r600g: Manage fences per screen rather than per context.

A fence is a screen object and can outlive the context it was created from.
The previous code would access freed memory in that case, resulting in
various problems.

Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=44151
       https://bugs.freedesktop.org/show_bug.cgi?id=44007

Probably fixes: https://bugs.freedesktop.org/show_bug.cgi?id=43993

NOTE: This is a candidate for the 7.11 branch.

Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Mathias Fröhlich <Mathias.Froehlich@web.de>

diff --git a/src/gallium/drivers/r600/r600_pipe.c b/src/gallium/drivers/r600/r600_pipe.c
index 7f62e0e1c69d92ddf20a6a54d79d14af0da32183..9f090807f82dffd807ae7fca26938b204e4c2e3c 100644 (file)
--- a/src/gallium/drivers/r600/r600_pipe.c
+++ b/src/gallium/drivers/r600/r600_pipe.c
@@ -53,27 +53,31 @@
  */
 static struct r600_fence *r600_create_fence(struct r600_pipe_context *ctx)
 {
+       struct r600_screen *rscreen = ctx->screen;
        struct r600_fence *fence = NULL;
 
-       if (!ctx->fences.bo) {
+       pipe_mutex_lock(rscreen->fences.mutex);
+
+       if (!rscreen->fences.bo) {
                /* Create the shared buffer object */
-               ctx->fences.bo = (struct r600_resource*)
-                       pipe_buffer_create(&ctx->screen->screen, PIPE_BIND_CUSTOM,
+               rscreen->fences.bo = (struct r600_resource*)
+                       pipe_buffer_create(&rscreen->screen, PIPE_BIND_CUSTOM,
                                           PIPE_USAGE_STAGING, 4096);
-               if (!ctx->fences.bo) {
+               if (!rscreen->fences.bo) {
                        R600_ERR("r600: failed to create bo for fence objects\n");
-                       return NULL;
+                       goto out;
                }
-               ctx->fences.data = ctx->ws->buffer_map(ctx->fences.bo->buf, ctx->ctx.cs,
-                                                      PIPE_TRANSFER_WRITE);
+               rscreen->fences.data = ctx->ws->buffer_map(rscreen->fences.bo->buf,
+                                                          ctx->ctx.cs,
+                                                          PIPE_TRANSFER_READ_WRITE);
        }
 
-       if (!LIST_IS_EMPTY(&ctx->fences.pool)) {
+       if (!LIST_IS_EMPTY(&rscreen->fences.pool)) {
                struct r600_fence *entry;
 
                /* Try to find a freed fence that has been signalled */
-               LIST_FOR_EACH_ENTRY(entry, &ctx->fences.pool, head) {
-                       if (ctx->fences.data[entry->index] != 0) {
+               LIST_FOR_EACH_ENTRY(entry, &rscreen->fences.pool, head) {
+                       if (rscreen->fences.data[entry->index] != 0) {
                                LIST_DELINIT(&entry->head);
                                fence = entry;
                                break;
@@ -86,33 +90,34 @@ static struct r600_fence *r600_create_fence(struct r600_pipe_context *ctx)
                struct r600_fence_block *block;
                unsigned index;
 
-               if ((ctx->fences.next_index + 1) >= 1024) {
+               if ((rscreen->fences.next_index + 1) >= 1024) {
                        R600_ERR("r600: too many concurrent fences\n");
-                       return NULL;
+                       goto out;
                }
 
-               index = ctx->fences.next_index++;
+               index = rscreen->fences.next_index++;
 
                if (!(index % FENCE_BLOCK_SIZE)) {
                        /* Allocate a new block */
                        block = CALLOC_STRUCT(r600_fence_block);
                        if (block == NULL)
-                               return NULL;
+                               goto out;
 
-                       LIST_ADD(&block->head, &ctx->fences.blocks);
+                       LIST_ADD(&block->head, &rscreen->fences.blocks);
                } else {
-                       block = LIST_ENTRY(struct r600_fence_block, ctx->fences.blocks.next, head);
+                       block = LIST_ENTRY(struct r600_fence_block, rscreen->fences.blocks.next, head);
                }
 
                fence = &block->fences[index % FENCE_BLOCK_SIZE];
-               fence->ctx = ctx;
                fence->index = index;
        }
 
        pipe_reference_init(&fence->reference, 1);
 
