Most drivers have refcounting done in gem, so lets get rid of another 
refcounting layer. ;)
It has been confusing to keep track of 2 refcounts, so lets just let the driver 
worry about
refcounting, and keep it hidden from ttm entirely. The core doesn't need to 
know about the
refcounting anywhere.

Vmwgfx has 1 bo that doesn't use vmw_dma_buffer, but instead ttm_bo_create. 
Converting this call
makes every bo use vmw_dma_buffer as base, which means I can simply add 
refcount to vmw_dma_buffer.

Mostly meant as a RFC, so I only took effort into converting vmwgfx, radeon, 
nouveau. Thoughts?

I've only done some very basic smoke testing btw, I know nouveau and radeon 
boot. No idea about vmwgfx.
---
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index af0b868a9dfd..9fcf38a7923a 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -449,26 +449,13 @@ int ast_dumb_create(struct drm_file *file,
        return 0;
 }

-void ast_bo_unref(struct ast_bo **bo)
-{
-       struct ttm_buffer_object *tbo;
-
-       if ((*bo) == NULL)
-               return;
-
-       tbo = &((*bo)->bo);
-       ttm_bo_unref(&tbo);
-       if (tbo == NULL)
-               *bo = NULL;
-
-}
 void ast_gem_free_object(struct drm_gem_object *obj)
 {
        struct ast_bo *ast_bo = gem_to_ast_bo(obj);

        if (!ast_bo)
                return;
-       ast_bo_unref(&ast_bo);
+       ttm_bo_release(&ast_bo->bo);
 }


diff --git a/drivers/gpu/drm/cirrus/cirrus_main.c 
b/drivers/gpu/drm/cirrus/cirrus_main.c
index 78e76f24343d..f4d3fd5be1e7 100644
--- a/drivers/gpu/drm/cirrus/cirrus_main.c
+++ b/drivers/gpu/drm/cirrus/cirrus_main.c
@@ -255,27 +255,13 @@ int cirrus_dumb_create(struct drm_file *file,
        return 0;
 }

-void cirrus_bo_unref(struct cirrus_bo **bo)
-{
-       struct ttm_buffer_object *tbo;
-
-       if ((*bo) == NULL)
-               return;
-
-       tbo = &((*bo)->bo);
-       ttm_bo_unref(&tbo);
-       if (tbo == NULL)
-               *bo = NULL;
-
-}
-
 void cirrus_gem_free_object(struct drm_gem_object *obj)
 {
        struct cirrus_bo *cirrus_bo = gem_to_cirrus_bo(obj);

        if (!cirrus_bo)
                return;
-       cirrus_bo_unref(&cirrus_bo);
+       ttm_bo_release(&cirrus_bo->bo);
 }


diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 4761adedad2a..511b4e97a093 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -848,9 +848,14 @@ int drm_gem_mmap(struct file *filp, struct vm_area_struct 
*vma)
        if (!node) {
                mutex_unlock(&dev->struct_mutex);
                return drm_mmap(filp, vma);
-       } else if (!drm_vma_node_is_allowed(node, filp)) {
-               mutex_unlock(&dev->struct_mutex);
-               return -EACCES;
+       } else {
+               read_lock(&node->vm_lock);
+               ret = drm_vma_node_verify_access(node, filp);
+               read_unlock(&node->vm_lock);
+               if (ret) {
+                       mutex_unlock(&dev->struct_mutex);
+                       return ret;
+               }
        }

        obj = container_of(node, struct drm_gem_object, vma_node);
diff --git a/drivers/gpu/drm/drm_vma_manager.c 
b/drivers/gpu/drm/drm_vma_manager.c
index 63b471205072..482b9c996217 100644
--- a/drivers/gpu/drm/drm_vma_manager.c
+++ b/drivers/gpu/drm/drm_vma_manager.c
@@ -405,7 +405,7 @@ EXPORT_SYMBOL(drm_vma_node_revoke);
  * Search the list in @node whether @filp is currently on the list of allowed
  * open-files (see drm_vma_node_allow()).
  *
- * This is locked against concurrent access internally.
+ * This call requires the vm_lock to be held.
  *
  * RETURNS:
  * true iff @filp is on the list
@@ -416,8 +416,6 @@ bool drm_vma_node_is_allowed(struct drm_vma_offset_node 
*node,
        struct drm_vma_offset_file *entry;
        struct rb_node *iter;

-       read_lock(&node->vm_lock);
-
        iter = node->vm_files.rb_node;
        while (likely(iter)) {
                entry = rb_entry(iter, struct drm_vma_offset_file, vm_rb);
@@ -429,8 +427,6 @@ bool drm_vma_node_is_allowed(struct drm_vma_offset_node 
*node,
                        iter = iter->rb_left;
        }

-       read_unlock(&node->vm_lock);
-
        return iter;
 }
 EXPORT_SYMBOL(drm_vma_node_is_allowed);
diff --git a/drivers/gpu/drm/mgag200/mgag200_main.c 
b/drivers/gpu/drm/mgag200/mgag200_main.c
index b1120cb1db6d..ca8367505742 100644
--- a/drivers/gpu/drm/mgag200/mgag200_main.c
+++ b/drivers/gpu/drm/mgag200/mgag200_main.c
@@ -310,27 +310,13 @@ int mgag200_dumb_create(struct drm_file *file,
        return 0;
 }

-void mgag200_bo_unref(struct mgag200_bo **bo)
-{
-       struct ttm_buffer_object *tbo;
-
-       if ((*bo) == NULL)
-               return;
-
-       tbo = &((*bo)->bo);
-       ttm_bo_unref(&tbo);
-       if (tbo == NULL)
-               *bo = NULL;
-
-}
-
 void mgag200_gem_free_object(struct drm_gem_object *obj)
 {
        struct mgag200_bo *mgag200_bo = gem_to_mga_bo(obj);

        if (!mgag200_bo)
                return;
-       mgag200_bo_unref(&mgag200_bo);
+       ttm_bo_release(&mgag200_bo->bo);
 }


diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c 
b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 29cc32f976f8..1ba8b90db8b5 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -146,8 +146,6 @@ nouveau_bo_del_ttm(struct ttm_buffer_object *bo)
        struct drm_device *dev = drm->dev;
        struct nouveau_bo *nvbo = nouveau_bo(bo);

