Changeset 58cbb0c8 in mainline

Timestamp:

2011-09-01T22:19:21Z (13 years ago)

Author:

Jiri Svoboda <jiri@…>

Branches:

lfn, master, serial, ticket/834-toolchain-update, topic/msim-upgrade, topic/simplify-dev-export

Children:

aff587f

Parents:

5f6e25e

Message:

Reference counting of device and function nodes in devman.

Location:

uspace/srv/devman

Files:

• devman.c (modified) (42 diffs)
• devman.h (modified) (5 diffs)
• main.c (modified) (43 diffs)

uspace/srv/devman/devman.c

@@ -30 +30 @@
  * @{
  */
+/** @file Device Manager
+ *
+ * Locking order:
+ *   (1) driver_t.driver_mutex
+ *   (2) dev_tree_t.rwlock
+ *
+ * Synchronization:
+ *    - device_tree.rwlock protects:
+ *        - tree root, complete tree topology
+ *        - complete contents of device and function nodes
+ *    - dev_node_t.refcnt, fun_node_t.refcnt prevent nodes from
+ *      being deallocated
+ *    - find_xxx() functions increase reference count of returned object
+ *    - find_xxx_no_lock() do not increase reference count
+ *
+ * TODO
+ *    - Track all steady and transient device/function states
+ *    - Check states, wait for steady state on certain operations
+ */
 
 #include <errno.h>
@@ -43 +62 @@
 #include "devman.h"
 
-fun_node_t *find_node_child(fun_node_t *parent, const char *name);
+static fun_node_t *find_node_child(dev_tree_t *, fun_node_t *, const char *);
 
 /* hash table operations */
@@ -406 +425 @@
         }
         
+        fun_add_ref(fun);
         insert_fun_node(tree, fun, str_dup(""), NULL);
+        
         match_id_t *id = create_match_id();
         id->id = str_dup("root");
@@ -422 +443 @@
         }
         
+        dev_add_ref(dev);
         insert_dev_node(tree, dev, fun);
         
@@ -467 +489 @@
 /** Assign a driver to a device.
  *
+ * @param tree          Device tree
  * @param node          The device's node in the device tree.
  * @param drv           The driver.
  */
-void attach_driver(dev_node_t *dev, driver_t *drv)
+void attach_driver(dev_tree_t *tree, dev_node_t *dev, driver_t *drv)
 {
         log_msg(LVL_DEBUG, "attach_driver(dev=\"%s\",drv=\"%s\")",
@@ -476 +499 @@
         
         fibril_mutex_lock(&drv->driver_mutex);
+        fibril_rwlock_write_lock(&tree->rwlock);
         
         dev->drv = drv;
         list_append(&dev->driver_devices, &drv->devices);
         
+        fibril_rwlock_write_unlock(&tree->rwlock);
         fibril_mutex_unlock(&drv->driver_mutex);
 }
@@ -485 +510 @@
 /** Detach driver from device.
  *
+ * @param tree          Device tree
  * @param node          The device's node in the device tree.
  * @param drv           The driver.
  */
-void detach_driver(dev_node_t *dev)
-{
-        /* XXX need lock on dev */
+void detach_driver(dev_tree_t *tree, dev_node_t *dev)
+{
         driver_t *drv = dev->drv;
         
         assert(drv != NULL);
+        
         log_msg(LVL_DEBUG, "detach_driver(dev=\"%s\",drv=\"%s\")",
             dev->pfun->pathname, drv->name);
         
         fibril_mutex_lock(&drv->driver_mutex);
+        fibril_rwlock_write_lock(&tree->rwlock);
         
         dev->drv = NULL;
         list_remove(&dev->driver_devices);
         
+        fibril_rwlock_write_unlock(&tree->rwlock);
         fibril_mutex_unlock(&drv->driver_mutex);
 }
@@ -578 +606 @@
         while (link != &driver->devices.head) {
                 dev = list_get_instance(link, dev_node_t, driver_devices);
+                fibril_rwlock_write_lock(&tree->rwlock);
+                
                 if (dev->passed_to_driver) {
+                        fibril_rwlock_write_unlock(&tree->rwlock);
                         link = link->next;
                         continue;
                 }
 
-                /*
-                 * We remove the device from the list to allow safe adding
-                 * of new devices (no one will touch our item this way).
-                 */
-                list_remove(link);
+                log_msg(LVL_DEBUG, "pass_devices_to_driver: dev->refcnt=%d\n",
+                    (int)atomic_get(&dev->refcnt));
+                dev_add_ref(dev);
 
                 /*
@@ -594 +623 @@
                  */
                 fibril_mutex_unlock(&driver->driver_mutex);
+                fibril_rwlock_write_unlock(&tree->rwlock);
 
                 add_device(driver, dev, tree);
+
+                dev_del_ref(dev);
 
