     | 4 ++++
 src/gallium/drivers/nouveau/nv50/nv50_miptree.c  | 7 +++++--
 src/gallium/drivers/nouveau/nv50/nv50_query_hw.c | 5 ++++-
 src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c | 5 ++++-
 4 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/src/gallium/drivers/nouveau/nouveau_buffer.c b/src/gallium/drivers/nouveau/nouveau_buffer.c
index b54c19b..a5a06cf 100644
--- a/src/gallium/drivers/nouveau/nouveau_buffer.c
+++ b/src/gallium/drivers/nouveau/nouveau_buffer.c
@@ -80,6 +80,8 @@ release_allocation(struct nouveau_mm_allocation **mm,
 inline void
 nouveau_buffer_release_gpu_storage(struct nv04_resource *buf)
 {
+   if (buf->fence)
+      pipe_mutex_lock(buf->fence->screen->push_mutex);
    if (buf->fence && buf->fence->state < NOUVEAU_FENCE_STATE_FLUSHED) {
       nouveau_fence_work(buf->fence, nouveau_fence_unref_bo, buf->bo);
       buf->bo = NULL;
@@ -89,6 +91,8 @@ nouveau_buffer_release_gpu_storage(struct nv04_resource *buf)

    if (buf->mm)
       release_allocation(&buf->mm, buf->fence);
+   if (buf->fence)
+      pipe_mutex_unlock(buf->fence->screen->push_mutex);

    if (buf->domain == NOUVEAU_BO_VRAM)
       NOUVEAU_DRV_STAT_RES(buf, buf_obj_current_bytes_vid, -(uint64_t)buf->base.width0);
diff --git a/src/gallium/drivers/nouveau/nv50/nv50_miptree.c b/src/gallium/drivers/nouveau/nv50/nv50_miptree.c
index 7450119..38e4faf 100644
--- a/src/gallium/drivers/nouveau/nv50/nv50_miptree.c
+++ b/src/gallium/drivers/nouveau/nv50/nv50_miptree.c
@@ -163,10 +163,13 @@ nv50_miptree_destroy(struct pipe_screen *pscreen, struct pipe_resource *pt)
 {
    struct nv50_miptree *mt = nv50_miptree(pt);

-   if (mt->base.fence && mt->base.fence->state < NOUVEAU_FENCE_STATE_FLUSHED)
+   if (mt->base.fence && mt->base.fence->state < NOUVEAU_FENCE_STATE_FLUSHED) {
+      pipe_mutex_lock(nouveau_screen(pscreen)->push_mutex);
       nouveau_fence_work(mt->base.fence, nouveau_fence_unref_bo, mt->base.bo);
-   else
+      pipe_mutex_unlock(nouveau_screen(pscreen)->push_mutex);
+   } else {
       nouveau_bo_ref(NULL, &mt->base.bo);
+   }

    nouveau_fence_ref(NULL, &mt->base.fence);
    nouveau_fence_ref(NULL, &mt->base.fence_wr);
diff --git a/src/gallium/drivers/nouveau/nv50/nv50_query_hw.c b/src/gallium/drivers/nouveau/nv50/nv50_query_hw.c
index 9067bcc..d2ad72e 100644
--- a/src/gallium/drivers/nouveau/nv50/nv50_query_hw.c
+++ b/src/gallium/drivers/nouveau/nv50/nv50_query_hw.c
@@ -56,9 +56,12 @@ nv50_hw_query_allocate(struct nv50_context *nv50, struct nv50_query *q,
       if (hq->mm) {
          if (hq->state == NV50_HW_QUERY_STATE_READY)
             nouveau_mm_free(hq->mm);
-         else
+         else {
+            pipe_mutex_lock(screen->base.push_mutex);
             nouveau_fence_work(screen->base.fence.current,
                                nouveau_mm_free_work, hq->mm);
+            pipe_mutex_unlock(screen->base.push_mutex);
+         }
       }
    }
    if (size) {
diff --git a/src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c b/src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c
index f2584cb..4b51a67 100644
--- a/src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c
+++ b/src/gallium/drivers/nouveau/nvc0/nvc0_query_hw.c
@@ -48,9 +48,12 @@ nvc0_hw_query_allocate(struct nvc0_context *nvc0, struct nvc0_query *q,
       if (hq->mm) {
          if (hq->state == NVC0_HW_QUERY_STATE_READY)
             nouveau_mm_free(hq->mm);
-         else
+         else {
+            pipe_mutex_lock(screen->base.push_mutex);
             nouveau_fence_work(screen->base.fence.current,
                                nouveau_mm_free_work, hq->mm);
+            pipe_mutex_unlock(screen->base.push_mutex);
+         }
       }
    }
    if (size) {
