freedreno: Flush if at risk of overflowing bos table

Fixes overflow crash in tex-miplevel-selection

Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/4007
Signed-off-by: Rob Clark <robdclark@chromium.org>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/11487>

diff --git a/src/freedreno/drm/freedreno_priv.h b/src/freedreno/drm/freedreno_priv.h
index 30efcb9..afc73dc 100644 (file)
--- a/src/freedreno/drm/freedreno_priv.h
+++ b/src/freedreno/drm/freedreno_priv.h
@@ -55,11 +55,16 @@ extern simple_mtx_t table_lock;
  * Stupid/simple growable array implementation:
  */
 
+#define MAX_ARRAY_SIZE ((unsigned short)~0)
+
 static inline void
 grow(void **ptr, uint16_t nr, uint16_t *max, uint16_t sz)
 {
+   assert((nr + 1) < MAX_ARRAY_SIZE);
    if ((nr + 1) > *max) {
-      if ((*max * 2) < (nr + 1))
+      if (*max > MAX_ARRAY_SIZE/2)
+         *max = MAX_ARRAY_SIZE;
+      else if ((*max * 2) < (nr + 1))
          *max = nr + 5;
       else
          *max = *max * 2;

diff --git a/src/freedreno/drm/freedreno_ringbuffer.h b/src/freedreno/drm/freedreno_ringbuffer.h
index 193b5f9..6fc49f7 100644 (file)
--- a/src/freedreno/drm/freedreno_ringbuffer.h
+++ b/src/freedreno/drm/freedreno_ringbuffer.h
@@ -130,6 +130,7 @@ struct fd_ringbuffer_funcs {
    uint32_t (*emit_reloc_ring)(struct fd_ringbuffer *ring,
                                struct fd_ringbuffer *target, uint32_t cmd_idx);
    uint32_t (*cmd_count)(struct fd_ringbuffer *ring);
+   bool (*check_size)(struct fd_ringbuffer *ring);
    void (*destroy)(struct fd_ringbuffer *ring);
 };
 
@@ -180,6 +181,12 @@ fd_ringbuffer_grow(struct fd_ringbuffer *ring, uint32_t ndwords)
    ring->funcs->grow(ring, ring->size);
 }
 
+static inline bool
+fd_ringbuffer_check_size(struct fd_ringbuffer *ring)
+{
+   return ring->funcs->check_size(ring);
+}
+
 static inline void
 fd_ringbuffer_emit(struct fd_ringbuffer *ring, uint32_t data)
 {

diff --git a/src/freedreno/drm/msm_ringbuffer.c b/src/freedreno/drm/msm_ringbuffer.c
index dbeeb73..239faee 100644 (file)
--- a/src/freedreno/drm/msm_ringbuffer.c
+++ b/src/freedreno/drm/msm_ringbuffer.c
@@ -597,6 +597,26 @@ msm_ringbuffer_cmd_count(struct fd_ringbuffer *ring)
    return 1;
 }
 
+static bool
+msm_ringbuffer_check_size(struct fd_ringbuffer *ring)
+{
+   assert(!(ring->flags & _FD_RINGBUFFER_OBJECT));
+   struct msm_ringbuffer *msm_ring = to_msm_ringbuffer(ring);
+   struct fd_submit *submit = msm_ring->u.submit;
+   struct fd_pipe *pipe = submit->pipe;
+
+   if ((fd_device_version(pipe->dev) < FD_VERSION_UNLIMITED_CMDS) &&
+       ((ring->cur - ring->start) > (ring->size / 4 - 0x1000))) {
+      return false;
+   }
+
+   if (to_msm_submit(submit)->nr_bos > MAX_ARRAY_SIZE/2) {
+      return false;
+   }
+
+   return true;
+}
+
 static void
 msm_ringbuffer_destroy(struct fd_ringbuffer *ring)
 {
@@ -632,6 +652,7 @@ static const struct fd_ringbuffer_funcs ring_funcs = {
    .emit_reloc = msm_ringbuffer_emit_reloc,
    .emit_reloc_ring = msm_ringbuffer_emit_reloc_ring,
    .cmd_count = msm_ringbuffer_cmd_count,
+   .check_size = msm_ringbuffer_check_size,
    .destroy = msm_ringbuffer_destroy,
 };
 

diff --git a/src/freedreno/drm/msm_ringbuffer_sp.c b/src/freedreno/drm/msm_ringbuffer_sp.c
index d71aa67..a221953 100644 (file)
--- a/src/freedreno/drm/msm_ringbuffer_sp.c
+++ b/src/freedreno/drm/msm_ringbuffer_sp.c
@@ -688,6 +688,20 @@ msm_ringbuffer_sp_cmd_count(struct fd_ringbuffer *ring)
    return 1;
 }
 
