Re: [Qemu-devel] [PULL 23/36] cadence_gem: Add queue support

2016-09-26 Thread Alistair Francis
On Mon, Sep 26, 2016 at 4:01 AM, Paolo Bonzini wrote: > > > On 22/09/2016 19:22, Peter Maydell wrote: >> +case GEM_RECEIVE_Q1_PTR ... GEM_RECEIVE_Q15_PTR: >> +s->rx_desc_addr[offset - GEM_RECEIVE_Q1_PTR + 1] = val; >> +break; > > MAX_PRIORITY_QUEUES is

Re: [Qemu-devel] [PULL 23/36] cadence_gem: Add queue support

2016-09-26 Thread Paolo Bonzini
On 22/09/2016 19:22, Peter Maydell wrote: > +case GEM_RECEIVE_Q1_PTR ... GEM_RECEIVE_Q15_PTR: > +s->rx_desc_addr[offset - GEM_RECEIVE_Q1_PTR + 1] = val; > +break; MAX_PRIORITY_QUEUES is still 8, so this can cause an out-of-bounds write in s->rx_desc_addr (and likewise for

[Qemu-devel] [PULL 23/36] cadence_gem: Add queue support

2016-09-22 Thread Peter Maydell
From: Alistair Francis Signed-off-by: Alistair Francis Reviewed-by: Peter Maydell Message-id: 28921252217b1d14f16889bafa88675f5b7a66cb.1469727764.git.alistair.fran...@xilinx.com Signed-off-by: Peter Maydell