-       if (unlikely(nvbo->gem.filp))
-               DRM_ERROR("bo %p still attached to GEM object\n", bo);
        WARN_ON(nvbo->pin_refcnt > 0);
        nv10_bo_put_tile_region(dev, nvbo->tile, NULL);
        kfree(nvbo);
@@ -246,6 +244,7 @@ nouveau_bo_new(struct drm_device *dev, int size, int align,
                /* ttm will call nouveau_bo_del_ttm if it fails.. */
                return ret;
        }
+       drm_gem_private_object_init(dev, &nvbo->gem, size);

        *pnvbo = nvbo;
        return 0;
@@ -1249,14 +1248,6 @@ out:
 }

 static int
-nouveau_bo_verify_access(struct ttm_buffer_object *bo, struct file *filp)
-{
-       struct nouveau_bo *nvbo = nouveau_bo(bo);
-
-       return drm_vma_node_verify_access(&nvbo->gem.vma_node, filp);
-}
-
-static int
 nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *mem)
 {
        struct ttm_mem_type_manager *man = &bdev->man[mem->mem_type];
@@ -1513,7 +1504,6 @@ struct ttm_bo_driver nouveau_bo_driver = {
        .evict_flags = nouveau_bo_evict_flags,
        .move_notify = nouveau_bo_move_ntfy,
        .move = nouveau_bo_move,
-       .verify_access = nouveau_bo_verify_access,
        .sync_obj_signaled = nouveau_bo_fence_signalled,
        .sync_obj_wait = nouveau_bo_fence_wait,
        .sync_obj_flush = nouveau_bo_fence_flush,
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.h 
b/drivers/gpu/drm/nouveau/nouveau_bo.h
index ff17c1f432fc..abbd8b83351f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.h
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.h
@@ -51,14 +51,15 @@ nouveau_bo_ref(struct nouveau_bo *ref, struct nouveau_bo 
**pnvbo)

        if (!pnvbo)
                return -EINVAL;
-       prev = *pnvbo;
-
-       *pnvbo = ref ? nouveau_bo(ttm_bo_reference(&ref->bo)) : NULL;
-       if (prev) {
-               struct ttm_buffer_object *bo = &prev->bo;

-               ttm_bo_unref(&bo);
+       prev = *pnvbo;
+       if (ref != prev) {
+               if (ref)
+                       drm_gem_object_reference(&ref->gem);
+               if (prev)
+                       drm_gem_object_unreference_unlocked(&prev->gem);
        }
+       *pnvbo = ref;

        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c 
b/drivers/gpu/drm/nouveau/nouveau_gem.c
index 091753f29554..2c4aecbd8544 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -38,7 +38,6 @@ void
 nouveau_gem_object_del(struct drm_gem_object *gem)
 {
        struct nouveau_bo *nvbo = nouveau_gem_object(gem);
-       struct ttm_buffer_object *bo = &nvbo->bo;

        if (gem->import_attach)
                drm_prime_gem_destroy(gem, nvbo->bo.sg);
@@ -47,7 +46,7 @@ nouveau_gem_object_del(struct drm_gem_object *gem)

        /* reset filp so nouveau_bo_del_ttm() can test for it */
        gem->filp = NULL;
-       ttm_bo_unref(&bo);
+       ttm_bo_release(&nvbo->bo);
 }

 int
diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c 
b/drivers/gpu/drm/nouveau/nouveau_ttm.c
index 19e3757291fb..48c9277d41da 100644
--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
@@ -277,16 +277,58 @@ const struct ttm_mem_type_manager_func nv04_gart_manager 
= {
        nv04_gart_manager_debug
 };

+static void nouveau_bo_vm_open(struct vm_area_struct *vma)
+{
+       struct nouveau_bo *bo = nouveau_bo(vma->vm_private_data);
+
+       drm_gem_object_reference(&bo->gem);
+}
+
+static void nouveau_bo_vm_close(struct vm_area_struct *vma)
+{
+       struct nouveau_bo *bo = nouveau_bo(vma->vm_private_data);
+
+       drm_gem_object_unreference_unlocked(&bo->gem);
+       vma->vm_private_data = NULL;
+}
+
+static const struct vm_operations_struct nouveau_bo_vm_ops = {
+       .fault = ttm_bo_vm_fault,
+       .open = nouveau_bo_vm_open,
+       .close = nouveau_bo_vm_close
+};
+
 int
 nouveau_ttm_mmap(struct file *filp, struct vm_area_struct *vma)
 {
        struct drm_file *file_priv = filp->private_data;
        struct nouveau_drm *drm = nouveau_drm(file_priv->minor->dev);
+       struct drm_vma_offset_node *node;
+       struct nouveau_bo *bo;
+       int ret;

        if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET))
                return drm_mmap(filp, vma);

