venus: fix a race condition in ring shmem reuse

With the shmem cache, vkDestroyRingMESA must be a synchronous call to
ensure renderer side ring destruction has finished before the same shmem
gets reused by other things.

Cc: mesa-stable
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/13672
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/36664>

src/virtio/vulkan/vn_renderer_util.c

@@ -5,6 +5,46 @@
 
 #include "vn_renderer_util.h"
 
+VkResult
+vn_renderer_submit_simple_sync(struct vn_renderer *renderer,
+                               const void *cs_data,
+                               size_t cs_size)
+{
+   VN_TRACE_FUNC();
+   struct vn_renderer_sync *sync;
+   VkResult result =
+      vn_renderer_sync_create(renderer, 0, VN_RENDERER_SYNC_BINARY, &sync);
+   if (result != VK_SUCCESS)
+      return result;
+
+   const struct vn_renderer_submit submit = {
+      .batches =
+         &(const struct vn_renderer_submit_batch){
+            .cs_data = cs_data,
+            .cs_size = cs_size,
+            .ring_idx = 0, /* CPU ring */
+            .syncs = &sync,
+            .sync_values = &(const uint64_t){ 1 },
+            .sync_count = 1,
+         },
+      .batch_count = 1,
+   };
+   const struct vn_renderer_wait wait = {
+      .timeout = UINT64_MAX,
+      .syncs = &sync,
+      .sync_values = &(const uint64_t){ 1 },
+      .sync_count = 1,
+   };
+
+   result = vn_renderer_submit(renderer, &submit);
+   if (result == VK_SUCCESS)
+      result = vn_renderer_wait(renderer, &wait);
+
+   vn_renderer_sync_destroy(renderer, sync);
+
+   return result;
+}
+
 void
 vn_renderer_shmem_pool_init(UNUSED struct vn_renderer *renderer,
                             struct vn_renderer_shmem_pool *pool,

src/virtio/vulkan/vn_renderer_util.h

@@ -35,6 +35,11 @@ vn_renderer_submit_simple(struct vn_renderer *renderer,
    return vn_renderer_submit(renderer, &submit);
 }
 
+VkResult
+vn_renderer_submit_simple_sync(struct vn_renderer *renderer,
+                               const void *cs_data,
+                               size_t cs_size);
+
 void
 vn_renderer_shmem_pool_init(struct vn_renderer *renderer,
                             struct vn_renderer_shmem_pool *pool,

src/virtio/vulkan/vn_ring.c

@@ -375,8 +375,13 @@ vn_ring_destroy(struct vn_ring *ring)
    struct vn_cs_encoder local_enc = VN_CS_ENCODER_INITIALIZER_LOCAL(
       destroy_ring_data, sizeof(destroy_ring_data));
    vn_encode_vkDestroyRingMESA(&local_enc, 0, ring->id);
-   vn_renderer_submit_simple(ring->instance->renderer, destroy_ring_data,
-                             vn_cs_encoder_get_len(&local_enc));
+
+   /* With the shmem cache, vkDestroyRingMESA must be a synchronous call to
+    * ensure renderer side ring destruction has finished before the same shmem
+    * gets reused by other things.
+    */
+   vn_renderer_submit_simple_sync(ring->instance->renderer, destroy_ring_data,
+                                  vn_cs_encoder_get_len(&local_enc));
 
    mtx_destroy(&ring->roundtrip_mutex);