                 /*
@@ -602 +634 @@
                  */
                 fibril_mutex_lock(&driver->driver_mutex);
-
-                /*
-                 * Insert the device back.
-                 * The order is not relevant here so no harm is done
-                 * (actually, the order would be preserved in most cases).
-                 */
-                list_append(link, &driver->devices);
 
                 /*
@@ -701 +726 @@
         char *loc_name = NULL;
         
+        assert(fibril_rwlock_is_locked(&tree->rwlock));
+        
         asprintf(&loc_name, "%s", fun->pathname);
         if (loc_name == NULL)
@@ -805 +832 @@
         
         /* Attach the driver to the device. */
-        attach_driver(dev, drv);
+        attach_driver(tree, dev, drv);
         
         fibril_mutex_lock(&drv->driver_mutex);
@@ -822 +849 @@
 }
 
-int driver_dev_remove(dev_node_t *dev)
+int driver_dev_remove(dev_tree_t *tree, dev_node_t *dev)
 {
         async_exch_t *exch;
         sysarg_t retval;
         driver_t *drv;
+        devman_handle_t handle;
         
         assert(dev != NULL);
+        
         log_msg(LVL_DEBUG, "driver_dev_remove(%p)", dev);
+        
+        fibril_rwlock_read_lock(&tree->rwlock);
         drv = dev->drv;
+        handle = dev->handle;
+        fibril_rwlock_read_unlock(&tree->rwlock);
         
         exch = async_exchange_begin(drv->sess);
-        retval = async_req_1_0(exch, DRIVER_DEV_REMOVE, dev->handle);
+        retval = async_req_1_0(exch, DRIVER_DEV_REMOVE, handle);
         async_exchange_end(exch);
         
@@ -840 +873 @@
 }
 
-int driver_fun_online(fun_node_t *fun)
+int driver_fun_online(dev_tree_t *tree, fun_node_t *fun)
 {
         async_exch_t *exch;
         sysarg_t retval;
         driver_t *drv;
+        devman_handle_t handle;
         
         log_msg(LVL_DEBUG, "driver_fun_online(%p)", fun);
+
+        fibril_rwlock_read_lock(&tree->rwlock);
+        
         if (fun->dev == NULL) {
                 /* XXX root function? */
+                fibril_rwlock_read_unlock(&tree->rwlock);
                 return EINVAL;
         }
         
         drv = fun->dev->drv;
+        handle = fun->handle;
+        fibril_rwlock_read_unlock(&tree->rwlock);
         
         exch = async_exchange_begin(drv->sess);
-        retval = async_req_1_0(exch, DRIVER_FUN_ONLINE, fun->handle);
+        retval = async_req_1_0(exch, DRIVER_FUN_ONLINE, handle);
         loc_exchange_end(exch);
         
@@ -861 +901 @@
 }
 
-int driver_fun_offline(fun_node_t *fun)
+int driver_fun_offline(dev_tree_t *tree, fun_node_t *fun)
 {
         async_exch_t *exch;
         sysarg_t retval;
         driver_t *drv;
+        devman_handle_t handle;
         
         log_msg(LVL_DEBUG, "driver_fun_offline(%p)", fun);
+
+        fibril_rwlock_read_lock(&tree->rwlock);
         if (fun->dev == NULL) {
                 /* XXX root function? */
+                fibril_rwlock_read_unlock(&tree->rwlock);
                 return EINVAL;
         }
         
         drv = fun->dev->drv;
+        handle = fun->handle;
+        fibril_rwlock_read_unlock(&tree->rwlock);
         
         exch = async_exchange_begin(drv->sess);
-        retval = async_req_1_0(exch, DRIVER_FUN_OFFLINE, fun->handle);
+        retval = async_req_1_0(exch, DRIVER_FUN_OFFLINE, handle);
         loc_exchange_end(exch);
         
@@ -909 +955 @@
         if (!create_root_nodes(tree))
                 return false;
-
+    
         /* Find suitable driver and start it. */
-        return assign_driver(tree->root_node->child, drivers_list, tree);
+        dev_node_t *rdev = tree->root_node->child;
+        dev_add_ref(rdev);
+        int rc = assign_driver(rdev, drivers_list, tree);
+        dev_del_ref(rdev);
+        
+        return rc;
 }
 