+static bool
+msm_ringbuffer_sp_check_size(struct fd_ringbuffer *ring)
+{
+   assert(!(ring->flags & _FD_RINGBUFFER_OBJECT));
+   struct msm_ringbuffer_sp *msm_ring = to_msm_ringbuffer_sp(ring);
+   struct fd_submit *submit = msm_ring->u.submit;
+
+   if (to_msm_submit_sp(submit)->nr_bos > MAX_ARRAY_SIZE/2) {
+      return false;
+   }
+
+   return true;
+}
+
 static void
 msm_ringbuffer_sp_destroy(struct fd_ringbuffer *ring)
 {
@@ -719,6 +733,7 @@ static const struct fd_ringbuffer_funcs ring_funcs_nonobj_32 = {
    .emit_reloc = msm_ringbuffer_sp_emit_reloc_nonobj_32,
    .emit_reloc_ring = msm_ringbuffer_sp_emit_reloc_ring_32,
    .cmd_count = msm_ringbuffer_sp_cmd_count,
+   .check_size = msm_ringbuffer_sp_check_size,
    .destroy = msm_ringbuffer_sp_destroy,
 };
 
@@ -735,6 +750,7 @@ static const struct fd_ringbuffer_funcs ring_funcs_nonobj_64 = {
    .emit_reloc = msm_ringbuffer_sp_emit_reloc_nonobj_64,
    .emit_reloc_ring = msm_ringbuffer_sp_emit_reloc_ring_64,
    .cmd_count = msm_ringbuffer_sp_cmd_count,
+   .check_size = msm_ringbuffer_sp_check_size,
    .destroy = msm_ringbuffer_sp_destroy,
 };
 

