r600: Fix use after free in compute_memory_promote_item.
[mesa.git] / src / gallium / drivers / r600 / compute_memory_pool.c
1 /*
2 * Permission is hereby granted, free of charge, to any person obtaining a
3 * copy of this software and associated documentation files (the "Software"),
4 * to deal in the Software without restriction, including without limitation
5 * on the rights to use, copy, modify, merge, publish, distribute, sub
6 * license, and/or sell copies of the Software, and to permit persons to whom
7 * the Software is furnished to do so, subject to the following conditions:
8 *
9 * The above copyright notice and this permission notice (including the next
10 * paragraph) shall be included in all copies or substantial portions of the
11 * Software.
12 *
13 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
14 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15 * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
16 * THE AUTHOR(S) AND/OR THEIR SUPPLIERS BE LIABLE FOR ANY CLAIM,
17 * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
18 * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
19 * USE OR OTHER DEALINGS IN THE SOFTWARE.
20 *
21 * Authors:
22 * Adam Rak <adam.rak@streamnovation.com>
23 */
24
25 #include "pipe/p_defines.h"
26 #include "pipe/p_state.h"
27 #include "pipe/p_context.h"
28 #include "util/u_blitter.h"
29 #include "util/u_double_list.h"
30 #include "util/u_transfer.h"
31 #include "util/u_surface.h"
32 #include "util/u_pack_color.h"
33 #include "util/u_math.h"
34 #include "util/u_memory.h"
35 #include "util/u_inlines.h"
36 #include "util/u_framebuffer.h"
37 #include "r600_shader.h"
38 #include "r600_pipe.h"
39 #include "r600_formats.h"
40 #include "compute_memory_pool.h"
41 #include "evergreen_compute.h"
42 #include "evergreen_compute_internal.h"
43 #include <inttypes.h>
44
45 #define ITEM_ALIGNMENT 1024
46 /**
47 * Creates a new pool
48 */
49 struct compute_memory_pool* compute_memory_pool_new(
50 struct r600_screen * rscreen)
51 {
52 struct compute_memory_pool* pool = (struct compute_memory_pool*)
53 CALLOC(sizeof(struct compute_memory_pool), 1);
54 if (pool == NULL)
55 return NULL;
56
57 COMPUTE_DBG(rscreen, "* compute_memory_pool_new()\n");
58
59 pool->screen = rscreen;
60 pool->item_list = (struct list_head *)
61 CALLOC(sizeof(struct list_head), 1);
62 pool->unallocated_list = (struct list_head *)
63 CALLOC(sizeof(struct list_head), 1);
64 list_inithead(pool->item_list);
65 list_inithead(pool->unallocated_list);
66 return pool;
67 }
68
69 static void compute_memory_pool_init(struct compute_memory_pool * pool,
70 unsigned initial_size_in_dw)
71 {
72
73 COMPUTE_DBG(pool->screen, "* compute_memory_pool_init() initial_size_in_dw = %ld\n",
74 initial_size_in_dw);
75
76 pool->shadow = (uint32_t*)CALLOC(initial_size_in_dw, 4);
77 if (pool->shadow == NULL)
78 return;
79
80 pool->size_in_dw = initial_size_in_dw;
81 pool->bo = (struct r600_resource*)r600_compute_buffer_alloc_vram(pool->screen,
82 pool->size_in_dw * 4);
83 }
84
85 /**
86 * Frees all stuff in the pool and the pool struct itself too
87 */
88 void compute_memory_pool_delete(struct compute_memory_pool* pool)
89 {
90 COMPUTE_DBG(pool->screen, "* compute_memory_pool_delete()\n");
91 free(pool->shadow);
92 if (pool->bo) {
93 pool->screen->b.b.resource_destroy((struct pipe_screen *)
94 pool->screen, (struct pipe_resource *)pool->bo);
95 }
96 free(pool);
97 }
98
99 /**
100 * Searches for an empty space in the pool, return with the pointer to the
101 * allocatable space in the pool, returns -1 on failure.