@@ -922 +973 @@
 dev_node_t *create_dev_node(void)
 {
-        dev_node_t *res = malloc(sizeof(dev_node_t));
-        
-        if (res != NULL) {
-                memset(res, 0, sizeof(dev_node_t));
-                list_initialize(&res->functions);
-                link_initialize(&res->driver_devices);
-                link_initialize(&res->devman_dev);
-        }
-        
-        return res;
+        dev_node_t *dev;
+        
+        dev = calloc(1, sizeof(dev_node_t));
+        if (dev == NULL)
+                return NULL;
+        
+        atomic_set(&dev->refcnt, 0);
+        list_initialize(&dev->functions);
+        link_initialize(&dev->driver_devices);
+        link_initialize(&dev->devman_dev);
+        
+        return dev;
 }
 
@@ -947 +1000 @@
 }
 
+/** Increase device node reference count.
+ *
+ * @param dev   Device node
+ */
+void dev_add_ref(dev_node_t *dev)
+{
+        atomic_inc(&dev->refcnt);
+}
+
+/** Decrease device node reference count.
+ *
+ * When the count drops to zero the device node is freed.
+ *
+ * @param dev   Device node
+ */
+void dev_del_ref(dev_node_t *dev)
+{
+        if (atomic_predec(&dev->refcnt) == 0)
+                delete_dev_node(dev);
+}
+
+
 /** Find the device node structure of the device witch has the specified handle.
  *
@@ -976 +1051 @@
         fibril_rwlock_read_lock(&tree->rwlock);
         dev = find_dev_node_no_lock(tree, handle);
+        if (dev != NULL)
+                dev_add_ref(dev);
+        
         fibril_rwlock_read_unlock(&tree->rwlock);
         
@@ -1003 +1081 @@
                     list_get_instance(item, fun_node_t, dev_functions);
 
-                if (pos < buf_cnt)
+                if (pos < buf_cnt) {
                         hdl_buf[pos] = fun->handle;
+                }
+
                 pos++;
         }
@@ -1020 +1100 @@
 fun_node_t *create_fun_node(void)
 {
-        fun_node_t *res = malloc(sizeof(fun_node_t));
-        
-        if (res != NULL) {
-                memset(res, 0, sizeof(fun_node_t));
-                link_initialize(&res->dev_functions);
-                list_initialize(&res->match_ids.ids);
-                link_initialize(&res->devman_fun);
-                link_initialize(&res->loc_fun);
-        }
-        
-        return res;
+        fun_node_t *fun;
+
+        fun = calloc(1, sizeof(fun_node_t));
+        if (fun == NULL)
+                return NULL;
+        
+        atomic_set(&fun->refcnt, 0);
+        link_initialize(&fun->dev_functions);
+        list_initialize(&fun->match_ids.ids);
+        link_initialize(&fun->devman_fun);
+        link_initialize(&fun->loc_fun);
+        
+        return fun;
 }
 
@@ -1048 +1130 @@
 }
 
+/** Increase function node reference count.
+ *
+ * @param fun   Function node
+ */
+void fun_add_ref(fun_node_t *fun)
+{
+        atomic_inc(&fun->refcnt);
+}
+
+/** Decrease function node reference count.
+ *
+ * When the count drops to zero the function node is freed.
+ *
+ * @param fun   Function node
+ */
+void fun_del_ref(fun_node_t *fun)
+{
+        if (atomic_predec(&fun->refcnt) == 0)
+                delete_fun_node(fun);
+}
+
 /** Find the function node with the specified handle.
  *
@@ -1058 +1161 @@
         unsigned long key = handle;
         link_t *link;
+        fun_node_t *fun;
         
         assert(fibril_rwlock_is_locked(&tree->rwlock));
@@ -1065 +1169 @@
                 return NULL;
         
-        return hash_table_get_instance(link, fun_node_t, devman_fun);
+        fun = hash_table_get_instance(link, fun_node_t, devman_fun);
+        
+        return fun;
 }
 
@@ -1079 +1185 @@
         
         fibril_rwlock_read_lock(&tree->rwlock);
+        
         fun = find_fun_node_no_lock(tree, handle);
+        if (fun != NULL)
+                fun_add_ref(fun);
+        
         fibril_rwlock_read_unlock(&tree->rwlock);
         
@@ -1087 +1197 @@
 /** Create and set device's full path in device tree.
  *
+ * @param tree          Device tree
  * @param node          The device's device node.
  * @param parent        The parent device node.
@@ -1092 +1203 @@
  *                      resources etc.).
  */
-static bool set_fun_path(fun_node_t *fun, fun_node_t *parent)
-{
+static bool set_fun_path(dev_tree_t *tree, fun_node_t *fun, fun_node_t *parent)
+{
+        assert(fibril_rwlock_is_write_locked(&tree->rwlock));
         assert(fun->name != NULL);
         