-       return ttm_bo_mmap(filp, vma, &drm->ttm.bdev);
+       drm_vma_offset_lock_lookup(&drm->ttm.bdev.vma_manager);
+       node = drm_vma_offset_lookup_locked(&drm->ttm.bdev.vma_manager,
+                                           vma->vm_pgoff, vma_pages(vma));
+       if (node) {
+               bo = container_of(node, struct nouveau_bo, bo.vma_node);
+               ret = drm_vma_node_verify_access(&nvbo->gem.vma_node, filp);
+
+               if (!ret && !kref_get_unless_zero(&bo->gem.refcount))
+                       ret = -EINVAL;
+       } else
+               ret = -EINVAL;
+       drm_vma_offset_unlock_lookup(&drm->ttm.bdev.vma_manager);
+
+       if (!ret) {
+               vma->vm_private_data = &bo->bo;
+               vma->vm_flags |= VM_IO | VM_MIXEDMAP | VM_DONTEXPAND | 
VM_DONTDUMP;
+               vma->vm_ops = &nouveau_bo_vm_ops;
+       }
+       return ret;
 }

 static int
diff --git a/drivers/gpu/drm/qxl/qxl_gem.c b/drivers/gpu/drm/qxl/qxl_gem.c
index b96f0c9d89b2..48c39dc04931 100644
--- a/drivers/gpu/drm/qxl/qxl_gem.c
+++ b/drivers/gpu/drm/qxl/qxl_gem.c
@@ -33,7 +33,7 @@ void qxl_gem_object_free(struct drm_gem_object *gobj)
        struct qxl_bo *qobj = gem_to_qxl_bo(gobj);

        if (qobj)
-               qxl_bo_unref(&qobj);
+               ttm_bo_release(&qobj->tbo);
 }

 int qxl_gem_object_create(struct qxl_device *qdev, int size,
diff --git a/drivers/gpu/drm/qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c
index 8691c76c5ef0..d644a7c7384a 100644
--- a/drivers/gpu/drm/qxl/qxl_object.c
+++ b/drivers/gpu/drm/qxl/qxl_object.c
@@ -209,19 +209,14 @@ void qxl_bo_kunmap_atomic_page(struct qxl_device *qdev,

 void qxl_bo_unref(struct qxl_bo **bo)
 {
-       struct ttm_buffer_object *tbo;
-
-       if ((*bo) == NULL)
-               return;
-       tbo = &((*bo)->tbo);
-       ttm_bo_unref(&tbo);
-       if (tbo == NULL)
-               *bo = NULL;
+       if (*bo)
+               drm_gem_object_unreference_unlocked(&(*bo)->gem_base);
+       *bo = NULL;
 }

 struct qxl_bo *qxl_bo_ref(struct qxl_bo *bo)
 {
-       ttm_bo_reference(&bo->tbo);
+       drm_gem_object_reference(&bo->gem_base);
        return bo;
 }

diff --git a/drivers/gpu/drm/radeon/radeon_gem.c 
b/drivers/gpu/drm/radeon/radeon_gem.c
index 805c5e566b9a..79d95c76ead6 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -34,9 +34,13 @@ void radeon_gem_object_free(struct drm_gem_object *gobj)
        struct radeon_bo *robj = gem_to_radeon_bo(gobj);

        if (robj) {
+               struct radeon_device *rdev = robj->rdev;
                if (robj->gem_base.import_attach)
                        drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg);
-               radeon_bo_unref(&robj);
+
+               down_read(&rdev->pm.mclk_lock);
+               ttm_bo_release(&robj->tbo);
+               up_read(&rdev->pm.mclk_lock);
        }
 }

diff --git a/drivers/gpu/drm/radeon/radeon_object.c 
b/drivers/gpu/drm/radeon/radeon_object.c
index a3b92bfbe81b..d31b522b8b90 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -196,18 +196,10 @@ void radeon_bo_kunmap(struct radeon_bo *bo)

 void radeon_bo_unref(struct radeon_bo **bo)
 {
-       struct ttm_buffer_object *tbo;
-       struct radeon_device *rdev;
-
        if ((*bo) == NULL)
                return;
-       rdev = (*bo)->rdev;
-       tbo = &((*bo)->tbo);
-       down_read(&rdev->pm.mclk_lock);
-       ttm_bo_unref(&tbo);
-       up_read(&rdev->pm.mclk_lock);
-       if (tbo == NULL)
-               *bo = NULL;
+       drm_gem_object_unreference_unlocked(&(*bo)->gem_base);
+       *bo = NULL;
 }

 int radeon_bo_pin_restricted(struct radeon_bo *bo, u32 domain, u64 max_offset,
@@ -386,12 +378,6 @@ int radeon_bo_list_validate(struct ww_acquire_ctx *ticket,
        return 0;
 }

-int radeon_bo_fbdev_mmap(struct radeon_bo *bo,
-                            struct vm_area_struct *vma)
-{
-       return ttm_fbdev_mmap(vma, &bo->tbo);
-}
-
 int radeon_bo_get_surface_reg(struct radeon_bo *bo)
 {
        struct radeon_device *rdev = bo->rdev;
diff --git a/drivers/gpu/drm/radeon/radeon_object.h 
b/drivers/gpu/drm/radeon/radeon_object.h
index 209b11150263..9685c6e1637b 100644
--- a/drivers/gpu/drm/radeon/radeon_object.h
+++ b/drivers/gpu/drm/radeon/radeon_object.h
@@ -142,8 +142,6 @@ extern void radeon_bo_list_add_object(struct radeon_bo_list 
*lobj,
                                struct list_head *head);
 extern int radeon_bo_list_validate(struct ww_acquire_ctx *ticket,
                                   struct list_head *head, int ring);
-extern int radeon_bo_fbdev_mmap(struct radeon_bo *bo,
-                               struct vm_area_struct *vma);
 extern int radeon_bo_set_tiling_flags(struct radeon_bo *bo,
                                u32 tiling_flags, u32 pitch);
 extern void radeon_bo_get_tiling_flags(struct radeon_bo *bo,
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c 
b/drivers/gpu/drm/radeon/radeon_ttm.c
index 71245d6f34a2..eb1a697a7349 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -201,13 +201,6 @@ static void radeon_evict_flags(struct ttm_buffer_object 
*bo,
        *placement = rbo->placement;
 }