102 */
103 int64_t compute_memory_prealloc_chunk(
104 struct compute_memory_pool* pool,
105 int64_t size_in_dw)
106 {
107 struct compute_memory_item *item;
108
109 int last_end = 0;
110
111 assert(size_in_dw <= pool->size_in_dw);
112
113 COMPUTE_DBG(pool->screen, "* compute_memory_prealloc_chunk() size_in_dw = %ld\n",
114 size_in_dw);
115
116 LIST_FOR_EACH_ENTRY(item, pool->item_list, link) {
117 if (last_end + size_in_dw <= item->start_in_dw) {
118 return last_end;
119 }
120
121 last_end = item->start_in_dw + align(item->size_in_dw, ITEM_ALIGNMENT);
122 }
123
124 if (pool->size_in_dw - last_end < size_in_dw) {
125 return -1;
126 }
127
128 return last_end;
129 }
130
131 /**
132 * Search for the chunk where we can link our new chunk after it.
133 */
134 struct list_head *compute_memory_postalloc_chunk(
135 struct compute_memory_pool* pool,
136 int64_t start_in_dw)
137 {
138 struct compute_memory_item *item;
139 struct compute_memory_item *next;
140 struct list_head *next_link;
141
142 COMPUTE_DBG(pool->screen, "* compute_memory_postalloc_chunck() start_in_dw = %ld\n",
143 start_in_dw);
144
145 /* Check if we can insert it in the front of the list */
146 item = LIST_ENTRY(struct compute_memory_item, pool->item_list->next, link);
147 if (LIST_IS_EMPTY(pool->item_list) || item->start_in_dw > start_in_dw) {
148 return pool->item_list;
149 }
150
151 LIST_FOR_EACH_ENTRY(item, pool->item_list, link) {
152 next_link = item->link.next;
153
154 if (next_link != pool->item_list) {
155 next = container_of(next_link, item, link);
156 if (item->start_in_dw < start_in_dw
157 && next->start_in_dw > start_in_dw) {
158 return &item->link;
159 }
160 }
161 else {
162 /* end of chain */
163 assert(item->start_in_dw < start_in_dw);
164 return &item->link;
165 }
166 }
167
168 assert(0 && "unreachable");
169 return NULL;
170 }
171
172 /**
173 * Reallocates pool, conserves data.
174 * @returns -1 if it fails, 0 otherwise
175 */
176 int compute_memory_grow_pool(struct compute_memory_pool* pool,
177 struct pipe_context * pipe, int new_size_in_dw)
178 {
179 COMPUTE_DBG(pool->screen, "* compute_memory_grow_pool() "
180 "new_size_in_dw = %d (%d bytes)\n",
181 new_size_in_dw, new_size_in_dw * 4);
182
183 assert(new_size_in_dw >= pool->size_in_dw);
184
185 if (!pool->bo) {
186 compute_memory_pool_init(pool, MAX2(new_size_in_dw, 1024 * 16));
187 if (pool->shadow == NULL)
188 return -1;
189 } else {
190 new_size_in_dw = align(new_size_in_dw, ITEM_ALIGNMENT);
191
192 COMPUTE_DBG(pool->screen, " Aligned size = %d (%d bytes)\n",
193 new_size_in_dw, new_size_in_dw * 4);
194
195 compute_memory_shadow(pool, pipe, 1);
196 pool->shadow = realloc(pool->shadow, new_size_in_dw*4);
197 if (pool->shadow == NULL)
198 return -1;
199
200 pool->size_in_dw = new_size_in_dw;
201 pool->screen->b.b.resource_destroy(
202 (struct pipe_screen *)pool->screen,
203 (struct pipe_resource *)pool->bo);
204 pool->bo = (struct r600_resource*)r600_compute_buffer_alloc_vram(
205 pool->screen,
206 pool->size_in_dw * 4);
207 compute_memory_shadow(pool, pipe, 0);
208 }
209
210 return 0;
211 }
212
213 /**
214 * Copy pool from device to host, or host to device.