@@ -1120 +1232 @@
  *
  * @param tree          The device tree.
- * @param node          The newly added device node. 
- * @param dev_name      The name of the newly added device.
- * @param parent        The parent device node.
+ * @param dev           The newly added device node.
+ * @param pfun          The parent function node.
  *
  * @return              True on success, false otherwise (insufficient resources
@@ -1129 +1240 @@
 bool insert_dev_node(dev_tree_t *tree, dev_node_t *dev, fun_node_t *pfun)
 {
-        assert(dev != NULL);
-        assert(tree != NULL);
         assert(fibril_rwlock_is_write_locked(&tree->rwlock));
         
@@ -1155 +1264 @@
 void remove_dev_node(dev_tree_t *tree, dev_node_t *dev)
 {
-        assert(tree != NULL);
-        assert(dev != NULL);
         assert(fibril_rwlock_is_write_locked(&tree->rwlock));
         
@@ -1174 +1281 @@
  *
  * @param tree          The device tree.
- * @param node          The newly added function node. 
- * @param dev_name      The name of the newly added function.
- * @param parent        Owning device node.
+ * @param fun           The newly added function node. 
+ * @param fun_name      The name of the newly added function.
+ * @param dev           Owning device node.
  *
  * @return              True on success, false otherwise (insufficient resources
@@ -1186 +1293 @@
         fun_node_t *pfun;
         
-        assert(fun != NULL);
-        assert(tree != NULL);
         assert(fun_name != NULL);
         assert(fibril_rwlock_is_write_locked(&tree->rwlock));
@@ -1198 +1303 @@
         
         fun->name = fun_name;
-        if (!set_fun_path(fun, pfun)) {
+        if (!set_fun_path(tree, fun, pfun)) {
                 return false;
         }
@@ -1222 +1327 @@
 void remove_fun_node(dev_tree_t *tree, fun_node_t *fun)
 {
-        assert(tree != NULL);
-        assert(fun != NULL);
         assert(fibril_rwlock_is_write_locked(&tree->rwlock));
         
@@ -1256 +1359 @@
         
         fun_node_t *fun = tree->root_node;
+        fun_add_ref(fun);
         /*
          * Relative path to the function from its parent (but with '/' at the
@@ -1273 +1377 @@
                 }
                 
-                fun = find_node_child(fun, rel_path + 1);
+                fun_node_t *cfun = find_node_child(tree, fun, rel_path + 1);
+                fun_del_ref(fun);
+                fun = cfun;
                 
                 if (cont) {
@@ -1291 +1397 @@
  * Device tree rwlock should be held at least for reading.
  *
+ * @param tree Device tree
  * @param dev Device the function belongs to.
  * @param name Function name (not path).
@@ -1296 +1403 @@
  * @retval NULL No function with given name.
  */
-fun_node_t *find_fun_node_in_device(dev_node_t *dev, const char *name)
-{
-        assert(dev != NULL);
+fun_node_t *find_fun_node_in_device(dev_tree_t *tree, dev_node_t *dev,
+    const char *name)
+{
         assert(name != NULL);
+        assert(fibril_rwlock_is_locked(&tree->rwlock));
 
         fun_node_t *fun;
@@ -1306 +1414 @@
                 fun = list_get_instance(link, fun_node_t, dev_functions);
 
-                if (str_cmp(name, fun->name) == 0)
+                if (str_cmp(name, fun->name) == 0) {
+                        fun_add_ref(fun);
                         return fun;
+                }
         }
 
@@ -1317 +1427 @@
  * Device tree rwlock should be held at least for reading.
  *
+ * @param tree          Device tree
  * @param parent        The parent function node.
  * @param name          The name of the child function.
  * @return              The child function node.
  */
-fun_node_t *find_node_child(fun_node_t *pfun, const char *name)
-{
-        return find_fun_node_in_device(pfun->child, name);
+static fun_node_t *find_node_child(dev_tree_t *tree, fun_node_t *pfun,
+    const char *name)
+{
+        return find_fun_node_in_device(tree, pfun->child, name);
 }
 
@@ -1336 +1448 @@
         fibril_rwlock_read_lock(&tree->rwlock);
         link = hash_table_find(&tree->loc_functions, &key);
-        if (link != NULL)
+        if (link != NULL) {
                 fun = hash_table_get_instance(link, fun_node_t, loc_fun);
+                fun_add_ref(fun);
+        }
         fibril_rwlock_read_unlock(&tree->rwlock);
         
