Re: [Qemu-devel] [PATCH v1 1/1] cadence_gem: Fix priority queue out of bounds access

[Peter Maydell]

On 29 September 2016 at 17:42, Alistair Francis
<address@hidden> wrote:
> On Thu, Sep 29, 2016 at 5:04 PM, Peter Maydell <address@hidden> wrote:
>> On 26 September 2016 at 10:49, Alistair Francis
>> <address@hidden> wrote:
>>> There was an error with some of the register implementation assuming
>>> there are 16 priority queues supported when the IP only supports 8. This
>>> patch corrects the registers to only support 8 queues.
>>>
>>> Signed-off-by: Alistair Francis <address@hidden>
>>> Reported-by: Paolo Bonzini <address@hidden>
>>> ---
>>> Thanks to Paolo for pointing this out.
>>>
>>>  hw/net/cadence_gem.c | 22 ++++------------------
>>>  1 file changed, 4 insertions(+), 18 deletions(-)
>>>
>>> diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
>>> index 8618e7a..7915732 100644
>>> --- a/hw/net/cadence_gem.c
>>> +++ b/hw/net/cadence_gem.c
>>> @@ -147,25 +147,19 @@
>>>  #define GEM_INT_Q1_MASK                 (0x00000640 / 4)
>>>
>>>  #define GEM_TRANSMIT_Q1_PTR             (0x00000440 / 4)
>>> -#define GEM_TRANSMIT_Q15_PTR            (GEM_TRANSMIT_Q1_PTR + 14)
>>> +#define GEM_TRANSMIT_Q7_PTR             (GEM_TRANSMIT_Q1_PTR + 6)
>>
>> 8 queues but they're numbered one to ... seven ??
>
> Yeah, I double checked the user guide and it is 1 to 7.
>
> I guess queue 0 uses the standard registers.

OK. The arithmetic of the array size vs the number of
registers looks OK, anyway.

Applied to target-arm.next.

thanks
-- PMM