-static int radeon_verify_access(struct ttm_buffer_object *bo, struct file 
*filp)
-{
-       struct radeon_bo *rbo = container_of(bo, struct radeon_bo, tbo);
-
-       return drm_vma_node_verify_access(&rbo->gem_base.vma_node, filp);
-}
-
 static void radeon_move_null(struct ttm_buffer_object *bo,
                             struct ttm_mem_reg *new_mem)
 {
@@ -676,7 +669,6 @@ static struct ttm_bo_driver radeon_bo_driver = {
        .init_mem_type = &radeon_init_mem_type,
        .evict_flags = &radeon_evict_flags,
        .move = &radeon_bo_move,
-       .verify_access = &radeon_verify_access,
        .sync_obj_signaled = &radeon_sync_obj_signaled,
        .sync_obj_wait = &radeon_sync_obj_wait,
        .sync_obj_flush = &radeon_sync_obj_flush,
@@ -784,52 +776,77 @@ void radeon_ttm_set_active_vram_size(struct radeon_device 
*rdev, u64 size)
        man->size = size >> PAGE_SHIFT;
 }

-static struct vm_operations_struct radeon_ttm_vm_ops;
-static const struct vm_operations_struct *ttm_vm_ops = NULL;
-
 static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
-       struct ttm_buffer_object *bo;
-       struct radeon_device *rdev;
+       struct ttm_buffer_object *bo = (struct ttm_buffer_object 
*)vma->vm_private_data;
+       struct radeon_device *rdev = radeon_get_rdev(bo->bdev);
        int r;

-       bo = (struct ttm_buffer_object *)vma->vm_private_data;  
-       if (bo == NULL) {
-               return VM_FAULT_NOPAGE;
-       }
-       rdev = radeon_get_rdev(bo->bdev);
        down_read(&rdev->pm.mclk_lock);
-       r = ttm_vm_ops->fault(vma, vmf);
+       r = ttm_bo_vm_fault(vma, vmf);
        up_read(&rdev->pm.mclk_lock);
        return r;
 }

+static void radeon_bo_vm_open(struct vm_area_struct *vma)
+{
+       struct radeon_bo *bo = container_of(vma->vm_private_data,
+                                           struct radeon_bo, tbo);
+
+       drm_gem_object_reference(&bo->gem_base);
+}
+
+static void radeon_bo_vm_close(struct vm_area_struct *vma)
+{
+       struct radeon_bo *bo = container_of(vma->vm_private_data,
+                                           struct radeon_bo, tbo);
+
+       drm_gem_object_unreference_unlocked(&bo->gem_base);
+       vma->vm_private_data = NULL;
+}
+
+static const struct vm_operations_struct radeon_ttm_vm_ops = {
+       .fault = radeon_ttm_fault,
+       .open = radeon_bo_vm_open,
+       .close = radeon_bo_vm_close
+};
+
 int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
 {
-       struct drm_file *file_priv;
+       struct drm_file *file_priv = filp->private_data;
        struct radeon_device *rdev;
-       int r;
+       struct drm_vma_offset_node *node;
+       struct radeon_bo *bo;
+       int ret;

        if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
                return drm_mmap(filp, vma);
        }

-       file_priv = filp->private_data;
        rdev = file_priv->minor->dev->dev_private;
        if (rdev == NULL) {
                return -EINVAL;
        }
-       r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
-       if (unlikely(r != 0)) {
-               return r;
-       }
-       if (unlikely(ttm_vm_ops == NULL)) {
-               ttm_vm_ops = vma->vm_ops;
-               radeon_ttm_vm_ops = *ttm_vm_ops;
-               radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
+
+       drm_vma_offset_lock_lookup(&rdev->mman.bdev.vma_manager);
+       node = drm_vma_offset_lookup_locked(&rdev->mman.bdev.vma_manager,
+                                           vma->vm_pgoff, vma_pages(vma));
+       if (node) {
+               bo = container_of(node, struct radeon_bo, tbo.vma_node);
+               ret = drm_vma_node_verify_access(&bo->gem_base.vma_node, filp);
+
+               if (!ret && !kref_get_unless_zero(&bo->gem_base.refcount))
+                       ret = -EINVAL;
+       } else
+               ret = -EINVAL;
+       drm_vma_offset_unlock_lookup(&rdev->mman.bdev.vma_manager);
+
+       if (!ret) {
+               vma->vm_private_data = &bo->tbo;
+               vma->vm_flags |= VM_IO | VM_MIXEDMAP | VM_DONTEXPAND | 
VM_DONTDUMP;
+               vma->vm_ops = &radeon_ttm_vm_ops;
        }
-       vma->vm_ops = &radeon_ttm_vm_ops;
-       return 0;
+       return ret;
 }


diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 8d5a646ebe6a..d5ba8c56c131 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -139,7 +139,6 @@ static void ttm_bo_release_list(struct kref *list_kref)
        size_t acc_size = bo->acc_size;

        BUG_ON(atomic_read(&bo->list_kref.refcount));
-       BUG_ON(atomic_read(&bo->kref.refcount));
        BUG_ON(atomic_read(&bo->cpu_writers));
        BUG_ON(bo->sync_obj != NULL);
        BUG_ON(bo->mem.mm_node != NULL);
@@ -619,10 +618,8 @@ static void ttm_bo_delayed_workqueue(struct work_struct 
*work)
        }
 }

-static void ttm_bo_release(struct kref *kref)
+void ttm_bo_release(struct ttm_buffer_object *bo)
 {
-       struct ttm_buffer_object *bo =
-           container_of(kref, struct ttm_buffer_object, kref);
        struct ttm_bo_device *bdev = bo->bdev;
        struct ttm_mem_type_manager *man = &bdev->man[bo->mem.mem_type];

@@ -633,15 +630,7 @@ static void ttm_bo_release(struct kref *kref)
        ttm_bo_cleanup_refs_or_queue(bo);
        kref_put(&bo->list_kref, ttm_bo_release_list);
 }
-
-void ttm_bo_unref(struct ttm_buffer_object **p_bo)
-{
-       struct ttm_buffer_object *bo = *p_bo;
-
-       *p_bo = NULL;
-       kref_put(&bo->kref, ttm_bo_release);
-}
-EXPORT_SYMBOL(ttm_bo_unref);
+EXPORT_SYMBOL(ttm_bo_release);

 int ttm_bo_lock_delayed_workqueue(struct ttm_bo_device *bdev)
 {
@@ -1116,7 +1105,6 @@ int ttm_bo_init(struct ttm_bo_device *bdev,
        }
        bo->destroy = destroy;