@@ -1345 +1459 @@
 void tree_add_loc_function(dev_tree_t *tree, fun_node_t *fun)
 {
+        assert(fibril_rwlock_is_write_locked(&tree->rwlock));
+        
         unsigned long key = (unsigned long) fun->service_id;
-        fibril_rwlock_write_lock(&tree->rwlock);
         hash_table_insert(&tree->loc_functions, &key, &fun->loc_fun);
-        fibril_rwlock_write_unlock(&tree->rwlock);
 }
 

uspace/srv/devman/devman.h

@@ -128 +128 @@
 /** Device node in the device tree. */
 struct dev_node {
+        /** Reference count */
+        atomic_t refcnt;
+        
         /** The global unique identifier of the device. */
         devman_handle_t handle;
@@ -156 +159 @@
 /** Function node in the device tree. */
 struct fun_node {
+        /** Reference count */
+        atomic_t refcnt;
+        
         /** The global unique identifier of the function */
         devman_handle_t handle;
@@ -239 +245 @@
 
 extern void add_driver(driver_list_t *, driver_t *);
-extern void attach_driver(dev_node_t *, driver_t *);
-extern void detach_driver(dev_node_t *);
+extern void attach_driver(dev_tree_t *, dev_node_t *, driver_t *);
+extern void detach_driver(dev_tree_t *, dev_node_t *);
 extern void add_device(driver_t *, dev_node_t *, dev_tree_t *);
 extern bool start_driver(driver_t *);
-extern int driver_dev_remove(dev_node_t *);
-extern int driver_fun_online(fun_node_t *);
-extern int driver_fun_offline(fun_node_t *);
+extern int driver_dev_remove(dev_tree_t *, dev_node_t *);
+extern int driver_fun_online(dev_tree_t *, fun_node_t *);
+extern int driver_fun_offline(dev_tree_t *, fun_node_t *);
 
 extern driver_t *find_driver(driver_list_t *, const char *);
@@ -258 +264 @@
 extern dev_node_t *create_dev_node(void);
 extern void delete_dev_node(dev_node_t *node);
+extern void dev_add_ref(dev_node_t *);
+extern void dev_del_ref(dev_node_t *);
 extern dev_node_t *find_dev_node_no_lock(dev_tree_t *tree,
     devman_handle_t handle);
@@ -267 +275 @@
 extern fun_node_t *create_fun_node(void);
 extern void delete_fun_node(fun_node_t *);
+extern void fun_add_ref(fun_node_t *);
+extern void fun_del_ref(fun_node_t *);
 extern fun_node_t *find_fun_node_no_lock(dev_tree_t *tree,
     devman_handle_t handle);
 extern fun_node_t *find_fun_node(dev_tree_t *tree, devman_handle_t handle);
 extern fun_node_t *find_fun_node_by_path(dev_tree_t *, char *);
-extern fun_node_t *find_fun_node_in_device(dev_node_t *, const char *);
+extern fun_node_t *find_fun_node_in_device(dev_tree_t *tree, dev_node_t *,
+    const char *);
 
 /* Device tree */

uspace/srv/devman/main.c

@@ -242 +242 @@
         
         fibril_rwlock_write_lock(&device_tree.rwlock);
-        
+
         if (fun->ftype == fun_inner) {
                 dev = create_dev_node();
                 if (dev == NULL) {
                         fibril_rwlock_write_unlock(&device_tree.rwlock);
-                        delete_fun_node(fun);
                         return ENOMEM;
                 }
 
                 insert_dev_node(&device_tree, dev, fun);
-        }
-        
-        fibril_rwlock_write_unlock(&device_tree.rwlock);
+                dev_add_ref(dev);
+        }
         
         log_msg(LVL_DEBUG, "devman_add_function(fun=\"%s\")", fun->pathname);
@@ -283 +281 @@
         }
         
+        fibril_rwlock_write_unlock(&device_tree.rwlock);
+        
         return EOK;
 }
@@ -289 +289 @@
 {
         int rc;
+        
+        fibril_rwlock_write_lock(&device_tree.rwlock);
         
         if (fun->ftype == fun_inner) {
@@ -296 +298 @@
                         dev_node_t *dev = fun->child;
                         
-                        rc = driver_dev_remove(dev);
+                        dev_add_ref(dev);
+                        fibril_rwlock_write_unlock(&device_tree.rwlock);
+                        
+                        rc = driver_dev_remove(&device_tree, dev);
                         if (rc != EOK) {
+                                dev_del_ref(dev);
                                 return ENOTSUP;
                         }
-                        detach_driver(dev);
+                        
+                        detach_driver(&device_tree, dev);
+                        
                         fibril_rwlock_write_lock(&device_tree.rwlock);
                         remove_dev_node(&device_tree, dev);
-                        fibril_rwlock_write_unlock(&device_tree.rwlock);
-                        delete_dev_node(dev);
+                        
+                        /* Delete ref created when node was inserted */
+                        dev_del_ref(dev);
+                        /* Delete ref created by dev_add_ref(dev) above */
+                        dev_del_ref(dev);
                 }
         } else {
@@ -310 +321 @@
                 rc = loc_service_unregister(fun->service_id);
                 if (rc != EOK) {
+                        fibril_rwlock_write_unlock(&device_tree.rwlock);
                         log_msg(LVL_ERROR, "Failed unregistering tree service.");
                         return EIO;
@@ -317 +329 @@
         }
         
