Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2215410/?format=api
{ "id": 2215410, "url": "http://patchwork.ozlabs.org/api/patches/2215410/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260324151111.237411-4-peter.maydell@linaro.org/", "project": { "id": 14, "url": "http://patchwork.ozlabs.org/api/projects/14/?format=api", "name": "QEMU Development", "link_name": "qemu-devel", "list_id": "qemu-devel.nongnu.org", "list_email": "qemu-devel@nongnu.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260324151111.237411-4-peter.maydell@linaro.org>", "list_archive_url": null, "date": "2026-03-24T15:11:03", "name": "[PULL,03/11] hw/dma/pl080: Fix transfer logic in PL080", "commit_ref": null, "pull_url": null, "state": "not-applicable", "archived": false, "hash": "6a41414ac4d5abc54d83cab544b37ff89a272d8c", "submitter": { "id": 5111, "url": "http://patchwork.ozlabs.org/api/people/5111/?format=api", "name": "Peter Maydell", "email": "peter.maydell@linaro.org" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260324151111.237411-4-peter.maydell@linaro.org/mbox/", "series": [ { "id": 497302, "url": "http://patchwork.ozlabs.org/api/series/497302/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/list/?series=497302", "date": "2026-03-24T15:11:00", "name": "[PULL,01/11] target/arm: fix s2prot not set for two-stage PMSA translations", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/497302/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2215410/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2215410/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256\n header.s=google header.b=L9PQlHij;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.gnu.org (lists.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fgD6J32LJz1y1G\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 25 Mar 2026 02:12:08 +1100 (AEDT)", "from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from <qemu-devel-bounces@nongnu.org>)\n\tid 1w53Pi-0000id-AI; Tue, 24 Mar 2026 11:11:27 -0400", "from eggs.gnu.org ([2001:470:142:3::10])\n by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <peter.maydell@linaro.org>)\n id 1w53Pd-0000f2-O7\n for qemu-devel@nongnu.org; Tue, 24 Mar 2026 11:11:22 -0400", "from mail-wr1-x42e.google.com ([2a00:1450:4864:20::42e])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.90_1) (envelope-from <peter.maydell@linaro.org>)\n id 1w53Pb-0005C8-Rv\n for qemu-devel@nongnu.org; Tue, 24 Mar 2026 11:11:21 -0400", "by mail-wr1-x42e.google.com with SMTP id\n ffacd0b85a97d-439b97a8a8cso4338521f8f.1\n for <qemu-devel@nongnu.org>; Tue, 24 Mar 2026 08:11:19 -0700 (PDT)", "from lanath.. (wildly.archaic.org.uk. [81.2.115.145])\n by smtp.gmail.com with ESMTPSA id\n ffacd0b85a97d-43b64717e97sm40781916f8f.35.2026.03.24.08.11.16\n for <qemu-devel@nongnu.org>\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Tue, 24 Mar 2026 08:11:16 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=linaro.org; s=google; t=1774365078; x=1774969878; darn=nongnu.org;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:to:from:from:to:cc:subject:date:message-id\n :reply-to; bh=dfNzBGzpTKbGiyXwJIuebHg/gBlotrth/GBr1EmFLrI=;\n b=L9PQlHij6P2oa62nh/6vI/myNzR7cRrJTW1xJ096HLD5FhpdUdOtrE0wu8WcyoUbz7\n /lSqpgn+96ypKo4kN5tp4U8SHXbetno48LZQF+LeRBxZg5chPVdkDJW2o0oB+2bWh6eJ\n wAfsp2+wRCGFF3AyJJeUoef99ihbcG0M6KsPdCkftkPLAysbw4iv/3jn48TZlFwCbmWz\n 5AKj1idqc3qaB0zVJ5SjcvKreCfsWl9T5ZUkbax3jqrrjuaBFIouM9YAUEiyFrgsyqMf\n UnWgDRLxmTFOvtDVmEeyiyykzsPBhmR0hwNa2ybsvE27L9Xil5IUsalXcmi1FwRMQFr0\n