-       kref_init(&bo->kref);
        kref_init(&bo->list_kref);
        atomic_set(&bo->cpu_writers, 0);
        INIT_LIST_HEAD(&bo->lru);
@@ -1165,7 +1153,7 @@ int ttm_bo_init(struct ttm_bo_device *bdev,
        ttm_bo_unreserve(bo);

        if (unlikely(ret))
-               ttm_bo_unref(&bo);
+               ttm_bo_release(bo);

        return ret;
 }
@@ -1200,34 +1188,6 @@ size_t ttm_bo_dma_acc_size(struct ttm_bo_device *bdev,
 }
 EXPORT_SYMBOL(ttm_bo_dma_acc_size);

-int ttm_bo_create(struct ttm_bo_device *bdev,
-                       unsigned long size,
-                       enum ttm_bo_type type,
-                       struct ttm_placement *placement,
-                       uint32_t page_alignment,
-                       bool interruptible,
-                       struct file *persistent_swap_storage,
-                       struct ttm_buffer_object **p_bo)
-{
-       struct ttm_buffer_object *bo;
-       size_t acc_size;
-       int ret;
-
-       bo = kzalloc(sizeof(*bo), GFP_KERNEL);
-       if (unlikely(bo == NULL))
-               return -ENOMEM;
-
-       acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct 
ttm_buffer_object));
-       ret = ttm_bo_init(bdev, bo, size, type, placement, page_alignment,
-                         interruptible, persistent_swap_storage, acc_size,
-                         NULL, NULL);
-       if (likely(ret == 0))
-               *p_bo = bo;
-
-       return ret;
-}
-EXPORT_SYMBOL(ttm_bo_create);
-
 static int ttm_bo_force_list_clean(struct ttm_bo_device *bdev,
                                        unsigned mem_type, bool allow_errors)
 {
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c 
b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 4834c463c38b..9a39373676d5 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -469,7 +469,6 @@ static int ttm_buffer_object_transfer(struct 
ttm_buffer_object *bo,
                fbo->sync_obj = NULL;
        spin_unlock(&bdev->fence_lock);
        kref_init(&fbo->list_kref);
-       kref_init(&fbo->kref);
        fbo->destroy = &ttm_transfered_destroy;
        fbo->acc_size = 0;
        fbo->resv = &fbo->ttm_resv;
@@ -704,7 +703,7 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
                        bo->ttm = NULL;

                ttm_bo_unreserve(ghost_obj);
-               ttm_bo_unref(&ghost_obj);
+               ttm_bo_release(ghost_obj);
        }

        *old_mem = *new_mem;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index c87d686ff8cf..acb7c1348154 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -86,7 +86,7 @@ out_unlock:
        return ret;
 }

-static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
        struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
            vma->vm_private_data;
@@ -232,97 +232,4 @@ out_unlock:
        ttm_bo_unreserve(bo);
        return retval;
 }
-
-static void ttm_bo_vm_open(struct vm_area_struct *vma)
-{
-       struct ttm_buffer_object *bo =
-           (struct ttm_buffer_object *)vma->vm_private_data;
-
-       (void)ttm_bo_reference(bo);
-}
-
-static void ttm_bo_vm_close(struct vm_area_struct *vma)
-{
-       struct ttm_buffer_object *bo = (struct ttm_buffer_object 
*)vma->vm_private_data;
-
-       ttm_bo_unref(&bo);
-       vma->vm_private_data = NULL;
-}
-
-static const struct vm_operations_struct ttm_bo_vm_ops = {
-       .fault = ttm_bo_vm_fault,
-       .open = ttm_bo_vm_open,
-       .close = ttm_bo_vm_close
-};
-
-static struct ttm_buffer_object *ttm_bo_vm_lookup(struct ttm_bo_device *bdev,
-                                                 unsigned long offset,
-                                                 unsigned long pages)
-{
-       struct drm_vma_offset_node *node;
-       struct ttm_buffer_object *bo = NULL;
-
-       drm_vma_offset_lock_lookup(&bdev->vma_manager);
-
-       node = drm_vma_offset_lookup_locked(&bdev->vma_manager, offset, pages);
-       if (likely(node)) {
-               bo = container_of(node, struct ttm_buffer_object, vma_node);
-               if (!kref_get_unless_zero(&bo->kref))
-                       bo = NULL;
-       }
-
-       drm_vma_offset_unlock_lookup(&bdev->vma_manager);
-
-       if (!bo)
-               pr_err("Could not find buffer object to map\n");
-
-       return bo;
-}
-
-int ttm_bo_mmap(struct file *filp, struct vm_area_struct *vma,
-               struct ttm_bo_device *bdev)
-{
-       struct ttm_bo_driver *driver;
-       struct ttm_buffer_object *bo;
-       int ret;
-
-       bo = ttm_bo_vm_lookup(bdev, vma->vm_pgoff, vma_pages(vma));
-       if (unlikely(!bo))
-               return -EINVAL;
-
-       driver = bo->bdev->driver;
-       if (unlikely(!driver->verify_access)) {
-               ret = -EPERM;
-               goto out_unref;
-       }
-       ret = driver->verify_access(bo, filp);
-       if (unlikely(ret != 0))
-               goto out_unref;
-
-       vma->vm_ops = &ttm_bo_vm_ops;
-
-       /*
-        * Note: We're transferring the bo reference to
-        * vma->vm_private_data here.
-        */
-
-       vma->vm_private_data = bo;
-       vma->vm_flags |= VM_IO | VM_MIXEDMAP | VM_DONTEXPAND | VM_DONTDUMP;
-       return 0;
-out_unref:
-       ttm_bo_unref(&bo);
-       return ret;
-}
-EXPORT_SYMBOL(ttm_bo_mmap);
-
-int ttm_fbdev_mmap(struct vm_area_struct *vma, struct ttm_buffer_object *bo)
-{
-       if (vma->vm_pgoff != 0)
-               return -EACCES;
-
-       vma->vm_ops = &ttm_bo_vm_ops;
-       vma->vm_private_data = ttm_bo_reference(bo);
-       vma->vm_flags |= VM_IO | VM_MIXEDMAP | VM_DONTEXPAND;
-       return 0;
-}
-EXPORT_SYMBOL(ttm_fbdev_mmap);
+EXPORT_SYMBOL(ttm_bo_vm_fault);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
index 7776e6f0aef6..2503c65c274f 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
@@ -593,14 +593,6 @@ void vmw_evict_flags(struct ttm_buffer_object *bo,
        *placement = vmw_sys_placement;
 }

