xf86-video-intel: 2 commits - src/sna/gen3_render.c src/sna/gen4_render.c src/sna/gen5_render.c src/sna/gen6_render.c src/sna/gen7_render.c src/sna/sna_accel.c src/sna/sna_render.c

[Chris Wilson]

 src/sna/gen3_render.c |    1 +
 src/sna/gen4_render.c |    1 +
 src/sna/gen5_render.c |    1 +
 src/sna/gen6_render.c |    1 +
 src/sna/gen7_render.c |    1 +
 src/sna/sna_accel.c   |    1 +
 src/sna/sna_render.c  |    2 ++
 7 files changed, 8 insertions(+)

New commits:
commit d3a49f36395d737698616fe8ba9da7b74cd2d89a
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Wed Nov 21 18:41:00 2012 +0000

    sna/gen3+: Clear the render.vbo when replacing it for vertex upload
    
    As we may trigger a flush and a retire when searching for a vertex
    buffer for the new vertices, we need to be careful to decouple the
    destroyed vbo in order to avoid a use-after-free when inspecting the
    state.
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/gen3_render.c b/src/sna/gen3_render.c
index 232d33f..f0f0a48 100644
--- a/src/sna/gen3_render.c
+++ b/src/sna/gen3_render.c
@@ -1640,6 +1640,7 @@ static int gen3_vertex_finish(struct sna *sna)
 		sna->render.vertex_reloc[0] = 0;
 		sna->render.vertex_used = 0;
 		sna->render.vertex_index = 0;
+		sna->render.vbo = NULL;
 
 		kgem_bo_destroy(&sna->kgem, bo);
 	}
diff --git a/src/sna/gen4_render.c b/src/sna/gen4_render.c
index 387dd85..f4ddb82 100644
--- a/src/sna/gen4_render.c
+++ b/src/sna/gen4_render.c
@@ -295,6 +295,7 @@ static int gen4_vertex_finish(struct sna *sna)
 					       0);
 		}
 
+		sna->render.vbo = NULL;
 		sna->render.nvertex_reloc = 0;
 		sna->render.vertex_used = 0;
 		sna->render.vertex_index = 0;
diff --git a/src/sna/gen5_render.c b/src/sna/gen5_render.c
index 54d7c86..0e3aec6 100644
--- a/src/sna/gen5_render.c
+++ b/src/sna/gen5_render.c
@@ -274,6 +274,7 @@ static int gen5_vertex_finish(struct sna *sna)
 		sna->render.nvertex_reloc = 0;
 		sna->render.vertex_used = 0;
 		sna->render.vertex_index = 0;
+		sna->render.vbo = NULL;
 		sna->render_state.gen5.vb_id = 0;
 
 		kgem_bo_destroy(&sna->kgem, bo);
diff --git a/src/sna/gen6_render.c b/src/sna/gen6_render.c
index 16d5d90..fbe0951 100644
--- a/src/sna/gen6_render.c
+++ b/src/sna/gen6_render.c
@@ -999,6 +999,7 @@ static int gen6_vertex_finish(struct sna *sna)
 		sna->render.nvertex_reloc = 0;
 		sna->render.vertex_used = 0;
 		sna->render.vertex_index = 0;
+		sna->render.vbo = NULL;
 		sna->render_state.gen6.vb_id = 0;
 
 		kgem_bo_destroy(&sna->kgem, bo);
diff --git a/src/sna/gen7_render.c b/src/sna/gen7_render.c
index a329112..3bec5df 100644
--- a/src/sna/gen7_render.c
+++ b/src/sna/gen7_render.c
@@ -1142,6 +1142,7 @@ static int gen7_vertex_finish(struct sna *sna)
 		sna->render.nvertex_reloc = 0;
 		sna->render.vertex_used = 0;
 		sna->render.vertex_index = 0;
+		sna->render.vbo = NULL;
 		sna->render_state.gen7.vb_id = 0;
 
 		kgem_bo_destroy(&sna->kgem, bo);
commit 1c57a52a1f46e8401429955d8c96fd5095c9012a
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Wed Nov 21 18:17:31 2012 +0000

    sna: Assert that we do not replace a GPU bo with a proxy
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c
index b38f80f..57bf4cd 100644
--- a/src/sna/sna_accel.c
+++ b/src/sna/sna_accel.c
@@ -4668,6 +4668,7 @@ sna_copy_boxes(DrawablePtr src, DrawablePtr dst, GCPtr gc,
 				DBG(("%s: caching upload for src bo\n",
 				     __FUNCTION__));
 				assert(src_priv->gpu_damage == NULL);
+				assert(src_priv->gpu_bo == NULL);
 				kgem_proxy_bo_attach(src_bo, &src_priv->gpu_bo);
 			}
 
diff --git a/src/sna/sna_render.c b/src/sna/sna_render.c
index 88b2382..c534f61 100644
--- a/src/sna/sna_render.c
+++ b/src/sna/sna_render.c
@@ -530,6 +530,7 @@ static struct kgem_bo *upload(struct sna *sna,
 		    channel->height == pixmap->drawable.height) {
 			assert(priv->gpu_damage == NULL);
 			assert(DAMAGE_IS_ALL(priv->cpu_damage));
+			assert(priv->gpu_bo == NULL);
 			kgem_proxy_bo_attach(bo, &priv->gpu_bo);
 		}
 	}
@@ -1165,6 +1166,7 @@ sna_render_picture_extract(struct sna *sna,
 				if (priv) {
 					assert(priv->gpu_damage == NULL);
 					assert(DAMAGE_IS_ALL(priv->cpu_damage));
+					assert(priv->gpu_bo == NULL);
 					kgem_proxy_bo_attach(bo, &priv->gpu_bo);
 				}
 			}