215 */
216 void compute_memory_shadow(struct compute_memory_pool* pool,
217 struct pipe_context * pipe, int device_to_host)
218 {
219 struct compute_memory_item chunk;
220
221 COMPUTE_DBG(pool->screen, "* compute_memory_shadow() device_to_host = %d\n",
222 device_to_host);
223
224 chunk.id = 0;
225 chunk.start_in_dw = 0;
226 chunk.size_in_dw = pool->size_in_dw;
227 compute_memory_transfer(pool, pipe, device_to_host, &chunk,
228 pool->shadow, 0, pool->size_in_dw*4);
229 }
230
231 /**
232 * Allocates pending allocations in the pool
233 * @returns -1 if it fails, 0 otherwise
234 */
235 int compute_memory_finalize_pending(struct compute_memory_pool* pool,
236 struct pipe_context * pipe)
237 {
238 struct compute_memory_item *item, *next;
239
240 int64_t allocated = 0;
241 int64_t unallocated = 0;
242
243 int err = 0;
244
245 COMPUTE_DBG(pool->screen, "* compute_memory_finalize_pending()\n");
246
247 LIST_FOR_EACH_ENTRY(item, pool->item_list, link) {
248 COMPUTE_DBG(pool->screen, " + list: offset = %i id = %i size = %i "
249 "(%i bytes)\n",item->start_in_dw, item->id,
250 item->size_in_dw, item->size_in_dw * 4);
251 }
252
253 /* Calculate the total allocated size */
254 LIST_FOR_EACH_ENTRY(item, pool->item_list, link) {
255 allocated += align(item->size_in_dw, ITEM_ALIGNMENT);
256 }
257
258 /* Calculate the total unallocated size of the items that
259 * will be promoted to the pool */
260 LIST_FOR_EACH_ENTRY(item, pool->unallocated_list, link) {
261 if (item->status & ITEM_FOR_PROMOTING)
262 unallocated += align(item->size_in_dw, ITEM_ALIGNMENT);
263 }
264
265 /* If we require more space than the size of the pool, then grow the
266 * pool.
267 *
268 * XXX: I'm pretty sure this won't work. Imagine this scenario:
269 *
270 * Offset Item Size
271 * 0 A 50
272 * 200 B 50
273 * 400 C 50
274 *
275 * Total size = 450
276 * Allocated size = 150
277 * Pending Item D Size = 200
278 *
279 * In this case, there are 300 units of free space in the pool, but
280 * they aren't contiguous, so it will be impossible to allocate Item D.
281 */
282 if (pool->size_in_dw < allocated + unallocated) {
283 err = compute_memory_grow_pool(pool, pipe, allocated + unallocated);
284 if (err == -1)
285 return -1;
286 }
287
288 /* Loop through all the unallocated items, check if they are marked
289 * for promoting, allocate space for them and add them to the item_list. */
290 LIST_FOR_EACH_ENTRY_SAFE(item, next, pool->unallocated_list, link) {
291 if (item->status & ITEM_FOR_PROMOTING) {
292 err = compute_memory_promote_item(pool, item, pipe, allocated);
293 item->status ^= ITEM_FOR_PROMOTING;
294
295 allocated += align(item->size_in_dw, ITEM_ALIGNMENT);
296
297 if (err == -1)
298 return -1;
299 }
300 }
301
302 return 0;
303 }
304
305 int compute_memory_promote_item(struct compute_memory_pool *pool,
306 struct compute_memory_item *item, struct pipe_context *pipe,
307 int64_t allocated)
308 {
309 struct pipe_screen *screen = (struct pipe_screen *)pool->screen;
310 struct r600_context *rctx = (struct r600_context *)pipe;
311 struct pipe_resource *src = (struct pipe_resource *)item->real_buffer;
312 struct pipe_resource *dst = NULL;
313 struct pipe_box box;
314
315 struct list_head *pos;
316 int64_t start_in_dw;
317 int err = 0;
318
319