-static int vmw_verify_access(struct ttm_buffer_object *bo, struct file *filp)
-{
-       struct ttm_object_file *tfile =
-               vmw_fpriv((struct drm_file *)filp->private_data)->tfile;
-
-       return vmw_user_dmabuf_verify_access(bo, tfile);
-}
-
 static int vmw_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct 
ttm_mem_reg *mem)
 {
        struct ttm_mem_type_manager *man = &bdev->man[mem->mem_type];
@@ -683,7 +675,6 @@ struct ttm_bo_driver vmw_bo_driver = {
        .init_mem_type = vmw_init_mem_type,
        .evict_flags = vmw_evict_flags,
        .move = NULL,
-       .verify_access = vmw_verify_access,
        .sync_obj_signaled = vmw_sync_obj_signaled,
        .sync_obj_wait = vmw_sync_obj_wait,
        .sync_obj_flush = vmw_sync_obj_flush,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 814665b7a117..65a95b71e5d5 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -299,14 +299,19 @@ static void vmw_dummy_query_bo_prepare(struct vmw_private 
*dev_priv)
  */
 static int vmw_dummy_query_bo_create(struct vmw_private *dev_priv)
 {
-       return ttm_bo_create(&dev_priv->bdev,
-                            PAGE_SIZE,
-                            ttm_bo_type_device,
-                            &vmw_vram_sys_placement,
-                            0, false, NULL,
-                            &dev_priv->dummy_query_bo);
-}
+       struct vmw_dma_buffer *vmw_bo = kzalloc(sizeof(*vmw_bo), GFP_KERNEL);
+       int ret;
+
+       if (!vmw_bo)
+               return -ENOMEM;

+       ret = vmw_dmabuf_init(dev_priv, vmw_bo, PAGE_SIZE,
+                             &vmw_vram_sys_placement, false,
+                             &vmw_dmabuf_bo_free);
+       if (!ret)
+               dev_priv->dummy_query_bo = &vmw_bo->base;
+       return ret;
+}

 static int vmw_request_device(struct vmw_private *dev_priv)
 {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 
b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index e401d5dbcb96..e9fea03b1899 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -67,6 +67,7 @@ struct vmw_fpriv {

 struct vmw_dma_buffer {
        struct ttm_buffer_object base;
+       struct kref refcount;
        struct list_head res_list;
 };

@@ -511,6 +512,7 @@ extern int vmw_surface_check(struct vmw_private *dev_priv,
                             uint32_t handle, int *id);
 extern int vmw_surface_validate(struct vmw_private *dev_priv,
                                struct vmw_surface *srf);
+extern void vmw_dmabuf_bo_release(struct kref *refcount);
 extern void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo);
 extern int vmw_dmabuf_init(struct vmw_private *dev_priv,
                           struct vmw_dma_buffer *vmw_bo,
@@ -842,18 +844,34 @@ static inline void vmw_dmabuf_unreference(struct 
vmw_dma_buffer **buf)
        struct vmw_dma_buffer *tmp_buf = *buf;

        *buf = NULL;
-       if (tmp_buf != NULL) {
-               struct ttm_buffer_object *bo = &tmp_buf->base;
-
-               ttm_bo_unref(&bo);
-       }
+       if (tmp_buf != NULL)
+               kref_put(&tmp_buf->refcount, &vmw_dmabuf_bo_release);
 }

 static inline struct vmw_dma_buffer *vmw_dmabuf_reference(struct 
vmw_dma_buffer *buf)
 {
-       if (ttm_bo_reference(&buf->base))
-               return buf;
-       return NULL;
+       kref_get(&buf->refcount);
+       return buf;
+}
+
+static inline void ttm_bo_unref(struct ttm_buffer_object **bo)
+{
+       struct vmw_dma_buffer *buf;
+
+       if (!*bo)
+               return;
+
+       buf = container_of(*bo, struct vmw_dma_buffer, base);
+       *bo = NULL;
+       kref_put(&buf->refcount, &vmw_dmabuf_bo_release);
+}
+
+static inline struct ttm_buffer_object *ttm_bo_reference(struct 
ttm_buffer_object *bo)
+{
+       struct vmw_dma_buffer *vmw_bo;
+
+       vmw_bo = container_of(bo, struct vmw_dma_buffer, base);
+       return &vmw_dmabuf_reference(vmw_bo)->base;
 }

 static inline struct ttm_mem_global *vmw_mem_glob(struct vmw_private *dev_priv)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index d568432bec22..ecc162b788aa 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -357,6 +357,14 @@ void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo)
        kfree(vmw_bo);
 }

+void vmw_dmabuf_bo_release(struct kref *refcount)
+{
+       struct vmw_dma_buffer *vmw_bo;
+
+       vmw_bo = container_of(refcount, struct vmw_dma_buffer, refcount);;
+       ttm_bo_release(&vmw_bo->base);
+}
+
 int vmw_dmabuf_init(struct vmw_private *dev_priv,
                    struct vmw_dma_buffer *vmw_bo,
                    size_t size, struct ttm_placement *placement,
@@ -373,6 +381,7 @@ int vmw_dmabuf_init(struct vmw_private *dev_priv,
        memset(vmw_bo, 0, sizeof(*vmw_bo));