IEgw==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1774365078; x=1774969878;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to\n :cc:subject:date:message-id:reply-to;\n bh=dfNzBGzpTKbGiyXwJIuebHg/gBlotrth/GBr1EmFLrI=;\n b=Fk2AXkTHFSUXpSCxNN+x5NNDn8IqYRJckO0cK5QPbeY4/OICn35q181ZBWBqlURTCl\n JGJooyOv4lie917uT524DjI13LYpDhW1OYVmX0trzLpMXyZAUpgJrfB5BgiY6T83NJ90\n 4fPo4DJMisAEaEX2evNf+RP4ksnAi5xsvDMVBbkZZYN+yCim+QEhhdKNh0s//dKI0PJ4\n jCc3iNxsErMFz7WR4sj7CQw25uv6Ih8v54lQnGS4Ylsu2lZoi2Sxif/vLmjtQAGkkFFl\n NNUifo3M9j5aEuD8gw7A640Z+4EP68BABi024IO9gOPfWIbumzQNxvcu7m4a4VILc8Wj\n kMMQ==", "X-Gm-Message-State": "AOJu0YxBfwheIDtSsyPk4lkKzIMgd0+uZGwU3v2sBLvSb8pzYMhjlB3K\n 2npnxZSxd8SbRLoAnYF9Ur8gLwiZ/jRj9c7FK2oTnE8i19tuNwfSgVexZT6jLbfP0CEwoRZDxjX\n MxEB9WKs=", "X-Gm-Gg": "ATEYQzzbQvboBjeVKqQLCP74EKyrVoEk/ieSlgjloWWo6D47B5JqT4beR/VlNu7/Hrh\n L6+vXU9wQMIOX5Oy3Zz+NrzJWnv2n4rKC0uYDrlftVUfEygbEpNbaJQKvpsEZh6LllLU9u+4vkS\n yji3rfapB3BFflygxZnNy+qwTq5lVoSGLPLJoTujUhMS1JRncnQ39cdRfHsSJrljcsbd2ftLMEA\n XSBrPbTTHWpKf8oUiWo8vX02FQwurnkMFpz04b/mo5PZZfNRPxS+MT4fD11AcVkrMmLnIGqpJ7u\n aRfZCBjzwF/JcdILtzHtQppfJyb0ecObJhci8KPNuV0u+gq4DOGhXcCKtfnGl0YBweF3o4Vh9pa\n apBnUD8EZAqYP1MfdqnyGKtmPUg+RzqlIASW2r38HThLb5LExj9t+5d1oCnb8kKHmopBPoVQMyl\n By/TDFs46B/Cc5AGdshs+rCHqIEGehElnqGaK+UNjBR0NGwTq6LTXsRvp3JvnwQ7Kcm4rEakyks\n I6uQ5IBVh7UGiUzj7LHggAbTabhzNc=", "X-Received": "by 2002:a05:6000:2c0e:b0:439:b744:c5fe with SMTP id\n ffacd0b85a97d-43b6427d272mr25436263f8f.52.1774365077977;\n Tue, 24 Mar 2026 08:11:17 -0700 (PDT)", "From": "Peter Maydell <peter.maydell@linaro.org>", "To": "qemu-devel@nongnu.org", "Subject": "[PULL 03/11] hw/dma/pl080: Fix transfer logic in PL080", "Date": "Tue, 24 Mar 2026 15:11:03 +0000", "Message-ID": "<20260324151111.237411-4-peter.maydell@linaro.org>", "X-Mailer": "git-send-email 2.43.0", "In-Reply-To": "<20260324151111.237411-1-peter.maydell@linaro.org>", "References": "<20260324151111.237411-1-peter.maydell@linaro.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Received-SPF": "pass client-ip=2a00:1450:4864:20::42e;\n envelope-from=peter.maydell@linaro.org; helo=mail-wr1-x42e.google.com", "X-Spam_score_int": "-20", "X-Spam_score": "-2.1", "X-Spam_bar": "--", "X-Spam_report": "(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,\n SPF_PASS=-0.001 autolearn=ham autolearn_force=no", "X-Spam_action": "no action", "X-BeenThere": "qemu-devel@nongnu.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "qemu development <qemu-devel.nongnu.org>", "List-Unsubscribe": "<https://lists.nongnu.org/mailman/options/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>", "List-Archive": "<https://lists.nongnu.org/archive/html/qemu-devel>", "List-Post": "<mailto:qemu-devel@nongnu.org>", "List-Help": "<mailto:qemu-devel-request@nongnu.org?subject=help>", "List-Subscribe": "<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=subscribe>", "Errors-To": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org", "Sender": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org" }, "content": "From: Tao Ding <dingtao0430@163.com>\n\nThe logic in the PL080 for transferring data has multiple bugs:\n\n * The TransferSize field in the channel control register counts\n in units of the source width; because our loop may do multiple\n source loads if the destination width is greater than the\n source width, we need to decrement it by (xsize / swidth),\n not by 1, each loop\n\n * It is documented in the TRM that it is a software error to program\n the source and destination width such that SWidth < DWidth and\n TransferSize * SWidth is not a multiple of DWidth. (This would\n mean that there isn't enough data to do a full final destination\n write.) We weren't doing anything sensible with this case.