+-- On Tue, 12 May 2020, Peter Maydell wrote --+ | > + uint16_t reply_queue_head; | | Using a 16-bit type here means that code like this: | | s->reply_queue_head = ldl_le_pci_dma(pcid, s->producer_pa); | s->reply_queue_head %= MEGASAS_MAX_FRAMES; | | suddenly does a truncation of the 32-bit loaded value before | the modulus operation, which is a bit odd, though since | MEGASAS_MAX_FRAMES happens to be a power of 2 the end | result won't change.
Yes, 16-bit also for its range of value is limitted to MEGASAS_MAX_FRAMES=2048. | It's also a bit weird to change reply_queue_head's type | but not reply_queue_tail or reply_queue_len. That's in the second patch. Thank you. -- Prasad J Pandit / Red Hat Product Security Team 8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D