        INIT_LIST_HEAD(&vmw_bo->res_list);
+       kref_init(&vmw_bo->refcount);

        ret = ttm_bo_init(bdev, &vmw_bo->base, size,
                          ttm_bo_type_device, placement,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c
index 98d6bfb3a997..abba9b341e5a 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c
@@ -28,21 +28,71 @@
 #include <drm/drmP.h>
 #include "vmwgfx_drv.h"

+static void vmw_bo_vm_open(struct vm_area_struct *vma)
+{
+       struct vmw_dma_buffer *vmw_bo;
+
+       vmw_bo = container_of(vma->vm_private_data,
+                             struct vmw_dma_buffer, base);
+
+       vmw_dmabuf_reference(vmw_bo);
+}
+
+static void vmw_bo_vm_close(struct vm_area_struct *vma)
+{
+       struct vmw_dma_buffer *vmw_bo;
+
+       vmw_bo = container_of(vma->vm_private_data,
+                             struct vmw_dma_buffer, base);
+
+       vmw_dmabuf_unreference(&vmw_bo);
+       vma->vm_private_data = NULL;
+}
+
+static const struct vm_operations_struct vmw_ttm_vm_ops = {
+       .fault = ttm_bo_vm_fault,
+       .open = vmw_bo_vm_open,
+       .close = vmw_bo_vm_close
+};
+
 int vmw_mmap(struct file *filp, struct vm_area_struct *vma)
 {
-       struct drm_file *file_priv;
-       struct vmw_private *dev_priv;
+       struct drm_file *file_priv = filp->private_data;
+       struct vmw_private *dev_priv = vmw_priv(file_priv->minor->dev);
+       struct drm_vma_offset_node *node;
+       struct vmw_dma_buffer *vmw_bo;
+       int ret;

        if (unlikely(vma->vm_pgoff < VMWGFX_FILE_PAGE_OFFSET)) {
                DRM_ERROR("Illegal attempt to mmap old fifo space.\n");
                return -EINVAL;
        }

-       file_priv = filp->private_data;
-       dev_priv = vmw_priv(file_priv->minor->dev);
-       return ttm_bo_mmap(filp, vma, &dev_priv->bdev);
-}
+       drm_vma_offset_lock_lookup(&dev_priv->bdev.vma_manager);
+       node = drm_vma_offset_lookup_locked(&dev_priv->bdev.vma_manager,
+                                           vma->vm_pgoff, vma_pages(vma));
+       if (node) {
+               struct ttm_object_file *tfile =
+                       vmw_fpriv((struct drm_file *)filp->private_data)->tfile;
+
+               vmw_bo = container_of(vma->vm_private_data,
+                                     struct vmw_dma_buffer, base.vma_node);
+
+               ret = vmw_user_dmabuf_verify_access(&vmw_bo->base, tfile);

+               if (!ret && !kref_get_unless_zero(&vmw_bo->refcount))
+                       ret = -EINVAL;
+       } else
+               ret = -EINVAL;
+       drm_vma_offset_unlock_lookup(&dev_priv->bdev.vma_manager);
+
+       if (!ret) {
+               vma->vm_private_data = &vmw_bo->base;
+               vma->vm_flags |= VM_IO | VM_MIXEDMAP | VM_DONTEXPAND | 
VM_DONTDUMP;
+               vma->vm_ops = &vmw_ttm_vm_ops;
+       }
+       return ret;
+}
 static int vmw_ttm_mem_global_init(struct drm_global_reference *ref)
 {
        DRM_INFO("global init.\n");
diff --git a/include/drm/drm_vma_manager.h b/include/drm/drm_vma_manager.h
index c18a593d1744..905b052705e6 100644
--- a/include/drm/drm_vma_manager.h
+++ b/include/drm/drm_vma_manager.h
@@ -245,6 +245,8 @@ static inline void drm_vma_node_unmap(struct 
drm_vma_offset_node *node,
  * drm_vma_node_is_allowed() but suitable as drop-in helper for TTM
  * verify_access() callbacks.
  *
+ * This call requires the vm_lock to be held.
+ *
  * RETURNS:
  * 0 if access is granted, -EACCES otherwise.
  */
diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
index 751eaffbf0d5..07725c293a9b 100644
--- a/include/drm/ttm/ttm_bo_api.h
+++ b/include/drm/ttm/ttm_bo_api.h
@@ -197,8 +197,6 @@ struct ttm_buffer_object {
        /**
        * Members not needing protection.
        */
-
-       struct kref kref;
        struct kref list_kref;

        /**
@@ -279,21 +277,6 @@ struct ttm_bo_kmap_obj {
 };

 /**
- * ttm_bo_reference - reference a struct ttm_buffer_object
- *
- * @bo: The buffer object.
- *
- * Returns a refcounted pointer to a buffer object.
- */
-
-static inline struct ttm_buffer_object *
-ttm_bo_reference(struct ttm_buffer_object *bo)
-{
-       kref_get(&bo->kref);
-       return bo;
-}
-
-/**
  * ttm_bo_wait - wait for buffer idle.
  *
  * @bo:  The buffer object.
@@ -331,13 +314,13 @@ extern int ttm_bo_validate(struct ttm_buffer_object *bo,
                                bool no_wait_gpu);

 /**
- * ttm_bo_unref
+ * ttm_bo_release
  *
  * @bo: The buffer object.
  *
- * Unreference and clear a pointer to a buffer object.
+ * Release and destroy a buffer object.
  */
-extern void ttm_bo_unref(struct ttm_buffer_object **bo);
+extern void ttm_bo_release(struct ttm_buffer_object *bo);