+        fibril_rwlock_write_unlock(&device_tree.rwlock);
+        
         return EOK;
 }
@@ -331 +345 @@
         dev_tree_t *tree = &device_tree;
         
-        fibril_rwlock_write_lock(&tree->rwlock);
-
-        dev_node_t *pdev = find_dev_node_no_lock(&device_tree, dev_handle);
-        
+        dev_node_t *pdev = find_dev_node(&device_tree, dev_handle);
         if (pdev == NULL) {
-                fibril_rwlock_write_unlock(&tree->rwlock);
                 async_answer_0(callid, ENOENT);
                 return;
@@ -347 +357 @@
                     (int) ftype);
 
-                fibril_rwlock_write_unlock(&tree->rwlock);
+                dev_del_ref(pdev);
                 async_answer_0(callid, EINVAL);
                 return;
@@ -355 +365 @@
         int rc = async_data_write_accept((void **)&fun_name, true, 0, 0, 0, 0);
         if (rc != EOK) {
+                dev_del_ref(pdev);
+                async_answer_0(callid, rc);
+                return;
+        }
+        
+        fibril_rwlock_write_lock(&tree->rwlock);
+        
+        /* Check that function with same name is not there already. */
+        if (find_fun_node_in_device(tree, pdev, fun_name) != NULL) {
                 fibril_rwlock_write_unlock(&tree->rwlock);
-                async_answer_0(callid, rc);
-                return;
-        }
-        
-        /* Check that function with same name is not there already. */
-        if (find_fun_node_in_device(pdev, fun_name) != NULL) {
-                fibril_rwlock_write_unlock(&tree->rwlock);
+                dev_del_ref(pdev);
                 async_answer_0(callid, EEXISTS);
                 printf(NAME ": Warning, driver tried to register `%s' twice.\n",
@@ -371 +384 @@
         
         fun_node_t *fun = create_fun_node();
+        fun_add_ref(fun);
         fun->ftype = ftype;
         
         if (!insert_fun_node(&device_tree, fun, fun_name, pdev)) {
                 fibril_rwlock_write_unlock(&tree->rwlock);
+                dev_del_ref(pdev);
                 delete_fun_node(fun);
                 async_answer_0(callid, ENOMEM);
@@ -381 +396 @@
         
         fibril_rwlock_write_unlock(&tree->rwlock);
+        dev_del_ref(pdev);
         
         devman_receive_match_ids(match_count, &fun->match_ids);
@@ -408 +424 @@
                 async_answer_0(callid, rc);
                 return;
-        }       
+        }
         
         fun_node_t *fun = find_fun_node(&device_tree, handle);
@@ -415 +431 @@
                 return;
         }
+        
+        fibril_rwlock_read_lock(&device_tree.rwlock);
         
         rc = loc_category_get_id(cat_name, &cat_id, IPC_FLAG_BLOCKING);
@@ -427 +445 @@
             fun->pathname, cat_name);
 
+        fibril_rwlock_read_unlock(&device_tree.rwlock);
+        fun_del_ref(fun);
+
         async_answer_0(callid, EOK);
 }
@@ -440 +461 @@
 
         printf("devman_drv_fun_online()\n");
-        fibril_rwlock_write_lock(&device_tree.rwlock);
-        fun = find_fun_node_no_lock(&device_tree, IPC_GET_ARG1(*icall));
-        fibril_rwlock_write_unlock(&device_tree.rwlock); /* XXX FIXME */
-        
-        if (fun == NULL || fun->dev == NULL || fun->dev->drv != drv) {
-                async_answer_0(iid, ENOENT);
-                return;
-        }
+        fun = find_fun_node(&device_tree, IPC_GET_ARG1(*icall));
+        if (fun == NULL) {
+                async_answer_0(iid, ENOENT);
+                return;
+        }
+        
+        fibril_rwlock_read_lock(&device_tree.rwlock);
+        if (fun->dev == NULL || fun->dev->drv != drv) {
+                fibril_rwlock_read_unlock(&device_tree.rwlock);
+                fun_del_ref(fun);
+                async_answer_0(iid, ENOENT);
+                return;
+        }
+        fibril_rwlock_read_unlock(&device_tree.rwlock);
         
         rc = online_function(fun);
         if (rc != EOK) {
                 printf("devman_drv_fun_online() online_fun->ERROR\n");
+                fun_del_ref(fun);
                 async_answer_0(iid, (sysarg_t) rc);
                 return;
         }
+        
+        fun_del_ref(fun);
         printf("devman_drv_fun_online() online_fun->OK\n");
         