-       ctx->fences.data[fence->index] = 0;
-       r600_context_emit_fence(&ctx->ctx, ctx->fences.bo, fence->index, 1);
+       rscreen->fences.data[fence->index] = 0;
+       r600_context_emit_fence(&ctx->ctx, rscreen->fences.bo, fence->index, 1);
+out:
+       pipe_mutex_unlock(rscreen->fences.mutex);
        return fence;
 }
 
@@ -191,18 +196,6 @@ static void r600_destroy_context(struct pipe_context *context)
        u_vbuf_destroy(rctx->vbuf_mgr);
        util_slab_destroy(&rctx->pool_transfers);
 
-       if (rctx->fences.bo) {
-               struct r600_fence_block *entry, *tmp;
-
-               LIST_FOR_EACH_ENTRY_SAFE(entry, tmp, &rctx->fences.blocks, head) {
-                       LIST_DEL(&entry->head);
-                       FREE(entry);
-               }
-
-               rctx->ws->buffer_unmap(rctx->fences.bo->buf);
-               pipe_resource_reference((struct pipe_resource**)&rctx->fences.bo, NULL);
-       }
-
        r600_update_num_contexts(rctx->screen, -1);
 
        FREE(rctx);
@@ -230,12 +223,6 @@ static struct pipe_context *r600_create_context(struct pipe_screen *screen, void
        rctx->family = rscreen->family;
        rctx->chip_class = rscreen->chip_class;
 
-       rctx->fences.bo = NULL;
-       rctx->fences.data = NULL;
-       rctx->fences.next_index = 0;
-       LIST_INITHEAD(&rctx->fences.pool);
-       LIST_INITHEAD(&rctx->fences.blocks);
-
        r600_init_blit_functions(rctx);
        r600_init_query_functions(rctx);
        r600_init_context_resource_functions(rctx);
@@ -555,6 +542,19 @@ static void r600_destroy_screen(struct pipe_screen* pscreen)
        if (rscreen == NULL)
                return;
 
+       if (rscreen->fences.bo) {
+               struct r600_fence_block *entry, *tmp;
+
+               LIST_FOR_EACH_ENTRY_SAFE(entry, tmp, &rscreen->fences.blocks, head) {
+                       LIST_DEL(&entry->head);
+                       FREE(entry);
+               }
+
+               rscreen->ws->buffer_unmap(rscreen->fences.bo->buf);
+               pipe_resource_reference((struct pipe_resource**)&rscreen->fences.bo, NULL);
+       }
+       pipe_mutex_destroy(rscreen->fences.mutex);
+
        rscreen->ws->destroy(rscreen->ws);
 
        util_slab_destroy(&rscreen->pool_buffers);
@@ -570,8 +570,10 @@ static void r600_fence_reference(struct pipe_screen *pscreen,
        struct r600_fence *newf = (struct r600_fence*)fence;
 
        if (pipe_reference(&(*oldf)->reference, &newf->reference)) {
-               struct r600_pipe_context *ctx = (*oldf)->ctx;
-               LIST_ADDTAIL(&(*oldf)->head, &ctx->fences.pool);
+               struct r600_screen *rscreen = (struct r600_screen *)pscreen;
+               pipe_mutex_lock(rscreen->fences.mutex);
+               LIST_ADDTAIL(&(*oldf)->head, &rscreen->fences.pool);
+               pipe_mutex_unlock(rscreen->fences.mutex);
        }
 
        *ptr = fence;
@@ -580,18 +582,18 @@ static void r600_fence_reference(struct pipe_screen *pscreen,
 static boolean r600_fence_signalled(struct pipe_screen *pscreen,
                                     struct pipe_fence_handle *fence)
 {
+       struct r600_screen *rscreen = (struct r600_screen *)pscreen;
        struct r600_fence *rfence = (struct r600_fence*)fence;
-       struct r600_pipe_context *ctx = rfence->ctx;
 