 /**
@@ -483,41 +466,6 @@ extern int ttm_bo_init(struct ttm_bo_device *bdev,
                        void (*destroy) (struct ttm_buffer_object *));

 /**
- * ttm_bo_synccpu_object_init
- *
- * @bdev: Pointer to a ttm_bo_device struct.
- * @bo: Pointer to a ttm_buffer_object to be initialized.
- * @size: Requested size of buffer object.
- * @type: Requested type of buffer object.
- * @flags: Initial placement flags.
- * @page_alignment: Data alignment in pages.
- * @interruptible: If needing to sleep while waiting for GPU resources,
- * sleep interruptible.
- * @persistent_swap_storage: Usually the swap storage is deleted for buffers
- * pinned in physical memory. If this behaviour is not desired, this member
- * holds a pointer to a persistent shmem object. Typically, this would
- * point to the shmem object backing a GEM object if TTM is used to back a
- * GEM user interface.
- * @p_bo: On successful completion *p_bo points to the created object.
- *
- * This function allocates a ttm_buffer_object, and then calls ttm_bo_init
- * on that object. The destroy function is set to kfree().
- * Returns
- * -ENOMEM: Out of memory.
- * -EINVAL: Invalid placement flags.
- * -ERESTARTSYS: Interrupted by signal while waiting for resources.
- */
-
-extern int ttm_bo_create(struct ttm_bo_device *bdev,
-                               unsigned long size,
-                               enum ttm_bo_type type,
-                               struct ttm_placement *placement,
-                               uint32_t page_alignment,
-                               bool interruptible,
-                               struct file *persistent_swap_storage,
-                               struct ttm_buffer_object **p_bo);
-
-/**
  * ttm_bo_check_placement
  *
  * @bo:                the buffer object.
@@ -649,57 +597,16 @@ extern int ttm_bo_kmap(struct ttm_buffer_object *bo, 
unsigned long start_page,
 extern void ttm_bo_kunmap(struct ttm_bo_kmap_obj *map);

 /**
- * ttm_fbdev_mmap - mmap fbdev memory backed by a ttm buffer object.
+ * ttm_bo_vm_fault - fault handler for mmap
  *
- * @vma:       vma as input from the fbdev mmap method.
- * @bo:        The bo backing the address space. The address space will
- * have the same size as the bo, and start at offset 0.
- *
- * This function is intended to be called by the fbdev mmap method
- * if the fbdev address space is to be backed by a bo.
- */
-
-extern int ttm_fbdev_mmap(struct vm_area_struct *vma,
-                         struct ttm_buffer_object *bo);
-
-/**
- * ttm_bo_mmap - mmap out of the ttm device address space.
- *
- * @filp:      filp as input from the mmap method.
  * @vma:       vma as input from the mmap method.
- * @bdev:      Pointer to the ttm_bo_device with the address space manager.
+ * @vm_fault:  passed by the mmap fault handler
  *
- * This function is intended to be called by the device mmap method.
- * if the device address space is to be backed by the bo manager.
- */
-
-extern int ttm_bo_mmap(struct file *filp, struct vm_area_struct *vma,
-                      struct ttm_bo_device *bdev);
-
-/**
- * ttm_bo_io
- *
- * @bdev:      Pointer to the struct ttm_bo_device.
- * @filp:      Pointer to the struct file attempting to read / write.
- * @wbuf:      User-space pointer to address of buffer to write. NULL on read.
- * @rbuf:      User-space pointer to address of buffer to read into.
- * Null on write.
- * @count:     Number of bytes to read / write.
- * @f_pos:     Pointer to current file position.
- * @write:     1 for read, 0 for write.
- *
- * This function implements read / write into ttm buffer objects, and is
- * intended to
- * be called from the fops::read and fops::write method.
- * Returns:
- * See man (2) write, man(2) read. In particular,
- * the function may return -ERESTARTSYS if
- * interrupted by a signal.
+ * This function is intended to be called by the mmap fault method.
+ * With vma->vm_private set to the faulting bo
  */

-extern ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
-                        const char __user *wbuf, char __user *rbuf,
-                        size_t count, loff_t *f_pos, bool write);
+int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf);

 extern void ttm_bo_swapout_all(struct ttm_bo_device *bdev);

diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h
index 8639c85d61c4..02581f10ca3e 100644
--- a/include/drm/ttm/ttm_bo_driver.h
+++ b/include/drm/ttm/ttm_bo_driver.h
@@ -401,21 +401,6 @@ struct ttm_bo_driver {
                     struct ttm_mem_reg *new_mem);

        /**
-        * struct ttm_bo_driver_member verify_access
-        *
-        * @bo: Pointer to a buffer object.
-        * @filp: Pointer to a struct file trying to access the object.
-        *
-        * Called from the map / write / read methods to verify that the
-        * caller is permitted to access the buffer object.
-        * This member may be set to NULL, which will refuse this kind of
-        * access for all buffer objects.
-        * This function should return 0 if access is granted, -EPERM otherwise.
-        */
-       int (*verify_access) (struct ttm_buffer_object *bo,
-                             struct file *filp);
-
-       /**
         * In case a driver writer dislikes the TTM fence objects,
         * the driver writer can replace those with sync objects of
         * his / her own. If it turns out that no driver writer is
@@ -875,8 +860,6 @@ static inline int ttm_bo_reserve(struct ttm_buffer_object 
*bo,
 {
        int ret;

-       WARN_ON(!atomic_read(&bo->kref.refcount));
-
        ret = ttm_bo_reserve_nolru(bo, interruptible, no_wait, use_ticket,
                                    ticket);
        if (likely(ret == 0))
@@ -901,8 +884,6 @@ static inline int ttm_bo_reserve_slowpath(struct 
ttm_buffer_object *bo,
 {
        int ret = 0;

-       WARN_ON(!atomic_read(&bo->kref.refcount));
-
        if (interruptible)
                ret = ww_mutex_lock_slow_interruptible(&bo->resv->lock,
                                                       ticket);

Reply via email to