@@ -470 +500 @@
         int rc;
 
+        fun = find_fun_node(&device_tree, IPC_GET_ARG1(*icall));
+        if (fun == NULL) {
+                async_answer_0(iid, ENOENT);
+                return;
+        }
+        
         fibril_rwlock_write_lock(&device_tree.rwlock);
-        fun = find_fun_node_no_lock(&device_tree, IPC_GET_ARG1(*icall));
-        fibril_rwlock_write_unlock(&device_tree.rwlock); /* XXX FIXME */
-        
-        if (fun == NULL || fun->dev == NULL || fun->dev->drv != drv) {
-                async_answer_0(iid, ENOENT);
-                return;
-        }
+        if (fun->dev == NULL || fun->dev->drv != drv) {
+                fun_del_ref(fun);
+                async_answer_0(iid, ENOENT);
+                return;
+        }
+        fibril_rwlock_write_unlock(&device_tree.rwlock);
         
         rc = offline_function(fun);
         if (rc != EOK) {
+                fun_del_ref(fun);
                 async_answer_0(iid, (sysarg_t) rc);
                 return;
         }
         
+        fun_del_ref(fun);
         async_answer_0(iid, (sysarg_t) EOK);
 }
@@ -495 +532 @@
         int rc;
         
+        
+        fun_node_t *fun = find_fun_node(&device_tree, fun_handle);
+        if (fun == NULL) {
+                async_answer_0(callid, ENOENT);
+                return;
+        }
+        
         fibril_rwlock_write_lock(&tree->rwlock);
-        
-        fun_node_t *fun = find_fun_node_no_lock(&device_tree, fun_handle);
-        if (fun == NULL) {
-                fibril_rwlock_write_unlock(&tree->rwlock);
-                async_answer_0(callid, ENOENT);
-                return;
-        }
         
         log_msg(LVL_DEBUG, "devman_remove_function(fun='%s')", fun->pathname);
@@ -508 +545 @@
         if (fun->ftype == fun_inner) {
                 /* Handle possible descendants */
-                /* TODO */
+                /* TODO - This is a surprise removal */
                 if (fun->child != NULL) {
                         log_msg(LVL_WARN, "devman_remove_function(): not handling "
@@ -521 +558 @@
                                     "service.");
                                 fibril_rwlock_write_unlock(&tree->rwlock);
+                                fun_del_ref(fun);
                                 async_answer_0(callid, EIO);
                                 return;
@@ -529 +567 @@
         remove_fun_node(&device_tree, fun);
         fibril_rwlock_write_unlock(&tree->rwlock);
-        delete_fun_node(fun);
+        
+        /* Delete ref added when inserting function into tree */
+        fun_del_ref(fun);
+        /* Delete ref added above when looking up function */
+        fun_del_ref(fun);
         
         log_msg(LVL_DEBUG, "devman_remove_function() succeeded.");
@@ -621 +663 @@
 {
         char *pathname;
+        devman_handle_t handle;
         
         int rc = async_data_write_accept((void **) &pathname, true, 0, 0, 0, 0);
@@ -637 +680 @@
         }
 
-        async_answer_1(iid, EOK, fun->handle);
+        fibril_rwlock_read_lock(&device_tree.rwlock);
+        handle = fun->handle;
+        fibril_rwlock_read_unlock(&device_tree.rwlock);
+
+        /* Delete reference created above by find_fun_node_by_path() */
+        fun_del_ref(fun);
+
+        async_answer_1(iid, EOK, handle);
 }
 
@@ -655 +705 @@
         if (!async_data_read_receive(&data_callid, &data_len)) {
                 async_answer_0(iid, EINVAL);
+                fun_del_ref(fun);
                 return;
         }
@@ -662 +713 @@
                 async_answer_0(data_callid, ENOMEM);
                 async_answer_0(iid, ENOMEM);
-                return;
-        }
+                fun_del_ref(fun);
+                return;
+        }
+
+        fibril_rwlock_read_lock(&device_tree.rwlock);
 
         size_t sent_length = str_size(fun->name);
@@ -673 +727 @@
         async_answer_0(iid, EOK);
 
