[Nouveau] [PATCH 2/2] nvfx: use bo_ref for render targets

[Xavier Chantry]

If nvfx_framebuffer prepare and validate were called successively with
fb->zsbuf not NULL and then NULL, nvfx->hw_zeta would contain garbage and
this would cause failures in nvfx_framebuffer_relocate/OUT_RELOC(hw_zeta).

This was triggered by piglit/texwrap 2D GL_DEPTH_COMPONENT24 and caused
first a 'write to user buffer!!' error in libdrm and then worse things.

When using bo_ref, the bo referenced by nvfx->hw_zeta is preserved properly.

Signed-off-by: Xavier Chantry <chantry.xavier at gmail.com>
---
 src/gallium/drivers/nvfx/nvfx_context.c  |    6 ++++++
 src/gallium/drivers/nvfx/nvfx_state_fb.c |   19 +++++++++++++++----
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/src/gallium/drivers/nvfx/nvfx_context.c b/src/gallium/drivers/nvfx/nvfx_context.c
index 95834d2..93a00aa 100644
--- a/src/gallium/drivers/nvfx/nvfx_context.c
+++ b/src/gallium/drivers/nvfx/nvfx_context.c
@@ -32,10 +32,16 @@ static void
 nvfx_destroy(struct pipe_context *pipe)
 {
 	struct nvfx_context *nvfx = nvfx_context(pipe);
+	struct pipe_framebuffer_state *fb = &nvfx->framebuffer;
 
 	if(nvfx->dummy_fs)
 		pipe->delete_fs_state(pipe, nvfx->dummy_fs);
 
+	for (int i = 0; i < 4; i++) {
+		nouveau_bo_ref(NULL, &nvfx->hw_rt[i].bo);
+	}
+	nouveau_bo_ref(NULL, &nvfx->hw_zeta.bo);
+
 	for(unsigned i = 0; i < nvfx->vtxbuf_nr; ++i)
 		pipe_resource_reference(&nvfx->vtxbuf[i].buffer, 0);
 	pipe_resource_reference(&nvfx->idxbuf.buffer, 0);
diff --git a/src/gallium/drivers/nvfx/nvfx_state_fb.c b/src/gallium/drivers/nvfx/nvfx_state_fb.c
index 73885de..1064837 100644
--- a/src/gallium/drivers/nvfx/nvfx_state_fb.c
+++ b/src/gallium/drivers/nvfx/nvfx_state_fb.c
@@ -30,7 +30,7 @@ nvfx_surface_get_render_target(struct pipe_surface* surf, int all_swizzled, stru
 	struct nvfx_surface* ns = (struct nvfx_surface*)surf;
 	if(!ns->temp)
 	{
-		target->bo = ((struct nvfx_miptree*)surf->texture)->base.bo;
+		nouveau_bo_ref(((struct nvfx_miptree*)surf->texture)->base.bo, &target->bo);
 		target->offset = surf->offset;
 		target->pitch = align(ns->pitch, 64);
 		assert(target->pitch);
@@ -40,7 +40,7 @@ nvfx_surface_get_render_target(struct pipe_surface* surf, int all_swizzled, stru
 	{
 		target->offset = 0;
 		target->pitch = ns->temp->linear_pitch;
-		target->bo = ns->temp->base.bo;
+		nouveau_bo_ref(ns->temp->base.bo, &target->bo);
 		assert(target->pitch);
 		return TRUE;
 	}
@@ -91,6 +91,17 @@ nvfx_framebuffer_prepare(struct nvfx_context *nvfx)
 	return all_swizzled;
 }
 
+static void
+nvfx_release_render_target(struct nvfx_context *nvfx)
+{
+	struct pipe_framebuffer_state *fb = &nvfx->framebuffer;
+	int i;
+	for(i = fb->nr_cbufs; i < 4; ++i)
+		nouveau_bo_ref(NULL, &nvfx->hw_rt[i].bo);
+	if (!fb->zsbuf)
+		nouveau_bo_ref(NULL, &nvfx->hw_zeta.bo);
+}
+
 void
 nvfx_framebuffer_validate(struct nvfx_context *nvfx, unsigned prepare_result)
 {
@@ -102,6 +113,8 @@ nvfx_framebuffer_validate(struct nvfx_context *nvfx, unsigned prepare_result)
 	unsigned w = fb->width;
 	unsigned h = fb->height;
 
+	nvfx_release_render_target(nvfx);
+
 	rt_enable = (NV30_3D_RT_ENABLE_COLOR0 << fb->nr_cbufs) - 1;
 	if (rt_enable & (NV30_3D_RT_ENABLE_COLOR1 |
 			 NV40_3D_RT_ENABLE_COLOR2 | NV40_3D_RT_ENABLE_COLOR3))
@@ -112,8 +125,6 @@ nvfx_framebuffer_validate(struct nvfx_context *nvfx, unsigned prepare_result)
 	for (i = 0; i < fb->nr_cbufs; i++)
 		nvfx->state.render_temps |= nvfx_surface_get_render_target(fb->cbufs[i], prepare_result, &nvfx->hw_rt[i]) << i;
 
-	for(; i < 4; ++i)
-		nvfx->hw_rt[i].bo = 0;
 
 	if (fb->zsbuf) {
 		nvfx->state.render_temps |= nvfx_surface_get_render_target(fb->zsbuf, prepare_result, &nvfx->hw_zeta) << 7;
-- 
1.7.3.2