From 22a5f98b3965adb2c5b2224da7ec4590807a618a Mon Sep 17 00:00:00 2001 From: Randolph Date: Wed, 29 Jul 2026 17:23:17 +0800 Subject: [PATCH] platform: generic/andes: fix 32-bit shift overflow in decode_pmaaddrx() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit decode_pmaaddrx() reconstructs the NAPOT region start and size from a pmaaddr CSR value using "1 << (k + 3)" and "1 << k". The integer literal 1 has type int, so these shifts are performed in 32-bit precision. Shifting a 32-bit value by 32 or more bits is undefined behavior, and on RV64 the compiler emits sllw, which truncates the shift amount modulo 32. As a result, any PMA region with size >= 4 GiB (k >= 29) is decoded incorrectly. For example, on the Andes QiLai SoC the PCIe region 0x1000000000 - 0x17ffffffff (pmaaddr = 0x4ffffffff, k = 32) is decoded as an 8-byte region at 0x13fffffffc. This is not merely cosmetic: decode_pmaaddrx() is used by has_pma_region_overlap() and andes_sbi_free_pma(), so overlap checks are performed against bogus ranges and freeing such an entry by its physical address always fails. Promote the shifts to unsigned long so they are performed in the native register width. Fixes: aa56084c4dfb ("platform: generic: andes: add a new Andes SBI call to set up a PMA entry") Signed-off-by: Randolph Lin Tested-by: Benoît Monin Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260729092317.2848665-1-randolph@andestech.com Signed-off-by: Anup Patel --- platform/generic/andes/andes_pma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/platform/generic/andes/andes_pma.c b/platform/generic/andes/andes_pma.c index ba9a35bb..28d33a2f 100644 --- a/platform/generic/andes/andes_pma.c +++ b/platform/generic/andes/andes_pma.c @@ -82,8 +82,8 @@ static void decode_pmaaddrx(int entry_id, unsigned long *start, */ pmaaddr = csr_read_num(CSR_PMAADDR0 + entry_id); k = sbi_ffz(pmaaddr); - *size = 1 << (k + 3); - *start = (pmaaddr - (1 << k) + 1) << 2; + *size = 1UL << (k + 3); + *start = (pmaaddr - (1UL << k) + 1) << 2; } static bool has_pma_region_overlap(unsigned long start, unsigned long size)