320 /* Search for free space in the pool for this item. */
321 while ((start_in_dw=compute_memory_prealloc_chunk(pool,
322 item->size_in_dw)) == -1) {
323 int64_t need = item->size_in_dw + 2048 -
324 (pool->size_in_dw - allocated);
325
326 if (need < 0) {
327 need = pool->size_in_dw / 10;
328 }
329
330 need = align(need, ITEM_ALIGNMENT);
331
332 err = compute_memory_grow_pool(pool,
333 pipe,
334 pool->size_in_dw + need);
335
336 if (err == -1)
337 return -1;
338 }
339 dst = (struct pipe_resource *)pool->bo;
340 COMPUTE_DBG(pool->screen, " + Found space for Item %p id = %u "
341 "start_in_dw = %u (%u bytes) size_in_dw = %u (%u bytes)\n",
342 item, item->id, start_in_dw, start_in_dw * 4,
343 item->size_in_dw, item->size_in_dw * 4);
344
345 /* Remove the item from the unallocated list */
346 list_del(&item->link);
347
348 /* Add it back to the item_list */
349 pos = compute_memory_postalloc_chunk(pool, start_in_dw);
350 list_add(&item->link, pos);
351 item->start_in_dw = start_in_dw;
352
353 u_box_1d(0, item->size_in_dw * 4, &box);
354
355 rctx->b.b.resource_copy_region(pipe,
356 dst, 0, item->start_in_dw * 4, 0 ,0,
357 src, 0, &box);
358
359 /* We check if the item is mapped for reading.
360 * In this case, we need to keep the temporary buffer 'alive'
361 * because it is possible to keep a map active for reading
362 * while a kernel (that reads from it) executes */
363 if (!(item->status & ITEM_MAPPED_FOR_READING)) {
364 pool->screen->b.b.resource_destroy(screen, src);
365 item->real_buffer = NULL;
366 }
367
368 return 0;
369 }
370
371 void compute_memory_demote_item(struct compute_memory_pool *pool,
372 struct compute_memory_item *item, struct pipe_context *pipe)
373 {
374 struct r600_context *rctx = (struct r600_context *)pipe;
375 struct pipe_resource *src = (struct pipe_resource *)pool->bo;
376 struct pipe_resource *dst;
377 struct pipe_box box;
378
379 /* First, we remove the item from the item_list */
380 list_del(&item->link);
381
382 /* Now we add it to the unallocated list */
383 list_addtail(&item->link, pool->unallocated_list);
384
385 /* We check if the intermediate buffer exists, and if it
386 * doesn't, we create it again */
387 if (item->real_buffer == NULL) {
388 item->real_buffer = (struct r600_resource*)r600_compute_buffer_alloc_vram(
389 pool->screen, item->size_in_dw * 4);
390 }
391
392 dst = (struct pipe_resource *)item->real_buffer;
393
394 /* We transfer the memory from the item in the pool to the
395 * temporary buffer */
396 u_box_1d(item->start_in_dw * 4, item->size_in_dw * 4, &box);
397
398 rctx->b.b.resource_copy_region(pipe,
399 dst, 0, 0, 0, 0,
400 src, 0, &box);
401
402 /* Remember to mark the buffer as 'pending' by setting start_in_dw to -1 */
403 item->start_in_dw = -1;
404 }
405
406 void compute_memory_free(struct compute_memory_pool* pool, int64_t id)
407 {
408 struct compute_memory_item *item, *next;
409 struct pipe_screen *screen = (struct pipe_screen *)pool->screen;
410 struct pipe_resource *res;
411
412 COMPUTE_DBG(pool->screen, "* compute_memory_free() id + %ld \n", id);
413
414 LIST_FOR_EACH_ENTRY_SAFE(item, next, pool->item_list, link) {
415
416 if (item->id == id) {
417 list_del(&item->link);
418
419 if (item->real_buffer) {
420 res = (struct pipe_resource *)item->real_buffer;
421 pool->screen->b.b.resource_destroy(