-       return ctx->fences.data[rfence->index];
+       return rscreen->fences.data[rfence->index];
 }
 
 static boolean r600_fence_finish(struct pipe_screen *pscreen,
                                  struct pipe_fence_handle *fence,
                                  uint64_t timeout)
 {
+       struct r600_screen *rscreen = (struct r600_screen *)pscreen;
        struct r600_fence *rfence = (struct r600_fence*)fence;
-       struct r600_pipe_context *ctx = rfence->ctx;
        int64_t start_time = 0;
        unsigned spins = 0;
 
@@ -602,7 +604,7 @@ static boolean r600_fence_finish(struct pipe_screen *pscreen,
                timeout /= 1000;
        }
 
-       while (ctx->fences.data[rfence->index] == 0) {
+       while (rscreen->fences.data[rfence->index] == 0) {
                if (++spins % 256)
                        continue;
 #ifdef PIPE_OS_UNIX
@@ -801,5 +803,12 @@ struct pipe_screen *r600_screen_create(struct radeon_winsys *ws)
 
        pipe_mutex_init(rscreen->mutex_num_contexts);
 
+       rscreen->fences.bo = NULL;
+       rscreen->fences.data = NULL;
+       rscreen->fences.next_index = 0;
+       LIST_INITHEAD(&rscreen->fences.pool);
+       LIST_INITHEAD(&rscreen->fences.blocks);
+       pipe_mutex_init(rscreen->fences.mutex);
+
        return &rscreen->screen;
 }

diff --git a/src/gallium/drivers/r600/r600_pipe.h b/src/gallium/drivers/r600/r600_pipe.h
index 46443af0a07c15a4c0f6ced53be0f41487b3a740..447b9dc13a4eefdea5e67731a21e4f0ec350e47e 100644 (file)
--- a/src/gallium/drivers/r600/r600_pipe.h
+++ b/src/gallium/drivers/r600/r600_pipe.h
@@ -71,6 +71,17 @@ enum r600_pipe_state_id {
        R600_PIPE_NSTATES
 };
 
+struct r600_pipe_fences {
+       struct r600_resource            *bo;
+       unsigned                        *data;
+       unsigned                        next_index;
+       /* linked list of preallocated blocks */
+       struct list_head                blocks;
+       /* linked list of freed fences */
+       struct list_head                pool;
+       pipe_mutex                      mutex;
+};
+
 struct r600_screen {
        struct pipe_screen              screen;
        struct radeon_winsys            *ws;
@@ -79,6 +90,8 @@ struct r600_screen {
        struct radeon_info              info;
        struct r600_tiling_info         tiling_info;
        struct util_slab_mempool        pool_buffers;
+       struct r600_pipe_fences         fences;
+
        unsigned                        num_contexts;
 
        /* for thread-safe write accessing to num_contexts */
@@ -156,7 +169,6 @@ struct r600_textures_info {
 
 struct r600_fence {
        struct pipe_reference           reference;
-       struct r600_pipe_context        *ctx;
        unsigned                        index; /* in the shared bo */
        struct list_head                head;
 };
@@ -168,16 +180,6 @@ struct r600_fence_block {
        struct list_head                head;
 };
 
-struct r600_pipe_fences {
-       struct r600_resource            *bo;
-       unsigned                        *data;
-       unsigned                        next_index;
-       /* linked list of preallocated blocks */
-       struct list_head                blocks;
-       /* linked list of freed fences */
-       struct list_head                pool;
-};
-
 #define R600_CONSTANT_ARRAY_SIZE 256
 #define R600_RESOURCE_ARRAY_SIZE 160
 
@@ -224,8 +226,6 @@ struct r600_pipe_context {
        struct r600_textures_info       vs_samplers;
        struct r600_textures_info       ps_samplers;
 
-       struct r600_pipe_fences         fences;
-
        struct u_vbuf                   *vbuf_mgr;
        struct util_slab_mempool        pool_transfers;
        boolean                         have_depth_texture, have_depth_fb;