From: Michael Tokarev <mjt@tls.msk.ru>
To: qemu-devel@nongnu.org
Cc: qemu-stable@nongnu.org,
Alexandra Diupina <adiupina@astralinux.ru>,
Peter Maydell <peter.maydell@linaro.org>,
Michael Tokarev <mjt@tls.msk.ru>
Subject: [Stable-8.2.4 13/16] hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields
Date: Tue, 7 May 2024 11:42:12 +0300 [thread overview]
Message-ID: <20240507084226.1026455-13-mjt@tls.msk.ru> (raw)
In-Reply-To: <qemu-stable-8.2.4-20240506205855@cover.tls.msk.ru>
From: Alexandra Diupina <adiupina@astralinux.ru>
The DMA descriptor structures for this device have
a set of "address extension" fields which extend the 32
bit source addresses with an extra 16 bits to give a
48 bit address:
https://docs.amd.com/r/en-US/ug1085-zynq-ultrascale-trm/ADDR_EXT-Field
However, we misimplemented this address extension in several ways:
* we only extracted 12 bits of the extension fields, not 16
* we didn't shift the extension field up far enough
* we accidentally did the shift as 32-bit arithmetic, which
meant that we would have an overflow instead of setting
bits [47:32] of the resulting 64-bit address
Add a type cast and use extract64() instead of extract32()
to avoid integer overflow on addition. Fix bit fields
extraction according to documentation.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Cc: qemu-stable@nongnu.org
Fixes: d3c6369a96 ("introduce xlnx-dpdma")
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
Message-id: 20240428181131.23801-1-adiupina@astralinux.ru
[PMM: adjusted commit message]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 4b00855f0ee2e2eee8fd2500ffef27c108be6dc3)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/hw/dma/xlnx_dpdma.c b/hw/dma/xlnx_dpdma.c
index dd66be5265..06e187e99c 100644
--- a/hw/dma/xlnx_dpdma.c
+++ b/hw/dma/xlnx_dpdma.c
@@ -175,24 +175,24 @@ static uint64_t xlnx_dpdma_desc_get_source_address(DPDMADescriptor *desc,
switch (frag) {
case 0:
- addr = desc->source_address
- + (extract32(desc->address_extension, 16, 12) << 20);
+ addr = (uint64_t)desc->source_address
+ + (extract64(desc->address_extension, 16, 16) << 32);
break;
case 1:
- addr = desc->source_address2
- + (extract32(desc->address_extension_23, 0, 12) << 8);
+ addr = (uint64_t)desc->source_address2
+ + (extract64(desc->address_extension_23, 0, 16) << 32);
break;
case 2:
- addr = desc->source_address3
- + (extract32(desc->address_extension_23, 16, 12) << 20);
+ addr = (uint64_t)desc->source_address3
+ + (extract64(desc->address_extension_23, 16, 16) << 32);
break;
case 3:
- addr = desc->source_address4
- + (extract32(desc->address_extension_45, 0, 12) << 8);
+ addr = (uint64_t)desc->source_address4
+ + (extract64(desc->address_extension_45, 0, 16) << 32);
break;
case 4:
- addr = desc->source_address5
- + (extract32(desc->address_extension_45, 16, 12) << 20);
+ addr = (uint64_t)desc->source_address5
+ + (extract64(desc->address_extension_45, 16, 16) << 32);
break;
default:
addr = 0;
--
2.39.2
next prev parent reply other threads:[~2024-05-07 8:45 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-07 8:41 [Stable-8.2.4 00/16] Patch Round-up for stable 8.2.4 (planned for 2024-05-12) Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 01/16] target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32 Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 02/16] target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64 Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 03/16] target/riscv/kvm: change timer regs size " Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 04/16] migration/colo: Fix bdrv_graph_rdlock_main_loop: Assertion `!qemu_in_coroutine()' failed Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 05/16] linux-user: do_setsockopt: fix SOL_ALG.ALG_SET_KEY Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 06/16] nbd/server: do not poll within a coroutine context Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 07/16] nbd/server: Mark negotiation functions as coroutine_fn Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 08/16] backends/cryptodev-builtin: Fix local_error leaks Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 09/16] target/loongarch/cpu.c: typo fix: expection Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 10/16] tests/avocado: update sunxi kernel from armbian to 6.6.16 Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 11/16] .gitlab-ci.d/cirrus.yml: Shorten the runtime of the macOS and FreeBSD jobs Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 12/16] hw/ufs: Fix buffer overflow bug Michael Tokarev
2024-05-07 8:42 ` Michael Tokarev [this message]
2024-05-07 8:42 ` [Stable-8.2.4 14/16] hw/arm/npcm7xx: Store derivative OTP fuse key in little endian Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 15/16] target/sh4: Fix ADDV opcode Michael Tokarev
2024-05-07 8:42 ` [Stable-8.2.4 16/16] target/sh4: Fix SUBV opcode Michael Tokarev
2024-05-07 8:45 ` [Stable-8.2.4 00/16] Patch Round-up for stable 8.2.4 (planned for 2024-05-10) Michael Tokarev
2024-05-10 15:05 ` Michael Tokarev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240507084226.1026455-13-mjt@tls.msk.ru \
--to=mjt@tls.msk.ru \
--cc=adiupina@astralinux.ru \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).