venus: use uint32_t in vn_ring_submit

And in vn_ring_write_buffer as well, to fix the assert in
vn_ring_write_buffer.

The ring code uses 32-bit unsigned integers and relies on that their
overflow/underflow behavior is well-defined.  When ring->shared.head is
about to overflow and ring->cur has overflowed, this expression

  ring->cur + size - vn_ring_load_head(ring)

gives an incorrect result when size is 64-bit.

Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
Reviewed-by: Yiwei Zhang <zzyiwei@chromium.org>
Reviewed-by: Ryan Neph <ryanneph@google.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/12494>
This commit is contained in:
Chia-I Wu 2021-08-20 15:20:58 -07:00
parent db9ffc5561
commit 572ed22494
2 changed files with 5 additions and 5 deletions

View file

@ -42,15 +42,15 @@ vn_ring_load_status(const struct vn_ring *ring)
}
static void
vn_ring_write_buffer(struct vn_ring *ring, const void *data, size_t size)
vn_ring_write_buffer(struct vn_ring *ring, const void *data, uint32_t size)
{
assert(ring->cur + size - vn_ring_load_head(ring) <= VN_RING_BUFFER_SIZE);
const size_t offset = ring->cur & VN_RING_BUFFER_MASK;
const uint32_t offset = ring->cur & VN_RING_BUFFER_MASK;
if (offset + size <= VN_RING_BUFFER_SIZE) {
memcpy(ring->shared.buffer + offset, data, size);
} else {
const size_t s = VN_RING_BUFFER_SIZE - offset;
const uint32_t s = VN_RING_BUFFER_SIZE - offset;
memcpy(ring->shared.buffer + offset, data, s);
memcpy(ring->shared.buffer, data + s, size - s);
}
@ -204,7 +204,7 @@ bool
vn_ring_submit(struct vn_ring *ring,
struct vn_ring_submit *submit,
const void *cs_data,
size_t cs_size,
uint32_t cs_size,
uint32_t *seqno)
{
const uint32_t cur_seqno = vn_ring_wait_space(ring, cs_size);

View file

@ -88,7 +88,7 @@ bool
vn_ring_submit(struct vn_ring *ring,
struct vn_ring_submit *submit,
const void *cs_data,
size_t cs_size,
uint32_t cs_size,
uint32_t *seqno);
void