\n The TRM doesn't document what the hardware actually does (though\n it drops some hints that suggest that it probably over-reads\n from the source).\n\n * In the loop to write to the destination, each loop adds swidth\n to ch->dest for each loop and also uses (ch->dest + n) as the\n destination address. This moves the destination address on\n further than we should each time round the loop, and also\n is incrementing ch->dest by swidth when it should be dwidth.\n\nThis patch fixes these problems:\n * decrement TransferSize by the correct amount\n * log and ignore the transfer size mismatch case\n * correct the loop logic for the destination writes\n\nA repro case which exercises some of this is as follows. It\nconfigures swidth to 1 byte, dwidth to 4 bytes, and transfer size 4,\nfor a transfer from 0x00000000 to 0x000010000. Examining the\ndestination memory in the QEMU monitor should show that the\nsource data 0x44332211 has all been copied, but before this\nfix it is not:\n\n ./qemu-system-arm -M versatilepb -m 128M -nographic -S \\\n -device loader,addr=0x00000000,data=0x44332211,data-len=4 \\\n -device loader,addr=0x00001000,data=0x00000000,data-len=4 \\\n -device loader,addr=0x10130030,data=0x00000001,data-len=4 \\\n -device loader,addr=0x10130100,data=0x00000000,data-len=4 \\\n -device loader,addr=0x10130104,data=0x00001000,data-len=4 \\\n -device loader,addr=0x10130108,data=0x00000000,data-len=4 \\\n -device loader,addr=0x1013010C,data=0x9e47f004,data-len=4 \\\n -device loader,addr=0x10130110,data=0x0000c001,data-len=4\n\nWithout this patch the QEMU monitor shows:\n (qemu) xp /1wx 0x00001000\n 00001000: 0x00002211\n\nCorrect result:\n (qemu) xp /1wx 0x00001000\n 00001000: 0x44332211\n\nCc: qemu-stable@nongnu.org\nSuggested-by: Peter Maydell <peter.maydell@linaro.org>\nSigned-off-by: Tao Ding <dingtao0430@163.com>\n[PMM: Wrote up what we are fixing in the commit message]\nReviewed-by: Peter Maydell <peter.maydell@linaro.org>\nSigned-off-by: Peter Maydell <peter.maydell@linaro.org>\n---\n hw/dma/pl080.c | 17 +++++++++++------\n 1 file changed, 11 insertions(+), 6 deletions(-)", "diff": "diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c\nindex 627ccbbd81..4a90c7bb27 100644\n--- a/hw/dma/pl080.c\n+++ b/hw/dma/pl080.c\n@@ -179,23 +179,28 @@ again:\n c, extract32(ch->ctrl, 21, 3));\n continue;\n }\n-\n- for (n = 0; n < dwidth; n+= swidth) {\n+ if ((size * swidth) % dwidth) {\n+ qemu_log_mask(LOG_GUEST_ERROR,\n+ \"pl080: channel %d: transfer size mismatch: size=%d swidth=%d dwidth=%d\\n\",\n+ c, size, swidth, dwidth);\n+ continue;\n+ }\n+ xsize = MAX(swidth, dwidth);\n+ for (n = 0; n < xsize; n += swidth) {\n address_space_read(&s->downstream_as, ch->src,\n MEMTXATTRS_UNSPECIFIED, buff + n, swidth);\n if (ch->ctrl & PL080_CCTRL_SI)\n ch->src += swidth;\n }\n- xsize = (dwidth < swidth) ? swidth : dwidth;\n /* ??? This may pad the value incorrectly for dwidth < 32. */\n for (n = 0; n < xsize; n += dwidth) {\n- address_space_write(&s->downstream_as, ch->dest + n,\n+ address_space_write(&s->downstream_as, ch->dest,\n MEMTXATTRS_UNSPECIFIED, buff + n, dwidth);\n if (ch->ctrl & PL080_CCTRL_DI)\n- ch->dest += swidth;\n+ ch->dest += dwidth;\n }\n \n- size--;\n+ size -= xsize / swidth;\n ch->ctrl = (ch->ctrl & 0xfffff000) | size;\n if (size == 0) {\n /* Transfer complete. */\n", "prefixes": [ "PULL", "03/11" ] }