422 screen, res);
423 }
424
425 free(item);
426
427 return;
428 }
429 }
430
431 LIST_FOR_EACH_ENTRY_SAFE(item, next, pool->unallocated_list, link) {
432
433 if (item->id == id) {
434 list_del(&item->link);
435
436 if (item->real_buffer) {
437 res = (struct pipe_resource *)item->real_buffer;
438 pool->screen->b.b.resource_destroy(
439 screen, res);
440 }
441
442 free(item);
443
444 return;
445 }
446 }
447
448 fprintf(stderr, "Internal error, invalid id %"PRIi64" "
449 "for compute_memory_free\n", id);
450
451 assert(0 && "error");
452 }
453
454 /**
455 * Creates pending allocations
456 */
457 struct compute_memory_item* compute_memory_alloc(
458 struct compute_memory_pool* pool,
459 int64_t size_in_dw)
460 {
461 struct compute_memory_item *new_item = NULL;
462
463 COMPUTE_DBG(pool->screen, "* compute_memory_alloc() size_in_dw = %ld (%ld bytes)\n",
464 size_in_dw, 4 * size_in_dw);
465
466 new_item = (struct compute_memory_item *)
467 CALLOC(sizeof(struct compute_memory_item), 1);
468 if (new_item == NULL)
469 return NULL;
470
471 new_item->size_in_dw = size_in_dw;
472 new_item->start_in_dw = -1; /* mark pending */
473 new_item->id = pool->next_id++;
474 new_item->pool = pool;
475 new_item->real_buffer = (struct r600_resource*)r600_compute_buffer_alloc_vram(
476 pool->screen, size_in_dw * 4);
477
478 list_addtail(&new_item->link, pool->unallocated_list);
479
480 COMPUTE_DBG(pool->screen, " + Adding item %p id = %u size = %u (%u bytes)\n",
481 new_item, new_item->id, new_item->size_in_dw,
482 new_item->size_in_dw * 4);
483 return new_item;
484 }
485
486 /**
487 * Transfer data host<->device, offset and size is in bytes
488 */
489 void compute_memory_transfer(
490 struct compute_memory_pool* pool,
491 struct pipe_context * pipe,
492 int device_to_host,
493 struct compute_memory_item* chunk,
494 void* data,
495 int offset_in_chunk,
496 int size)
497 {
498 int64_t aligned_size = pool->size_in_dw;
499 struct pipe_resource* gart = (struct pipe_resource*)pool->bo;
500 int64_t internal_offset = chunk->start_in_dw*4 + offset_in_chunk;
501
502 struct pipe_transfer *xfer;
503 uint32_t *map;
504
505 assert(gart);
506
507 COMPUTE_DBG(pool->screen, "* compute_memory_transfer() device_to_host = %d, "
508 "offset_in_chunk = %d, size = %d\n", device_to_host,
509 offset_in_chunk, size);
510
511 if (device_to_host) {
512 map = pipe->transfer_map(pipe, gart, 0, PIPE_TRANSFER_READ,
513 &(struct pipe_box) { .width = aligned_size * 4,
514 .height = 1, .depth = 1 }, &xfer);
515 assert(xfer);
516 assert(map);
517 memcpy(data, map + internal_offset, size);
518 pipe->transfer_unmap(pipe, xfer);
519 } else {
520 map = pipe->transfer_map(pipe, gart, 0, PIPE_TRANSFER_WRITE,
521 &(struct pipe_box) { .width = aligned_size * 4,
522 .height = 1, .depth = 1 }, &xfer);
523 assert(xfer);
524 assert(map);
525 memcpy(map + internal_offset, data, size);
526 pipe->transfer_unmap(pipe, xfer);
527 }
528 }
529
530 /**
531 * Transfer data between chunk<->data, it is for VRAM<->GART transfers
532 */
533 void compute_memory_transfer_direct(
534 struct compute_memory_pool* pool,
535 int chunk_to_data,
536 struct compute_memory_item* chunk,
537 struct r600_resource* data,
538 int offset_in_chunk,
539 int offset_in_data,
540 int size)
541 {
542 ///TODO: DMA
543 }