+        fibril_rwlock_read_unlock(&device_tree.rwlock);
+        fun_del_ref(fun);
         free(buffer);
 }
@@ -692 +748 @@
         if (!async_data_read_receive(&data_callid, &data_len)) {
                 async_answer_0(iid, EINVAL);
+                fun_del_ref(fun);
                 return;
         }
@@ -699 +756 @@
                 async_answer_0(data_callid, ENOMEM);
                 async_answer_0(iid, ENOMEM);
-                return;
-        }
-
+                fun_del_ref(fun);
+                return;
+        }
+        
+        fibril_rwlock_read_lock(&device_tree.rwlock);
+        
         size_t sent_length = str_size(fun->pathname);
         if (sent_length > data_len) {
@@ -710 +770 @@
         async_answer_0(iid, EOK);
 
+        fibril_rwlock_read_unlock(&device_tree.rwlock);
+        fun_del_ref(fun);
         free(buffer);
 }
@@ -777 +839 @@
         
         if (fun->child == NULL) {
+                fun_del_ref(fun);
                 fibril_rwlock_read_unlock(&device_tree.rwlock);
                 async_answer_0(iid, ENOENT);
@@ -784 +847 @@
         async_answer_1(iid, EOK, fun->child->handle);
         
+        fun_del_ref(fun);
         fibril_rwlock_read_unlock(&device_tree.rwlock);
 }
@@ -798 +862 @@
         int rc;
 
-        fibril_rwlock_write_lock(&device_tree.rwlock);
-        fun = find_fun_node_no_lock(&device_tree, IPC_GET_ARG1(*icall));
-        fibril_rwlock_write_unlock(&device_tree.rwlock); /* XXX FIXME */
-        
+        fun = find_fun_node(&device_tree, IPC_GET_ARG1(*icall));
         if (fun == NULL) {
                 async_answer_0(iid, ENOENT);
@@ -807 +868 @@
         }
         
-        rc = driver_fun_online(fun);
+        rc = driver_fun_online(&device_tree, fun);
+        fun_del_ref(fun);
         
         async_answer_0(iid, (sysarg_t) rc);
@@ -825 +887 @@
         int rc;
 
-        fibril_rwlock_write_lock(&device_tree.rwlock);
-        fun = find_fun_node_no_lock(&device_tree, IPC_GET_ARG1(*icall));
-        fibril_rwlock_write_unlock(&device_tree.rwlock); /* XXX FIXME */
-        
+        fun = find_fun_node(&device_tree, IPC_GET_ARG1(*icall));
         if (fun == NULL) {
                 async_answer_0(iid, ENOENT);
@@ -834 +893 @@
         }
         
-        rc = driver_fun_offline(fun);
+        rc = driver_fun_offline(&device_tree, fun);
+        fun_del_ref(fun);
         
         async_answer_0(iid, (sysarg_t) rc);
@@ -851 +911 @@
         }
 
+        fibril_rwlock_read_lock(&device_tree.rwlock);
         async_answer_1(iid, EOK, fun->handle);
+        fibril_rwlock_read_unlock(&device_tree.rwlock);
+        fun_del_ref(fun);
 }
 
@@ -909 +972 @@
         if (fun == NULL)
                 dev = find_dev_node(&device_tree, handle);
-        else
+        else {
+                fibril_rwlock_read_lock(&device_tree.rwlock);
                 dev = fun->dev;
+                if (dev != NULL)
+                        dev_add_ref(dev);
+                fibril_rwlock_read_unlock(&device_tree.rwlock);
+        }
 
         /*
@@ -922 +990 @@
                     "function with handle %" PRIun " was found.", handle);
                 async_answer_0(iid, ENOENT);
-                return;
+                goto cleanup;
         }
 
@@ -930 +998 @@
                     handle);
                 async_answer_0(iid, ENOENT);
-                return;
+                goto cleanup;
         }
         
@@ -952 +1020 @@
                     "the device %" PRIun " is not in usable state.", handle);
                 async_answer_0(iid, ENOENT);
-                return;
+                goto cleanup;
         }
         
@@ -965 +1033 @@
                     "Could not forward to driver `%s'.", driver->name);
                 async_answer_0(iid, EINVAL);
-                return;
+                goto cleanup;
         }
 
@@ -981 +1049 @@
         async_forward_fast(iid, exch, method, fwd_h, 0, IPC_FF_NONE);
         async_exchange_end(exch);
+
+cleanup:
+        if (dev != NULL)
+                dev_del_ref(dev);
+        if (fun != NULL)
+                fun_del_ref(fun);
 }
 
@@ -1000 +1074 @@
         }
         
+        fibril_rwlock_read_lock(&device_tree.rwlock);
         dev = fun->dev;
+        fun_del_ref(fun);
         
         async_exch_t *exch = async_exchange_begin(dev->drv->sess);
@@ -1006 +1082 @@
             IPC_FF_NONE);
         async_exchange_end(exch);
+        
+        fibril_rwlock_read_unlock(&device_tree.rwlock);
         
         log_msg(LVL_DEBUG,