回复：[PATCH v13 net-next 03/11] net/nebula-matrix: add chip related definitions

[Illusion Wang]

[...]
>> +void nbl_write_all_regs(struct nbl_hw_mgt *hw_mgt)
>> +{
>> + struct nbl_common_info *common = hw_mgt->>common;
>> + u8 eth_mode = common->>eth_mode;
>> + const u32 *nbl_sec046_data;
>> + const u32 *nbl_sec071_data;
>> + u32 i;
>> +
>> + switch (eth_mode) {
>> + case 1:
>> +  nbl_sec046_data = nbl_sec046_1p_data;
>> +  nbl_sec071_data = nbl_sec071_1p_data;
>> +  break;
>> + case 2:
>> +  nbl_sec046_data = nbl_sec046_2p_data;
>> +  nbl_sec071_data = nbl_sec071_2p_data;
>> +  break;
>> + case 4:
>> +  nbl_sec046_data = nbl_sec046_4p_data;
>> +  nbl_sec071_data = nbl_sec071_4p_data;
>> +  break;
>> + default:
>> +  nbl_sec046_data = nbl_sec046_2p_data;
>> +  nbl_sec071_data = nbl_sec071_2p_data;
>> + }
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC006_SIZE; i++) {
>> +  if ((i + 1) % NBL_SEC_BLOCK_SIZE == 0)
>> +   nbl_hw_rd32(hw_mgt, NBL_HW_DUMMY_REG);
>> +
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC006_REGI(i), nbl_sec006_data[i]);
>> + }
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC007_SIZE; i++)
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC007_REGI(i), nbl_sec007_data[i]);
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC008_SIZE; i++) {
>> +  if ((i + 1) % NBL_SEC_BLOCK_SIZE == 0)
>> +   nbl_hw_rd32(hw_mgt, NBL_HW_DUMMY_REG);
>> +
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC008_REGI(i), nbl_sec008_data[i]);
>> + }
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC009_SIZE; i++) {
>> +  if ((i + 1) % NBL_SEC_BLOCK_SIZE == 0)
>> +   nbl_hw_rd32(hw_mgt, NBL_HW_DUMMY_REG);
>> +
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC009_REGI(i), nbl_sec009_data[i]);
>> + }
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC010_SIZE; i++)
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC010_REGI(i), nbl_sec010_data[i]);
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC011_SIZE; i++) {
>> +  if ((i + 1) % NBL_SEC_BLOCK_SIZE == 0)
>> +   nbl_hw_rd32(hw_mgt, NBL_HW_DUMMY_REG);
>> +
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC011_REGI(i), nbl_sec011_data[i]);
>> + }
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC012_SIZE; i++)
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC012_REGI(i), nbl_sec012_data[i]);
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC013_SIZE; i++)
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC013_REGI(i), nbl_sec013_data[i]);
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC014_SIZE; i++)
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC014_REGI(i), nbl_sec014_data[i]);
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC022_SIZE; i++)
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC022_REGI(i), nbl_sec022_data[i]);
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC023_SIZE; i++)
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC023_REGI(i), nbl_sec023_data[i]);
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC024_SIZE; i++) {
>> +  if ((i + 1) % NBL_SEC_BLOCK_SIZE == 0)
>> +   nbl_hw_rd32(hw_mgt, NBL_HW_DUMMY_REG);
>> +
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC024_REGI(i), nbl_sec024_data[i]);
>> + }
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC025_SIZE; i++) {
>> +  if ((i + 1) % NBL_SEC_BLOCK_SIZE == 0)
>> +   nbl_hw_rd32(hw_mgt, NBL_HW_DUMMY_REG);
>> +
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC025_REGI(i), nbl_sec025_data[i]);
>> + }
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC026_SIZE; i++)
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC026_REGI(i), nbl_sec026_data[i]);
>> +
>> + nbl_flush_writes(hw_mgt);
>> + for (i = 0; i < NBL_SEC027_SIZE; i++) {
>> +  if ((i + 1) % NBL_SEC_BLOCK_SIZE == 0)
>> +   nbl_hw_rd32(hw_mgt, NBL_HW_DUMMY_REG);
>> +
>> +  nbl_hw_wr32(hw_mgt, NBL_SEC027_REGI(i), nbl_sec027_data[i]);

>Sashiko says:

>Could this loop read past the end of the nbl_sec009_data array?
>The macro NBL_SEC009_SIZE is defined as 2048, but the nbl_sec009_data array
>contains significantly fewer elements (around 754). This appears to cause
>sequential out-of-bounds reads into the .rodata section, writing unrelated
>memory to the device registers.
>Similar size mismatches exist for nbl_sec025_data (262 elements vs size
>1024)
>and nbl_sec022_data (506 elements vs size 256).
>Would it be safer to use ARRAY_SIZE() to bound these iterations?

But I printed out the results: 
ARRAY_SIZE(nbl_sec009_data) equals NBL_SEC009_SIZE,
ARRAY_SIZE(nbl_sec025_data) equals NBL_SEC025_SIZE,
and ARRAY_SIZE(nbl_sec022_data) equals NBL_SEC022_SIZE.

Is the AI making a mistake here?