diff --git a/src/gallium/drivers/freedreno/ci/piglit-freedreno-a630-fails.txt b/src/gallium/drivers/freedreno/ci/piglit-freedreno-a630-fails.txt
index 20757c4..26ca915 100644 (file)
--- a/src/gallium/drivers/freedreno/ci/piglit-freedreno-a630-fails.txt
+++ b/src/gallium/drivers/freedreno/ci/piglit-freedreno-a630-fails.txt
@@ -90,32 +90,6 @@ spec@arb_sample_shading@samplemask 4@sample mask_in_one,Fail
 spec@arb_shader_image_load_store@indexing,Crash
 spec@arb_shader_storage_buffer_object@array-ssbo-auto-binding,Fail
 spec@arb_shader_storage_buffer_object@linker@instance-matching-shader-storage-blocks-member-array-size-mismatch,Fail
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *gradarb 1d,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *gradarb 1dshadow,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *gradarb 2d,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *gradarb 2dshadow,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *gradarb 3d,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *gradarb cube,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *lod 1d,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *lod 1dshadow,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *lod 2d,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *lod 2dshadow,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *lod 3d,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *lod cube,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projgradarb 1d,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projgradarb 1d_projvec4,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projgradarb 1dshadow,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projgradarb 2d,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projgradarb 2d_projvec4,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projgradarb 2dshadow,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projgradarb 3d,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projlod 1d,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projlod 1d_projvec4,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projlod 1dshadow,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projlod 2d,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projlod 2d_projvec4,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projlod 2dshadow,Crash
-spec@arb_shader_texture_lod@execution@tex-miplevel-selection *projlod 3d,Crash
 spec@arb_tessellation_shader@execution@fs-primitiveid-instanced,Fail
 spec@arb_tessellation_shader@execution@gs-primitiveid-instanced,Fail
 spec@arb_tessellation_shader@execution@invocation-counting-even,Fail
@@ -349,78 +323,9 @@ spec@ext_transform_feedback@structs struct-array-elem run,Fail
 spec@ext_transform_feedback@structs struct-array-elem run interface,Fail
 spec@ext_transform_feedback@tessellation triangle_fan flat_first,Fail
 spec@ext_transform_feedback@tessellation triangle_strip flat_first,Fail
-spec@glsl-1.20@execution@tex-miplevel-selection gl2:texture() 1d,Crash
-spec@glsl-1.20@execution@tex-miplevel-selection gl2:texture() 1dshadow,Crash
-spec@glsl-1.20@execution@tex-miplevel-selection gl2:texture() 2d,Crash
-spec@glsl-1.20@execution@tex-miplevel-selection gl2:texture() 2dshadow,Crash
-spec@glsl-1.20@execution@tex-miplevel-selection gl2:texture() 3d,Crash
-spec@glsl-1.20@execution@tex-miplevel-selection gl2:texture() cube,Crash
-spec@glsl-1.20@execution@tex-miplevel-selection gl2:textureproj 1d,Crash
-spec@glsl-1.20@execution@tex-miplevel-selection gl2:textureproj 1d_projvec4,Crash
-spec@glsl-1.20@execution@tex-miplevel-selection gl2:textureproj 1dshadow,Crash
-spec@glsl-1.20@execution@tex-miplevel-selection gl2:textureproj 2d,Crash
-spec@glsl-1.20@execution@tex-miplevel-selection gl2:textureproj 2d_projvec4,Crash
-spec@glsl-1.20@execution@tex-miplevel-selection gl2:textureproj 2dshadow,Crash
-spec@glsl-1.20@execution@tex-miplevel-selection gl2:textureproj 3d,Crash
 spec@glsl-1.30@execution@texelfetch fs sampler3d 1x129x9-98x129x9,Fail
 spec@glsl-1.30@execution@texelfetch fs sampler3d 98x129x1-98x129x9,Fail
 spec@glsl-1.30@execution@texelfetch fs sampler3d 98x1x9-98x129x9,Fail
-spec@glsl-1.30@execution@tex-miplevel-selection texture() 1darray,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texture() 1darrayshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texture() 1d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texture() 1dshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texture() 2darray,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texture() 2darrayshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texture() 2d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texture() 2dshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texture() 3d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texture() cubearray,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texture() cubearrayshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texture() cube,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texture() cubeshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturegrad 1darray,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturegrad 1darrayshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturegrad 1d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturegrad 1dshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturegrad 2darray,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturegrad 2darrayshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturegrad 2d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturegrad 2dshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturegrad 3d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturegrad cubearray,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturegrad cube,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturegrad cubeshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturelod 1darray,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturelod 1darrayshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturelod 1d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturelod 1dshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturelod 2darray,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturelod 2d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturelod 2dshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturelod 3d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturelod cubearray,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection texturelod cube,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureproj 1d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureproj 1d_projvec4,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureproj 1dshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureproj 2d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureproj 2d_projvec4,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureproj 2dshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureproj 3d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojgrad 1d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojgrad 1d_projvec4,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojgrad 1dshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojgrad 2d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojgrad 2d_projvec4,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojgrad 2dshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojgrad 3d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojlod 1d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojlod 1d_projvec4,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojlod 1dshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojlod 2d,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojlod 2d_projvec4,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojlod 2dshadow,Crash
-spec@glsl-1.30@execution@tex-miplevel-selection textureprojlod 3d,Crash
 spec@glsl-1.50@execution@compatibility@clipping@gs-clip-vertex-const-accept,Fail
 spec@glsl-1.50@execution@compatibility@clipping@gs-clip-vertex-different-from-position,Fail
 spec@glsl-1.50@execution@compatibility@clipping@gs-clip-vertex-enables,Fail
@@ -586,7 +491,6 @@ spec@!opengl 1.1@texwrap formats bordercolor-swizzled@GL_RGBA4- swizzled- border
 spec@!opengl 1.1@texwrap formats bordercolor-swizzled@GL_RGBA8- swizzled- border color only,Fail
 spec@!opengl 1.1@windowoverlap,Fail
 spec@!opengl 1.4@gl-1.4-polygon-offset,Fail
-spec@!opengl 1.4@tex-miplevel-selection-lod-bias,Crash
 spec@!opengl 2.0@gl-2.0-edgeflag,Crash
 spec@!opengl 2.0@gl-2.0-edgeflag-immediate,Crash
 spec@!opengl 2.0@vertex-program-two-side back2,Crash

diff --git a/src/gallium/drivers/freedreno/freedreno_batch.c b/src/gallium/drivers/freedreno/freedreno_batch.c
index e910867..eb206af 100644 (file)
--- a/src/gallium/drivers/freedreno/freedreno_batch.c
+++ b/src/gallium/drivers/freedreno/freedreno_batch.c
@@ -540,11 +540,7 @@ fd_batch_check_size(struct fd_batch *batch)
       return;
    }
 
-   if (fd_device_version(batch->ctx->screen->dev) >= FD_VERSION_UNLIMITED_CMDS)
-      return;
-
-   struct fd_ringbuffer *ring = batch->draw;
-   if ((ring->cur - ring->start) > (ring->size / 4 - 0x1000))
+   if (!fd_ringbuffer_check_size(batch->draw))
       fd_batch_flush(batch);
 }